Kali Infrastructure

Forge runs Kali Linux in a Docker container -- a full offensive toolkit with 2,400+ commands and 194 mapped tools across 14 PTES phases. The container is the execution sandbox: every security tool, from nmap to responder, runs inside it.

Container Architecture

Operator Machine
    |
Docker Engine
    |
allysec-kali (ghcr.io/allyseclabs/allysec-kali-full:latest)
    |-- 2,400+ Kali Linux commands
    |-- 194 mapped tools (KaliTool catalog)
    |-- Host networking (direct network access)
    |-- Privileged mode (raw socket, packet injection)
    |-- Docker socket mount (container-in-container)
    |-- Persistent volume (/var/lib/allysec/kali)

Single Full Image

The container ships as one image: allysec-kali-full. This replaces an earlier tiered approach (base/recon/ad/cloud/web images) that proved fragile. A single image eliminates image dependency chains and ensures every tool is available on first deploy.

Deployment

# Manual deploy
docker pull ghcr.io/allyseclabs/allysec-kali-full:latest
docker run -d --name allysec-kali \
  --network host \
  --privileged \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v allysec-kali-data:/var/lib/allysec/kali \
  ghcr.io/allyseclabs/allysec-kali-full:latest

Auto-Deploy

Set ALLYSEC_AUTO_DEPLOY=1 and the container is pulled and started on first tool invocation. No manual setup required.

Auto-Install

Set ALLYSEC_AUTO_INSTALL=1 and missing tools are installed via apt-get at runtime. If a tool is requested that is not in the base image, the system installs it and caches the installation in the persistent volume.

Tool Mapping

The KaliTool catalog maps 194 tools to 14 PTES phases. The mapping enables phase-aware tool discovery:

PTES Phase	Tools	Examples
1. Passive Reconnaissance	14	subfinder, amass, theHarvester, httpx
2. Active Reconnaissance	12	nmap, masscan, dnsrecon, naabu
3. Enumeration	13	enum4linux, smbclient, snmpwalk, dirb
4. Vulnerability Analysis	16	nuclei, nikto, wpscan, sqlmap
5. Exploitation	19	metasploit, searchsploit, hydra, impacket
6. Post-Exploitation	21	mimikatz, bloodhound, crackmapexec, chisel
7. Sniffing / MITM	8	responder, bettercap, ettercap, arpspoof
8. Web Application	40	ffuf, feroxbuster, gobuster, commix, wpscan
9. Cloud Security	9	pacu, ScoutSuite, cloudsploit, s3scanner
10. Container / Kubernetes	11	trivy, kube-hunter, kubeaudit, grype
11. API Security	4	kiterunner, arjun, swagger-hack
12. JWT / OAuth	3	jwt_tool, jwtcrack, oauth2-proxy
13. Deserialization	2	ysoserial, jackson
14. SSRF / CORS / Prototype	21	ssrfmap, gopherus, corscanner

Tools are listed by their primary phase; several map to multiple stages.

Health Checking

The Pipeline verifies container health on session startup. It checks:

1. Container is running (docker ps)
2. Tool count meets minimum threshold (170+)
3. Network connectivity (can reach targets)
4. Persistent volume is writable

If health checks fail, the Pipeline surfaces diagnostics and offers remediation.

Evolution

The infrastructure evolved from five separate tiered images to one full image. The tiered approach was abandoned because:

• Dependency chains between images caused deployment failures
• Partial images required runtime tool installation that slowed first-touch latency
• Operators needed to know which image had which tool

The single full image solves all three problems at the cost of a larger pull. The tradeoff is intentional: disk space is cheap; an operator's time is not.