Ubuntu 24.04 containers for Suricata (4.x and newer) and Snort (2.9.16.x and newer) #234
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
-Changed FROM to ubuntu:24.04 -Installed new packages python3, python3-dev, python3-pip, libtool and libtirpc-dev -DAQ libraries have the command "autoreconf -f -i" added to the chain of commands used to compile and install the DAQ libraries in order to address a possible compilation failure -Snort has CFLAGS="-I/usr/include/tirpc" appended to the ./configure command in order to help snort locate RPC libraries it needs during compilation -final CMD statement at the end of the dockerfile changed from "python3.8" to "python3"
- From line changed to ubuntu:24.04 - installing new packages python3 python3-dev and python3-pip - Final CMD statement changed from "python3.8" to "python3"
xssfox
approved these changes
Nov 25, 2024
|
Looks good |
- Moved the hadolint ignore=DL3008 line to directly above the RUN apt-get statement in order to resolve docker-lint failure
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Greetings!
This PR is to address #199
Here is a summary of changes:
Dockerfile_suricata:
FROM ubuntu:24.04in order to use Ubuntu 24.04 as the base container imagepython3,python3-dev, andpython3-pipto mirror the packages pulled for the zeek containerdalton-agent.pyusespython3instead ofpython3.8to run the agent.Dockerfile_snort:
FROM ubuntu:24.04in order to use Ubuntu 24.04 as the base container imagepython3,python3-dev, andpython3-pipto mirror the packages pulled for the zeek containerapt-get:libtoollibtirpc-devautoreconf -f -ito the./configure && make && make installcommand chain to avoid a failure to compile the DAQ librariesCFLAGS="-I/usr/include/tirpc"to Snort's./configurecommand. This was necessary because by default Snort tries to look for the RPC headers in/usr/include/rpc. This is no longer correct, so we have to point to the new location of the RPC headers (/usr/include/tirpc) for snort to compile successfully)dalton-agent.pyusespython3instead ofpython3.8to run the agent.