In this week, my job is set up ELK with Suricata. I choose docker is platform to run all. Now, i had some experience about docker. Use docker-compose. It is very good deployment for production, build &amp;&amp; run. Install docker-compose via pip. Use build image to create your custom start-up distro. I used docker compose version 2 syntax, notice different with version, like network and net Use network --net if you need monitor, or use all card You can not use cd command, must use WORKDIR. Read Dockerfile document very carefully. Use links, when use it, it run links container before. You can run manual, and start main container after. Must sure it started. In docker command, must use command to hold tty, like: suricata -c xxx or python manager server 0.0.0.0:8080 ---------------------------------------------------------- Thanks for reading -------------------------------------------------------------------------- Security Research SecurityLab - Linux Lab -- Window and Cisco Lab to be continued - I will update more. 
Nam Habach


In this week, my job is set up ELK with Suricata. I choose docker is platform to run all. Now, i had some experience about docker.  
Use docker-compose. It is very good deployment for production, build && run.  
Install docker-compose via pip.  
Use build image to create your custom start-up distro.  
I used docker compose version 2 syntax, notice different with version, like network and net  
Use network --net if you need monitor, or use all card  
You can not use cd command, must use WORKDIR. Read Dockerfile document very carefully.  
Use links, when use it, it run links container before. You can run manual, and start main container after. Must sure it started.  
In docker command, must use command to hold tty, like: suricata -c xxx or python manager server 0.0.0.0:8080  
\----------------------------------------------------------  
Thanks for reading  
\--------------------------------------------------------------------------  
Security Research  
SecurityLab - Linux Lab -- Window and Cisco Lab  
to be continued - I will update more.  

  

  
  

Nam Habach

Some experience when use Docker