Real World CTF

Cybersecurity students needed a platform to practice on real vulnerabilities. However, storing heavy Docker images locally on our servers for every challenge was burning through our storage budget and making deployments a nightmare.

I architected a completely decoupled deployment system. Instead of the server hosting heavy images, admins build vulnerable environments locally, push them to the GitHub Container Registry (GHCR), and simply paste the GHCR URL into the admin dashboard. The custom 'Lab Runner' backend then dynamically pulls the image from GitHub on-demand and spins it up in a strictly isolated, read-only Docker container network behind a reverse proxy.

Managing the lifecycle of dynamic containers—ensuring they don't leak resources, properly killing them after idle timeouts, and routing traffic securely via reverse proxies dynamically without reloading the entire web server.

This was my first time working directly with a Docker Registry (GHCR) to orchestrate deployments. I learned how to completely decouple the build process from the runtime environment, allowing the server to dynamically pull and execute containers on demand instead of hoarding heavy images locally.