Fastest OWASP crAPI Docker Setup

The official crAPI setup guide uses Docker Compose and the project’s main branch for the latest stable workflow. Check docker compose version first; the project requires Compose 1.27.0 or newer, although a current Docker installation is strongly preferred.

docker compose version
mkdir -p "$HOME/crapi-lab"
cd "$HOME/crapi-lab"
curl -L -o crapi.zip https://github.com/OWASP/crAPI/archive/refs/heads/main.zip
unzip -q crapi.zip
cd crAPI-main/deploy/docker
docker compose pull
docker compose -f docker-compose.yml --compatibility up -d
docker compose ps

docker compose version
New-Item -ItemType Directory -Force "$HOME\crapi-lab" | Out-Null
Set-Location "$HOME\crapi-lab"
curl.exe -L -o crapi.zip https://github.com/OWASP/crAPI/archive/refs/heads/main.zip
tar -xf .\crapi.zip
Set-Location .\crAPI-main\deploy\docker
docker compose pull
docker compose -f docker-compose.yml --compatibility up -d
docker compose ps
Start-Process "http://localhost:8888"

# Application and MailHog
curl -I http://127.0.0.1:8888
curl -I http://127.0.0.1:8025

# Linux desktop
xdg-open http://127.0.0.1:8888
xdg-open http://127.0.0.1:8025

What Is OWASP crAPI?

OWASP crAPI stands for Completely Ridiculous API. It is an intentionally vulnerable, API-driven training application maintained as an OWASP project. The fictional vehicle-owner platform uses microservices and realistic workflows so learners can study API security in a controlled environment.

crAPI is most useful when you begin with the normal application workflow. Register, verify the account, sign in, add a vehicle, and observe what a legitimate user can do. That baseline makes later authorization, property, authentication, data-exposure, resource-consumption, inventory, and business-flow findings easier to explain.

For broader context, see the top API security risks and controls and the focused OWASP API1 BOLA guide.

Install OWASP crAPI on Ubuntu, RHEL, or Windows

If Docker is already installed and working, use the quick start above. The longer examples below are for a new lab machine and follow Docker’s official repository-based installation methods. Review Docker’s current prerequisites before changing packages on a workstation that already runs containers.

Ubuntu copy-and-paste installation

These commands install Docker Engine and the Compose plugin from Docker’s official Ubuntu repository, verify the engine, and start the official crAPI stack.

sudo apt update
sudo apt install -y ca-certificates curl unzip
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

sudo tee /etc/apt/sources.list.d/docker.sources >/dev/null <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF

sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin
sudo systemctl enable --now docker
sudo docker run --rm hello-world

mkdir -p "$HOME/crapi-lab"
cd "$HOME/crapi-lab"
curl -L -o crapi.zip https://github.com/OWASP/crAPI/archive/refs/heads/main.zip
unzip -q crapi.zip
cd crAPI-main/deploy/docker
sudo docker compose pull
sudo docker compose -f docker-compose.yml --compatibility up -d
sudo docker compose ps

Official reference: Install Docker Engine on Ubuntu.

Red Hat Enterprise Linux copy-and-paste installation

Docker’s current documentation supports maintained RHEL releases and recommends the RPM repository for normal installation and upgrades.

sudo dnf -y install dnf-plugins-core curl unzip
sudo dnf config-manager --add-repo \
  https://download.docker.com/linux/rhel/docker-ce.repo
sudo dnf install -y docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin
sudo systemctl enable --now docker
sudo docker run --rm hello-world

mkdir -p "$HOME/crapi-lab"
cd "$HOME/crapi-lab"
curl -L -o crapi.zip https://github.com/OWASP/crAPI/archive/refs/heads/main.zip
unzip -q crapi.zip
cd crAPI-main/deploy/docker
sudo docker compose pull
sudo docker compose -f docker-compose.yml --compatibility up -d
sudo docker compose ps

Official reference: Install Docker Engine on RHEL.

Windows PowerShell installation

Install Docker Desktop from Docker’s official Windows page, start Docker Desktop, and confirm that docker version can reach the Linux-container engine. Docker Desktop licensing terms may apply to larger organizations, so review the current terms before enterprise use.

docker version
docker compose version

New-Item -ItemType Directory -Force "$HOME\crapi-lab" | Out-Null
Set-Location "$HOME\crapi-lab"
curl.exe -L -o crapi.zip https://github.com/OWASP/crAPI/archive/refs/heads/main.zip
tar -xf .\crapi.zip
Set-Location .\crAPI-main\deploy\docker
docker compose pull
docker compose -f docker-compose.yml --compatibility up -d
docker compose ps
Start-Process "http://localhost:8888"
Start-Process "http://localhost:8025"

Official reference: Install Docker Desktop on Windows.

Open crAPI, Create a Login, and Use MailHog

After the Compose services are healthy, open the application and local inbox on the same machine:

• crAPI application: http://localhost:8888
• MailHog inbox: http://localhost:8025

Recommended first-login sequence

1. Open the application.
2. Register a disposable local account with a made-up training identity.
3. Use a password that is not reused anywhere else.
4. Open MailHog when the application sends email.
5. Return to crAPI, sign in, and complete the normal vehicle-owner workflow.

Why the happy path matters

The official repository recommends learning the intended workflow before attempting challenges. Record the caller identity, endpoint, object, request properties, response fields, and expected state change. This prevents false conclusions and gives each finding a defensible explanation.

Use the official crAPI happy-path guide and challenge descriptions as the source of truth.

OWASP crAPI GitHub, Branches, Releases, and Downloads

The official OWASP repository and project documentation should be your source of truth. Avoid repackaged archives and old forks unless a course explicitly requires a specific version.

git clone https://github.com/OWASP/crAPI.git
cd crAPI/deploy/docker
docker compose pull
docker compose -f docker-compose.yml --compatibility up -d

The current setup documentation also includes optional chatbot and LLM-provider settings. Those are not required for the core lab. Do not place production API keys in a broadly reachable or shared training deployment.

A Beginner crAPI Walkthrough That Survives Version Changes

A useful walkthrough teaches a repeatable method rather than a list of challenge answers. Endpoints, sample data, and challenge wording can change, but the process of comparing expected behavior with accepted behavior remains valuable.

1. Create a disposable local account.
2. Complete the official happy path before any challenge.
3. Record the caller, method, endpoint, object, request, response, and state change.
4. Change one authorized lab input or sequence at a time.
5. Compare the result with the documented business rule.
6. Name the missing server-side control.
7. Record the minimum evidence a defender would need.
8. Reset the local lab when you need a clean state.

What makes a useful lab finding?

A strong finding explains the normal action, the single controlled change, the unexpected result, the business impact, the missing server-side control, and the minimum safe evidence needed for investigation. A screenshot or copied request alone is not enough.

What the crAPI Mass-Assignment Lesson Is Teaching

Mass assignment occurs when an application maps client-supplied properties to an internal object without restricting which properties the current caller may change. The real defect is not the presence of an extra JSON field; it is the server accepting a field that should be controlled by ownership rules, business logic, or a privileged role.

OWASP terminology has evolved. In the 2023 API Security Top 10, property-level authorization problems—including patterns previously discussed as mass assignment or excessive data exposure—are addressed under API3: Broken Object Property Level Authorization.

Safe learning method

1. Complete the normal create or update action with your own local account.
2. Record the properties the user interface legitimately sends.
3. Compare the request with the response and any available schema.
4. Classify each field as user-controlled, server-controlled, or role-controlled.
5. Follow the official challenge description inside the local lab.
6. Document the business impact without testing any external system.
7. Write the allow-list, property authorization, validation, and audit controls that should prevent the issue.

// Bind only fields this operation and caller may change
const allowedFields = policy.writableFields(currentUser, existingRecord);
const update = pick(request.body, allowedFields);

rejectUnknownProperties(request.body, allowedFields);
authorizePropertyChanges(currentUser, existingRecord, update);
validateStateTransition(existingRecord, update);
auditUnexpectedFieldAttempts(currentUser, request.body);

For deeper defensive coverage, see the mass-assignment API vulnerability guide and broken object property-level authorization.

OWASP crAPI Troubleshooting: Page Not Loading, Ports Busy, or Containers Unhealthy

crAPI runs several services, so a failed page does not always mean the installation is broken. Start with the Compose status, rendered configuration, and service logs. Reinstalling immediately can hide the real error.

docker compose ps
docker compose config
docker compose logs --tail=250

docker version
docker compose version

# Linux: check whether expected ports are already in use
sudo ss -lntp | grep -E ':8888|:8025'

# Windows PowerShell: check expected ports
Get-NetTCPConnection -LocalPort 8888,8025 -ErrorAction SilentlyContinue

# Re-pull images and recreate after reviewing the logs
docker compose pull
docker compose -f docker-compose.yml --compatibility up -d --force-recreate

Stop, restart, or reset the lab

docker compose ps
docker compose logs --tail=150

# Stop without deleting data
docker compose stop

# Start the same lab later
docker compose start

# Remove containers and networks, preserve named volumes
docker compose down

# Full reset: remove containers and named volumes
docker compose down -v

From crAPI Lab Finding to Production API Control

crAPI is a training environment, not a production blueprint. Its value is in connecting one controlled finding to the design, testing, deployment, monitoring, and response controls that a real API needs.

The practical model is not “testing versus monitoring.” It combines secure design, contract and authorization testing, deployment hardening, runtime visibility, controlled enforcement, incident response, and feedback into development. See API security testing versus runtime monitoring and API runtime visibility.

Official and Current OWASP crAPI References

Commands, release details, ports, and challenge behavior can change. Verify them against these primary sources:

• OWASP crAPI project page
• Official OWASP crAPI GitHub repository
• Official latest release page
• Official crAPI setup guide
• Official application happy path
• Official challenge descriptions
• OWASP ZAP crAPI test-app guidance
• Docker Engine on Ubuntu
• Docker Engine on RHEL
• Docker Desktop on Windows
• OWASP API Security Top 10:2023

Conclusion: Build a Local crAPI Lab You Can Reproduce

The best beginner setup is simple and repeatable: use the official Docker workflow, keep the vulnerable application on localhost, open localhost:8888, create a disposable account, use MailHog on localhost:8025, and complete the intended workflow before starting a challenge.

The lasting skill is not memorizing a challenge answer. It is learning how to establish expected behavior, make one controlled change, explain the missing server-side control, and identify the minimum evidence that engineering and security teams would need in production.

OWASP crAPI FAQ