Docker agent

The Docker agent is a containerized VPN agent for environments already running Docker. It works on Linux, Windows, and macOS (including Apple Silicon).

VPN profiles require the Internal network scanning add-on.

Prerequisites

Docker installed and running
Outbound connectivity to vpn2.pentest-tools.com on TCP port 22
Network access to internal targets from the Docker host

Quick start

Create VPN profile

In Pentest-Tools.com, create a new VPN profile and copy the VPN UUID.

Pull and run

Run the following command, replacing <VPN_UUID> with your UUID:

docker pull pentesttoolscom/vpn_agent:latest && \
docker run -d \
  --name pentest-agent \
  --restart unless-stopped \
  --cap-add=NET_ADMIN \
  --device /dev/net/tun \
  pentesttoolscom/vpn_agent:latest <VPN_UUID>

You can also copy this command directly from the deployment menu in Settings > VPN Profiles.

Verify connection

Go to Settings > VPN Profiles and check that your profile shows as Online.

Required capabilities

The agent needs these Linux capabilities:

Capability	Purpose
`NET_ADMIN`	VPN tunnel management
`/dev/net/tun`	TUN device for the VPN tunnel

Network modes

By default, the container uses Docker’s bridge network. Depending on your setup, you may need a different mode.

Host network mode

Gives the container direct access to the host’s network interfaces:

docker run -d \
  --name pentest-agent \
  --network host \
  --cap-add=NET_ADMIN \
  --device /dev/net/tun \
  pentesttoolscom/vpn_agent:latest <VPN_UUID>

Host network mode exposes the container’s ports directly on the host machine. This can cause conflicts if ports 80, 443, or 1194 are already in use on the host. It also means the agent’s network traffic is not isolated from the host.

Custom Docker network

To scan containers in a specific Docker network:

docker run -d \
  --name pentest-agent \
  --network your-internal-network \
  --cap-add=NET_ADMIN \
  --device /dev/net/tun \
  pentesttoolscom/vpn_agent:latest <VPN_UUID>

Docker Compose

Set your VPN UUID as the command in the Compose file:

services:
  vpn-agent:
    image: pentesttoolscom/vpn_agent:latest
    container_name: pentest-agent
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun
    network_mode: host
    command: "<VPN_UUID>"

Replace <VPN_UUID> with the UUID from your VPN profile.

Start the agent in the background:

docker compose up -d

Managing the agent

# View logs
docker logs pentest-agent

# Check status
docker ps | grep pentest-agent

# Restart
docker restart pentest-agent

# Stop
docker stop pentest-agent

# Remove
docker rm -f pentest-agent

Troubleshooting

Container exits immediately

Check that the VPN UUID is provided as an argument after the image name
Verify --cap-add=NET_ADMIN is set
Check that the /dev/net/tun device is mounted
Check container logs: docker logs pentest-agent

Cannot reach internal targets

Verify the container’s network mode allows access to targets
Check host firewall rules
Try --network host mode

Intro

Core

Tools reference

Capabilities

AI

Account & billing

Prerequisites

Quick start

Required capabilities

Network modes

Host network mode

Custom Docker network

Docker Compose

Managing the agent

Troubleshooting

​Prerequisites

​Quick start

​Required capabilities

​Network modes

​Host network mode

​Custom Docker network

​Docker Compose

​Managing the agent

​Troubleshooting

​Related topics

Prerequisites

Quick start

Required capabilities

Network modes

Host network mode

Custom Docker network

Docker Compose

Managing the agent

Troubleshooting

Related topics