Kali in Docker — Method 2 (Docker Compose)

The same lab as Method 1, automated with two files: a docker-compose.yml and a setup.sh entrypoint script that installs the toolset and configures the MCP service on first boot. Once that initial run finishes, the container can be fully managed from Docker Desktop with one click.

Step 1 — Create a project folder

mkdir kali-mcp && cd kali-mcp

mkdir kali-mcp; cd kali-mcp

mkdir kali-mcp && cd kali-mcp

Step 2 — Create the setup.sh entrypoint

Save the following as setup.sh in the project folder. It runs once on first boot, drops a sentinel file at /etc/kali-mcp-setup-complete, then hands off to systemd. On subsequent boots the sentinel skips the setup block.

#!/bin/bash

# Only run setup if not already done
if [ ! -f /etc/kali-mcp-setup-complete ]; then
    echo ">>> Running first-time setup..."

    # Update and install Kali tools + MCP server + sudo
    apt update
    apt install -y kali-linux-default mcp-kali-server sudo

    # Create the systemd service
    cat > /etc/systemd/system/kali-mcp-server.service << EOF
[Unit]
Description=Kali MCP Server
After=network.target

[Service]
ExecStart=/usr/bin/kali-server-mcp
Restart=always
RestartSec=3

[Install]
WantedBy=multi-user.target
EOF

    # Enable the service
    systemctl daemon-reload
    systemctl enable kali-mcp-server

    # Mark setup as complete so it doesn't run again
    touch /etc/kali-mcp-setup-complete
    echo ">>> First-time setup complete."
fi

# Hand off to systemd
exec /sbin/init

Step 3 — Create the docker-compose.yml

Use the variant for your host platform. The Linux version uses host networking; the Windows and macOS versions use bridge mode with a port map, because Docker Desktop does not support --network host on either platform.

services:
  kali-mcp:
    image: kalilinux/kali-rolling
    container_name: kali-mcp
    privileged: true
    network_mode: host
    restart: unless-stopped
    tmpfs:
      - /run
      - /run/lock
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
      - ./setup.sh:/setup.sh:ro
    cgroupns_mode: host
    entrypoint: ["/bin/bash", "/setup.sh"]

services:
  kali-mcp:
    image: kalilinux/kali-rolling
    container_name: kali-mcp
    privileged: true
    restart: unless-stopped
    ports:
      - "5000:5000"
    tmpfs:
      - /run
      - /run/lock
    volumes:
      - ./setup.sh:/setup.sh:ro
    entrypoint: ["/bin/bash", "/setup.sh"]

services:
  kali-mcp:
    image: kalilinux/kali-rolling
    container_name: kali-mcp
    privileged: true
    restart: unless-stopped
    ports:
      - "5000:5000"
    tmpfs:
      - /run
      - /run/lock
    volumes:
      - ./setup.sh:/setup.sh:ro
    entrypoint: ["/bin/bash", "/setup.sh"]

Step 4 — Make the script executable

chmod +x setup.sh

# No action needed. Docker handles execute permissions
# inside the Linux container automatically — provided
# the file has LF line endings (see warning above).

chmod +x setup.sh

Step 5 — Start the container

Same on all three platforms.

docker compose up -d

Docker will pull the Kali image and start the container. The setup.sh script runs inside the container and installs everything.

Step 6 — Verify the MCP server

docker exec kali-mcp systemctl status kali-mcp-server

You should see active (running). The MCP server listens on:

After first-time setup — use Docker Desktop

Once the initial run has completed, the terminal is no longer required to manage the lab. From Docker Desktop you can:

• Start the container with one click.
• Stop it the same way.
• Restart it after configuration changes.
• View logs directly in the UI.

The kali-mcp-server service starts automatically every time the container boots, whether started from Docker Desktop or the CLI. The restart: unless-stopped policy means Docker will bring the container back up after a host reboot too.

Quick reference

Common things that go wrong