Distrobox Kali Linux: Run Kali in a container on any distro

Distrobox Kali Linux setups give you a full Kali userland in a terminal tab, with no virtual machine and no reboot. Distrobox builds the container with Podman or Docker and shares your home folder, display and network with the host. You install Distrobox, create one Kali container and add tools with apt. This guide walks through each step and the fixes for common errors.

What is Distrobox and why run Kali in it

Distrobox is a command-line wrapper around Podman, Docker or Lilipod. It builds a container from any OCI image (the standard container image format) and plugs it into your desktop. The idea comes from Fedora’s toolbox, but Distrobox is written in POSIX shell so it runs on most hosts.

Kali fits this model well. The official image is a minimal rolling base, so you add only the tool groups you want. The box keeps its own packages, which means host upgrades leave your Kali tools untouched.

A Distrobox container shares the following with the host:

Your home directory
External storage and USB devices
X11 and Wayland graphical apps
Audio and the network
The SSH agent and D-Bus

The project’s own benchmark on a modest laptop measured about 396 ms to enter a container. That is quick enough to use a box as your default terminal.

Distrobox vs VM vs plain Docker for Kali

Three routes put Kali on a Linux machine without replacing your main distro. They differ in how much of your desktop the tools can reach and how much memory the setup costs.

Virtual machine: boots a full Kali with its own kernel. It is heavier but fully separate. Follow the guide to install Kali Linux in VirtualBox for this route.
Plain Docker: Kali’s container docs run the image with an interactive terminal. You get a root shell with no desktop link and no systemd.
Distrobox: shares your home folder, display and devices. Kali tools open on your desktop and read your files.

Some penetration testing tools need full hardware access. A dual boot of Kali next to Windows 11 gives you that, and an encrypted persistent live Kali USB suits a portable lab.

What you need before installing

Distrobox needs a container manager on the host. That is the program that runs the containers. Podman, Docker and Lilipod all work and one is enough. Check what is installed first.

podman --version
docker --version

A version string in the output means the tool is ready. A “command not found” message means you need to install one of them before you continue with the next section.

Choose Podman or Docker

Pick Podman if you can. It runs containers rootless (without root privileges) by default, and the Distrobox maintainers recommend rootless Podman or Lilipod when root access worries you. Docker containers run as root. Arch users can follow the guide to install Docker on Arch.

sudo apt install podman    # Debian, Ubuntu and Kali
sudo dnf install podman    # Fedora
sudo pacman -S podman      # Arch Linux

How to install Distrobox

Install from your package manager

Most distros package Distrobox, so start with your own package manager and let it handle updates. Kali’s package tracker lists version 1.8.2.5-1 in kali-rolling since 1 July 2026.

sudo apt install distrobox    # Debian, Ubuntu and Kali
sudo dnf install distrobox    # Fedora
sudo pacman -S distrobox      # Arch Linux

Older Fedora guides tell you to enable a Copr repository first. Fedora ships Distrobox in its own repositories now, so the plain command above is enough.

Install with the upstream script

Use the script when your distro has no package or you want the newest release. Run it as root for a system-wide install. Or pass a prefix to install into your home folder without sudo.

curl -s https://raw.githubusercontent.com/89luca89/distrobox/main/install | sudo sh
curl -s https://raw.githubusercontent.com/89luca89/distrobox/main/install | sh -s -- --prefix ~/.local

Add ~/.local/bin to your PATH after a prefix install. Download and read the script before you pipe it into a root shell, since it runs with full privileges.

Check the installed version

Run the command below. It prints the Distrobox version so you know whether you run the 1.8 line or a 2.0 release candidate.

distrobox create --version

Distrobox 1.8 or 2.0 release candidate

The stable release is 1.8.2.5 from 27 April 2026. A Go rewrite called Distrobox 2 is in release-candidate stage. Version 2.0.0-rc.3 appeared on 29 June 2026. The maintainers still recommend v1 for production until v2 matches its features.

In v2 each command no longer ships as a separate executable, so distrobox-create becomes distrobox create. Release candidate 3 added compatibility entry points for the old names. This guide uses the spaced form, which works in both versions.

Create a Kali Linux container with Distrobox

Create the container

Create the box with a single command. You give it a name and the official Kali Linux image, which the Kali team rebuilds every week as a minimal rolling release with no tools installed.

distrobox create --name kali --image docker.io/kalilinux/kali-rolling:latest

create builds the container
--name kali names it kali
--image points at the official rolling image on Docker Hub

The first run pulls the image and asks for confirmation, so answer Y. Distrobox then builds the container and adds an entry to your application menu.

Enter the container

Enter the box with distrobox enter and the container name. The first entry takes longer because Distrobox sets up your user inside the container.

distrobox enter kali
cat /etc/os-release

With Docker or the --root flag you also set a password for your user at this step. Rootless Podman skips that prompt. The os-release output names Kali GNU/Linux Rolling, which confirms you are inside the box.

Update the box

Host updates do not touch packages inside the container, so update Kali separately. Run the Distrobox upgrade command from the host or use apt inside the box.

distrobox upgrade kali
sudo apt update && sudo apt full-upgrade

Install Kali tools inside the container

Start with the headless set

A fresh Kali image has no security tools. Kali’s own container docs say the images skip the default metapackage (a package that only pulls in a group of other packages), so you add one yourself.

distrobox enter kali
sudo apt update && sudo apt -y install kali-linux-headless

The headless set covers the tools that need no GUI. Its dependency list includes nmap, hydra, sqlmap, john, hashcat and metasploit-framework. Expect a long download, so use a stable connection.

Choose a larger set or one category

Start with headless and add a category when you need it. These are the metapackages most people reach for:

kali-linux-default adds GUI apps such as zenmap, hydra-gtk and ophcrack
kali-linux-large adds many more tools on top of the default set
kali-linux-everything installs every Kali tool and Kali warns it pulls in a lot
kali-tools-top10 covers nmap, wireshark, burpsuite, metasploit-framework and others
kali-tools-web groups the web application assessment tools

A single tool installs the usual way.

sudo apt install -y nikto

Use these tools only on systems you own or have written permission to test. A container does not change that rule.

Run Kali GUI tools from the host

Distrobox shares your display, so graphical Kali apps open as normal windows on your desktop. A Linux.org walkthrough ran GParted from an Arch container on an Ubuntu host and saw the host drives in the window.

sudo apt install -y wireshark
distrobox-export --app wireshark

The export command runs inside the container and adds a launcher to your host application menu. Pass -d and -a to remove the launcher later.

distrobox-export -d -a wireshark

For a terminal launcher that opens straight into Kali, run the next command on the host. A Qubes guide edits the generated desktop file to start xfce4-terminal inside the box.

distrobox generate-entry kali

Everyday Distrobox commands for Kali

These host commands cover most daily use:

distrobox list
distrobox enter kali -- nmap --version
distrobox stop kali
distrobox rm kali
distrobox ephemeral --image docker.io/kalilinux/kali-rolling:latest

list shows the containers Distrobox created
enter kali -- command runs one command and returns to your shell
stop and rm shut down and delete the container
ephemeral creates a temporary container and removes it when you exit the shell

Distrobox also reads manifest files through distrobox-assemble, which creates and destroys a set of boxes in batch. A manifest helps if you rebuild the same Kali setup often.

Create options worth adding for Kali

NVIDIA GPU access

Add --nvidia when the host has proprietary NVIDIA drivers and you want GPU tools such as hashcat inside the box. The flag needs a glibc based container and a fairly new distro, which Kali meets.

distrobox create --name kali-gpu --image docker.io/kalilinux/kali-rolling:latest --nvidia

A separate home folder

A custom home keeps Kali dotfiles out of your host home folder. The flag does not stop Distrobox from mounting your real home, but configs and temporary files land in the new path.

distrobox create --name kali --image docker.io/kalilinux/kali-rolling:latest --home ~/distrobox/kali

Systemd inside the box

Kali’s Docker docs say the image has no systemd. The --init flag starts a separate init system and the Distrobox docs show Debian images with a few extra packages. Treat this as a starting point for Kali and test it, since the docs list no Kali example.

distrobox create --name kali-init --image docker.io/kalilinux/kali-rolling:latest --init --additional-packages "systemd libpam-systemd pipewire-audio-client-libraries"

With --init host processes disappear from view inside the container, because the init system must run as PID 1.

Real root with the root flag

Use --root only when a tool truly needs real root. Inside a rootful container root can change system files outside it, so Distrobox forces a user password at first entry.

distrobox create --root --name kali-root --image docker.io/kalilinux/kali-rolling:latest

Security limits of Distrobox

Distrobox is not a sandbox. The project says isolation is not its main goal, and the container has full access to your home folder and attached drives. A Kali tool that deletes files can delete yours.

Reduce the exposure with --home for a separate home or --unshare-all, which shares only HOME, basic sockets and the host filesystem under /run/host. For stronger isolation the project README points to other tools such as Litterbox.

distrobox create --name kali-isolated --image docker.io/kalilinux/kali-rolling:latest --unshare-all

Manage Kali boxes with a GUI

BoxBuddy and DistroShelf are graphical front ends for Distrobox and both ship on Flathub. A Warriornux guide installs BoxBuddy with the first command below and a Qubes forum guide points to DistroShelf.

flatpak install flathub io.github.dvlv.boxbuddyrs
flatpak install flathub com.ranfdev.DistroShelf

Fix common Distrobox Kali errors

Permission denied on the Docker socket

A Linux.org reader hit a permission denied error from the Docker daemon socket while Distrobox pulled the Kali image. The user had no access to Docker. Add the user to the docker group and log in again or switch to Podman.

sudo usermod -aG docker $USER

Image not found

Use the full official name docker.io/kalilinux/kali-rolling:latest. A missing hyphen in kali-rolling caused the failure in the same Linux.org thread. Docker users can list matching images with the command below.

docker search kali

The container will not start after an update

Forum reports describe Kali and Mint boxes failing with a generic error after an update. Move to the latest 1.8.x release first. If entering still fails, recreate the box. Your home folder files stay but packages installed inside the container are lost.

distrobox rm kali
distrobox create --name kali --image docker.io/kalilinux/kali-rolling:latest

sudo fails inside a rootful box

A Qubes guide found that a rootful Kali box left the user outside the sudo group. Enter the container as root and add the user to the group. The guide’s NOPASSWD sudoers edit works but is looser than needed. Read how to give a Kali Linux user sudo access for the safer route.

sudo podman exec -it kali /bin/bash
usermod -aG sudo YOUR_USERNAME

Check the network from inside Kali

Distrobox shares the host network namespace unless you pass --unshare-netns. So the box sees the same addresses as your host. Follow the guide to find your IP address in Kali Linux if you need the interface details for a scan.

Remove the Kali container and Distrobox

Stop and remove the box first. Files in your home folder stay because the container shared it. Anything installed inside the container is gone.

distrobox stop kali
distrobox rm kali

Remove Distrobox with your package manager if you installed it that way. If you used the upstream script run the uninstall script and add the same prefix if you chose one.

sudo apt remove distrobox
curl -s https://raw.githubusercontent.com/89luca89/distrobox/main/uninstall | sudo sh
curl -s https://raw.githubusercontent.com/89luca89/distrobox/main/uninstall | sh -s -- --prefix ~/.local

Key takeaways

Distrobox runs Kali in a container that shares your home, display and network.
Install Podman or Docker first. Podman runs rootless by default.
Create the box from docker.io/kalilinux/kali-rolling:latest.
The image has no tools. Install kali-linux-headless first.
Use distrobox-export to add GUI apps to your host menu.
Add –nvidia for GPU tools and –home for a separate home folder.
Distrobox is not a sandbox. Use –unshare-all for more isolation.
Update with distrobox upgrade. Host updates skip the container.
Stable is 1.8.2.5. Distrobox 2 is still a release candidate.

Frequently asked questions

How do I install Kali Linux with Distrobox?

Install Distrobox and Podman then run distrobox create –name kali –image docker.io/kalilinux/kali-rolling:latest. Enter it with distrobox enter kali and install tools with apt.

Is Distrobox better than a virtual machine for Kali?

It starts faster and uses less memory because it shares the host kernel. A virtual machine isolates better and suits tools that need full hardware access.

Does Kali in Distrobox include any tools by default?

No. The official image is minimal. Run sudo apt update then sudo apt -y install kali-linux-headless or pick another Kali metapackage such as kali-linux-default for GUI apps.

Can I run Kali GUI apps with Distrobox?

Yes. The container shares your display so you install the app with apt and run it. Use distrobox-export –app to add a launcher to your host menu.

Is Distrobox safe for running Kali tools?

It is not a sandbox. The container can read your home folder and attached drives. Use –home or –unshare-all for more separation and rootless Podman to avoid root.

Which Distrobox version should I use in 2026?

Use the stable 1.8.2.5 release. Distrobox 2.0 is still a release candidate and the maintainers recommend v1 for production until v2 reaches feature parity.

How do I delete a Distrobox Kali container?

Run distrobox stop kali then distrobox rm kali. Your home folder files stay in place but packages installed inside the container are removed.