The Container Lab

$ cd ~
$ git config --global core.autocrlf input
$ git clone https://github.com/toniall/darkweblabs.git
$ cd darkweblabs && ls

$ docker version --format '{{.Server.Version}}'
$ docker compose version --short
$ uname -m

$ cd ~/darkweblabs
$ git pull

$ cd ~
$ git clone https://github.com/toniall/darkweblabs.git
$ cd darkweblabs

$ ls -R . | head -20

$ chmod +x lab labs/checks/*.sh
$ ls -l lab | cut -c1-11

$ ./lab selftest

$ ./lab doctor

$ ./lab up base
$ ./lab stop base     # stop — containers kept; ./lab up base resumes them
$ ./lab down base     # delete — removes containers (the evidence volume is always kept)

$ docker compose ps

$ ./lab open

# or browse to http://127.0.0.1:6901 yourself
# the password is generated at first run:
$ ./lab creds

$ ./lab creds

$ curl -s https://check.torproject.org/api/ip
$ curl -s https://icanhazip.com

# what stacks exist
$ ./lab list

# stop everything; volumes and images are kept
$ ./lab down

# start again — seconds this time, nothing rebuilds
$ ./lab up base

$ docker network ls --filter name=darkweb

$ TPL='{{range $k,$v := .NetworkSettings.Networks}}'
$ TPL="$TPL"'{{$k}} {{$v.IPAddress}}{{"\n"}}{{end}}'

$ for c in darkweb-gateway darkweb-workstation darkweb-portal; do
    echo "== $c"
    docker inspect "$c" --format "$TPL"
  done

$ docker network inspect darkweb_internal --format \
    '{{.Name}} internal={{.Internal}}
     subnet={{range .IPAM.Config}}{{.Subnet}}{{end}}'

# the portal is on the internal network only — it should not reach the internet
$ docker exec darkweb-portal sh -c \
    'timeout 5 curl -sS -o /dev/null -w "%{http_code}\n" http://1.1.1.1'
$ echo "exit=$?"

$ docker exec darkweb-gateway     ip -brief addr
$ docker exec darkweb-workstation ip -brief addr

$ docker exec darkweb-gateway     readlink /proc/self/ns/net
$ docker exec darkweb-workstation readlink /proc/self/ns/net
$ docker exec darkweb-portal      readlink /proc/self/ns/net

  workstation:
    image: darkweb-lab-workstation:4.11
    networks:
      internal:      # 10.152.152.11 — the torified path
      deskaccess:    # 10.152.153.11 — desktop port only
    # start-up points the default route at the gateway and
    # locks the desktop-access interface to inbound only

$ docker exec darkweb-workstation ip route

# open a terminal on the lab desktop, then try a torified path and a raw one:
$ curl --socks5-hostname 10.152.152.10:9050 -s https://check.torproject.org/api/ip
$ ping -c1 -W3 1.1.1.1

$ docker volume ls --filter name=darkweb

# leave a marker in evidence, and a marker in scratch
$ docker exec darkweb-workstation \
    sh -c 'echo "collected 2026-07-26" > /evidence/marker.txt'
$ docker exec darkweb-workstation sh -c 'echo "scratch" > ~/scratch.txt'

# now break the desktop session on purpose
$ docker exec darkweb-workstation sh -c 'rm -rf ~/.config/xfce4'

$ ./lab reset base

# the wrapper is careful about which volumes it removes:
#   compose down, remove only *_scratch volumes, compose up

$ docker exec darkweb-workstation cat /evidence/marker.txt
$ docker exec darkweb-workstation cat ~/scratch.txt

$ docker image ls --filter reference='darkweb-lab-*' \
    --format 'table {{.Repository}}\t{{.Tag}}\t{{.ID}}\t{{.Size}}'

# build the counterexample from the Dockerfile in the repo, then read it back
$ docker build -q -t darkweb-lab-workstation:1.0-vulnerable images/vulnerable
$ docker history --no-trunc --format '{{.CreatedBy}}' \
    darkweb-lab-workstation:1.0-vulnerable | head -30

$ docker inspect -f '{{json .Config.Env}}' \
    darkweb-lab-workstation:4.11 | tr ',' '\n'

$ docker inspect -f 'user={{.Config.User}}' \
    darkweb-lab-workstation:4.11