search

google / timesketch

Collaborative forensic timeline analysis
Apache License 2.0
2.59k stars 590 forks source link

TimeSketch on ARM64 #2721

Open HakkYahud opened 1 year ago

HakkYahud commented 1 year ago

Hello,

I would like to set up a development environment on timesketch to test it. However, my current system is a Mac M1 which run on ARM. I would like to know if it timesketch is multi arch ?

Running the docker compose gives me the following error : "... exec format error".

May I have some assistance for this current issue ?

I have checked the docker-compose file, and maybe the path of the image is pulling the amd64 version, which is the incorrect one for me.

Thank you

jeffc-s1 commented 1 year ago

I'm using TS on arm64, I've replaced the existing Dockerfile with one that bases it off a python container and then installs everything with pip. It takes a bit longer to process initially, but here's the Dockerfile.

# Changing base to python alpine
FROM python:3

RUN pip3 install -r https://raw.githubusercontent.com/google/timesketch/master/requirements.txt
RUN pip3 install https://github.com/google/timesketch/archive/master.zip
RUN pip3 install plaso psycopg2

COPY docker-entrypoint.sh /
RUN chmod a+x /docker-entrypoint.sh

# Load the entrypoint script to be run later
ENTRYPOINT ["/docker-entrypoint.sh"]