Docker runs applications in containers: isolated environments started from a template image. You can start several containers from the same image, throw them away and start again in seconds, or build your own images on top of an existing one.
The Parrot project publishes Parrot Linux Docker images so that the Parrot tools can be used on any system that runs Docker (Linux, macOS or Windows) without installing Parrot or setting up a full virtual machine.
Available Parrot Linux Docker images
The images are published on Docker Hub under the parrotsec organisation. The current documentation of the project lists the images below; the base image is built for amd64 and arm64.
parrotsec/core
The core system with just the Parrot basics and no security tools. Use it as the starting point for your own images.
docker run --rm -ti --network host -v $PWD/work:/work parrotsec/core
parrotsec/security
Built on top of parrotsec/core. It contains a large collection of tools that can be used from the command line inside a container. Tools that need a graphical interface are left out.
docker run --rm -ti --network host -v $PWD/work:/work parrotsec/security
Single-tool images
Smaller images that contain one tool or a small set of related tools. Images that share tools are stacked on top of each other to reuse layers and save disk space.
| Image | Built on | Example |
|---|---|---|
parrotsec/nmap | core | docker run --rm -ti parrotsec/nmap -F 192.168.1.1 |
parrotsec/metasploit | nmap | docker run --rm -ti --network host -v $PWD/msf:/root/ parrotsec/metasploit |
parrotsec/set | metasploit | docker run --rm -ti --network host -v $PWD/set:/root/.set parrotsec/set |
parrotsec/beef | core | docker run --rm --network host -ti -v $PWD/beef:/var/lib/beef-xss parrotsec/beef |
parrotsec/bettercap | nmap | docker run --rm -ti --network host parrotsec/bettercap |
parrotsec/sqlmap | nmap | docker run --rm -ti parrotsec/sqlmap -u <target URL> --wizard |
Older versions of this page used a tools- prefix (for example parrotsec/tools-nmap) and rolling and lts tags, including i386 and armhf builds. If a name here does not resolve, check the current image list on Docker Hub.
What the options mean
--rmremoves the container when you exit, so nothing is left behind.-tigives you an interactive terminal.--network hostlets the container use the network of the host directly, which scanners and listeners usually need. It works on Linux hosts; Docker Desktop on macOS and Windows handles host networking differently.-v $PWD/work:/workmaps a folder of the host into the container, so that your results survive when the container is removed.
Keep the images current
Images are rebuilt by the project from time to time. Pull the image again to get the latest build, and update the packages inside a long-running container with APT:
docker pull parrotsec/security
For everyday commands such as stopping, resuming, removing containers and opening ports, see general usage on Docker. Only run these tools against systems you own or are authorised to test.