Post cover image

July 23, 2026

Getting Started with Docker for Application Security: Deploying OWASP crAPI

Learn how to deploy a deliberately vulnerable API using Docker and begin your API Security journey.

By Gabriel Odusanya

4 min read

Introduction

One of the biggest challenges beginners face when learning Application Security or API hacking is finding a safe environment to practice. Testing against live applications without permission is illegal, while simple demo applications often fail to reflect how modern software is built.

This is where Docker and OWASP crAPI become invaluable.

Docker allows you to deploy complex applications within minutes, while OWASP crAPI provides a realistic, intentionally vulnerable application that mirrors the APIs and microservices used by many organizations today. Together, they create the perfect environment for learning API Security, Application Security, and secure software testing.

In this guide, we'll install Docker, deploy crAPI, understand its architecture, and prepare our lab for future API security assessments.

Why Docker Matters in Application Security

Modern applications no longer run as a single program on one server. Most organizations build applications using multiple services that communicate through APIs. A single application might consist of a frontend, authentication service, API gateway, database, messaging service, and several backend microservices — all running independently.

Managing all of these manually would be difficult. Docker solves this problem by packaging each service into its own container, allowing developers and security engineers to deploy the entire environment with just a few commands.

For an Application Security Engineer, Docker is more than a deployment tool. It provides a repeatable and isolated environment where applications can be tested safely without affecting your operating system. This makes it an essential skill for anyone working in AppSec, penetration testing, or DevSecOps.

What is OWASP crAPI?

OWASP crAPI (Completely Ridiculous API) is an intentionally vulnerable application created by the OWASP Foundation to help security professionals learn API security through hands-on practice.

Unlike many beginner labs, crAPI is built using a modern microservice architecture. It includes user authentication, REST APIs, databases, file uploads, shopping functionality, vehicle management, and numerous backend services that communicate with one another.

Because it resembles how production applications are designed, crAPI provides an excellent environment for understanding both Application Security and API Security.

Installing Docker

The first step is installing Docker Engine on Ubuntu.

Update your package list:

sudo apt update

Install Docker and its required components:

sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

Once the installation finishes, verify Docker is available:

docker --version

You should see something similar to:

Docker version 29.x.x

To ensure Docker is working correctly, run the official test container:

docker run hello-world

If Docker successfully downloads the image and displays the "Hello from Docker!" message, your installation is complete.

(Insert your Docker installation screenshot here.)

Downloading OWASP crAPI

With Docker installed, the next step is downloading the crAPI project from GitHub.

Download the latest version:

curl -L -o /tmp/crapi.zip https://github.com/OWASP/crAPI/archive/refs/heads/develop.zip

Extract the archive:

unzip /tmp/crapi.zip

Navigate to the Docker deployment directory:

cd crAPI-develop/deploy/docker

This directory contains the Docker Compose configuration responsible for deploying the entire application.

Deploying the Application

Before starting the application, Docker needs to download all the required container images.

Run:

docker compose pull

During this process, Docker downloads several images, including:

  • PostgreSQL
  • MongoDB
  • Mailhog
  • API Gateway
  • Identity Service
  • Workshop Service
  • Community Service
  • Web Frontend
  • Chatbot

Each of these represents a different component of the application. Together, they simulate the architecture commonly found in enterprise software.

Starting crAPI

Once the images have been downloaded, start the application:

docker compose --compatibility up -d

Docker will automatically:

  • Create an isolated network for the application.
  • Create persistent storage volumes.
  • Start the databases.
  • Launch each backend service.
  • Start the frontend interface.
  • Connect every service together.

You can verify everything is running with:

docker ps

Healthy containers indicate that the deployment was successful.

(Insert your Docker Compose output screenshot.)

Accessing the Application

Open your browser and visit:

http://localhost:8888

You should be presented with the crAPI login page.

Since this is a deliberately vulnerable training application, simply create a new account using the Sign Up option. After registering, you'll gain access to the dashboard and all available features.

crAPI — LOGIN PAGE

None

crAPI — DASHBOARD

None

Understanding the Architecture

One reason crAPI is highly recommended for Application Security training is its architecture.

Rather than running as a single application, crAPI consists of multiple services communicating through APIs. These include authentication, user management, shopping, workshops, messaging, databases, and more.

This architecture closely resembles modern cloud-native applications, giving you experience working with the same technologies you'll encounter during real-world security assessments.

Learning to understand these components is just as important as finding vulnerabilities because effective security testing begins with understanding how an application is built.

What Can You Learn from crAPI?

After deploying the application, you can begin exploring common API and Application Security vulnerabilities, including:

  • Broken Object Level Authorization (BOLA)
  • Broken Authentication
  • Broken Function Level Authorization (BFLA)
  • Excessive Data Exposure
  • Security Misconfiguration
  • SQL Injection
  • JWT Weaknesses
  • File Upload Vulnerabilities
  • Server-Side Request Forgery (SSRF)
  • Business Logic Flaws

These vulnerabilities align closely with the OWASP API Security Top 10, making crAPI an excellent platform for structured learning.

Conclusion

Setting up a secure lab is one of the first steps toward becoming an effective Application Security Engineer. By combining Docker with OWASP crAPI, you've created an environment that mirrors how modern applications are deployed and gives you a safe place to practice identifying and understanding real-world API vulnerabilities.

This lab isn't just for learning individual attacks it's an opportunity to understand application architecture, explore how services interact, and build the practical skills required for roles in Application Security, API Security, penetration testing, and DevSecOps.

In the next article, we'll intercept crAPI's API requests with Burp Suite, map the application's endpoints, and begin our first API security assessment.