docker-compose.yml

services:
  kali-server:
    container_name: zebbern-kali
    # Defaults to :latest for local use. CI overrides it with the same immutable
    # digest the integration gate certifies, so the live layer and the smoke
    # layer exercise the same bits; a digest pull creates no local tag, so
    # without this compose would rebuild from the Dockerfile instead.
    image: ${ZKM_IMAGE:-ghcr.io/zebbern/zebbern-kali-mcp:latest}
    build:
      context: .
      dockerfile: Dockerfile
      args:
        INCLUDE_METASPLOIT: ${INCLUDE_METASPLOIT:-true}
        INCLUDE_CADO_NFS: ${INCLUDE_CADO_NFS:-true}
    ports:
      - "${API_BIND_ADDRESS:-127.0.0.1}:${API_PORT:-5000}:${API_PORT:-5000}"
      - "${SOCKS_BIND_ADDRESS:-127.0.0.1}:${SOCKS_PORT:-1080}:1080"
    environment:
      API_LISTEN_HOST: ${API_LISTEN_HOST:-0.0.0.0}
      API_PORT: ${API_PORT:-5000}
      DEBUG_MODE: ${DEBUG_MODE:-0}
      HTB_ROUTES: ${HTB_ROUTES:-}
      EXTRA_HOSTS: ${EXTRA_HOSTS:-}
      KALI_API_TOKEN: ${KALI_API_TOKEN:-}
      REQUIRED_TOOLS: ${REQUIRED_TOOLS:-}
      JOB_MAX_COUNT: ${JOB_MAX_COUNT:-256}
      JOB_OUTPUT_MAX_LINES: ${JOB_OUTPUT_MAX_LINES:-2000}
      JOB_OUTPUT_MAX_CHARS: ${JOB_OUTPUT_MAX_CHARS:-2097152}
      JOB_OUTPUT_MAX_LINE_CHARS: ${JOB_OUTPUT_MAX_LINE_CHARS:-4096}
      JOB_INPUT_MAX_BYTES: ${JOB_INPUT_MAX_BYTES:-65536}
      JOB_INPUT_QUEUE_SIZE: ${JOB_INPUT_QUEUE_SIZE:-16}
      JOB_OUTPUT_MAX_WAIT: ${JOB_OUTPUT_MAX_WAIT:-30}
      CTF_MAX_DOWNLOAD_BYTES: ${CTF_MAX_DOWNLOAD_BYTES:-104857600}
      SOCKS_LISTEN_HOST: ${SOCKS_LISTEN_HOST:-0.0.0.0}
    # Headless Chrome maps its renderer shared memory here, and Docker's 64MB
    # default is not enough: gowitness navigated fine -- it reported the real
    # status code and page title -- and then wrote no image, reporting
    # have-screenshot=false with no error of its own.
    shm_size: 1gb
    cap_add:
      - NET_RAW
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    volumes:
      - kali-tmp:/app/tmp
      - ${VPN_DIR:-./vpn}:/vpn:ro
    restart: unless-stopped
    ulimits:
      nofile:
        soft: 65535
        hard: 65535
    sysctls:
      - net.ipv4.ip_forward=1
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:${API_PORT:-5000}/live || exit 1"]
      interval: 5m
      timeout: 5s
      start_period: 30s
      retries: 3
    deploy:
      resources:
        limits:
          # Two cores was not enough headroom for the tools that spawn their
          # own runtime. Headless Chrome loses a ~60s startup race against
          # anything else starting at the same time -- gowitness failed about
          # one run in five alongside a booting msfconsole and never when idle
          # -- and it fails by writing no screenshot while still exiting 0.
          #
          # There is deliberately NO cpus cap. Any fixed number is wrong
          # somewhere: `cpus` is validated against the host's core count and
          # Docker REFUSES TO START the container when it does not fit --
          # "range of CPUs is from 0.01 to 4.00, as there are only 4 CPUs
          # available" is how an 8.0 cap failed every CI run on a 4-core
          # runner. Uncapped is both more headroom than any cap and portable;
          # the scheduler still shares fairly with the host.
          memory: 10g
    # -- CTF network helpers (uncomment as needed) --
    # dns:
    #   - 8.8.8.8
    #   - 1.1.1.1
    # extra_hosts:
    #   - "ctf.local:10.10.10.1"

volumes:
  kali-tmp: