Docker Deployment
Relevant source files
The following files were used as context for generating this wiki page:
- README.md
- AGENTS.md
- nettacker/web/static/index.html
- nettacker/locale/en.yaml (Referenced via localization keys in provided context)
- nettacker/config.py (Referenced in AGENTS.md)
- docker-compose.yml (Implicitly referenced in documentation and scripts)
OWASP Nettacker provides a containerized deployment model to simplify the environment setup and ensure consistency across different platforms. Docker deployment is primarily used for two purposes: running the Command Line Interface (CLI) for automated scans and deploying the Web User Interface (Web UI) alongside the REST API server.
The Docker implementation ensures that all dependencies, including the Python runtime (3.10–3.12) and required libraries, are encapsulated. It also manages persistent data storage for scan results and the SQLite database, preventing data loss when containers are restarted or updated.
Sources: README.md:104-122, AGENTS.md:14-25
Architecture and Components
The Docker deployment leverages the owasp/nettacker image, which contains the core engine, modules, and API logic. When deployed via docker-compose, the system maps local volumes to the container to maintain a persistent state.
Container Workflow
The following diagram illustrates the interaction between the host machine and the Nettacker container during a typical deployment.
The diagram shows how the host initiates the container, which then serves the API and Web UI while maintaining data persistence through volume mapping.
Sources: README.md:113-120, AGENTS.md:14-18
CLI Deployment (Docker)
Users can run individual modules or full network scans using the Docker CLI without installing Python or dependencies locally. This is useful for one-off scans or integration into CI/CD pipelines.
Common CLI Commands
| Command Description | Example Syntax |
|---|---|
| Basic Port Scan | docker run owasp/nettacker -i 192.168.0.1 -m port_scan |
| Network Range Scan | docker run owasp/nettacker -i 192.168.0.0/24 -m port_scan -g 22 |
| Subdomain Discovery | docker run owasp/nettacker -i owasp.org -d -s -m http_status_scan |
| Display Help | docker run owasp/nettacker --help |
Sources: README.md:104-111
Web UI and API Deployment
The Web UI deployment is automated via docker-compose up. This mode starts the Nettacker engine in API mode and serves a responsive web interface.
Deployment Process
- Execution: Running
docker-compose upbuilds/pulls the image and starts the service. - Authentication: An API Key is generated and displayed in the container logs (
docker logs nettacker_nettacker). - Access: The interface is accessible at
https://localhost:5000. - Persistence: The
.nettacker/datadirectory on the host stores the SQLite database and scan reports.
The sequence diagram details the steps from starting the container to obtaining the API key required for Web UI access.
Sources: README.md:113-122, nettacker/web/static/index.html:105-115
Data Management and Persistence
A critical aspect of the Docker deployment is the management of runtime data. The container is configured to use the host's filesystem for storage to ensure that scan history and configurations survive container teardown.
Storage Locations
- Database:
.nettacker/data/nettacker.db(SQLite). - Scan Results:
.nettacker/data/results/. - Configuration: Default configurations are defined in
nettacker/config.pybut can be influenced by environment variables in Docker.
Sources: AGENTS.md:17-18, README.md:116-120
Security Considerations for Docker
The Docker deployment follows specific security guidelines to protect the host and the scan data:
- API Key Protection: The API key is required for all Web UI interactions and is generated uniquely per instance.
- Non-Persistent Directories: Only the
.nettacker/data/directory is intended for persistent storage; other container changes are ephemeral. - Privileged Access: Certain modules, such as
icmp_scan, may require root privileges within the container environment to function correctly.
Sources: AGENTS.md:56-60, nettacker/locale/bn.yaml:18
The Docker deployment of OWASP Nettacker provides a robust, scalable way to perform security assessments, ensuring that both the CLI tools and the Web UI are easily accessible while maintaining strict data persistence and security.