mirror of
https://github.com/jokob-sk/NetAlertX.git
synced 2025-12-06 17:15:38 -08:00
92 lines
5.1 KiB
YAML
Executable File
92 lines
5.1 KiB
YAML
Executable File
services:
|
|
netalertx:
|
|
#use an environmental variable to set host networking mode if needed
|
|
network_mode: ${NETALERTX_NETWORK_MODE:-host} # Use host networking for ARP scanning and other services
|
|
build:
|
|
context: . # Build context is the current directory
|
|
dockerfile: Dockerfile # Specify the Dockerfile to use
|
|
image: netalertx:latest
|
|
container_name: netalertx # The name when you docker contiainer ls
|
|
read_only: true # Make the container filesystem read-only
|
|
cap_drop: # Drop all capabilities for enhanced security
|
|
- ALL
|
|
cap_add: # Add only the necessary capabilities
|
|
- NET_ADMIN # Required for ARP scanning
|
|
- NET_RAW # Required for raw socket operations
|
|
- NET_BIND_SERVICE # Required to bind to privileged ports (nbtscan)
|
|
|
|
volumes:
|
|
|
|
- type: volume # Persistent Docker-managed Named Volume for storage of config files
|
|
source: netalertx_config # the default name of the volume is netalertx_config
|
|
target: /app/config # inside the container mounted to /app/config
|
|
read_only: false # writable volume
|
|
|
|
# Example custom local folder called /home/user/netalertx_config
|
|
# - type: bind
|
|
# source: /home/user/netalertx_config
|
|
# target: /app/config
|
|
# read_only: false
|
|
# ... or use the alternative format
|
|
# - /home/user/netalertx_config:/app/config:rw
|
|
|
|
- type: volume
|
|
source: netalertx_db
|
|
target: /app/db
|
|
read_only: false
|
|
|
|
- type: bind # Bind mount for timezone consistency
|
|
source: /etc/localtime
|
|
target: /etc/localtime
|
|
read_only: true
|
|
|
|
# Use a custom Enterprise-configured nginx config for ldap or other settings
|
|
# - /custom-enterprise.conf:/services/config/nginx/conf.active/netalertx.conf:ro
|
|
|
|
# Test your plugin on the production container
|
|
# - /path/on/host:/app/front/plugins/custom
|
|
|
|
# Retain logs - comment out tmpfs /app/log if you want to retain logs between container restarts
|
|
# - /path/on/host/log:/app/log
|
|
|
|
# Tempfs mounts for writable directories in a read-only container and improve system performance
|
|
# All mounts have noexec,nosuid,nodev for security purposes no devices, no suid/sgid and no execution of binaries
|
|
# async where possible for performance, sync where required for correctness
|
|
# uid=20211 and gid=20211 is the netalertx user inside the container
|
|
# mode=1700 gives rwx------ permissions to the netalertx user only
|
|
tmpfs:
|
|
# Speed up logging. This can be commented out to retain logs between container restarts
|
|
- "/app/log:uid=20211,gid=20211,mode=1700,rw,noexec,nosuid,nodev,async,noatime,nodiratime"
|
|
# Speed up API access as frontend/backend API is very chatty
|
|
- "/app/api:uid=20211,gid=20211,mode=1700,rw,noexec,nosuid,nodev,sync,noatime,nodiratime"
|
|
# Required for customization of the nginx listen addr/port without rebuilding the container
|
|
- "/services/config/nginx/conf.active:uid=20211,gid=20211,mode=1700,rw,noexec,nosuid,nodev,async,noatime,nodiratime"
|
|
# /services/config/nginx/conf.d is required for nginx and php to start
|
|
- "/services/run:uid=20211,gid=20211,mode=1700,rw,noexec,nosuid,nodev,async,noatime,nodiratime"
|
|
# /tmp is required by php for session save this should be reworked to /services/run/tmp
|
|
- "/tmp:uid=20211,gid=20211,mode=1700,rw,noexec,nosuid,nodev,async,noatime,nodiratime"
|
|
environment:
|
|
LISTEN_ADDR: ${LISTEN_ADDR:-0.0.0.0} # Listen for connections on all interfaces
|
|
PORT: ${PORT:-20211} # Application port
|
|
GRAPHQL_PORT: ${GRAPHQL_PORT:-20212} # GraphQL API port
|
|
ALWAYS_FRESH_INSTALL: ${ALWAYS_FRESH_INSTALL:-false} # Set to true to reset your config and database on each container start
|
|
NETALERTX_DEBUG: ${NETALERTX_DEBUG:-0} # 0=kill all services and restart if any dies. 1 keeps running dead services.
|
|
|
|
# Resource limits to prevent resource exhaustion
|
|
mem_limit: 2048m # Maximum memory usage
|
|
mem_reservation: 1024m # Soft memory limit
|
|
cpu_shares: 512 # Relative CPU weight for CPU contention scenarios
|
|
pids_limit: 512 # Limit the number of processes/threads to prevent fork bombs
|
|
logging:
|
|
driver: "json-file" # Use JSON file logging driver
|
|
options:
|
|
max-size: "10m" # Rotate log files after they reach 10MB
|
|
max-file: "3" # Keep a maximum of 3 log files
|
|
|
|
# Always restart the container unless explicitly stopped
|
|
restart: unless-stopped
|
|
|
|
volumes: # Persistent volumes for configuration and database storage
|
|
netalertx_config: # Configuration files
|
|
netalertx_db: # Database files
|