tpotce/docker/elk/logstash/Dockerfile

FROM alpine:3.12
#
# VARS
ENV LS_VER=7.9.1
# Include dist
ADD dist/ /root/dist/
#
# Setup env and apt
RUN sed -i 's/dl-cdn/dl-2/g' /etc/apk/repositories && \
    apk -U --no-cache add \
             aria2 \
             bash \
             bzip2 \
	     curl \
             libc6-compat \
             libzmq \
             nss \
             openjdk11-jre && \
#
# Get and install packages
    mkdir -p /etc/listbot && \
    cd /etc/listbot && \
    aria2c -s16 -x 16 https://listbot.sicherheitstacho.eu/cve.yaml.bz2 && \
    aria2c -s16 -x 16 https://listbot.sicherheitstacho.eu/iprep.yaml.bz2 && \
    bunzip2 *.bz2 && \
    cd /root/dist/ && \
    mkdir -p /usr/share/logstash/ && \
    aria2c -s 16 -x 16 https://artifacts.elastic.co/downloads/logstash/logstash-$LS_VER.tar.gz && \
    tar xvfz logstash-$LS_VER.tar.gz --strip-components=1 -C /usr/share/logstash/ && \
    /usr/share/logstash/bin/logstash-plugin install logstash-filter-translate && \
    /usr/share/logstash/bin/logstash-plugin install logstash-output-syslog && \
#
# Add and move files
    cd /root/dist/ && \
    cp update.sh /usr/bin/ && \
    chmod u+x /usr/bin/update.sh && \
    mkdir -p /etc/logstash/conf.d && \
    cp logstash.conf /etc/logstash/conf.d/ && \
    cp tpot_es_template.json /etc/logstash/ && \
#
# Setup user, groups and configs
    addgroup -g 2000 logstash && \
    adduser -S -H -s /bin/bash -u 2000 -D -g 2000 logstash && \
    chown -R logstash:logstash /usr/share/logstash && \
    chown -R logstash:logstash /etc/listbot && \
    chmod 755 /usr/bin/update.sh && \
#
# Clean up
    rm -rf /root/* && \
    rm -rf /tmp/* && \
    rm -rf /var/cache/apk/*
#
# Healthcheck
HEALTHCHECK --retries=10 CMD curl -s -XGET 'http://127.0.0.1:9600'
#
# Start logstash
#USER logstash:logstash
#CMD update.sh && exec /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf --config.reload.automatic --java-execution --log.level debug
CMD update.sh && exec /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf --config.reload.automatic --java-execution
provide fix for #669 2020-07-06 23:30:11 +00:00			`FROM alpine:3.12`
download instead of git pull download translation maps rather than running a git pull translation maps will now be bzip2 compressed to reduce traffic to a minimum fixes #432 2019-08-14 14:43:47 +00:00			`#`
elk 7.x dev test 2020-01-31 14:21:55 +00:00			`# VARS`
continue pin / prep images ghcr 2020-09-04 12:37:28 +00:00			`ENV LS_VER=7.9.1`
include docker repos ... skip emobility since it is a dev repo 2017-10-13 18:58:14 +00:00			`# Include dist`
			`ADD dist/ /root/dist/`
download instead of git pull download translation maps rather than running a git pull translation maps will now be bzip2 compressed to reduce traffic to a minimum fixes #432 2019-08-14 14:43:47 +00:00			`#`
include docker repos ... skip emobility since it is a dev repo 2017-10-13 18:58:14 +00:00			`# Setup env and apt`
bump elk stack to 6.6.2, replace wget with aria2 to speed up d/l 2019-03-15 22:23:30 +00:00			`RUN sed -i 's/dl-cdn/dl-2/g' /etc/apk/repositories && \`
prepare for honeypy 2019-03-10 18:15:59 +00:00			`apk -U --no-cache add \`
bump elk stack to 6.6.2, replace wget with aria2 to speed up d/l 2019-03-15 22:23:30 +00:00			`aria2 \`
bump elk stack to 6.5.1 fix docker hub build 2018-11-22 23:18:59 +00:00			`bash \`
download instead of git pull download translation maps rather than running a git pull translation maps will now be bzip2 compressed to reduce traffic to a minimum fixes #432 2019-08-14 14:43:47 +00:00			`bzip2 \`
			`curl \`
bump elk stack to 6.5.1 fix docker hub build 2018-11-22 23:18:59 +00:00			`libc6-compat \`
			`libzmq \`
bump elk stack to 6.6.2, replace wget with aria2 to speed up d/l 2019-03-15 22:23:30 +00:00			`nss \`
elk 7.x dev test 2020-01-31 14:21:55 +00:00			`openjdk11-jre && \`
download instead of git pull download translation maps rather than running a git pull translation maps will now be bzip2 compressed to reduce traffic to a minimum fixes #432 2019-08-14 14:43:47 +00:00			`#`
include docker repos ... skip emobility since it is a dev repo 2017-10-13 18:58:14 +00:00			`# Get and install packages`
download instead of git pull download translation maps rather than running a git pull translation maps will now be bzip2 compressed to reduce traffic to a minimum fixes #432 2019-08-14 14:43:47 +00:00			`mkdir -p /etc/listbot && \`
fix cd 2019-08-15 08:32:04 +00:00			`cd /etc/listbot && \`
prep for new listbot FQDN 2020-05-12 09:19:09 +00:00			`aria2c -s16 -x 16 https://listbot.sicherheitstacho.eu/cve.yaml.bz2 && \`
			`aria2c -s16 -x 16 https://listbot.sicherheitstacho.eu/iprep.yaml.bz2 && \`
download instead of git pull download translation maps rather than running a git pull translation maps will now be bzip2 compressed to reduce traffic to a minimum fixes #432 2019-08-14 14:43:47 +00:00			`bunzip2 *.bz2 && \`
include docker repos ... skip emobility since it is a dev repo 2017-10-13 18:58:14 +00:00			`cd /root/dist/ && \`
			`mkdir -p /usr/share/logstash/ && \`
elk 7.x dev test 2020-01-31 14:21:55 +00:00			`aria2c -s 16 -x 16 https://artifacts.elastic.co/downloads/logstash/logstash-$LS_VER.tar.gz && \`
			`tar xvfz logstash-$LS_VER.tar.gz --strip-components=1 -C /usr/share/logstash/ && \`
include docker repos ... skip emobility since it is a dev repo 2017-10-13 18:58:14 +00:00			`/usr/share/logstash/bin/logstash-plugin install logstash-filter-translate && \`
			`/usr/share/logstash/bin/logstash-plugin install logstash-output-syslog && \`
download instead of git pull download translation maps rather than running a git pull translation maps will now be bzip2 compressed to reduce traffic to a minimum fixes #432 2019-08-14 14:43:47 +00:00			`#`
include docker repos ... skip emobility since it is a dev repo 2017-10-13 18:58:14 +00:00			`# Add and move files`
			`cd /root/dist/ && \`
			`cp update.sh /usr/bin/ && \`
			`chmod u+x /usr/bin/update.sh && \`
			`mkdir -p /etc/logstash/conf.d && \`
			`cp logstash.conf /etc/logstash/conf.d/ && \`
prep for elk 7.9 2020-08-24 10:35:46 +00:00			`cp tpot_es_template.json /etc/logstash/ && \`
download instead of git pull download translation maps rather than running a git pull translation maps will now be bzip2 compressed to reduce traffic to a minimum fixes #432 2019-08-14 14:43:47 +00:00			`#`
tweaking, hardening 2018-03-31 15:18:28 +00:00			`# Setup user, groups and configs`
			`addgroup -g 2000 logstash && \`
			`adduser -S -H -s /bin/bash -u 2000 -D -g 2000 logstash && \`
			`chown -R logstash:logstash /usr/share/logstash && \`
			`chown -R logstash:logstash /etc/listbot && \`
			`chmod 755 /usr/bin/update.sh && \`
download instead of git pull download translation maps rather than running a git pull translation maps will now be bzip2 compressed to reduce traffic to a minimum fixes #432 2019-08-14 14:43:47 +00:00			`#`
include docker repos ... skip emobility since it is a dev repo 2017-10-13 18:58:14 +00:00			`# Clean up`
tweaking, hardening 2018-05-04 16:29:55 +00:00			`rm -rf /root/* && \`
bump elk stack to 6.5.1 fix docker hub build 2018-11-22 23:18:59 +00:00			`rm -rf /tmp/* && \`
tweaking, hardening 2018-05-04 16:29:55 +00:00			`rm -rf /var/cache/apk/*`
download instead of git pull download translation maps rather than running a git pull translation maps will now be bzip2 compressed to reduce traffic to a minimum fixes #432 2019-08-14 14:43:47 +00:00			`#`
include docker repos ... skip emobility since it is a dev repo 2017-10-13 18:58:14 +00:00			`# Healthcheck`
			`HEALTHCHECK --retries=10 CMD curl -s -XGET 'http://127.0.0.1:9600'`
download instead of git pull download translation maps rather than running a git pull translation maps will now be bzip2 compressed to reduce traffic to a minimum fixes #432 2019-08-14 14:43:47 +00:00			`#`
Start cleaning up and update documentation 2017-10-23 11:02:04 +00:00			`# Start logstash`
start on elk6.x 2018-04-18 15:21:32 +00:00			`#USER logstash:logstash`
provide fix for #669 2020-07-06 23:30:11 +00:00			`#CMD update.sh && exec /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf --config.reload.automatic --java-execution --log.level debug`
bump elk stack to 6.6.1 2019-02-28 14:52:42 +00:00			`CMD update.sh && exec /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf --config.reload.automatic --java-execution`