Velociraptor Docker Image

Unofficial Docker image for Velociraptor by Velocidex.

What is Velociraptor?

Velociraptor is an advanced digital forensic and incident response tool that enhances your visibility into your endpoints.

Visit velociraptor official docs for more information.

How to use this image

Quickstart

Run the container in detached mode with the default configuration.
This exposes the following ports:

• 8889 – GUI (Web UI)
• 8000 – Client (Agent)
• 8001 – API

docker run -d --name velociraptor \
  -p 8000:8000 \
  -p 8001:8001 \
  -p 8889:8889 \
  zharfanug/velociraptor:latest

Environment

The image sets the following defaults:

Variable	Default	Purpose
VELO_CERT	auto-generated self-signed	Path to the TLS certificate used by the server. If omitted, a self-signed certificate is generated.
VELO_CERT_KEY	auto-generated key	Path to the TLS private key corresponding to VELO_CERT.
VELO_CA	-	Path to a Certificate Authority (CA) bundle file. Used for clients to trust the server certificate.
VELO_CLIENT_FQDN	https://localhost:8000/	Public URL advertised to clients.
VELO_GUI_FQDN	https://localhost:8889/	Public URL for the Velociraptor web UI.
VELO_USER	admin	Initial administrator username for the web UI.
VELO_PASSWORD	admin	Initial administrator password. Change immediately in production.