Simplify docker.md instructions

Removed unnecessary note about mounting the entire '/var/run' directory.

docs/docker.md

@@ -31,4 +31,18 @@ Test if the image was created successfully:
 docker run -it mvt
 ```
 
-If a prompt is spawned successfully, you can close it with `exit`.
+If a prompt is spawned successfully, you can close it with `exit`.
+
+## Access an iOS device from Docker
+
+On the Linux host, install and start [usbmuxd](https://github.com/libimobiledevice/usbmuxd), then connect and unlock the iOS device. The daemon exposes the device through the `/var/run/usbmuxd` socket.
+
+Bind that socket into the container to let MVT communicate with the device:
+
+```bash
+docker run -it \
+    --mount type=bind,source=/var/run/usbmuxd,target=/var/run/usbmuxd \
+    ghcr.io/mvt-project/mvt
+```
+
+If you built the image from source, replace `ghcr.io/mvt-project/mvt` with `mvt`. 

src/mvt/android/artifacts/dumpsys_packages.py

@@ -72,6 +72,7 @@ class DumpsysPackagesArtifact(AndroidArtifact):
             "first_install_time": "",
             "last_update_time": "",
             "installer": "",
+            "system": False,
             "permissions": list(),
             "requested_permissions": list(),
         }
@@ -136,6 +137,8 @@ class DumpsysPackagesArtifact(AndroidArtifact):
                 details["timestamp"] = line.split("=")[1].strip()
             elif line.strip().startswith("installerPackageName="):
                 details["installer"] = line.split("=", 1)[1].strip()
+            elif line.strip().startswith("pkgFlags="):
+                details["system"] = "SYSTEM" in line.split("=", 1)[1].split()
             elif line.strip().startswith("firstInstallTime="):
                 first_install_times[current_user] = line.split("=", 1)[1].strip()
             elif line.strip().startswith("lastUpdateTime="):

tests/android/test_artifact_dumpsys_packages.py

@@ -26,6 +26,24 @@ class TestDumpsysPackagesArtifact:
         )
         assert dpa.results[0]["version_name"] == "5.0.07"
         assert dpa.results[0]["first_install_time"] == "2008-12-31 16:00:00"
+        assert dpa.results[0]["system"] is True
+
+    def test_parsing_system_flag(self):
+        system_details = DumpsysPackagesArtifact.parse_dumpsys_package_for_details(
+            "    pkgFlags=[ SYSTEM HAS_CODE ALLOW_CLEAR_USER_DATA ]"
+        )
+        third_party_details = DumpsysPackagesArtifact.parse_dumpsys_package_for_details(
+            "    pkgFlags=[ HAS_CODE ALLOW_BACKUP ]"
+        )
+        missing_flag_details = (
+            DumpsysPackagesArtifact.parse_dumpsys_package_for_details(
+                "    versionName=1.0"
+            )
+        )
+
+        assert system_details["system"] is True
+        assert third_party_details["system"] is False
+        assert missing_flag_details["system"] is False
 
     def test_ioc_check(self, indicator_file):
         dpa = DumpsysPackagesArtifact()