Docker Snort3

Description

Unofficial snort3 IDS/IPS software docker image.

Information

• From : Debian Bookworm Slim
• Size : 756 MB
• Time : Build from source. Take multiples minutes depending on your system
• Snort Version : 3.3.7.0
• Libdaq Version : 3.0.16
• Trivy : 0 unfixed vulnerabilities.

Installation

Docker Hub

docker pull mikehorn/snort3:latest

Build Yourself

git clone https://github.com/MikeHorn-git/docker-snort3.git
cd docker-snort3/
docker compose build

Usage

To use file from your host :

• Create a directory in your home with the name snort
• Modify the docker-compose.yml, to replace the $USER var to your username in the volumes section
• Place the files you want in host : /home/$USER/snort
• In the docker container they are available at /files

Example 1

docker compose run --rm snort3 -i eth0

Example 2

docker compose run --rm snort3 -r /files/file.pcap

Security

• Lint with hadolint
• Scan with trivy

To-Do

• Create and configure snort.conf file.
• Add docker-compose.yml file.
• Push image to Docker Hub.