Add 20 honeypot services: email, DB, ICS, cloud, IoT, network protocols

Tier 1 (upstream images): telnet (cowrie), smtp (mailoney),
elasticsearch (elasticpot), conpot (Modbus/S7/SNMP ICS).

Tier 2 (custom asyncio honeypots): pop3, imap, mysql, mssql, redis,
mongodb, postgres, ldap, vnc, docker_api, k8s, sip, mqtt, llmnr, snmp,
tftp — each with Dockerfile, entrypoint, and protocol-accurate
handshake/credential capture.

Adds 256 pytest cases covering registration, compose fragments,
LOG_TARGET propagation, and Dockerfile presence for all 25 services.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

templates/docker_api/Dockerfile

@@ -0,0 +1,14 @@
+FROM debian:bookworm-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    python3 python3-pip \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN pip3 install --no-cache-dir --break-system-packages flask
+
+COPY docker_api_honeypot.py /opt/docker_api_honeypot.py
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+EXPOSE 2375 2376
+ENTRYPOINT ["/entrypoint.sh"]

templates/docker_api/docker_api_honeypot.py

@@ -0,0 +1,131 @@
+#!/usr/bin/env python3
+"""
+Docker API honeypot.
+Serves a fake Docker REST API on port 2375. Responds to common recon
+endpoints (/version, /info, /containers/json, /images/json) with plausible
+but fake data. Logs all requests as JSON.
+"""
+
+import json
+import os
+import socket
+from datetime import datetime, timezone
+
+from flask import Flask, request
+
+HONEYPOT_NAME = os.environ.get("HONEYPOT_NAME", "docker-host")
+LOG_TARGET = os.environ.get("LOG_TARGET", "")
+
+app = Flask(__name__)
+
+_VERSION = {
+    "Version": "24.0.5",
+    "ApiVersion": "1.43",
+    "MinAPIVersion": "1.12",
+    "GitCommit": "ced0996",
+    "GoVersion": "go1.20.6",
+    "Os": "linux",
+    "Arch": "amd64",
+    "KernelVersion": "5.15.0-76-generic",
+}
+
+_INFO = {
+    "ID": "FAKE:FAKE:FAKE:FAKE",
+    "Containers": 3,
+    "ContainersRunning": 3,
+    "Images": 7,
+    "Driver": "overlay2",
+    "MemoryLimit": True,
+    "SwapLimit": True,
+    "KernelMemory": False,
+    "Name": HONEYPOT_NAME,
+    "DockerRootDir": "/var/lib/docker",
+    "HttpProxy": "",
+    "HttpsProxy": "",
+    "NoProxy": "",
+    "ServerVersion": "24.0.5",
+}
+
+_CONTAINERS = [
+    {
+        "Id": "a1b2c3d4e5f6",
+        "Names": ["/webapp"],
+        "Image": "nginx:latest",
+        "State": "running",
+        "Status": "Up 3 days",
+        "Ports": [{"IP": "0.0.0.0", "PrivatePort": 80, "PublicPort": 8080, "Type": "tcp"}],
+    }
+]
+
+
+def _forward(event: dict) -> None:
+    if not LOG_TARGET:
+        return
+    try:
+        host, port = LOG_TARGET.rsplit(":", 1)
+        with socket.create_connection((host, int(port)), timeout=3) as s:
+            s.sendall((json.dumps(event) + "\n").encode())
+    except Exception:
+        pass
+
+
+def _log(event_type: str, **kwargs) -> None:
+    event = {
+        "ts": datetime.now(timezone.utc).isoformat(),
+        "service": "docker_api",
+        "host": HONEYPOT_NAME,
+        "event": event_type,
+        **kwargs,
+    }
+    print(json.dumps(event), flush=True)
+    _forward(event)
+
+
+@app.before_request
+def log_request():
+    _log(
+        "request",
+        method=request.method,
+        path=request.path,
+        remote_addr=request.remote_addr,
+        body=request.get_data(as_text=True)[:512],
+    )
+
+
+@app.route("/version")
+@app.route("/<ver>/version")
+def version(ver=None):
+    return app.response_class(json.dumps(_VERSION), mimetype="application/json")
+
+
+@app.route("/info")
+@app.route("/<ver>/info")
+def info(ver=None):
+    return app.response_class(json.dumps(_INFO), mimetype="application/json")
+
+
+@app.route("/containers/json")
+@app.route("/<ver>/containers/json")
+def containers(ver=None):
+    return app.response_class(json.dumps(_CONTAINERS), mimetype="application/json")
+
+
+@app.route("/images/json")
+@app.route("/<ver>/images/json")
+def images(ver=None):
+    return app.response_class(json.dumps([]), mimetype="application/json")
+
+
+@app.route("/", defaults={"path": ""})
+@app.route("/<path:path>", methods=["GET", "POST", "PUT", "DELETE"])
+def catch_all(path):
+    return app.response_class(
+        json.dumps({"message": "page not found", "response": 404}),
+        status=404,
+        mimetype="application/json",
+    )
+
+
+if __name__ == "__main__":
+    _log("startup", msg=f"Docker API honeypot starting as {HONEYPOT_NAME}")
+    app.run(host="0.0.0.0", port=2375, debug=False)

templates/docker_api/entrypoint.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+set -e
+exec python3 /opt/docker_api_honeypot.py