A deliberately vulnerable CI/CD environment designed to teach and practice CI/CD security through hands-on challenges.
A deliberately vulnerable CI/CD environment. Learn CI/CD security through multiple challenges.
This tool is used by security engineers and DevSecOps practitioners to learn and improve their skills in securing CI/CD pipelines by exploiting and mitigating real-world vulnerabilities. It provides a practical, challenge-based environment that simulates common CI/CD security risks, enabling users to gain hands-on experience in a safe, controlled setting.
Avoid browsing repository files directly as they contain spoilers for the challenges. Each challenge is independent; do not use access from one challenge to solve another. The environment is designed for learning and does not require exploiting CVEs or hijacking default admin accounts. Running requires Docker and Docker Compose installed on the host machine.
Download the docker-compose.yaml file: curl -o cicd-goat/docker-compose.yaml --create-dirs https://raw.githubusercontent.com/cider-security-research/cicd-goat/main/docker-compose.yaml
Change directory: cd cicd-goat
Start the environment with Docker Compose: docker compose up -d
For Windows Powershell users: mkdir cicd-goat; cd cicd-goat
Download docker-compose.yaml on Windows: curl -o docker-compose.yaml https://raw.githubusercontent.com/cider-security-research/cicd-goat/main/docker-compose.yaml
Replace network mode in docker-compose.yaml for Windows: get-content docker-compose.yaml | %{$_ -replace "bridge","nat"}
Start environment on Windows: docker compose up -dcurl -o cicd-goat/docker-compose.yaml --create-dirs https://raw.githubusercontent.com/cider-security-research/cicd-goat/main/docker-compose.yaml
Downloads the docker-compose configuration file needed to run the environment.
cd cicd-goat && docker compose up -d
Starts the entire vulnerable CI/CD environment in detached mode.
mkdir cicd-goat; cd cicd-goat
Creates and navigates into the project directory on Windows.
curl -o docker-compose.yaml https://raw.githubusercontent.com/cider-security-research/cicd-goat/main/docker-compose.yaml
Downloads the docker-compose.yaml file on Windows.
get-content docker-compose.yaml | %{$_ -replace "bridge","nat"}
Modifies the network configuration in docker-compose.yaml for Windows compatibility.
docker compose up -d
Launches all containers in the background to start the challenge environment.