docker-builds: a commix image, plus new Metasploit, MVT and PocketBase

docker-builds rebuilds security tools that ship no container image, only an amd64 one, or one that has gone stale. Everything is published to ghcr.io/matusso/<image> for linux/amd64 and linux/arm64, built natively on both architectures, smoke tested, signed with build provenance and scanned with Trivy. This update adds one new image and moves three others to their latest upstream releases.

New image: commix

commix (command injection exploiter) finds and exploits OS command injection in web applications. It does for command injection roughly what sqlmap does for SQL injection: it tests GET and POST parameters, cookies and headers with classic, time-based and file-based techniques, then gives you a pseudo-shell on the target if one of them works. Upstream publishes no container image, so this is the first build of it in docker-builds.

docker pull ghcr.io/matusso/commix:v4.1

# test one parameter of a target you are authorised to test
docker run --rm -t -v "$PWD:/work" ghcr.io/matusso/commix:v4.1 \
  -u 'https://target.example/ping.php?addr=127.0.0.1' --batch

How it is built

commix needs nothing outside the Python standard library, so the image is small (about 87 MB):

1. Build stage clones the v4.1 tag with --depth 1 and deletes .git.
2. Runtime stage is a clean python:3.15-alpine with only the source tree copied in. No virtualenv, no compiler, no git.
3. It runs as uid/gid 10001 in /work, like every image built from files/ in the repo.
4. Labels carry the upstream version, source and licence (GPL-3.0-or-later).

$ docker run --rm ghcr.io/matusso/commix:v4.1 --version
v4.1
$ docker run --rm --entrypoint id ghcr.io/matusso/commix:v4.1
uid=10001(tool) gid=10001(tool) groups=10001(tool)

Two things worth knowing

The image runs commix.py, not the commix console script. In v4.1, setup.py points the commix entry point at a function that only exists in a later release, so a pip installed commix crashes on start. The image calls upstream’s commix.py launcher directly, which works.

--help is not a smoke test for commix. commix does a lot of its work at import time, so --help succeeds even when the launcher is broken. The CI smoke test therefore runs a full scan with --batch against a closed port (127.0.0.1:9), checks that commix got as far as printing its legal disclaimer, and fails on any Python Traceback. It runs on both architectures before the multi-arch manifest is published.

What v4.1 itself brings is in the upstream release notes: a --http1.0 switch, better handling of the * custom injection marker across URL parameters, POST data, cookies and headers, a new randomcase.py tamper script, and many fixes for non-ASCII URLs and unhandled exceptions.

Updated images

Metasploit Framework 6.5.5 → 6.5.8

rapid7/metasploit-framework moved 322 commits between the two tags. Some of the new modules:

• Langflow: a whole family of modules for the AI workflow builder, including unauthenticated RCE (CVE-2026-0768, CVE-2026-0769, CVE-2026-10134), authenticated RCE and command injection, and an auth bypass scanner.
• AI and LLM infrastructure: LiteLLM MCP test command injection, a vLLM multimodal information leak scanner, and an Ollama auto-update persistence module for Windows.
• Web applications: N-able N-central unauthenticated RCE, two OpenCTI RCEs, Grafana SQL expressions RCE (CVE-2024-9264) and dizqueTV RCE.
• Linux local: a privilege escalation for CVE-2026-3888 and DirtyClone (CVE-2026-43503), plus a PAM backdoor post module.
• Scanners: MongoDB version, schema dump and hash dump, and Apache Solr version detection.

docker run --rm -it ghcr.io/matusso/metasploit-framework:6.5.8

MVT v2026.9.7 → v2026.10.12

The Mobile Verification Toolkit from Amnesty International’s Security Lab looks for traces of spyware on Android and iOS devices. Upstream releases weekly. The latest release recommends pymobiledevice3 for iOS acquisition, fixes a spurious ADB state parse error on devices without stored keys, and keeps settings history timestamps that fall on 29 February. The image also moved to Python 3.15.

docker run --rm -v "$PWD:/work" ghcr.io/matusso/mvt:v2026.10.12 mvt-ios check-backup --output /work/out /work/backup

PocketBase v0.40.4 → v0.40.6

PocketBase is an open-source backend in a single Go binary: SQLite, auth, file storage and an admin UI. Two releases landed since the last build:

• v0.40.5 is built with Go 1.27.2 for its net/http security fixes, one of them a DoS that could affect PocketBase. It also updates modernc.org/sqlite and adds extra CORS wildcard subdomain checks.
• v0.40.6 is built with Go 1.27.3 for the fix related to the eMudhra CA compromise. It also adds a global pixel limit for thumbnail generation (configurable with PB_THUMBS_MAX_SOURCE_PIXELS) to reduce memory exhaustion risk, and extra fileblob escape checks.

Upstream says v0.40.6 will most likely be the last PocketBase release on GitHub, and future updates will come from a new host. The image tracks GitHub releases today, so expect its build to change once that happens.

docker run --rm -p 8080:8080 -v pb_data:/pb/pb_data ghcr.io/matusso/pocketbase:v0.40.6

Verify what you pull

Every image carries a build attestation tied to the workflow run and commit that produced it:

gh attestation verify oci://ghcr.io/matusso/commix:v4.1 --owner matusso

The full catalogue, per-image notes and licences are in the docker-builds README and on the project page.