The safest and simplest way to start Google Gruyere is the official hosted lab: open https://google-gruyere.appspot.com/start, wait for the redirect, and save the full instance URL containing the unique identifier.

The official setup guide states that each hosted instance is sandboxed from other users. You do not need Docker, Linux packages, Windows services, or a local Python installation to complete the codelab.

Official hosted start:
https://google-gruyere.appspot.com/start

After the redirect:
https://google-gruyere.appspot.com/<unique-id>/

What Is Google Gruyere?

Google’s Web Application Exploits and Defenses codelab describes Gruyere as a small web application with intentional security bugs. It allows users to publish text snippets and store files while presenting training scenarios involving cross-site scripting, cross-site request forgery, information disclosure, denial of service, remote code execution, path traversal, client-state manipulation, and configuration weaknesses.

The OWASP Vulnerable Web Applications Directory lists Gruyere as a Google-authored Python application that supports black-box and white-box security education. The codelab combines hands-on tasks with explanations of how to fix or prevent the underlying problem.

Official Google Gruyere Start, Download, and Source Resources

There is no official Google GitHub repository or official Google Docker image linked by the codelab. Search results that use “official Google Gruyere Docker” should therefore be answered carefully: Google provides the hosted lab and source code, while Docker packaging is community-maintained.

Start Google Gruyere on Appspot

1. Open the official start page

https://google-gruyere.appspot.com/start

2. Save the redirected URL

The official setup chapter says App Engine creates a new instance, assigns a unique ID, and redirects the browser. That identifier is part of the exercise URLs.

3. Keep the instance scoped to the codelab

Do not use the hosted environment for unrelated scanning, denial-of-service testing, automated traffic generation, or attacks outside the tasks described by Google.

4. Reset only your assigned instance

The codelab documents a reset mechanism for an instance that becomes unusable. Use the reset flow only for your own unique instance and follow the current official instructions.

Google Gruyere Login and First Session

Google Gruyere does not use one universal public username and password for the hosted lab. The official “Using Gruyere” section instructs learners to create an account inside their assigned instance and explicitly warns against reusing a password from a real service.

1. Open the complete redirected instance URL.
2. Select the sign-up option.
3. Create a synthetic username and a password used only for the lab.
4. Sign in to the same unique instance.
5. Keep the instance URL and lab credentials out of public posts.
6. Do not enter real personal, corporate, customer, or production information.

A disposable account makes the exercises easier to reset and prevents accidental credential reuse.

Google Gruyere Download and Source-Code Options

The official codelab supports source browsing and a source ZIP for white-box learning. It also says that local execution is optional; most learners can complete the lab through the hosted instance.

Download from Linux or macOS

curl -fL   -o gruyere-code.zip   https://google-gruyere.appspot.com/gruyere-code.zip

unzip gruyere-code.zip

Download from Windows PowerShell

Invoke-WebRequest `
  -Uri "https://google-gruyere.appspot.com/gruyere-code.zip" `
  -OutFile "gruyere-code.zip"

Expand-Archive `
  -Path "gruyere-code.zip" `
  -DestinationPath "gruyere-source"

Verify that the URL is the official google-gruyere.appspot.com domain before opening or running the archive.

Google Gruyere and the Python 2.7 Limitation

The official local-run instructions say Gruyere was developed and tested with Python 2.7. The Python Software Foundation marks Python 2.7 as end-of-life since January 1, 2020.

For most readers, the best decision is to use the hosted lab. Local Python 2.7 execution should be limited to a disposable VM with no sensitive data, no shared browser session, and no external exposure.

Google Gruyere Docker: Official Status and Community Options

Google does not publish an official Gruyere Docker image in the codelab. The karthequian/gruyere Docker Hub repository is a community image. It can be useful for an isolated lab, but its publisher, build history, base image, architecture support, package age, and contents should be reviewed before use.

Review the image before running it

docker pull karthequian/gruyere
docker image inspect karthequian/gruyere
docker history karthequian/gruyere

Docker documents how to search Docker Hub, but search visibility does not make an image official or trusted. The image namespace should be evaluated independently from Google’s source distribution.

Local-only community Docker example

docker run --rm   --name google-gruyere   -p 127.0.0.1:8008:8008   karthequian/gruyere

Docker’s port-publishing documentation states that including 127.0.0.1 restricts access to the Docker host. Docker also warns that omitting a host IP publishes the port on all interfaces by default.

Stop and remove the lab

docker stop google-gruyere

Run Google Gruyere on Linux

The hosted lab works in a Linux browser without installation. For a local container, install Docker from current vendor documentation rather than an old copied package command.

Verify Docker before using a community image

docker --version
docker run --rm hello-world

Run on Linux loopback

docker run --rm   --name google-gruyere   -p 127.0.0.1:8008:8008   karthequian/gruyere

Use a nonproduction workstation or VM, confirm the published address with docker port google-gruyere, and never change the mapping to a public interface for convenience.

Run Google Gruyere on Windows

The simplest Windows method is still the official hosted lab. A local Docker option requires Docker Desktop and a reviewed community image.

1. Follow the current Docker Desktop for Windows installation guide.
2. Use the recommended supported backend and confirm Docker Desktop is running.
3. Open PowerShell.
4. Inspect the community image before running it.
5. Bind port 8008 only to 127.0.0.1.
6. Use a separate browser profile with no real credentials or active production sessions.

docker pull karthequian/gruyere

docker run --rm `
  --name google-gruyere `
  -p 127.0.0.1:8008:8008 `
  karthequian/gruyere

Open http://localhost:8008, then follow the redirected unique local path. If port 8008 is unavailable, map another host port while keeping the container port at 8008.

docker run --rm `
  --name google-gruyere `
  -p 127.0.0.1:8009:8008 `
  karthequian/gruyere

Run the Official Google Gruyere Source Locally

The official local instructions use the downloaded source and Python 2.7. Because that runtime is unsupported, use a disposable VM created specifically for the lab.

cd <gruyere-directory>
python2.7 gruyere.py

The official server source shows several deliberate local safeguards: it binds to 127.0.0.1, uses port 8008, creates a random identifier in the path, rejects requests from nonlocal addresses, and exits automatically after two hours. The source labels those controls as sections not to change.

Important local differences

• Use localhost:8008 instead of the Appspot hostname.
• Use the random local unique ID shown by the server.
• The hosted App Engine sandbox can stop certain runaway behavior that may affect a local process differently.
• Close unrelated browser pages and avoid shared user sessions while the local vulnerable service runs.
• Do not modify the loopback, unique-ID, remote-address, or timeout safeguards.

Google Gruyere Troubleshooting

Google Gruyere Walkthrough: A Better Learning Method

The official codelab is organized by vulnerability family. A useful walkthrough should preserve the learning process rather than immediately reveal a payload or final solution.

1. Read the vulnerability explanation. Identify the trust boundary and expected control.
2. Map the feature. Record pages, fields, URLs, parameters, cookies, AJAX requests, and response behavior.
3. State a hypothesis. Explain which assumption may be unsafe.
4. Test only the assigned lab task. Do not broaden the activity to other hosts or services.
5. Inspect the source when required. Connect the behavior to a specific design or implementation choice.
6. Write the defensive fix. Focus on validation, encoding, authorization, state integrity, safe routing, resource limits, or configuration.
7. Retest the intended behavior. A fix should block the unsafe path without breaking the legitimate feature.

Learning record:
- Feature or route:
- Trusted and untrusted data:
- Expected security control:
- Observed behavior:
- Root cause:
- Defensive change:
- Regression test:
- Runtime monitoring signal:

This structure turns the codelab into a secure-development exercise rather than a collection of copied solutions.

What Google Gruyere Teaches About Modern Web and API Security

Gruyere is an older application, but its core lessons remain relevant because modern APIs and single-page applications still depend on trust decisions involving identity, object access, state, input, output, browser behavior, server-side routing, and resource consumption.

For a wider comparison, see API security testing versus runtime monitoring and REST API endpoint security best practices.

Use Ammune to Observe an Authorized Google Gruyere Lab

Ammune can complement a local or authorized Gruyere environment by adding runtime API and HTTP traffic visibility. This should be done only inside the lab scope and without sending real data or credentials through the training application.

Suggested defensive workshop flow

Official or isolated Gruyere instance
  → Normal navigation and account setup
  → Ammune runtime traffic learning
  → Authorized codelab exercise
  → Request and response evidence
  → Root-cause and remediation discussion
  → SIEM or incident workflow
  → Repeat the legitimate feature after the fix

Related Ammune resources include API runtime security protection, enterprise API monitoring best practices, real-time API threat detection, and the API security incident response playbook.

Google Gruyere Alternatives

Choose the lab based on the technology and defensive skill you want to learn. Gruyere remains useful for fundamentals; Juice Shop and crAPI provide stronger coverage of modern JavaScript and API-centric architectures.

Google Gruyere Setup and Safety Checklist

Conclusion

The official Google Gruyere hosted lab is the best starting point: it creates a sandboxed instance, requires no local installation, and follows the original Web Application Exploits and Defenses codelab. The official source browser and ZIP support white-box learning when code inspection is needed.

Docker is not an official Google distribution path for Gruyere. Treat every Docker image as community packaging, inspect it before use, bind port 8008 to 127.0.0.1, and keep the lab disposable. The original source requires Python 2.7, which is end-of-life, so avoid installing it on a normal workstation.

Ammune can add runtime traffic visibility, behavior analytics, sensitive-data context, and SIEM-ready evidence to an authorized Gruyere workshop, helping teams connect each training flaw with modern web and API security operations.

Frequently Asked Questions About Google Gruyere