How to Build a Legal Home Lab

#What makes a lab legal

A home lab is legal when every system you attack is yours, or belongs to someone who gave you written permission. Everything below follows from that one rule. Your own laptop, a virtual machine you created and a container you started are in scope. Your neighbor's Wi-Fi, your school network and "that site that looks vulnerable" are not, even when the test is harmless.

Write the rule down before you install anything. Authorization is easy to blur once a tool is running and a target looks interesting.

#What you need

• A computer you own or administer.
• Docker Engine or Docker Desktop, from the Docker documentation.
• A text editor and a terminal.

The commands below ran on Windows with Docker 29.8.2. Other versions may print slightly different text.

#Step 1: create the folder and the scope file

Keep the lab in one folder so you can find it and delete it later:

mkdir -p lab/notes
cd lab

Create scope.md in that folder with the targets you allow yourself:

# Scope

Allowed targets:
- 127.0.0.1 (containers I started, ports bound to loopback)

Not allowed:
- Anything else, until I have written permission from its owner.

It looks trivial. It still stops you from pointing a scanner at an address you never meant to test.

#Step 2: check that Docker works

docker --version

Docker version 29.8.2, build 7fc2dff

If the command fails, install Docker first. If docker info says it cannot reach the daemon, start Docker Desktop or the Docker service and try again.

#Step 3: publish ports on loopback only

Containers are the easiest way to run vulnerable software without installing it on your system. The risk is the port mapping. Docker's port publishing documentation says that a -p mapping without an address makes the port available outside the host. A deliberately vulnerable app does not belong there.

Name the loopback address in the mapping. This example uses a plain web server image as a stand-in for a lab target:

docker run -d --rm --name lab-check -p 127.0.0.1:18080:80 caddy:2
docker port lab-check

80/tcp -> 127.0.0.1:18080

127.0.0.1:18080 means only your own machine can reach the port. Compare it with a mapping that has no address:

docker stop lab-check
docker run -d --rm --name lab-check -p 18081:80 caddy:2
docker port lab-check

lab-check
80/tcp -> 0.0.0.0:18081
80/tcp -> [::]:18081

Here Docker listens on 0.0.0.0 and [::], which are all interfaces. Whether other devices can actually reach it depends on your firewall and network, so do not rely on that. Put 127.0.0.1 in every lab command and check with docker port each time.

#Step 4: cut off the network when you can

Some exercises need no network at all, such as reading a suspicious script or running a parser on a file. Docker's none network driver gives the container no network except loopback:

docker run --rm --network none alpine:3.22 ip -o link | cut -d' ' -f2

lo:

Only the loopback interface (lo) exists. Use --network none for anything you do not want talking to the outside, and treat a downloaded sample as hostile until you have read it.

#Step 5: keep a lab notebook

Create one file per session in notes/. Write the date, the target, what you tried and what happened, in that order, while you work:

## 2026-01-15 14:20, first run
- Target: juice-shop-lab, http://127.0.0.1:3000
- Goal: see what a failed login returns
- Command: curl -i http://127.0.0.1:3000/rest/user/login
- Result: (paste what you saw, not what you expected)
- Next: ...

The notebook has two jobs. It shows you what you did when a result surprises you, and it is the habit a real report starts from. Record the command you ran and the output you got. Do not paste output from a guide.

#Step 6: tear it down

Stop what you started, then check that nothing is left:

docker stop lab-check
docker ps -a --filter name=lab-check --format '{{.Names}}'

lab-check

docker stop prints the container name. Because the container was started with --rm, Docker removes it after it stops, so the second command prints nothing. If you want the image gone as well, remove it with docker image rm. Delete the lab folder only when you no longer need the notes.

A lab you can rebuild in a few minutes is better than one you are afraid to touch.

#Next step

You now have a scoped folder, a loopback habit and a way to stop. The next article, Run OWASP Juice Shop with Docker, uses this setup to start an intentionally vulnerable web application. Read the OWASP Juice Shop project page first so you know what you are running.

#Sources

• Docker: Get started
• Docker: Port publishing and mapping
• Docker: None network driver
• Docker CLI reference: docker container run
• OWASP Juice Shop project