vxcontrol/kali-linux

Kali Linux Docker Images for Penetration Testing

![]([][]([]
Join the Community! Connect with security researchers, AI enthusiasts, and fellow ethical hackers. Get support, share insights, and stay updated with the latest PentAGI developments.

🛡️ Production-ready Kali Linux containers with 200+ curated CLI security tools

Streamlined Docker images specifically optimized for headless penetration testing environments. Get started with security testing in seconds without spending hours installing and configuring tools.

🚀 Quick Start

bash
# Pull the latest image
docker pull vxcontrol/kali-linux

bash
# Start interactive session
docker run --rm -it vxcontrol/kali-linux bash

bash
# Run with network capabilities for advanced scanning
docker run --rm -it --cap-add NET_ADMIN --cap-add NET_RAW --net=host vxcontrol/kali-linux bash

🎯 Why This Image?

✅ Zero Setup Time

• 200+ penetration testing tools pre-installed and ready to use
• No dependency management - everything works out of the box
• Fresh tool versions - includes latest releases installed via go install and package managers
• Consistent environment across different systems and teams

✅ Optimized for Automation

• AI-Agent Ready - Perfect execution environment for PentAGI and other automated security testing frameworks
• Headless by design - All tools are CLI-based for scriptable workflows
• Container isolation - Safe testing environment with proper resource constraints

✅ Professional Grade

• Production tested - Used in real-world penetration testing engagements
• Multi-platform support - Available for both ARM64 (Apple Silicon) and AMD64 architectures
• Minimal *** surface - Only essential tools, no unnecessary packages

📦 Available Variants

Base Image (Recommended)

bash
docker pull vxcontrol/kali-linux:latest

Lightweight container with essential penetration testing tools.

Systemd-Enabled Image

bash
docker pull vxcontrol/kali-linux:systemd

Extended image with systemctl support for tools requiring service management.

🔧 Essential Tools Included

Network Discovery & Reconnaissance

• nmap - Network discovery and security auditing
• masscan - High-speed internet-wide port scanner
• amass - In-depth subdomain enumeration
• subfinder - Fast passive subdomain discovery
• httpx - Fast HTTP probing and technology detection

Web Application Testing

• nuclei - Fast vulnerability scanner with YAML templates
• sqlmap - Automatic SQL injection detection and exploitation
• gobuster - Directory/file and DNS enumeration
• ffuf - Fast web fuzzer
• nikto - Web server vulnerability scanner

Windows & Active Directory

• impacket-* - Complete suite for Windows protocol exploitation
• evil-winrm - Windows Remote Management shell
• bloodhound-python - Active Directory relationship mapping
• crackmapexec - Post-exploitation tool for Windows networks

Password & Hash ***ing

• hashcat - Advanced password recovery
• john - Password hash ***ing tool
• hydra - Network authentication brute-forcer

Post-Exploitation & Analysis

• metasploit - Complete exploitation framework
• radare2 - Reverse engineering toolkit
• binwalk - Firmware analysis tool

https://github.com/vxcontrol/kali-linux-image

💻 Usage Examples

Interactive Penetration Testing

bash
# Mount current directory for file access
docker run --rm -it -v $(pwd):/work -w /work vxcontrol/kali-linux bash

bash
# Network scanning with proper capabilities
docker run --rm --net=host --cap-add NET_ADMIN --cap-add NET_RAW \
  vxcontrol/kali-linux nmap -sS -O example.com

bash
# Web application testing
docker run --rm -v $(pwd):/data -w /data \
  vxcontrol/kali-linux sqlmap -u "http://example.com/page?id=1"

Automated Security Testing

bash
# Vulnerability scanning with results export
docker run --rm -v $(pwd)/results:/results \
  vxcontrol/kali-linux nuclei -u example.com -o /results/vulns.json

bash
# Subdomain enumeration
docker run --rm -v $(pwd):/output \
  vxcontrol/kali-linux subfinder -d example.com -o /output/subdomains.txt

bash
# Directory brute-forcing
docker run --rm -v $(pwd)/results:/results \
  vxcontrol/kali-linux gobuster dir -u http://example.com \
  -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
  -o /results/directories.txt

CI/CD Integration

yaml
# docker-compose.yml
services:
  security-scan:
    image: vxcontrol/kali-linux
    volumes:
      - ./reports:/results
      - ./targets.txt:/targets.txt
    command: |
      bash -c "
        nuclei -l /targets.txt -o /results/vulnerabilities.json
        subfinder -dL /targets.txt -o /results/subdomains.txt
      "

🔧 Tool Aliases for Quick Access

Linux

Add these aliases to your shell profile (.bashrc, .zshrc) for instant access to tools:

bash
# Network scanning
alias nmap='docker run --rm --net=host --cap-add NET_ADMIN --cap-add NET_RAW vxcontrol/kali-linux nmap'
alias masscan='docker run --rm --net=host --cap-add NET_ADMIN --cap-add NET_RAW vxcontrol/kali-linux masscan'
alias naabu='docker run --rm --net=host --cap-add NET_ADMIN --cap-add NET_RAW vxcontrol/kali-linux naabu'

# Web application testing
alias nuclei='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux nuclei'
alias sqlmap='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux sqlmap'
alias gobuster='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux gobuster'
alias ffuf='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux ffuf'
alias nikto='docker run --rm --net=host -v $(pwd):/work -w /work vxcontrol/kali-linux nikto'

# Reconnaissance
alias subfinder='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux subfinder'
alias httpx='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux httpx'
alias amass='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux amass'
alias katana='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux katana'

# Windows/AD testing
alias crackmapexec='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux crackmapexec'
alias evil-winrm='docker run --rm -it -v $(pwd):/work -w /work vxcontrol/kali-linux evil-winrm'
alias impacket-secretsdump='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux impacket-secretsdump'

# Password cracking
alias hashcat='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux hashcat'
alias john='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux john'
alias hydra='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux hydra'

# Metasploit
alias msfconsole='docker run --rm -it --net=host -v ~/.msf4:/root/.msf4 -v $(pwd):/work -w /work vxcontrol/kali-linux msfconsole'
alias msfvenom='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux msfvenom'

# Interactive shell
alias kali-shell='docker run --rm -it -v $(pwd):/work -w /work --cap-add NET_ADMIN --cap-add NET_RAW vxcontrol/kali-linux bash'

macOS

For macOS users, add these aliases to your shell profile (.zshrc, .bash_profile):

bash
# Network scanning  
alias nmap='docker run --rm --net=host vxcontrol/kali-linux nmap'
alias masscan='docker run --rm --net=host vxcontrol/kali-linux masscan'
alias naabu='docker run --rm --net=host vxcontrol/kali-linux naabu'

# Web application testing
alias nuclei='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux nuclei'
alias sqlmap='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux sqlmap'
alias gobuster='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux gobuster'
alias ffuf='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux ffuf'
alias nikto='docker run --rm --net=host -v $(pwd):/work -w /work vxcontrol/kali-linux nikto'

# Reconnaissance
alias subfinder='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux subfinder'
alias httpx='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux httpx'
alias amass='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux amass'
alias katana='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux katana'

# Windows/AD testing
alias crackmapexec='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux crackmapexec'
alias evil-winrm='docker run --rm -it -v $(pwd):/work -w /work vxcontrol/kali-linux evil-winrm'
alias impacket-secretsdump='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux impacket-secretsdump'

# Password cracking
alias hashcat='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux hashcat'
alias john='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux john'
alias hydra='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux hydra'

# Metasploit
alias msfconsole='docker run --rm -it --net=host -v ~/.msf4:/root/.msf4 -v $(pwd):/work -w /work vxcontrol/kali-linux msfconsole'
alias msfvenom='docker run --rm -v $(pwd):/work -w /work vxcontrol/kali-linux msfvenom'

# Interactive shell
alias kali-shell='docker run --rm -it -v $(pwd):/work -w /work vxcontrol/kali-linux bash'

Note for macOS users: Raw network capabilities (--cap-add NET_ADMIN --cap-add NET_RAW) are not available in Docker Desktop for Mac, so they are omitted from network scanning tools. For advanced network testing, *** using a Linux VM or remote testing environment.

🤖 AI Agent Integration

Perfect for autonomous AI-driven penetration testing:

bash
# Spawn container for AI agent automation
docker run --rm -d --name pentesting-session \
  --cap-add NET_ADMIN --cap-add NET_RAW \
  -v /tmp/results:/results \
  vxcontrol/kali-linux tail -f /dev/null

# AI agents can execute commands
docker exec pentesting-session nmap -sn 192.168.1.0/24
docker exec pentesting-session nuclei -u https://example.com -o /results/vulns.json

Designed for seamless integration with PentAGI - an autonomous AI agents system for penetration testing.

📋 System Requirements

Minimum

• 1GB RAM
• 1 CPU core
• 7GB disk space

Recommended

• 2GB+ RAM
• 2+ CPU cores
• 10GB+ disk space for results

🛡️ Security ***ations

⚠️ Important: These images contain penetration testing tools intended for authorized security testing only.

• Network Capabilities: Docker socket access grants significant host privileges
• Raw Network Access: Required capabilities enable low-level network manipulation
• Tool Responsibility: Each tool has its own security implications and legal requirements

See Disclaimer section for complete legal and ethical usage guidelines.

🔧 Troubleshooting & Support

• Source Code & Issues: https://github.com/vxcontrol/kali-linux-image
• Tool Problems: Create an issue on GitHub with detailed error information
• Feature Requests: Submit enhancement requests via GitHub Issues
• Build Issues: Check the repository for build instructions and requirements

📄 License

Container Configuration: The Docker configuration files and build scripts in this project are licensed under the MIT License.

Included Software: This Docker image contains software packages from the official Kali Linux repository and third-party tools, each governed by their respective licenses. Users are responsible for ensuring compliance with the individual licenses of all included software for their specific use cases.

Base Image: Built upon the official https://hub.docker.com/r/kalilinux/kali-rolling image, subject to its licensing terms and conditions.

⚠️ Disclaimer

Ethical Use Only: This image is provided exclusively for ethical hacking, authorized penetration testing, and security research in full compliance with the Kali Linux EULA and the licenses of all included software.

No Warranty: The authors and contributors provide this image "as is" without warranty of any kind and disclaim all liability for any damages arising from the use of this image or any software contained within it.

User Responsibility: Users are solely responsible for ensuring their use complies with all applicable laws, regulations, and the terms of service of target systems. Only use on systems you own or have explicit written authorization to test.