docker-compose.yml

# ============================================
# Docker Security Lab - Vulnerable Apps Setup
# Author: Mr. Taiwo Micheal (Appledev_T)
# Version: 6.0 (Secured & Optimized)
#
# SECURITY IMPROVEMENTS:
# - Environment variables moved to .env file
# - Database ports removed (use internal network)
# - Portainer bound to localhost only
# - Resource limits added to prevent system overload
# - Profiles added for selective service startup
# - Enhanced healthchecks with appropriate timeouts
#
# USAGE:
#   Start all services:        docker compose --profile all up -d
#   Web basics only:           docker compose --profile web-basics up -d
#   API security only:         docker compose --profile api-security up -d
#   Advanced training:         docker compose --profile advanced up -d
#   Management tools:          docker compose --profile management up -d
#
# Apps included:
#   - Juice Shop (OWASP) - Port 3000
#   - DVWA + MySQL - Port 8082
#   - WebGoat - Ports 8080, 9090
#   - Mutillidae II (standalone) - Port 8083
#   - VulnBank (custom) - Port 5000
#   - DVGA (GraphQL) - Port 5013
#   - WrongSecrets (OWASP) - Port 8084
#   - Pixi (API Security) - Port 8085
#   - DVRA (REST API) - Port 3001
#   - SSRF Vulnerable App - Port 8087
#   - Portainer (Docker UI) - Ports 9000, 9443 (localhost only)
#
# Network: All services on vuln_network bridge
# ============================================

services:
  # ========================================
  # WEB APPLICATION VULNERABILITIES
  # Profile: web-basics
  # ========================================

  # ------------------------
  # Juice Shop (OWASP)
  # Modern vulnerable web app covering OWASP Top 10
  # Use: XSS, SQLi, Broken Auth, etc.
  # ------------------------
  juice-shop:
    image: bkimminich/juice-shop
    container_name: juice-shop
    ports:
      - "3000:3000"
    restart: unless-stopped
    networks:
      - vuln_network
    profiles:
      - web-basics
      - all
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          memory: 512M
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:3000"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

  # ------------------------
  # DVWA Database (MySQL 5.7)
  # Note: No host port binding - access via vuln_network only
  # ------------------------
  dvwa-db:
    image: mysql:5.7
    container_name: dvwa-db
    environment:
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
      MYSQL_DATABASE: dvwa
      MYSQL_USER: dvwauser
      MYSQL_PASSWORD: ${DVWA_DB_PASSWORD}
    # Removed host port binding for security
    # If you need direct DB access from host, uncomment:
    # ports:
    #   - "127.0.0.1:3307:3306"
    restart: unless-stopped
    networks:
      - vuln_network
    profiles:
      - web-basics
      - all
    volumes:
      - dvwa-data:/var/lib/mysql
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 1G
        reservations:
          memory: 512M
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p${MYSQL_ROOT_PASSWORD}"]
      interval: 10s
      timeout: 5s
      retries: 5

  # ------------------------
  # DVWA (Damn Vulnerable Web App)
  # Classic vulnerable web application
  # Use: SQLi, XSS, CSRF, File Upload, Command Injection
  # ------------------------
  dvwa:
    image: vulnerables/web-dvwa
    container_name: dvwa
    environment:
      MYSQL_HOST: dvwa-db
      MYSQL_USER: dvwauser
      MYSQL_PASSWORD: ${DVWA_DB_PASSWORD}
      MYSQL_DATABASE: dvwa
    depends_on:
      dvwa-db:
        condition: service_healthy
    ports:
      - "8082:80"
    restart: unless-stopped
    networks:
      - vuln_network
    profiles:
      - web-basics
      - all
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          memory: 256M
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost/setup.php"]
      interval: 30s
      timeout: 10s
      retries: 3

  # ------------------------
  # Mutillidae II (NOWASP)
  # Standalone with embedded MySQL
  # Use: OWASP Top 10, OWASP Top 25
  # ------------------------
  mutillidae:
    image: citizenstig/nowasp
    container_name: mutillidae
    ports:
      - "8083:80"
    # Removed MySQL port binding for security
    # If you need direct DB access from host, uncomment:
    # - "127.0.0.1:3308:3306"
    restart: unless-stopped
    networks:
      - vuln_network
    profiles:
      - web-basics
      - all
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          memory: 256M
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

  # ========================================
  # ADVANCED WEB TRAINING
  # Profile: advanced
  # ========================================

  # ------------------------
  # WebGoat (OWASP)
  # Interactive security training platform
  # Use: Guided lessons on web vulnerabilities
  # ------------------------
  webgoat:
    image: webgoat/webgoat
    container_name: webgoat
    ports:
      - "8080:8080"
      - "9090:9090"
    environment:
      - WEBGOAT_PORT=8080
      - WEBWOLF_PORT=9090
    restart: unless-stopped
    networks:
      - vuln_network
    profiles:
      - advanced
      - all
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          memory: 512M
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/WebGoat"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 120s

  # ------------------------
  # WrongSecrets (OWASP)
  # Secrets management vulnerabilities
  # Use: Learn about secret detection and protection
  # ------------------------
  wrongsecrets:
    image: jeroenwillemsen/wrongsecrets:latest
    container_name: wrongsecrets
    ports:
      - "8084:8080"
    environment:
      - SPRING_PROFILES_ACTIVE=without-vault
    restart: unless-stopped
    networks:
      - vuln_network
    profiles:
      - advanced
      - all
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          memory: 256M
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8080"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

  # ========================================
  # API SECURITY TRAINING
  # Profile: api-security
  # ========================================

  # ------------------------
  # DVGA (Damn Vulnerable GraphQL Application)
  # GraphQL-specific vulnerabilities
  # Use: GraphQL injection, introspection, batching attacks
  # ------------------------
  dvga:
    image: dolevf/dvga
    container_name: dvga
    ports:
      - "5013:5013"
    environment:
      - WEB_HOST=0.0.0.0
      - WEB_PORT=5013
    restart: unless-stopped
    networks:
      - vuln_network
    profiles:
      - api-security
      - all
    deploy:
      resources:
        limits:
          cpus: '0.25'
          memory: 256M
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:5013"]
      interval: 30s
      timeout: 10s
      retries: 3

  # ------------------------
  # Pixi (API Security Platform)
  # Modern API vulnerabilities
  # Use: OWASP API Security Top 10
  # ------------------------
  pixi:
    image: deadrobots/pixi
    container_name: pixi
    ports:
      - "8085:8000"
    restart: unless-stopped
    networks:
      - vuln_network
    profiles:
      - api-security
      - all
    deploy:
      resources:
        limits:
          cpus: '0.25'
          memory: 256M
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8000"]
      interval: 30s
      timeout: 10s
      retries: 3

  # ------------------------
  # DVRA (Damn Vulnerable RESTaurant API)
  # REST API vulnerabilities
  # Use: API authentication, authorization, injection
  # ------------------------
  dvra:
    image: szym0nio/dvra
    container_name: dvra
    ports:
      - "3001:3000"
    restart: unless-stopped
    networks:
      - vuln_network
    profiles:
      - api-security
      - all
    deploy:
      resources:
        limits:
          cpus: '0.25'
          memory: 256M
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:3000"]
      interval: 30s
      timeout: 10s
      retries: 3

  # ------------------------
  # SSRF Vulnerable App
  # Server-Side Request Forgery practice
  # Use: SSRF exploitation and prevention
  # ------------------------
  ssrf-vulnerable:
    image: jnovikov/ssrf-vulnerable-app
    container_name: ssrf-vulnerable
    ports:
      - "8087:8080"
    restart: unless-stopped
    networks:
      - vuln_network
    profiles:
      - api-security
      - all
    deploy:
      resources:
        limits:
          cpus: '0.25'
          memory: 256M
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8080"]
      interval: 30s
      timeout: 10s
      retries: 3

  # ========================================
  # CUSTOM APPLICATIONS
  # Profile: web-basics
  # ========================================

  # ------------------------
  # VulnBank Database (PostgreSQL)
  # Note: No host port binding - access via vuln_network only
  # ------------------------
  vuln-bank-db:
    image: postgres:13
    container_name: vuln-bank-db
    environment:
      POSTGRES_DB: vulnerable_bank
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    # Removed host port binding for security
    # If you need direct DB access from host, uncomment:
    # ports:
    #   - "127.0.0.1:5432:5432"
    restart: unless-stopped
    networks:
      - vuln_network
    profiles:
      - web-basics
      - all
    volumes:
      - vuln-postgres-data:/var/lib/postgresql/data
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 1G
        reservations:
          memory: 512M
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5

  # ------------------------
  # VulnBank (Custom Flask App)
  # Custom vulnerable banking application
  # Use: Business logic flaws, authentication bypass
  # ------------------------
  vuln-bank:
    build: ./vuln-bank
    container_name: vuln-bank
    ports:
      - "5000:5000"
    environment:
      DB_NAME: vulnerable_bank
      DB_USER: postgres
      DB_PASSWORD: ${POSTGRES_PASSWORD}
      DB_HOST: vuln-bank-db
      DB_PORT: 5432
    depends_on:
      vuln-bank-db:
        condition: service_healthy
    volumes:
      - ./vuln-bank/static/uploads:/app/static/uploads
    restart: unless-stopped
    networks:
      - vuln_network
    profiles:
      - web-basics
      - all
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          memory: 256M
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:5000"]
      interval: 30s
      timeout: 10s
      retries: 3

  # ========================================
  # OPTIONAL: SQL INJECTION LABS
  # Uncomment both sqli-labs-db and sqli-labs to enable
  # Profile: advanced
  # ========================================

  # ------------------------
  # SQLi-labs Database (MySQL 5.7)
  # ------------------------
  # sqli-labs-db:
  #   image: mysql:5.7
  #   container_name: sqli-labs-db
  #   environment:
  #     MYSQL_ROOT_PASSWORD: ${SQLI_ROOT_PASSWORD}
  #     MYSQL_DATABASE: security
  #     MYSQL_USER: sqli
  #     MYSQL_PASSWORD: ${SQLI_DB_PASSWORD}
  #   # Removed host port binding for security
  #   restart: unless-stopped
  #   networks:
  #     - vuln_network
  #   profiles:
  #     - advanced
  #     - all
  #   volumes:
  #     - sqli-labs-data:/var/lib/mysql
  #   deploy:
  #     resources:
  #       limits:
  #         cpus: '0.5'
  #         memory: 1G
  #       reservations:
  #         memory: 512M
  #   healthcheck:
  #     test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p${SQLI_ROOT_PASSWORD}"]
  #     interval: 10s
  #     timeout: 5s
  #     retries: 5

  # ------------------------
  # SQLi-labs
  # Dedicated SQL Injection practice (75+ challenges)
  # ------------------------
  # sqli-labs:
  #   image: acgpiano/sqli-labs
  #   container_name: sqli-labs
  #   environment:
  #     MYSQL_HOST: sqli-labs-db
  #     MYSQL_USER: root
  #     MYSQL_PASSWORD: ${SQLI_ROOT_PASSWORD}
  #     MYSQL_DATABASE: security
  #   depends_on:
  #     sqli-labs-db:
  #       condition: service_healthy
  #   ports:
  #     - "8086:80"
  #   restart: unless-stopped
  #   networks:
  #     - vuln_network
  #   profiles:
  #     - advanced
  #     - all
  #   deploy:
  #     resources:
  #       limits:
  #         cpus: '0.5'
  #         memory: 512M
  #       reservations:
  #         memory: 256M
  #   healthcheck:
  #     test: ["CMD", "curl", "-f", "http://localhost/"]
  #     interval: 30s
  #     timeout: 10s
  #     retries: 3

  # ========================================
  # MANAGEMENT TOOLS
  # Profile: management
  # ========================================

  # ------------------------
  # Portainer (Docker Management UI)
  # SECURITY: Bound to localhost only!
  # Access via: http://localhost:9000
  # Or use SSH tunnel: ssh -L 9000:localhost:9000 user@server
  # ------------------------
  portainer:
    image: portainer/portainer-ce:latest
    container_name: portainer
    ports:
      - "127.0.0.1:9000:9000"   # HTTP - localhost only
      - "127.0.0.1:9443:9443"   # HTTPS - localhost only
      - "127.0.0.1:8000:8000"   # Edge agent - localhost only
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer-data:/data
    restart: unless-stopped
    networks:
      - vuln_network
    profiles:
      - management
      - all
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:9000"]
      interval: 30s
      timeout: 10s
      retries: 3

# ================================
# Networks
# ================================
networks:
  vuln_network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16
    driver_opts:
      com.docker.network.bridge.name: vuln_br0

# ================================
# Volumes (Persistent Storage)
# ================================
volumes:
  portainer-data:
    driver: local
  dvwa-data:
    driver: local
  vuln-postgres-data:
    driver: local
  sqli-labs-data:
    driver: local