Skip to content
Get packs

Guide · Open source

How to use Vulhub: install Docker, launch and clean up

Updated · written with AI from the project's own documentation and checked against our catalogue data

Vulhub is an open-source collection of pre-built, deliberately vulnerable environments packaged as Docker Compose files. This guide shows you how to install the prerequisites, start an example environment with a single command, and shut it down cleanly when you are finished. It is written for people who are comfortable with a terminal but may be new to security testing labs.

Vulhubvulhub/vulhub · ★ 21.4k · MIT

Quick start

  1. 1Install Docker. Install Docker and start its service. The README gives an Ubuntu 24.04 example and links to Docker documentation for other systems.
  2. 2Clone Vulhub. Run git clone --depth 1 to download the repository with a shallow history.
  3. 3Enter an environment directory. Change into the vulnerability you want to practise, such as langflow/CVE-2025-3248.
  4. 4Start the environment. Run docker compose up -d to launch the environment in the background.
  5. 5Read the environment README. Open the README inside that directory for reproduction steps and usage.
  6. 6Clean up. Run docker compose down -v from the same directory when testing is finished.

What you need before you start

Vulhub depends on Docker. Every environment runs on Docker Compose, but you do not need to install docker-compose separately because the built-in docker compose command is used instead.

The README recommends a VPS or virtual machine with at least 1GB RAM for best results.

  • Docker with the docker compose command
  • At least 1GB RAM recommended
  • Permission for Docker to access the files in the current directory

Install Docker

The README gives this example for Ubuntu 24.04. It installs the latest Docker version and then starts the Docker service. For other operating systems, use the Docker documentation.

curl -s https://get.docker.com/ | sh systemctl start docker

Download Vulhub

Clone the repository with a shallow clone. The --depth 1 flag downloads only the latest commit history rather than the full history.

git clone --depth 1 https://github.com/vulhub/vulhub

Launch a vulnerable environment

Move into the directory for the vulnerability you want to practise, then start it in the background with docker compose up -d. The README uses the langflow CVE-2025-3248 directory as its example. Each environment directory contains its own README with reproduction steps and usage instructions, so read that file before you begin.

  • Pick a directory under vulhub, such as langflow/CVE-2025-3248
  • Run the start command from inside that directory
  • Open the environment's README for the reproduction steps
cd vulhub/langflow/CVE-2025-3248 docker compose up -d

Clean up after testing

When you finish, stop the environment and remove it with docker compose down -v, run from the same directory. Vulhub environments are disposable, so this keeps your machine tidy between exercises.

docker compose down -v

Fix common problems

Image pulls from Docker Hub may fail in mainland China; the README suggests a registry mirror or an overseas VPS. On Apple Silicon Macs, most environments run natively, but if one fails, the README suggests setting the platform explicitly. Some environments fail on Kali Linux because of a low ulimit nofile setting, and the FAQ on vulhub.org has the fix. Some environments may not support ARM architectures.

  • Image pull fails in mainland China: use a registry mirror or an overseas VPS
  • Apple Silicon failure: set the platform variable and start again
  • Kali Linux failure: check the low ulimit nofile setting in the FAQ
export DOCKER_DEFAULT_PLATFORM=linux/amd64 docker compose up -d

What people use it for

  • Security students reproducing a known vulnerability in a controlled target
  • Security researchers who need a quick, disposable vulnerable target
  • Instructors preparing demonstrations of web vulnerabilities

Frequently asked questions

Is Vulhub free to use?

Vulhub is licensed under the MIT License, as stated in the README. You can read the full terms in the LICENSE file in the repository.

What do I need to run Vulhub?

You need Docker with the docker compose command. The README also recommends at least 1GB RAM for best results and says a VPS or VM is a good option.

Do I need to install docker-compose separately?

No. The README says all environments run on Docker Compose, and you can use the built-in docker compose command instead of installing docker-compose separately.

Can I use Vulhub in production?

No. The README states that all environments are for testing and educational purposes only and must not be used in production.

Why does an environment fail to start on my Mac or Kali machine?

On Apple Silicon Macs, the README suggests setting DOCKER_DEFAULT_PLATFORM=linux/amd64 and trying again. On Kali Linux, some environments fail because of a low ulimit nofile setting, and the vulhub.org FAQ explains the fix.

How does Vulhub compare with DVWA or OWASP Juice Shop?

Vulhub focuses on reproducing specific known vulnerabilities in pre-built Docker environments, each started with a single command. Projects such as DVWA, OWASP Juice Shop, WebGoat and Vulnerable-Docker are alternatives to consider if you want a different style of lab, so compare them against what you need to practise.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Vulhub suits people who already run Docker and want quick, disposable vulnerable targets for learning, research or demonstrations. It is not a fit for production systems, for machines with very little memory, or for anyone who does not want to install Docker.

Install options & downloads