Building a Cybersecurity Home Lab: Fedora Server, Docker and Wazuh

I am an information security intern in my first semester of Computer Science. Day to day I work with CrowdStrike, Defender and other enterprise tools — but with limited access, a defined scope and real incidents that do not wait for you to learn at the pace you wanted.

That bothered me.

Theory is necessary but not enough. CTFs are great, but they lack the control of a real environment. And at work, sometimes you are playing ping pong between CrowdStrike and Defender looking for an analysis input that neither of them shows in full — and that lost time is time that could be going into investigating more incidents.

I have an analogy that sums it up: I love cars. And to really understand how a car works, reading the manual is not enough. You have to take it apart, get your hands dirty, get the assembly wrong and try again. Only then do you really understand — and only after that can you improve anything.

A home lab is that. It is the car taken apart in the garage.

The hardware

You do not need an enterprise server to start. Mine is a Dell Inspiron with a 7th generation Intel Core i5, 8GB of RAM and a 1TB hard drive. Modest hardware, with plans to expand as the need grows.

Why Fedora Server?

Ubuntu Server is the most common choice, and that is exactly why it was not mine. Fedora is already my system on the laptop — I am inside the ecosystem, I know DNF and I like how it resolves dependencies. No Snap, no unnecessary overhead, no stolen performance.

Fedora Server brings innovation before the others. For a learning environment, that is exactly what I want.

Why Docker and not VMs?

Modest hardware cannot run multiple VMs at the same time. But the main reason is not only performance.

Docker containers share the host kernel. That means that to study how a Linux system works from the inside out — processes, namespaces, cgroups, filesystem — Docker is a direct window into it. You are not abstracting the operating system, you are working on top of it.

Windows is the exception. Windows containers are not a viable option here because the kernel is not shared. For that, VirtualBox with a dedicated VM.

What was built

• Fedora Server with remote access through Tailscale — the server sits with its lid closed in any corner and is managed 100% remotely
• Wazuh 4.14.6 through Docker Compose — manager, indexer and dashboard
• Everything starts automatically at boot through systemd — a reboot does not break the lab

What no tutorial will tell you

In the middle of the setup, the disk filled up. 5GB of temporary files piled up by Wazuh in /var/ossec/tmp with no automatic cleanup. System frozen, dnf update failing, 104MB free out of 15GB.

Diagnosis, careful cleanup and automated periodic cleanup through a systemd timer. That is not in the official Wazuh README.

That is exactly the kind of thing a home lab teaches and a CTF does not.

Links

• Original article on dev.to (in Portuguese)
• Lab repository on GitHub