hexstrike-docker-mcp/docker-compose.yml at master · acaranta/hexstrike-docker-mcp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
# HexStrike AI — dockerized on the linuxserver Kali base (web desktop + tools),
# with the API server (8888) and the remote streamable-HTTP MCP (8889).
services:
  hexstrike:
    build:
      context: .
      # Pin/override the upstream commit at build time if desired:
      # args:
      #   HEXSTRIKE_REF: d689933ff579d839c676c82b231f8e98326c5f04
    image: hexstrike-ai:local
    container_name: hexstrike-ai
    # nmap SYN scans, masscan, responder, etc. need raw sockets. Grant the
    # minimal caps rather than full --privileged where possible.
    cap_add:
      - NET_RAW
      - NET_ADMIN
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
      # Web desktop HTTP basic auth (linuxserver base) — CHANGE THESE:
      - CUSTOM_USER=kali
      - PASSWORD=changeme
      # Bearer token required on the MCP endpoint (STRONGLY recommended).
      # Generate one with:  openssl rand -hex 32   and paste it here.
      # Leave empty for an open endpoint (lab/CTF on an isolated network only).
      - HEXSTRIKE_MCP_TOKEN=change-me-openssl-rand-hex-32
      # Optional port overrides (must match the published ports below):
      # - HEXSTRIKE_SERVER_PORT=8888
      # - HEXSTRIKE_MCP_PORT=8889
      # Host-header allowlist for the MCP transport's DNS-rebinding protection.
      # Left unset the check is DISABLED (reachable via any IP/hostname). Set it
      # to lock the endpoint to specific host:port values your clients send:
      # - HEXSTRIKE_MCP_ALLOWED_HOSTS=hexstrike.lan:8889,10.0.0.5:8889
    ports:
      - "3000:3000"   # web desktop (HTTP)
      - "3002:3001"   # web desktop (HTTPS)
      - "8888:8888"   # HexStrike API server
      - "8889:8889"   # HexStrike MCP (streamable HTTP)
    volumes:
      - ./config:/config          # persistent home + /config/hexstrike work dirs
    shm_size: "1gb"               # Chromium/browser-agent needs shared memory
    restart: unless-stopped
    # security_opt / seccomp may need loosening for some low-level tools:
    # security_opt:
    #   - seccomp:unconfined