Added DOCKER.md for docker hub

Author: vermi

.github/workflows/docker-publish.yml

@@ -67,5 +67,5 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
           repository: therealpotus/vol3-triage
-          readme-filepath: ./README.md
+          readme-filepath: ./DOCKER.md
           short-description: "LLM-guided Volatility3 memory forensics triage tool"

DOCKER.md

@@ -0,0 +1,91 @@
+# LLM-Guided Volatility3 Triage Tool
+
+A memory forensics triage assistant that combines Volatility3 with Large Language Model analysis to help analysts quickly identify and prioritize suspicious artifacts in Windows memory dumps.
+
+## Features
+
+- **Automated Volatility3 Execution**: Runs 10 forensic plugins to extract processes, network connections, DLLs, handles, and code injection indicators
+- **Two-Stage LLM Analysis**: Uses Google Gemini or Anthropic Claude to analyze raw data and provide scored findings with explanations
+- **Interactive Chat**: Ask follow-up questions about findings with full forensic context
+- **Hunting Checklist**: Automatically generates prioritized investigation steps
+- **Web Interface**: Simple browser-based UI for submitting dumps and reviewing results
+
+## Quick Start
+
+### Using Docker Run
+
+```bash
+# Create directories for dumps and outputs
+mkdir -p dumps runs
+
+# Run with Google Gemini (recommended)
+docker run -d \
+  -p 8000:8000 \
+  -v $(pwd)/dumps:/dumps:ro \
+  -v $(pwd)/runs:/app/runs \
+  -e LLM_PROVIDER=google \
+  -e GOOGLE_API_KEY=your_google_api_key \
+  --name vol3-triage \
+  therealpotus/vol3-triage:latest
+
+# Or run with Anthropic Claude
+docker run -d \
+  -p 8000:8000 \
+  -v $(pwd)/dumps:/dumps:ro \
+  -v $(pwd)/runs:/app/runs \
+  -e LLM_PROVIDER=anthropic \
+  -e ANTHROPIC_API_KEY=your_anthropic_api_key \
+  --name vol3-triage \
+  therealpotus/vol3-triage:latest
+```
+
+### Using Docker Compose
+
+1. Download the compose file:
+   ```bash
+   wget https://raw.githubusercontent.com/vermi/vol3-triage/main/docker-compose.yml
+   ```
+
+2. Create a `.env` file:
+   ```bash
+   echo "LLM_PROVIDER=google" > .env
+   echo "GOOGLE_API_KEY=your_key_here" >> .env
+   ```
+
+3. Start the container:
+   ```bash
+   docker-compose up -d
+   ```
+
+## Usage
+
+1. Place memory dump files in your `./dumps/` directory
+2. Open `http://localhost:8000/app` in your browser
+3. Enter the path `/dumps/your-file.dmp`, a case name, and scenario description
+4. Click **Run Triage** and wait for analysis (5-15 minutes depending on dump size)
+5. Review results in the Summary, Checklist, LLM Analysis, and Chat tabs
+
+## Environment Variables
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `LLM_PROVIDER` | LLM provider: `google` or `anthropic` | `google` |
+| `GOOGLE_API_KEY` | Google Gemini API key | - |
+| `ANTHROPIC_API_KEY` | Anthropic Claude API key | - |
+
+## API Keys
+
+- **Google Gemini** (recommended, 1M token context): https://aistudio.google.com/apikey
+- **Anthropic Claude** (200K token context): https://console.anthropic.com/
+
+## Volume Mounts
+
+| Path | Description |
+|------|-------------|
+| `/dumps` | Memory dump files (read-only) |
+| `/app/runs` | Analysis output directory (persisted) |
+
+## Links
+
+- **GitHub**: https://github.com/vermi/vol3-triage
+- **Documentation**: See full README on GitHub for detailed documentation