Vibe Check Workshop - Participant Setup

DEF CON 34, Adversary Village: hands-on workshop on developer trust failures.

This repo contains the workshop setup files. The actual labs (the malicious repos, the AI agent harness, the npm payloads) live inside a Docker image hosted on GitHub Container Registry. They never touch your host filesystem.

The workshop IDE is VS Code running in your browser (code-server), which lives inside the container. You do not need to install Cursor, VS Code, or any other IDE.

That is everything. No Git Bash, no WSL setup, no extra shell tooling. All commands below run in PowerShell (Windows), Terminal (macOS), or your normal terminal (Linux).

Setup time: about 10 minutes once, most of it installing Docker.

Install Docker Desktop: https://www.docker.com/products/docker-desktop

Open the .dmg, drag Docker to Applications, launch it, accept the license. Wait for the whale icon in the menu bar to stop animating.

Verify in a terminal:

docker --version
docker compose version

Install Docker Desktop: https://www.docker.com/products/docker-desktop

Run the installer. Accept all defaults; it automatically configures WSL2 for you. Reboot if asked. Launch Docker Desktop and wait for the whale icon in the system tray to be steady.

Verify in PowerShell:

docker --version
docker compose version

Most distros ship Podman. Recommended:

sudo apt install -y podman podman-compose     # Debian/Ubuntu
# or
sudo dnf install -y podman podman-compose     # Fedora/RHEL

Both packages are needed: podman 5.x no longer ships a built-in compose subcommand and delegates to podman-compose (or docker-compose) instead. Without podman-compose you will see Error: looking up compose provider failed.

Verify:

podman --version
podman compose version

If you prefer Docker Engine:

curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker $USER
newgrp docker

You can either clone the repo (if you have git) or download a ZIP.

git clone https://github.com/hkm67/vibe-check-workshop
cd vibe-check-workshop

1. Visit https://github.com/hkm67/vibe-check-workshop
2. Click the green Code button, then Download ZIP
3. Unzip and cd into the folder

docker compose pull

This downloads the image from GitHub Container Registry (~145 MB). Only runs once; the image stays cached for future sessions.

If you prefer Podman: replace every docker with podman in the commands on this page. Both work identically with this compose file.

Start the lab container:

docker compose up -d

The facilitator will walk you through which URLs to open and what to do, when. Everything happens inside the container — your laptop only runs the browser tab.

Each browser IDE has a built-in terminal (Terminal -> New Terminal) that opens a shell inside the container. That is the simplest path, and what the labs assume.

If you want a shell on your host terminal instead:

docker compose exec lab bash

Or with Podman:

podman compose exec lab bash

Same /workspace, same processes — just a different window onto the same container.

End of a session (or between rounds if you want to reset):

docker compose down

This removes the container. The image stays cached for next time.

Full cleanup (removes the container AND the image):

docker compose down --rmi all

Rotate any API key you exported during the workshop. Your shell history still holds it.

No lab content is here. The malicious repos, the AI agent harness and the npm payloads all live inside the image you pulled with docker compose pull.

Slides from this run will be shared separately.

The image is publicly readable, but some setups need an explicit anonymous login. Try:

docker login ghcr.io
# Username: leave blank or use 'anonymous'
# Password: leave blank

Then retry the pull. If that does not work, flag the facilitator.

The container has not finished starting. Wait 5 seconds and refresh.

If still no luck, verify the container is running:

docker ps

You should see vibe-check-lab listed with 0.0.0.0:8443->8443/tcp and the other port mappings.

Something else on your laptop is using port 8443, 8444, 3000, or 8090.

# macOS / Linux
lsof -i :8443
# Windows (PowerShell)
netstat -ano | findstr :8443

Stop the conflicting process, then re-run docker compose up -d.

You are on Podman 5.x (Fedora 41+, recent Ubuntu) which removed the built-in compose subcommand. Install podman-compose:

sudo dnf install -y podman-compose      # Fedora
sudo apt install -y podman-compose      # Debian/Ubuntu

Then retry. If your distro does not package podman-compose, install Docker Engine instead (see the install section above).

It should not. No lab content is in this repo — only the compose file, the docs, and the slides. If your AV flagged anything, flag the facilitator immediately.