Exegol Workstation overview
Exegol Workstation is the offensive lab in Docker: a clean box per engagement, on the OS you already use. It is not another Linux distro. It is a maintained environment that Studio, MCP, and Sentinel plug into.
- What it is: curated images, a wrapper that turns them into containers, and offline resources shared into every box.
- Why that is better: you stop babysitting a distro. Start a container for the job, throw it away when done.
- What you get: tools already in, tunnel in the box, workspace on the host, then optional Studio, MCP, or Sentinel on the same workstation.
Community covers personal use, learning, and CTFs. Commercial or employer-sponsored work needs a paid plan. See pricing and the legal overview.
Install is the next page if you are setting up a machine.
Not another distro
Kali, ParrotSec, BlackArch and similar tools are distributions: a whole OS plus a toolbox you still set up and keep alive. Exegol Workstation is the opposite model.
| Distro approach | Workstation approach |
|---|---|
| Install or virtualize a full OS | Stay on the OS you already run |
| Maintain tools and dependencies yourself | Pull a versioned image |
| The environment ages with the machine | One container per engagement, then discard it |
Internal labs, USB, and Wi-Fi work best on Linux. Windows and macOS run through Docker (on Mac, OrbStack over Docker Desktop). Treat them as fine for web/OSINT and more constrained for full internal labs. See Install.
How the pieces fit
You talk to the wrapper. The wrapper talks to Docker.
- An image is an immutable template (the toolkit at a given version).
- A container is a running environment created from that image at a moment in time.
- Updating the image does not change containers already created from an older one. A new container is required to pick up the update.
Every container can mount offline resources at /opt/resources, your my-resources customisations, and the history and credentials helpers that ship in the image.
Components
| Component | Role |
|---|---|
| Images | Pre-built Docker templates specialised by use |
| Wrapper | CLI that creates and manages containers |
| Resources | Offline scripts and binaries mounted into containers |
| In the image | History, credentials, services, and your my-resources layer |
| Help | FAQ, troubleshooting, tips |
Images
An Exegol image is a pre-built Docker template: tools installed, versioned together, started through the wrapper.
- Community: the
freeimage (full toolkit, delayed relative tofull). - Pro / Team / Enterprise:
full,ad,web,light,osint,nightly, and optional private images.
The tools list is generated per image and version. Local builds use exegol build.
Wrapper
The wrapper is the command-line interface. It creates and manages containers the way a VM manager manages VMs: start, stop, update, desktop, VPN, workspace.
You do not write docker run flags for the setups Exegol already knows. Features include desktop, X11, VPN, shell logging, network modes, and container profiles ProTeamEnterprise.
| Page | What it covers |
|---|---|
| Wrapper overview | Features and how containers are shaped |
| Command-line | Per-action reference (start, info, update, …) |
| User config | Persistent defaults in ~/.exegol/config.yml |
| Container profiles | Named container-shape defaults applied at creation |
Resources
Exegol resources are offline scripts and binaries (LinPEAS, Sysinternals, and the rest) that would otherwise be re-downloaded every engagement. The wrapper manages them and shares them with containers by default at /opt/resources.
In the image
These live inside the image (or your host-side customisation volume), not as separate Workstation products:
| Piece | What it is |
|---|---|
| My resources | Host volume for your tools and setup scripts, applied at container creation |
| Exegol history | Credential/host store (exh) wired into the pre-filled command history |
| Credentials | Helpers for credentials obtained during an engagement |
| Services | Services that ship with the image |
Help
Workstation-specific Q&A and fixes:
| Page | When to use it |
|---|---|
| FAQ | “Can I…?” short answers |
| Troubleshooting | Symptom → fix |
| Tips & tricks | Shortcuts inside a running container |
What plugs into Workstation
Workstation is the hub. The other products sit on the same lab:
- Studio New!: the hacker's IDE. Hacking cockpit for VS Code and compatible forks that drives your Exegol containers.
- Sentinel EnterpriseAdd-on: structured command audit on the host for a person or a SIEM.
- MCP: let an LLM use Exegol without living on the host.
- Dashboard: account, plan, licenses, organizations.
Images and containers
- Image: immutable template. You cannot open a shell in an image.
- Container: running environment created from an image at a given time. Updating the image does not change existing containers.
Typical flow after Install:
exegol install full
exegol start eng-acme full