Run IDA Pro inside a Docker container with a full XFCE desktop, accessible entirely from your web browser via KasmVNC.

No local GUI installation, no X11 forwarding, no VNC client — just a browser.

Default Credentials

Field	Value
VNC Username	kasm_user
VNC Password	changeme (change before exposing to any network)

⚠️ Security: Always override VNC_PASSWORD via environment variable before running the container on a network you do not fully control.

• IDA Pro installed and ready on /opt/ida-pro/ida
• Full XFCE desktop in your browser with desktop icons, file manager, terminal
• Persistent workspace (~/workspace) mounted from the host
• Runtime license mount — your ida.hexlic is never baked into the image
• ida-pro-mcp MCP server auto-started on container port 8745
• One-command build and run on any Linux x86_64 machine with Docker

┌─────────────────────────────────┐
│  Your Linux x86_64 host         │
│  - Docker daemon                │
│  - IDA installer (.run)         │
│  - ida.hexlic (optional)        │
└─────────────────────────────────┘
              │ docker build / run
              ▼
┌─────────────────────────────────┐
│  Docker: ida-vnc:9.4          │
│  ┌──────────────────────────┐   │
│  │ KasmVNC (:6901)          │   │
│  │   ▼                      │   │
│  │ XFCE Desktop             │   │
│  │   ▼                      │   │
│  │ IDA Pro 9.4              │   │
│  └──────────────────────────┘   │
│  - license (bind mount, ro)       │
│  - workspace (bind mount)         │
│  - ida-pro-mcp (:8745)            │
└─────────────────────────────────┘
              │
              ▼
        https://localhost:8443

• Linux x86_64 host with Docker Engine installed and running
• IDA Pro installer — the official x86_64 Linux .run file (e.g. ida-pro_94_x64linux.run)
• IDA license (ida.hexlic) — optional but recommended
• A modern web browser

git clone https://github.com/<your-username>/ida-vnc.git
cd ida-vnc

Place your IDA Pro installer in the downloads/ directory (gitignored):

cp /path/to/ida-pro_94_x64linux.run downloads/

Why not commit the installer? The .run file is ~600 MB and is licensed software. downloads/*.run is already gitignored so it never enters the repo.

docker build -t ida-vnc:9.4 .

mkdir -p ~/IDA-workspace

docker run -d \
  --name ida-vnc \
  -p 8443:6901 \
  -p 8745:8745 \
  -e VNC_PW=changeme \
  -v ~/IDA-workspace:/home/kasm-user/workspace \
  -v ~/ida.hexlic:/home/kasm-user/.idapro/ida.hexlic:ro \
  ida-vnc:9.4

No license file yet? Omit the -v ~/ida.hexlic:... line. IDA will start in evaluation mode and the container will print a friendly reminder.

https://localhost:8443

• Accept the self-signed certificate warning.
• Enter the VNC username: kasm_user
• Enter the VNC password: changeme (or whatever you set via -e VNC_PW=)
• You should see the XFCE desktop. Double-click the IDA Pro 9.4 icon on the desktop, or open it from the Applications menu.

# Stop and remove the container
docker stop ida-vnc && docker rm ida-vnc

# Remove the image
docker rmi ida-vnc:9.4

# Deep cleanup
docker system prune -f

You can also build and publish the image entirely on GitHub Actions — no local Linux machine needed. This is useful if you develop on macOS, Windows, or just want a reproducible CI build.

Click Fork on the GitHub repository page to create a copy under your own account.

GitHub Actions needs to download your legally obtained IDA Pro Linux installer (.run file). Options:

• A private S3 bucket with a pre-signed URL
• A private file server that supports HTTP basic auth
• A GitHub Release asset on a private repository
• Any HTTPS URL that curl can fetch

⚠️ Do not commit the installer. The workflow downloads it at build time from the URL you provide.

Go to your fork:

Settings → Secrets and variables → Actions → New repository secret

Create a secret named IDA_DOWNLOAD_URL with the full HTTPS URL to your installer, e.g.:

https://your-private-server.example.com/ida-pro_94_x64linux.run

If your URL requires authentication headers (e.g. Authorization: Bearer ...), create another secret named IDA_DOWNLOAD_HEADERS with newline-separated headers:

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

1. Go to Actions → Build IDA-VNC Docker Image
2. Click Run workflow
3. Keep the default tag latest and click Run workflow

The workflow will download the installer from your secret URL, build the Docker image on GitHub's x86_64 runner, and push it to GitHub Container Registry.

The resulting image will be available at:

ghcr.io/<your-username>/ida-vnc:latest

On any Linux x86_64 host with Docker:

# Log in to GHCR (only needed once per session)
echo $GITHUB_TOKEN | docker login ghcr.io -u <your-username> --password-stdin

# Pull and run
docker run -d \
  --name ida-vnc \
  -p 8443:6901 \
  -p 8745:8745 \
  -e VNC_PW=changeme \
  -v ~/IDA-workspace:/home/kasm-user/workspace \
  -v ~/ida.hexlic:/home/kasm-user/.idapro/ida.hexlic:ro \
  ghcr.io/<your-username>/ida-vnc:latest

Note: Private GHCR images require authentication. For a fully public image, make sure your package visibility is set to public after the first push: https://github.com/users/<you>/packages/container/ida-vnc/settings

If you prefer Compose over raw docker commands:

# Copy the example env and edit
export HOST_PORT=8443
export VNC_PASSWORD=changeme
export WORKSPACE_HOST_PATH=$HOME/IDA-workspace
export IDA_HEXLIC_HOST_PATH=$HOME/ida.hexlic

docker compose up -d

Or create a .env file with those variables and simply run:

docker compose up -d

A Makefile is provided as a convenience wrapper around docker commands.

make build    # docker build -t ida-vnc:9.4 .
make run      # docker run with standard mounts
make stop     # docker stop + rm
make restart  # stop + run
make shell    # docker exec -it ida-vnc bash
make logs     # docker logs -f ida-vnc
make clean    # docker rmi ida-vnc:9.4
make prune    # deep cleanup
make help     # show all targets

You can override defaults via environment variables or a .env file:

export VNC_PASSWORD=MySecurePassword
export HOST_PORT=8443
export IDA_HEXLIC_HOST_PATH=$HOME/ida.hexlic
export WORKSPACE_HOST_PATH=$HOME/IDA-workspace
make run

The image ships with ida-pro-mcp pre-installed. On container startup, the MCP server is started automatically:

uv run --no-project --python python3.11 idalib-mcp --host 127.0.0.1 --port 8745

• Container endpoint: http://127.0.0.1:8745/mcp
• Default host port mapping: 8745:8745
• Log file: /tmp/idalib-mcp.log

By default the server binds to 127.0.0.1 inside the container (accessible from other processes running in the same container). If you want to expose it to the Docker host, set MCP_HOST=0.0.0.0 when starting the container:

docker run -d \
  --name ida-vnc \
  -p 8443:6901 \
  -p 8745:8745 \
  -e VNC_PW=changeme \
  -e MCP_HOST=0.0.0.0 \
  -v ~/IDA-workspace:/home/kasm-user/workspace \
  -v ~/ida.hexlic:/home/kasm-user/.idapro/ida.hexlic:ro \
  ida-vnc:9.4

With Makefile or Docker Compose, override the default host port via MCP_PORT:

export MCP_PORT=8745
make run

ida-vnc/
├── .env.example              # Environment template (copy to .env)
├── .github/
│   └── workflows/
│       └── build.yml         # GitHub Actions CI workflow
├── .gitignore
├── Dockerfile                # Image definition (Kasm base + IDA + Qt deps)
├── Makefile                  # Convenience wrapper for local docker commands
├── docker-compose.yml        # Alternative: run with Docker Compose
├── README.md                 # This file
├── assets/
│   └── screenshot.png        # XFCE desktop + IDA Pro screenshot
├── resources/
│   ├── custom_startup.sh     # License check + workspace init hook
│   └── ida-pro.desktop       # XFCE desktop icon + menu entry
└── docs/
    └── BUILD.md              # Detailed build guide & troubleshooting

Option A — Pre-mount: Place files in the directory you mount as /home/kasm-user/workspace (e.g. ~/IDA-workspace). They appear inside the container automatically.

Option B — After startup: Use the KasmVNC sidebar (left edge of browser) → Files → Upload.

Option C — Docker cp:

docker cp ./sample.bin ida-vnc:/home/kasm-user/workspace/

Check the logs:

docker logs ida-vnc

Common causes:

• Port conflict: 8443 is already in use. Change the host port: -p 8444:6901 and access https://localhost:8444.
• License mount is a directory: If ~/ida.hexlic does not exist on the host, Docker creates it as a directory. Delete the directory and ensure the file exists.

The Dockerfile already installs all required Qt6 XCB libraries (libxcb-cursor0, libxcb-icccm4, etc.). If you see similar errors, open an issue with the full error message — IDA may have added new Qt dependencies.

• Container is not running: docker ps
• Wrong port: verify docker ps shows the correct host port mapping
• Firewall blocking the port

Verify the mount is a file, not a directory:

docker exec ida-vnc bash -c "file ~/.idapro/ida.hexlic"
# Should say: data
# If it says: directory → delete the host directory and put a real file there

• License file is never baked into the image. It is mounted read-only at runtime.
• VNC password defaults to changeme. Always override it via -e VNC_PW= or VNC_PASSWORD in .env before exposing the port.
• Self-signed certificate: KasmVNC uses a built-in self-signed certificate. Accept the browser warning for local use, or mount a real certificate pair if you need public access.

This project is licensed under the MIT License. See LICENSE for details.

Note: This repository is a Docker packaging layer. It does not include IDA Pro or its license. You must provide your own legally obtained IDA Pro installer and license file (ida.hexlic).

KasmVNC and the Kasm Core image are trademarks of Kasm Technologies, Inc.