The official local Docker setup is: pull bkimminich/juice-shop, run it with docker run --rm -p 127.0.0.1:3000:3000 bkimminich/juice-shop, and browse to http://localhost:3000.

The current official GitHub README lists the localhost-bound command, the bkimminich/juice-shop Docker Hub page hosts the image, and the OWASP Foundation project page identifies Juice Shop as an intentionally insecure application for training, awareness demonstrations, capture-the-flag exercises, and security-tool evaluation.

Official OWASP Juice Shop Docker Run Command

The highest-impression query—owasp juice shop docker run bkimminich/juice-shop official—has a direct answer in the current project repository.

docker pull bkimminich/juice-shop
docker run --rm -p 127.0.0.1:3000:3000 bkimminich/juice-shop

The official OWASP Juice Shop GitHub README currently documents this exact workflow. After the container starts, open http://localhost:3000.

Official command with a container name

docker run --rm --name juice-shop   -p 127.0.0.1:3000:3000   bkimminich/juice-shop

The optional --name juice-shop makes status, log, and stop commands easier to read. It does not change the application itself.

Detached local run

docker run -d --rm --name juice-shop   -p 127.0.0.1:3000:3000   bkimminich/juice-shop

The -d flag runs the container in the background. Use docker logs -f juice-shop to follow its output and docker stop juice-shop to stop it.

Official OWASP Juice Shop Website, GitHub, Docker Hub, and Documentation

Search results repeatedly include words such as official, official docs, official documentation, and official image. Those modifiers matter because a deliberately vulnerable application should not be downloaded from an unknown mirror.

The official image name is bkimminich/juice-shop. The Docker Hub page, GitHub repository, and official documentation all converge on that image name, which directly addresses searches for docker hub bkimminich/juice-shop official and owasp juice shop official docker image bkimminich/juice-shop.

OWASP Juice Shop Docker Image and Latest Release in 2026

As of August 1, 2026, the official GitHub releases page identifies v20.1.1 as the latest release, published June 23, 2026. The official security policy currently lists 20.1.x as the supported branch.

Pin v20.1.1 for a repeatable lab

docker pull bkimminich/juice-shop:v20.1.1

docker run --rm --name juice-shop   -p 127.0.0.1:3000:3000   bkimminich/juice-shop:v20.1.1

Before publishing training instructions, verify the release page and supported-version policy again. The words official 2026 should indicate current verification, not a permanently fixed version.

OWASP Juice Shop Docker Run Port 3000 Command Explained

Why the host IP matters

Docker documents that port mappings without a host address publish to all host addresses by default. The Docker run reference also warns that omitting the IP address can make the published port externally accessible. Because Juice Shop is intentionally insecure, prefer the current official README command with 127.0.0.1 for a local lab.

Official Docker Image: Latest Tag vs Versioned Tag

The query set includes both official image and official 2026. The most reliable answer depends on whether the reader values immediate currency or repeatability.

Use the official Docker Hub tags page and GitHub releases together when validating a version.

Install Docker for OWASP Juice Shop

Do not rely on a generic package command copied from an old blog. Docker installation steps and supported operating systems change. Use current Docker documentation for the platform.

Docker’s current Ubuntu documentation specifically warns that distribution-provided packages such as docker.io can conflict with Docker’s official Engine packages. That is why the refined article links to the current platform documentation instead of presenting one stale installation recipe as universal.

Run OWASP Juice Shop Locally on Port 3000

1. Pull the official image

docker pull bkimminich/juice-shop

2. Start the local container

docker run -d --rm --name juice-shop   -p 127.0.0.1:3000:3000   bkimminich/juice-shop

3. Confirm the container is running

docker ps
docker logs --tail 50 juice-shop

4. Open the application

http://localhost:3000

5. Stop the lab

docker stop juice-shop

The official setup is intentionally simple. Keep real credentials, customer information, production tokens, and corporate secrets out of the lab.

OWASP Juice Shop Docker Troubleshooting

Use port 3001 when port 3000 is occupied

docker run --rm --name juice-shop   -p 127.0.0.1:3001:3000   bkimminich/juice-shop

Then browse to http://localhost:3001. The container still listens on port 3000 internally; only the host-side port changes.

OWASP Juice Shop GitHub, Source Download, and Packaged Releases

Docker is the fastest option for many local labs, but it is not the only official distribution method.

Clone from the official GitHub repository

git clone https://github.com/juice-shop/juice-shop.git --depth 1
cd juice-shop
npm install
npm start

The official running guide documents the source-based workflow and packaged release option. Check the current GitHub README for supported Node.js versions before building from source.

OWASP Juice Shop Login: Safe Lab Guidance

The login page is part of the intentionally insecure training application. It supports exercises related to authentication, account behavior, sessions, authorization, and API traffic. This article does not provide challenge solutions or unauthorized access instructions.

The official trainer’s guide provides classroom-oriented guidance, and the official companion guide provides structured learning material.

Why OWASP Juice Shop Is an Intentionally Insecure Training Application

The OWASP project page explains that Juice Shop includes vulnerabilities from the OWASP Top Ten and other real-world security flaws. It is written with a modern JavaScript application stack and contains challenges with varied difficulty.

OWASP Juice Shop API Monitoring and Ammune

Juice Shop is useful for API security education because browser actions call REST APIs and produce observable request and response behavior. The OWASP project page specifically notes that proxies and security scanners can use the application to evaluate JavaScript-heavy frontends and REST APIs.

How Ammune fits the lab

Ammune can complement OWASP Juice Shop by providing runtime API discovery, request and response visibility, behavior learning, API abuse detection, sensitive-data monitoring, and security evidence for DevSecOps and SOC workflows. It should be connected only to an isolated and authorized lab, with deployment mode, TLS visibility, throughput, storage, and enforcement controls validated before use.

Related guides include API runtime security protection, real-time API threat detection, API auto-discovery, REST API endpoint security best practices, enterprise API monitoring best practices, and API security for enterprise DevSecOps.

The official Juice Shop monitoring guide also discusses monitoring multiple training instances and related dashboard approaches.

Official OWASP Juice Shop Docker Setup Checklist

Common OWASP Juice Shop Docker Mistakes

1. Using an unofficial image. Verify bkimminich/juice-shop through official OWASP and GitHub sources.
2. Publishing port 3000 on every interface. Prefer the current localhost-bound official command for a local lab.
3. Calling the public demo a practice target. The official repository says it is not intended for personal hacking activity.
4. Using an unpinned image for a formal class. Pin and record a version when repeatability matters.
5. Keeping old setup commands. Revalidate Docker installation and Juice Shop release guidance before each update.
6. Using real credentials or data. Keep the lab synthetic.
7. Sharing one mutable instance with a large class. Use isolated instances or a documented multi-user design.
8. Ignoring monitoring. Pair the training app with request, response, API, and SIEM visibility.
9. Self-linking the article. Internal links should lead to related guidance, not the current page.
10. Treating intentionally vulnerable as production-ready. It is a lab target by design.

Conclusion

The strongest SEO and the safest technical answer are aligned: use the official bkimminich/juice-shop image, verify it through Docker Hub and GitHub, run it with docker run --rm -p 127.0.0.1:3000:3000 bkimminich/juice-shop, browse to http://localhost:3000, and keep the intentionally insecure application isolated.

For reproducible 2026 training, verify the current release and supported branch, then pin the chosen version. Pair the lab with API monitoring so learners can connect vulnerable application behavior to endpoints, requests, responses, identities, abnormal patterns, sensitive data, and incident evidence.

Frequently Asked Questions About OWASP Juice Shop Docker