fifa17-recon: Docker build consumes authoritative tools via curated manifest

Build context moves from docker/fifa17-python/ up to fifa17-recon/ so the
Dockerfile reads the single-source tools/ and data/ trees. Only the 77 runtime
files listed in runtime-tools.list are installed into /app/tools (baseline image
minus the two git-ignored certs, regenerated in-image). memdump and recon
artifacts are excluded via fifa17-recon/.dockerignore.

fifa17-recon/.dockerignore

@@ -0,0 +1,16 @@
+# Keep the authoritative-tree build context lean: only tools/ and data/ runtime
+# files (plus the Dockerfile's own entrypoint/manifest) are needed in-image.
+.git
+.gitignore
+artifacts
+captures
+futmem
+staging
+docs
+FUT-RUNBOOK.md
+README.md
+data/memdump
+**/__pycache__
+*.pyc
+*.pem
+*.key

fifa17-recon/docker/fifa17-python/Dockerfile

@@ -1,27 +1,46 @@
-# OpenFUT FIFA-17 FUT backend — Python migration deployment (fifa17-python/).
+# OpenFUT FIFA-17 FUT backend — Python migration deployment.
 #
 # Runs the 5 network responders (LSX / Blaze / roster / UTAS / POW) that FIFA 17
 # dials to reach the FUT hub. Pure-Python; the only third-party dep is
 # pycryptodome (LSX AES handshake). autopatch.py is intentionally NOT run here —
 # it patches the game process memory and belongs on the client (105).
 #
-# Build context is this directory (fifa17-python/): tools/ and data/ are the
-# authoritative deployment sources, staged from the frozen baseline image
-# openfut-fut-backend:python-baseline-2026-08-10 (see docs/BASELINE-*.md). A
-# SHA256SUMS.txt is baked into the image so any running backend can be matched
-# to the exact dataset it was built from.
+# Build context is fifa17-recon/ (the repo tree). tools/ is the AUTHORITATIVE
+# recon tree (fifa17-recon/tools/). Only the runtime file set listed in
+# docker/fifa17-python/runtime-tools.list is installed into /app/tools, so the
+# deployed manifest stays byte-identical to the frozen baseline image
+# openfut-fut-backend:python-baseline-2026-08-10 (see docs/BASELINE-*.md) while
+# recon scripts, ghidra_queries and docs stay out of the image. data/ comes
+# from the authoritative fifa17-recon/data. A SHA256SUMS.txt is baked into the
+# image so any running backend can be matched to the exact dataset it was built
+# from.
 FROM python:3.12-slim
 
 RUN pip install --no-cache-dir pycryptodome==3.20.0
 
 WORKDIR /app
-COPY tools/ /app/tools/
-COPY data/  /app/data/
+
+# Stage the authoritative tools tree in full...
+COPY tools/ /app/tools-full/
+
+# ...then install ONLY the runtime manifest (baseline image minus the two
+# git-ignored certs, which are regenerated below).
+COPY docker/fifa17-python/runtime-tools.list /app/runtime-tools.list
+RUN set -eu; \
+    mkdir -p /app/tools; \
+    while IFS= read -r f; do \
+      [ -n "$f" ] || continue; \
+      mkdir -p "/app/tools/$(dirname "$f")"; \
+      cp "/app/tools-full/$f" "/app/tools/$f"; \
+    done < /app/runtime-tools.list; \
+    rm -rf /app/tools-full
+
+COPY data/ /app/data/
 
 # Redirector TLS cert (CN/SAN = winter15.gosredirector.ea.com). ProtoSSL
-# cert-verify is patched client-side, so a self-signed cert is fine. The staged
-# pair is git-ignored (*.pem/*.key); regenerate if absent so a fresh checkout
-# builds without extra steps.
+# cert-verify is patched client-side, so a self-signed cert is fine. The pair is
+# git-ignored (*.pem/*.key); regenerate if absent so a fresh checkout builds
+# without extra steps.
 RUN if [ ! -s tools/redir_cert.pem ] || [ ! -s tools/redir_key.pem ]; then \
       apt-get update && apt-get install -y --no-install-recommends openssl && \
       openssl req -x509 -newkey rsa:2048 -nodes \
@@ -34,7 +53,7 @@ RUN if [ ! -s tools/redir_cert.pem ] || [ ! -s tools/redir_key.pem ]; then \
 # Bake a dataset manifest so every image is self-identifying.
 RUN find /app/tools /app/data -type f | LC_ALL=C sort | xargs sha256sum > /app/SHA256SUMS.txt
 
-COPY entrypoint.sh /app/entrypoint.sh
+COPY docker/fifa17-python/entrypoint.sh /app/entrypoint.sh
 RUN chmod +x /app/entrypoint.sh
 
 # LSX 4216 | Blaze redir/main/nucleus 42127/42130/42131 | roster 8081 | UTAS 8099 | POW 8094/8080

fifa17-recon/docker/fifa17-python/docker-compose.yml

@@ -14,8 +14,8 @@ name: openfut-fut-backend
 services:
   fut-backend:
     build:
-      context: .
-      dockerfile: Dockerfile
+      context: ../..
+      dockerfile: fifa17-python/Dockerfile
     image: openfut-fut-backend:dev
     container_name: openfut-fut-backend
     restart: unless-stopped

fifa17-recon/docker/fifa17-python/runtime-tools.list

@@ -0,0 +1,77 @@
+origin_login_probe.py
+card_proof.py
+force_login_flag.py
+card_record_poke.py
+test_tournament_contract.py
+dmp_stack.py
+fut_clubitems.py
+test_autopatch_logging.py
+capture_lsx.py
+roster_server.py
+autopatch.py
+dbschema_probe.py
+test_account_profiles.py
+coach_window.py
+watch_club_model.py
+db_dump.py
+coach_probe.py
+uidiff.py
+probe_club_stats.py
+blaze_responder_v3.py
+dbdata_extract.py
+decode_fire2.py
+check_club_stat_vocab.py
+fut_accounts.py
+strip_dead_cards.py
+test_hub_offline_season_contract.py
+repair_club.py
+forge_node.py
+verify_preauth.py
+fut_coaches.py
+heat2.py
+test_security_question.py
+test_utas_log_redaction.py
+sbc_populate_poke.py
+atomdump.py
+lsx_responder.py
+fut_staff.py
+fut_cards.py
+blaze_responder.py
+blaze_responder_v2.py
+fut_store.py
+blaze_responder_v3b.py
+test_fut_contract.py
+utas_server.py
+lsx_force_online.py
+grab_crash_code.py
+gate_byte_probe.py
+fut_admin.py
+test_match_rewards.py
+lsx_responder_v2.py
+card_identity_probe.py
+extract_player_ids.py
+watch_online_mode.py
+store_enable_poke.py
+pow_server.py
+fut_account.py
+blaze_responder_v3_patched.py
+check_settings_flags.py
+test_match_lifecycle.py
+sbc_hook_poke.py
+futlog.py
+fut_seed.py
+hub_counter_probe.py
+fut_consumables.py
+db_catalog_walk.py
+memtool.py
+build_player_facts.py
+sweep_collect.py
+test_card_families.py
+fut_club_stats.py
+dmp.py
+build_consumables.py
+test_market_buy.py
+dump_login_code.py
+auth_watch.py
+vgamepad.py
+ghidra_env.py