I wanted a reproducible container: a Kali base, a focused set of web-pentest tools, and a Python service on top. Simple, in theory. In practice I hit three walls that turn a 20-minute Dockerfile into an afternoon. All three are on Apple Silicon (arm64), and all three are avoidable once you know them.

This is the writeup I wanted while fighting it. Examples use a Kali base image and an open-source MCP tool server, but the lessons apply to any Python-on-Kali build.

Wall 1: Kali ships Python 3.14, and the wheels aren't there yet

The naive Dockerfile:

FROM kalilinux/kali-rolling RUN apt-get update && apt-get install -y python3 python3-venv python3-pip RUN python3 -m venv /opt/venv && /opt/venv/bin/pip install -r requirements.txt

Enter fullscreen mode

Exit fullscreen mode

…dies on the pip step with something like:

error: [Errno 2] No such file or directory: 'aarch64-linux-gnu-gcc' ERROR: Failed building wheel for cffi ERROR: Failed to build 'zstandard' ...

Enter fullscreen mode

Exit fullscreen mode

Two…