Built Pentest Environment On Your Mac Using Docker

A Simple and Working Setup for Every Apple Silicon Macs (M1, M2, M3, M4, M5)

Photo by Ales Nesetril on Unsplash

Penetration testing has become a foundational skill that everyone in the tech industry should master by 2026. As the vibes coding expands exponentially, many developers neglected to overlook security. Consequently, mastering pentest could become big advantage for you.

Since Apple introduced Apple Silicon chips, MacBooks now use a different processor architecture instead of the older Intel-based system. This change brought major improvements, especially better speed and performance.

However, it also created new challenges. Users can no longer install standard Ubuntu or DVWA ISO files without first checking whether they support the correct architecture. On Apple Silicon Macs, ARM64 versions are required for the software to run properly. Unfortunately, many open-source projects still do not provide native ARM-compatible images or applications.

Fortunately, as technology continues to improve, solutions for these limitations are also becoming available. In this article, I will share several tips on how to build a reliable penetration testing environment on a Mac, especially for devices using the M1 chip.

This lab environment is completely legal and safe to use for learning purposes. You are also encouraged to modify and improve it based on your own needs and ideas. The solution is Docker.

Clcik here to read for free

What Is Docker?

What is Docker? In short, think of Docker as a giant container ship. Just like a real cargo ship, it carries container boxes throughout its journey. In this context, those containers are the applications we want to install.

This means we don’t have to go through the hassle of setting up or configuring an OS just to get an application running. We can just let Docker handle all the preparation for us.

The installation is quite straightforward. Simply access the official website and download the Docker application directly, making sure to select the Apple Silicon version.

Proceed with the standard installation process. To check whether Docker was installed successfully, run the following commands in your terminal.

docker --version
docker compose version

If the installation process is successful, we can continue to the next step.

The Lab Arshitecture

To make things easier to follow, let me first break down the lab architecture we are going to build inside Docker.

Since we are not running heavy standalone operating systems and are letting Docker handle most of the work, our lab environment will look like the diagram above.

To allow your macOS system to communicate with the Docker containers, we use a feature called port mapping. This creates a connection between your host machine and the isolated Docker environment through Docker’s virtual network.

Create an Isolated Pentest Network

Run this command on your terminal.

docker network create \
--subnet=172.30.0.0/16 \
pentestlab

Notice that the pentestlab network has been successfully created after running the previous command.

Creating the Kali Container

To install your Kali Linux instance, run the following command.

docker run -it --name kali \
--network pentestlab \
--ip 172.20.0.5 \
kalilinux/kali-rolling

It’s honestly that simple and fast to have Kali Linux running on your macOS.

However, this minimal image requires a quick update and some initial customization. First, let’s update the package repository:

apt update

Next, install the essential penetration testing tools based on your needs. For this tutorial, the tools below are already enough for the job.

apt install -y \
nmap \
sqlmap \
nikto \
hydra \
net-tools \
iputils-ping \
curl \
wget

Just like that, your tools are ready.

You can verify the IP address by running ifconfig to ensure it matches the static IP we assigned earlier (172.30.0.5).

At this point, we already have:

• A Kali Linux instance (Attacker Machine)
• An isolated virtual network
• Essential pentesting tools

Our next step is to build the target labs we planned earlier. Don’t worry about leaving this container for now. You can safely exit the Kali terminal by typing exit

Installing Target 1 — DVWA

The installation is incredibly straightforward. Simply run the following command, and the DVWA platform will be deployed inside your Docker environment.

docker run -d \
--name dvwa \
--network pentestlab \
--ip 172.30.0.10 \
vulnerables/web-dvwa

To confirm that the installation was successful, check your active containers by running docker ps

Installing Target 2 — OWASP Juice Shop

Just like before, run this command to deploy the second target.

docker run -d \
--name juice \
--network pentestlab \
--ip 172.30.0.11 \
bkimminich/juice-shop

Installing Target 3 — WebGoat

Next, let’s install the WebGoat container:

docker run -d \
--name webgoat \
--network pentestlab \
--ip 172.30.0.12 \
webgoat/webgoat

Installing Target 4 — Vulnerable SSH Machine

Finally, let’s add a vulnerable SSH machine to practice network brute-forcing.

docker run -d \
--name vulnssh \
--network pentestlab \
--ip 172.30.0.20 \
rastasheep/ubuntu-sshd:18.04

Verifying the Setup

Validate that all targets have been successfully installed and are running in the background by executing docker-ps

And that’s it! We have successfully built a fully local penetration testing lab environment right on an Apple Silicon M1 architecture.

Testing the Machine

To back to your Kali Linux instance back up, start the container and attach to its interactive terminal using the following commands docker start kali and docker exec -it kali bash

From inside the Kali container, you will be able to see and interact with all the lab targets we have installed.

Exposing the Web Applications (Port Mapping)

As we know, three of the targets we deployed are web applications: DVWA, Juice Shop, and WebGoat. By default, Docker isolates these containers, so you cannot directly access their web interfaces from your Mac browser.

This is where port mapping becomes important. To make these applications accessible from your host machine, we need to recreate the containers with specific port settings. First, remove the existing isolated containers.

docker rm -f dvwa
docker rm -f juice
docker rm -f webgoat

Next, redeploy each container with the corresponding port mapping flags (-p) just follow this command.

DVWA

docker run -d \
--name dvwa \
--network pentestlab \
--ip 172.30.0.10 \
-p 8080:80 \
vulnerables/web-dvwa

OWASP Juice Shop

docker run -d \
--name juice \
--network pentestlab \
--ip 172.30.0.11 \
-p 3000:3000 \
bkimminich/juice-shop

WebGoat

docker run -d \
--name webgoat \
--network pentestlab \
--ip 172.30.0.12 \
-p 8081:8080 \
webgoat/webgoat

Now, when you check your running containers using docker ps, you will see the active port mappings listed

As a result, you can easily access each vulnerable application right from your Mac’s preferred web browser:

• DVWA: [http://localhost:8080](http://localhost:8080)
• Juice Shop: [http://localhost:3000](http://localhost:3000)
• WebGoat: [http://localhost:8081/WebGoat](http://localhost:8081/WebGoat)

Attacking Simulation

Since this article focuses on building the penetration testing environment, I will not go too into attack demonstrations. However, let’s run a few simple tests to make sure everything is working properly.

Enumeration Examples

Now that our self-hosted Apple Silicon pentest lab is fully functional, let’s test it out. Inside your Kali Linux container, you can run a quick web vulnerability scan using Nikto against one of our targets.

You can also leverage sqlmap to hunt for database vulnerabilities across the network, or use any of the other tools we installed earlier.

Managing Your Environment

Building a versatile pentest lab with Docker is incredibly fast and efficient.

To prevent these containers from idling and draining your Mac’s RAM when you’re done practicing, you can shut them all down simultaneously using this single command.

docker stop kali dvwa juice webgoat vulnssh

When you are ready to jump back into hacking next time, you don’t have to rebuild anything from scratch. Simply power them back up with.

docker start kali dvwa juice webgoat vulnssh

Conclusion

To finish setting up this completely legal pentest lab, I want to say thank you to everyone who helped make this guide possible, and also to you, the readers — whether you only stopped by for a quick look or successfully followed the entire installation process.

Your support motivates me to continue writing and sharing more technical content. From here, there are many things you can explore, from beginner practice to more advanced red team simulations.

Feel free to experiment, break things safely, and improve the lab you have built. Happy Learning! ✨