FAQ
Docker with Compose v2, and python3 for the flag checker. Clone, enter a
lab, docker compose up -d, open the host port.
No. There is no scoring server. You verify solves locally.
Yes. Reading the lab source is a legitimate solve. Open labs work that way. The repository stores only the SHA-256 hash; the plaintext lives inside the service.
duck{...}. Lowercase letters, digits, and underscores between the braces,
16 to 40 characters.
A four-tier ladder from easy to insane. Grades describe action, not
time. See Tracks and Difficulty.
Copy labs/_template/, fill it in, run the validator, open a pull request.
See Authoring a Lab.
Structure, metadata, and flag hygiene. With --compose it also runs
docker compose config. A lab that passes can merge.
No. Pin base images to full version tags. python:3.12-alpine yes,
python:latest no.
Open an issue with the lab issue form, or a pull request with a fix. The vulnerabilities inside labs are the product and need no report.
By opening a pull request you agree your code falls under Apache-2.0 and your written content under CC-BY-4.0. See the README for the split.
Anywhere you like. Publish them on your own site and link the lab so other people can follow your path.
