~/projects/docker-builds

docker-builds

Multi-arch container images for security tooling. Native amd64 + arm64 builds, signed provenance, Trivy scan on every publish.

ver caddy-v2.11.4 lang Python · GitHub Actions lic Apache-2.0 linux/amd64linux/arm64

Source Download

quickstart — zsh

docker pull ghcr.io/matusso/wafw00f:latest

docker run --rm ghcr.io/matusso/wafw00f https://example.com

same tag on an M-series Mac and an x86_64 server

gh attestation verify oci://ghcr.io/matusso/wafw00f:latest --owner matusso

Plenty of good security tools ship no container image, an amd64-only image, or one that has gone stale. docker-builds fills that gap. It rebuilds them on a pinned schedule for linux/amd64 and linux/arm64 and publishes them to ghcr.io/matusso/<image>.

Native, no QEMUamd64 builds on ubuntu-latest, arm64 on ubuntu-24.04-arm. Nothing runs under emulation.

Smoke tested per archEach image runs its entrypoint before the manifest is published. A broken arm64 build never reaches latest.

Signed provenanceEvery manifest carries a build attestation tied to the exact workflow run and commit.

Scanned on publishTrivy results go to GitHub code scanning on every push.

Non-rootImages built here run as uid/gid 10001 and work in /work.

Pinned + DependabotUpstream versions are pinned. Base images and actions are bumped weekly.

Image catalogue

Image	Version	Upstream	Pull
`binwalk`	`v3.1.0`	ReFirmLabs/binwalk	`ghcr.io/matusso/binwalk`
`dirsearch`	`v0.5.0`	maurosoria/dirsearch	`ghcr.io/matusso/dirsearch`
`ghauri`	`1.4.3`	r0oth3x49/ghauri	`ghcr.io/matusso/ghauri`
`kiterunner`	`v1.0.2`	assetnote/kiterunner	`ghcr.io/matusso/kiterunner`
`masscan`	`1.3.2`	robertdavidgraham/masscan	`ghcr.io/matusso/masscan`
`metasploit-framework`	`6.5.5`	rapid7/metasploit-framework	`ghcr.io/matusso/metasploit-framework`
`mvt`	`v2026.9.7`	mvt-project/mvt	`ghcr.io/matusso/mvt`
`pocketbase`	`v0.40.4`	pocketbase/pocketbase	`ghcr.io/matusso/pocketbase`
`raptor`	`sha-<commit>`	gadievron/raptor	`ghcr.io/matusso/raptor`
`routersploit`	`v3.4.7`	threat9/routersploit	`ghcr.io/matusso/routersploit`
`wafw00f`	`v2.4.2`	EnableSecurity/wafw00f	`ghcr.io/matusso/wafw00f`

Versions as of the last update of this page. The repository README is always current.

Install

There is nothing to install apart from Docker (or Podman). Pull an image and run it:

# Fingerprint a WAF
docker run --rm ghcr.io/matusso/wafw00f:v2.4.2 https://example.com

# Brute-force web paths
docker run --rm ghcr.io/matusso/dirsearch:v0.5.0 -u https://example.com

# Analyse firmware in the current directory
docker run --rm -v "$PWD:/work" ghcr.io/matusso/binwalk:latest /work/firmware.bin

# masscan needs a real network
docker run --rm --network host ghcr.io/matusso/masscan:latest -p80,443 192.0.2.0/24 --rate 1000

# PocketBase with persistent data
docker run --rm -p 8080:8080 -v pb_data:/pb/pb_data ghcr.io/matusso/pocketbase:latest

No formulas here, the images are the product. If you don’t have a container runtime on your Mac yet:

brew install --cask docker     # Docker Desktop
# or a lightweight alternative
brew install colima docker && colima start

Then docker run ghcr.io/matusso/<image> works the same on Apple Silicon and Intel.

Resolve the digest once and use it everywhere:

docker buildx imagetools inspect ghcr.io/matusso/wafw00f:v2.4.2 --format '{{.Manifest.Digest}}'
docker run --rm ghcr.io/matusso/wafw00f@sha256:<digest> --help

Bind mounts and the non-root user

Images built here run as uid 10001, so writes to a host directory need matching ownership:

docker run --rm --user "$(id -u):$(id -g)" -v "$PWD:/work" ghcr.io/matusso/ghauri:latest ...

Downloads: custom Caddy

Not an image but a release: Caddy v2.11.4 with the caddy-dns/cloudflare module compiled in.

LNX Linux · amd64caddy-linux-amd64-v2.11.4.tar.gz LNX Linux · arm64caddy-linux-arm64-v2.11.4.tar.gz LNX Linux · armv7caddy-linux-armv7-v2.11.4.tar.gz

release caddy-v2.11.4 · verify with SHA256SUMS · all releases →

gh release download caddy-v2.11.4 --repo matusso/docker-builds --pattern '*linux-amd64*'
sha256sum -c SHA256SUMS --ignore-missing

These images package penetration testing and forensics tools. Use them only against systems you are authorised to test. Each image keeps its upstream licence (some are AGPL/GPL); check the org.opencontainers.image.licenses label before redistributing.