DefectDojo Vulnerability Management Platform

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

Overview

DefectDojo is an open source, OWASP flagship DevSecOps and application vulnerability management platform trusted by security teams worldwide, with thousands of GitHub stars and contributions from a large global community. This image delivers DefectDojo fully installed and running as the official production Docker Compose stack, so a working vulnerability management console is serving within minutes of launch.

Why This Image Instead of Self-Deployment

Deploying DefectDojo from the GitHub repository requires manual secret generation, storage configuration, systemd service integration, reverse proxy setup and ongoing maintenance of the Compose topology. This image removes that operational burden: every component is pre-configured and tested, secrets are generated automatically on first boot, stateful data lives on a dedicated resizable disk, and the full stack starts on boot via systemd. You skip hours of setup and go straight to importing your first scan results.

Application Stack

The appliance runs the official DefectDojo Compose topology: an nginx reverse proxy answers on port 80 and fronts a uwsgi Django application server, with celery worker and celery beat services handling asynchronous and scheduled work, a PostgreSQL database for storage and a Valkey (Redis compatible) instance as the Celery broker and cache. Every stateful Docker volume, the database, the cache and the media and uploads, is relocated onto a dedicated, independently resizable data disk kept separate from the operating system disk.

Import, Triage and Track

DefectDojo understands the output of over 150 security scanner parsers across SAST, DAST, dependency, container and infrastructure testing. Findings are imported, normalised and deduplicated so the same issue reported by different tools is tracked once. Organise work into products, engagements and tests, assign and age findings, capture risk acceptance, and use the dashboards, metrics and reports to communicate posture to engineering and leadership.

Secure First Boot

No shared or default password ships in the image. On the first boot of your instance a one-shot service generates a fresh Django secret key, a fresh credential encryption key, a fresh database password and a strong, unique administrator password, initialises an empty database, and records the administrator credentials in a file that only the root user can read. The default installer password never applies, and every instance is independent.

Ready To Use

Retrieve the generated administrator password over SSH, open the console in your browser, and sign in to start importing findings. The unauthenticated login page also serves as a health endpoint for load balancer and uptime checks. A full REST API is available for automation and CI/CD integration.

Use Cases

Compliance-driven teams centralise SAST and DAST findings from their CI/CD pipeline into a single evidence source that shows vulnerability identification, triage decisions and remediation timelines for audits such as SOC 2. DevSecOps teams post scanner results (for example OWASP ZAP, Trivy or Semgrep) into DefectDojo automatically from Jenkins or GitHub Actions, and triage new critical and high findings each morning using the deduplication view. SaaS companies with multiple product lines use DefectDojo's product hierarchy and dashboards to report vulnerability trends to leadership and track mean-time-to-remediate across teams.

cloudimg Support

24/7 technical support by email and chat. Our engineers help with deployment, reverse proxy and TLS termination, scanner integration and import automation, backup and storage planning, and scaling the stack.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.