Past event · DEF CON Training Las Vegas 2026. These materials are preserved for reference. Registration and survey submissions are closed. Lab availability is not guaranteed.
Back to IgniteCyber Academy
IgniteCyber Academy Back to Onboarding
Mac ARM / Docker-Based Setup

Run the Blue vs. Red Analyst Stack on Apple Silicon

Use this guide if you are using a Mac with Apple Silicon, including M1, M2, M3, M4, or newer. Docker Desktop provides the Linux container environment, so students do not need to install a separate Ubuntu virtual machine.

Start Setup Back to Onboarding

The standard downloadable VMs are intended for x86 Windows, macOS Intel, and Linux systems. If you are using an Apple Silicon Mac, follow this Docker-based setup guide instead. The hosted labs remain the primary bootcamp environment, but this local setup gives you a backup option if you need to run the analyst stack locally.

. Before Class: Completion Checklist

  • Docker Desktop is installed and running.
  • Docker Desktop has at least 12 GB of memory assigned.
  • Git, Python 3, curl, and nc are available.
  • The public student repository has been downloaded.
  • The public release verifier passes.
  • The production launcher finishes successfully.
  • JupyterLab opens and shows the Phase 0–7 notebooks.
  • OpenSearch loads the bootcamp telemetry indexes.
  • SkillBit is accessible at https://mctf.io/ignitecyber.

1. Confirm Your Mac Uses Apple Silicon

Run these commands in your terminal:

uname -m
sw_vers -productVersion

Expected result:

arm64

If uname -m returns x86_64, use the Intel Mac or standard VM setup instructions instead.

2. Recommended Hardware

ResourceMinimumPreferred
Mac memory16 GB24–32 GB
Docker memory allocation12 GB16 GB
Docker CPU allocation8 CPUs8 or more
Free storage60 GB80 GB or more
InternetRequired for setupReliable broadband

An 8 GB Mac is not recommended for production mode because OpenSearch, JupyterLab, Ollama, and supporting services run at the same time.

3. Install Docker Desktop for Apple Silicon

  1. Download Docker Desktop for Mac with Apple Silicon from the official Docker installation page.
  2. Install and start Docker Desktop.
  3. Accept the requested macOS permissions.
  4. Wait until Docker Desktop shows the engine is running.
  5. Open Settings → Resources → Advanced and configure:
    • Memory: at least 12 GB
    • CPUs: at least 8
    • Swap: 2–4 GB
    • Disk image limit: enough for at least 60 GB free Docker storage

Use VirtioFS for file sharing when available.

docker version
docker compose version
docker info --format 'Docker architecture: {{.Architecture}}'

Expected architecture:

arm64 or aarch64

4. Install Required Command-Line Tools

xcode-select --install

Verify tools are available:

git --version
python3 --version
curl --version
nc -h 2>&1 | head -n 1

If Python or Git is missing and Homebrew is installed:

brew install python git

5. Download the Bootcamp Student Repository

Keep the repository in a normal local folder. Avoid OneDrive, iCloud Drive, Dropbox, or network shares because synchronized folders can make container mounts slow or inconsistent.

mkdir -p "$HOME/bluevsred-lab"
cd "$HOME/bluevsred-lab"
git clone https://github.com/carloanez/BluevsRed-bootcamp-student.git
cd BluevsRed-bootcamp-student
Public repository:github.com/carloanez/BluevsRed-bootcamp-student

Run the public release verifier:

python3 scripts/verify_public_release.py .

Expected result:

[PASS] Public student release contains no blocked paths, stored notebook outputs, or recognized secret/token patterns.

6. Create the Local Production Configuration

cp deployment/local-vms/analyst-vm/compose/.env.example \
   deployment/local-vms/analyst-vm/compose/.env
chmod 600 deployment/local-vms/analyst-vm/compose/.env

Generate secrets:

for name in \
  JUPYTER_TOKEN \
  POSTGRES_PASSWORD \
  LANGFUSE_NEXTAUTH_SECRET \
  LANGFUSE_SALT \
  HEDGEDOC_POSTGRES_PASSWORD
do
  printf '%s=' "$name"
  openssl rand -hex 24
done

Open configuration file:

nano deployment/local-vms/analyst-vm/compose/.env

Do not reuse the same secret value. Do not commit or share the .env file.

Required settings:

ANALYST_BIND_ADDR=127.0.0.1
HEDGEDOC_BIND_ADDR=127.0.0.1
SECASSIST_BIND_ADDR=127.0.0.1

SKILLBIT_BASE_URL=https://mctf.io/ignitecyber

HEDGEDOC_DOMAIN=127.0.0.1:3002
HEDGEDOC_URL_ADDPORT=false
HEDGEDOC_ANONYMOUS_CLASSROOM_ACK=true

OLLAMA_MODEL=llama3.2:1b

Do not change service bindings from 127.0.0.1 to 0.0.0.0.

7. Validate and Start the Local Stack

Validation command:

deployment/local-vms/analyst-vm/scripts/validate_environment.sh --strict

Expected result:

[PASS] Analyst VM environment and Compose configuration validated.

Startup command:

deployment/local-vms/analyst-vm/scripts/start_services.sh \
  --production --pull --healthcheck

The first startup can take 15–45 minutes because Docker must download images, build services, download the Ollama model, start OpenSearch, and ingest telemetry.

8. Open the Student Tools

ToolAddressPurpose
JupyterLabhttp://127.0.0.1:8888Guided investigation notebooks
OpenSearch Dashboardshttp://127.0.0.1:5601Search and inspect indexes
OpenSearch APIhttp://127.0.0.1:9200Notebook query backend
SecAssist readinesshttp://127.0.0.1:3000/readyLocal evidence-backed assistant API
Langfusehttp://127.0.0.1:3001Inspect AI traces
HedgeDochttp://127.0.0.1:3002Investigation report workspace
Ollama APIhttp://127.0.0.1:11434/api/tagsConfirm local model inventory
Qdranthttp://127.0.0.1:6333/dashboardRetrieval collection
SkillBithttps://mctf.io/ignitecyberSubmit challenge tokens

Get your Jupyter token:

grep '^JUPYTER_TOKEN=' deployment/local-vms/analyst-vm/compose/.env

Do not share or screenshot your Jupyter token.

9. Begin the Bootcamp Notebooks

  1. day1_phase0_baseline_lab.ipynb
  2. day2_phase1_initial_access_lab.ipynb
  3. day2_phase2_execution_foothold_lab.ipynb
  4. day2_phase3_persistence_privilege_lab.ipynb
  5. day3_phase4_lateral_movement_lab.ipynb
  6. day3_phase5_collection_exfiltration_lab.ipynb
  7. day4_phase6_ghost_in_the_assistant_lab.ipynb
  8. day4_phase7_impact_recovery_lab.ipynb

Start with Day 1 Phase 0. Do not replace the notebook OpenSearch container address with localhost inside notebook code.

10. Health Check, Restart, and Shutdown

Health check:

deployment/local-vms/analyst-vm/scripts/healthcheck.sh --production

Acceptance test:

deployment/local-vms/analyst-vm/scripts/acceptance_test.sh --production

Restart after reboot:

cd "$HOME/bluevsred-lab/BluevsRed-bootcamp-student"

deployment/local-vms/analyst-vm/scripts/start_services.sh \
  --production --healthcheck

Safe shutdown:

deployment/local-vms/analyst-vm/scripts/stop_services.sh

Do not add --volumes during normal shutdown. That deletes service state and should only be used if an instructor tells you to reset everything.

. Troubleshooting

Docker daemon is unavailable

Start Docker Desktop and wait until the engine is running.

OpenSearch exits or Mac becomes unresponsive

Increase Docker memory to at least 12 GB. Exit code 137 usually means the Docker Linux VM ran out of memory.

A required port is already in use
for port in 3000 3001 3002 5601 6333 8888 9200 11434; do
  lsof -nP -iTCP:"$port" -sTCP:LISTEN
done
No matching manifest for linux/arm64

Update Docker Desktop, confirm architecture, and contact the instructor with the exact image name.

JupyterLab rejects login

Re-read the Jupyter token from .env.

No notebooks appear
deployment/local-vms/analyst-vm/scripts/lab_setup.sh --lab 8 --missing-only
Ollama model is missing

Rerun the production startup command while connected to the internet.

SkillBit is not a local container

This is expected. SkillBit is hosted separately at https://mctf.io/ignitecyber.

. Student Safety and Privacy Rules

  • Keep all service bindings on 127.0.0.1.
  • Never commit or share the .env file.
  • Do not place completed tokens, instructor answers, or raw secrets into public AI tools.
  • Treat AI-generated conclusions as hypotheses until independently verified.
  • Do not use the bootcamp environment to scan, probe, or interact with systems outside the authorized lab scope.

. Quick Command Card

# Enter the repository
cd "$HOME/bluevsred-lab/BluevsRed-bootcamp-student"

# Validate
deployment/local-vms/analyst-vm/scripts/validate_environment.sh --strict

# First production startup
deployment/local-vms/analyst-vm/scripts/start_services.sh \
  --production --pull --healthcheck

# Later production startup
deployment/local-vms/analyst-vm/scripts/start_services.sh \
  --production --healthcheck

# Recheck the running stack
deployment/local-vms/analyst-vm/scripts/healthcheck.sh --production

# First-session production acceptance test
deployment/local-vms/analyst-vm/scripts/acceptance_test.sh --production

# Safe shutdown
deployment/local-vms/analyst-vm/scripts/stop_services.sh
Back to Onboarding