Posted inSecurity

Guide to Installing DefectDojo on Docker: Centralized Vulnerability Management for DevSecOps

Security tutorial - IT technology blog
Security tutorial - IT technology blog

When Security Reports Become a Nightmare

If you’re working in DevSecOps, this scenario is definitely familiar. Early in the morning, you run Trivy to scan container images. By noon, OWASP ZAP returns a pile of web vulnerabilities. Late in the afternoon, SonarQube sends over another list of source code flaws. The result is dozens of PDF, CSV, and JSON files scattered everywhere.

The real headache begins when your boss asks: “How many critical vulnerabilities do we currently have? Which ones were reported last month but still haven’t been fixed?”. Manually deduplicating using Excel is extremely exhausting and prone to errors. DefectDojo was born specifically to solve this mess.

Why Do Security Professionals Love DefectDojo?

DefectDojo is an open-source Vulnerability Management System (VMS). It acts as a centralized “warehouse” for all security scan results. Instead of managing vulnerabilities based on luck, this tool helps you:

  • Support importing results from over 150 popular tools like Nmap, Burp Suite, Snyk, or Nessus.
  • Automatically merge duplicate findings. In fact, I once reduced the number of junk findings by 70% thanks to this deduplication feature.
  • Closely track the Service Level Agreement (SLA) for each team’s fixes.
  • Provide visual charts for quick reporting to management.

The biggest plus is the ability to integrate directly into CI/CD. Security is no longer a final hurdle but becomes part of the automation flow.

System Resource Requirements

DefectDojo is a fairly heavy toolset. It operates on Django, Celery, PostgreSQL, Redis, and RabbitMQ. So, forget about running it on a 1GB RAM VPS.

Minimum recommended configuration for smooth operation:

  • CPU: Minimum 2 Cores.
  • RAM: 8GB (4GB can run, but the system will hang when you import report files larger than 50MB).
  • Disk: 20GB SSD or more.
  • Requirements: Docker and Docker Compose pre-installed.

Installing DefectDojo using Docker Compose

Using Docker is the fastest way to deploy without worrying about environment conflicts. I recommend cloning the official repo to get the latest bug fixes.

Step 1: Download the Source Code

git clone https://github.com/DefectDojo/django-DefectDojo
cd django-DefectDojo

Step 2: Environment Setup

Never use default passwords. For safety, use a password generator at toolcraft.app to create strong strings. All operations happen in the browser, so you don’t have to worry about leaking secrets over the network. Then, update this information in the .env file.

Next, build and start the system using the provided scripts:

# The build process may take 5-10 minutes depending on network speed
./dc-build.sh

# Start with MySQL and RabbitMQ backend
./dc-up.sh mysql-rabbitmq

Step 3: Retrieve Login Credentials

The system will automatically generate a random admin password on the first run. Use the following command to find it:

docker compose logs initializer | grep "Admin password:"

Now, open your browser and go to http://localhost:8080. Log in with the username admin and the password you just found.

Practical Operation: Importing Data into Dojo

To avoid confusion, you need to understand how DefectDojo organizes data. The standard structure is usually:

Product Type (Banking Project) → Product (Mobile App) → Engagement (Periodic Scan Sprint 1) → Test (Results from Trivy).

How to Import Scan Files

Suppose you have a trivy_report.json file. To import it into the system:

  1. Access the **Engagement** you just created.
  2. Click the **(+)** icon and select **Import Scan Results**.
  3. Select the correct **Scan type** as “Trivy Scan”.
  4. Upload the file and click **Import**.

Dojo will automatically classify vulnerabilities by severity: Critical, High, Medium, and Low. You will immediately see the overall security posture of your application.

Automation with API (For Power Users)

Manual uploading is only for getting started. To truly master DevSecOps, you should push results automatically from Jenkins or GitHub Actions via the API.

Here is a concise Python script to do this:

import requests

URL = "http://your-defectdojo-url/api/v2/import-scan/"
TOKEN = "YOUR_API_KEY"

headers = {"Authorization": f"Token {TOKEN}"}
data = {
    "active": True,
    "verified": True,
    "scan_type": "Trivy Scan",
    "engagement": 1  # Engagement ID
}
files = {"file": open("trivy_results.json", "rb")}

response = requests.post(URL, headers=headers, data=data, files=files)
print("Success!" if response.status_code == 201 else f"Error: {response.text}")

“Battle-Tested” Lessons for Deployment

After many real-world projects, I have some advice to help you save time:

  • Enable Deduplication: Always activate the deduplication feature in the system settings. It prevents five different tools from reporting the same SQL Injection vulnerability and cluttering your reports.
  • Status Classification: Be bold in marking “False Positive” for non-existent issues and “Risk Accepted” for vulnerabilities that cannot be fixed. Your reports will be much cleaner and more professional.
  • Don’t Forget Volumes: Docker containers are easily deleted and recreated. Ensure you have mounted volumes for the database to avoid losing all your data after a docker-compose down command.

Conclusion

Deploying DefectDojo on Docker is a smart move to professionalize your security workflow. Although the initial configuration takes some effort, the value it brings to vulnerability management is well worth it. Good luck mastering this powerful tool!

Share:
Tags: