docker-suricata

The container exposes several key volumes:

• /var/log/suricata: The Suricata log directory.
• /var/lib/suricata: Rules, Suricata-Update cache, and other runtime data.
• /etc/suricata: The configuration directory.

To ensure bind-mounted files are owned by your host user instead of the container's internal user, set the PUID and PGID environment variables to match your host user's IDs.

Example:

docker run -e PUID=$(id -u) -e PGID=$(id -g) ...

You can update Suricata rules without stopping the container by executing suricata-update inside the running container and then signaling Suricata to reload.

1. Start the container (e.g., named suricata):

   docker run --name=suricata --rm -it --net=host \
    --cap-add=net_admin --cap-add=net_raw --cap-add=sys_nice \
    jasonish/suricata:latest -i eth0

2. In a separate terminal, run the update and reload command:
   ```bash
docker exec -it --user suricata suricata suricata-update -f

Note: The suricata-update -f command executes the update and signals Suricata to reload rules via suricatasc -c reload-rules.

You can run logrotate manually inside the container using docker exec.

Manual rotation:

docker exec CONTAINER_ID logrotate /etc/logrotate.d/suricata

Force/Verbose test:

docker exec CONTAINER_ID logrotate -vf /etc/logrotate.d/suricata

Automatic rotation: To automate rotation, set the ENABLE_CRON=yes environment variable and create a bash script in one of the /etc/cron.* directories (e.g., /etc/cron.hourly/suricata) that executes the logrotate command:

#!/bin/bash
logrotate /etc/logrotate.d/suricata

You can generate default Suricata configuration files by mounting an empty host directory to /etc/suricata and running the container with the -V flag. This is useful for bootstrapping a custom configuration.

Example:

mkdir ./etc
docker run --rm -it -v $(pwd)/etc:/etc/suricata jasonish/suricata:latest -V

Note: Files created in the host directory may be owned by a different UID/GID than your host user, requiring sudo for editing.

To monitor network traffic from your host machine, you must run the container using the host network stack (--net=host) and grant specific Linux capabilities. Without these capabilities, Suricata will run as root; with them, it can drop privileges to a non-root user.

Required capabilities:

• net_admin
• net_raw
• sys_nice

Docker Example:

docker run --rm -it --net=host \
    --cap-add=net_admin --cap-add=net_raw --cap-add=sys_nice \
    jasonish/suricata:latest -i <interface>

Podman Example: Note that with podman, adding capabilities is mandatory.

sudo podman run --rm -it --net=host \
    --cap-add=net_admin,net_raw,sys_nice \
    jasonish/suricata:latest -i eth0

The most effective way to provide custom configurations is to bind mount a host directory to /etc/suricata. Once initialized, you can modify files in that directory and they will be used in subsequent runs.

Example:

docker run --rm -it --net=host \
    -v $(pwd)/etc:/etc/suricata \
    --cap-add=net_admin --cap-add=net_raw --cap-add=sys_nice \
    jasonish/suricata:latest -i eth0

Use the SURICATA_OPTIONS environment variable to pass additional command line arguments to the Suricata binary.

Example:

docker run --net=host -e SURICATA_OPTIONS="-i eno1 -vvv" jasonish/suricata:latest

The image is available on Docker Hub, quay.io, and ghcr.io.

Common Tags:

• latest: The latest release version (currently 8.0).
• main: The latest code from the git master branch.
• 8.0: The latest 8.0 patch release.
• 7.0: The latest 7.0 patch release.
• Specific version tags (e.g., 7.0.11) are available for versions 4.1.5 and newer.

Architecture-specific tags: If you need a specific architecture, use tags like latest-amd64 or 6.0.4-arm64v8.

docker pull jasonish/suricata:latest
docker pull jasonish/suricata:7.0.11
docker pull quay.io/jasonish/suricata:latest
docker pull ghcr.io/jasonish/suricata:latest