A free security lab lets you break virtual machines while keeping the original disks untouched
The local practice environment combines full QEMU guests with a configurable network. You supply the operating-system images and keep their base files intact.
BeatBox gives a destructive security exercise a place to make a mess. The open-source lab runs virtual machines on your own computer, lets you connect them through configurable networks, and keeps each machine’s changes on a separate layer above the starting disk. The experiment can leave a broken guest behind while the base disk remains available for the next attempt at the same exercise.
The maker’s README describes full machines with their own kernels and disks, backed by QEMU. You bring an installer image. “The disk you started from is never written to,” its README says. BeatBox also says it never downloads a disk. The image you provide remains a reusable starting point for an experiment that can steadily dismantle its guest configuration.
A save point lets you freeze a machine before trying something you may want to reverse. When an exercise is finished, the disposable machine can go. This is particularly appealing for a practice task whose whole purpose is to damage the guest configuration: cleanup becomes part of the design, with the important original separated from the writable experiment.
The network side supplies switches and routers, VLANs, NAT and names and addresses. Firewall rules run top to bottom. That detail makes rule order something you can observe in the lab, rather than a footnote remembered just after the wrong connection succeeds.
BeatBox also has lightweight PCs and servers alongside the full virtual machines. The README describes those lighter nodes as taking a megabyte or two apiece. That figure belongs to the lightweight nodes; a full guest operating system still has its own requirements. A whole pretend office gets a lot less affordable when every receptionist needs a complete Windows desktop.
The project describes watching conversations move through the network and seeing what the firewall did to them. Networks can be saved to files or started from templates. Those features support a repeatable exercise: the interesting output can include the traffic path and rule decision, beyond the satisfying moment when something breaks.
Services include web servers, nginx-backed sites, PostgreSQL and an email inbox. BeatBox checks requirements before starting a service and tells you what is missing. Custom service descriptions allow a different setup. The software is available under Apache 2.0 or MIT licensing, without a paid lab subscription in the documented setup.
The README lists Linux packages and Windows 10/11 installers, with QEMU and hardware-virtualization access checked at first launch. That is the maker’s supported path, not a performance result from a test here. A spare installer image does not establish that a host has the memory or acceleration needed for the whole planned lab.
A writable overlay protects the starting disk’s bytes within this design. It supplies no blanket proof that arbitrary hostile code cannot reach the host or another network. Those are separate isolation questions, with separate configuration and testing. The reusable lab is attractive enough without pretending its disposable guest makes the rest of the computer disposable too.
Break the guest. Keep the original.