kali-linux-image/docker-bake.hcl at master · vxcontrol/kali-linux-image · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
# Docker Bake configuration for Kali Linux images
# Supports multi-platform builds with SBOM and provenance generation

group "default" {
  targets = ["base", "systemd", "test", "mcp"]
}

# Sequential build group to ensure proper layering
group "sequential" {
  targets = ["base"]
}

group "dependent" {
  targets = ["systemd"]
}

# Builds from kali-rolling directly, so it shares no layers with base and can
# run alongside the sequential base -> systemd chain.
group "independent" {
  targets = ["test"]
}

# Layered on base, like systemd: reuses the base layers and adds the MCP stack.
group "gateway" {
  targets = ["mcp"]
}

# Common configuration for all targets
variable "TAG" {
  default = "latest"
}

variable "REGISTRY" {
  default = "vxcontrol"
}

# Base Kali Linux image with essential penetration testing tools
target "base" {
  dockerfile = "Dockerfile"
  target = "base"
  platforms = ["linux/amd64", "linux/arm64"]
  tags = [
    "${REGISTRY}/kali-linux:latest"
  ]

  # Build provenance attestation (mode=max).
  attest = [
    "type=provenance,mode=max"
  ]

  # Build metadata
  labels = {
    "org.opencontainers.image.title" = "Kali Linux Penetration Testing Image"
    "org.opencontainers.image.description" = "AI-ready Kali Linux container with 200+ curated CLI penetration testing tools"
    "org.opencontainers.image.url" = "https://hub.docker.com/r/vxcontrol/kali-linux"
    "org.opencontainers.image.documentation" = "https://github.com/vxcontrol/kali-linux-image/blob/master/README.md"
    "org.opencontainers.image.source" = "https://github.com/vxcontrol/kali-linux-image"
    "org.opencontainers.image.vendor" = "vxcontrol"
    "org.opencontainers.image.licenses" = "MIT"
    "org.opencontainers.image.version" = "${TAG}"
    "com.vxcontrol.dockerfile.url" = "https://raw.githubusercontent.com/vxcontrol/kali-linux-image/master/Dockerfile"
    "com.vxcontrol.license.url" = "https://raw.githubusercontent.com/vxcontrol/kali-linux-image/master/LICENSE"
  }
}

# Systemd-enabled Kali Linux image with service management support
target "systemd" {
  dockerfile = "Dockerfile"
  target = "systemd"
  platforms = ["linux/amd64", "linux/arm64"]
  tags = [
    "${REGISTRY}/kali-linux:systemd",
  ]

  # Build dependencies - reuse base layers
  contexts = {
    base = "target:base"
  }

  # Build provenance attestation (mode=max).
  attest = [
    "type=provenance,mode=max"
  ]

  # Build metadata
  labels = {
    "org.opencontainers.image.title" = "Kali Linux Penetration Testing Image (Systemd)"
    "org.opencontainers.image.description" = "AI-ready Kali Linux container with systemctl support and 200+ penetration testing tools"
    "org.opencontainers.image.url" = "https://hub.docker.com/r/vxcontrol/kali-linux"
    "org.opencontainers.image.documentation" = "https://github.com/vxcontrol/kali-linux-image/blob/master/README.md"
    "org.opencontainers.image.source" = "https://github.com/vxcontrol/kali-linux-image"
    "org.opencontainers.image.vendor" = "vxcontrol"
    "org.opencontainers.image.licenses" = "MIT"
    "org.opencontainers.image.version" = "${TAG}"
    "com.vxcontrol.dockerfile.url" = "https://raw.githubusercontent.com/vxcontrol/kali-linux-image/master/Dockerfile"
    "com.vxcontrol.license.url" = "https://raw.githubusercontent.com/vxcontrol/kali-linux-image/master/LICENSE"
  }
}

# Sandbox-policy test image: the container PentAGI starts to check that agents
# reach a Docker daemon of their own that refuses host-escape requests. It is
# pulled into the sandbox on every startup check, so it carries only a Docker
# client and curl -- the tooling the checks exercise lives in the containers
# they create. Built FROM kali-rolling, not from base, for the same reason.
target "test" {
  dockerfile = "Dockerfile"
  target = "test"
  platforms = ["linux/amd64", "linux/arm64"]
  tags = [
    "${REGISTRY}/kali-linux:test",
  ]

  # Build provenance attestation (mode=max).
  attest = [
    "type=provenance,mode=max"
  ]

  # Build metadata
  labels = {
    "org.opencontainers.image.title" = "Kali Linux Sandbox Policy Test Image"
    "org.opencontainers.image.description" = "Minimal Kali image with a Docker client and curl, used by PentAGI to verify sandbox isolation"
    "org.opencontainers.image.url" = "https://hub.docker.com/r/vxcontrol/kali-linux"
    "org.opencontainers.image.documentation" = "https://github.com/vxcontrol/kali-linux-image/blob/master/README.md"
    "org.opencontainers.image.source" = "https://github.com/vxcontrol/kali-linux-image"
    "org.opencontainers.image.vendor" = "vxcontrol"
    "org.opencontainers.image.licenses" = "MIT"
    "org.opencontainers.image.version" = "${TAG}"
    "com.vxcontrol.dockerfile.url" = "https://raw.githubusercontent.com/vxcontrol/kali-linux-image/master/Dockerfile"
    "com.vxcontrol.license.url" = "https://raw.githubusercontent.com/vxcontrol/kali-linux-image/master/LICENSE"
  }
}

# MCP gateway image: the full penetration-testing toolkit exposed as one
# token-authenticated MCP endpoint (agentgateway + ~15 stdio MCP servers +
# in-container Burp Suite). Built FROM base -- like systemd -- so it reuses the
# base layers instead of rebuilding the toolchain. Config and scripts are
# COPYed from ./mcp by the root Dockerfile's `mcp` stage.
target "mcp" {
  dockerfile = "Dockerfile"
  target = "mcp"
  platforms = ["linux/amd64", "linux/arm64"]
  tags = [
    "${REGISTRY}/kali-linux:mcp",
  ]

  # Build dependencies - reuse base layers
  contexts = {
    base = "target:base"
  }

  # Build provenance attestation (mode=max).
  attest = [
    "type=provenance,mode=max"
  ]

  # Build metadata
  labels = {
    "org.opencontainers.image.title" = "Kali Linux MCP Gateway"
    "org.opencontainers.image.description" = "Kali penetration-testing tools exposed as one token-authenticated MCP endpoint (agentgateway + Burp Suite)"
    "org.opencontainers.image.url" = "https://hub.docker.com/r/vxcontrol/kali-linux"
    "org.opencontainers.image.documentation" = "https://github.com/vxcontrol/kali-linux-image/blob/master/mcp/README.md"
    "org.opencontainers.image.source" = "https://github.com/vxcontrol/kali-linux-image"
    "org.opencontainers.image.vendor" = "vxcontrol"
    "org.opencontainers.image.licenses" = "MIT"
    "org.opencontainers.image.version" = "${TAG}"
    "com.vxcontrol.dockerfile.url" = "https://raw.githubusercontent.com/vxcontrol/kali-linux-image/master/Dockerfile"
    "com.vxcontrol.license.url" = "https://raw.githubusercontent.com/vxcontrol/kali-linux-image/master/LICENSE"
  }
}