search

jasonish / docker-suricata

A Suricata Docker image.
https://hub.docker.com/r/jasonish/suricata/
MIT License
250 stars 76 forks source link

sudo not found #24

Closed yodapotatofly closed 2 years ago

yodapotatofly commented 2 years ago

Hello,

in here master/examples/logrotate.sh, you suggest using docker exec suricata sudo logrotate /etc/logrotate.d/suricata $@ to rotate the logs. However, sudo doesn't appear to be installed in the container :

$ docker exec suricata sudo logrotate /etc/logrotate.d/suricata $@
OCI runtime exec failed: exec failed: container_linux.go:380: starting container process caused: exec: "sudo": executable file not found in $PATH: unknown

Am I missing something ?

jasonish commented 2 years ago

Unfortunately this script is out of date. You can rotate logs without sudo, for example:

docker exec CONTAINER_ID logrotate -v -f /etc/logrotate.d/suricata

note that forces and does it verbosely just to show that its working.

jasonish commented 2 years ago

Thanks, I've updated the README and removed this helper script.

yodapotatofly commented 2 years ago

I had tried that but i was running into some logrotate permission issue so I assumed sudo was required.

Thanks :)

jasonish commented 2 years ago

Log rotate will complain if the directory permissions aren't just right.. Was that it? Thats something I could look into making sure if correct on container startup, cause if its a host volume, who knows what the permissions are to start with.

yodapotatofly commented 2 years ago

Yep, i was testing on WSL and permissions with docker doesn't behave like in real linux. It was indeed a bind-mout to a host volume, but the host volume, in this particular case, was already a mountpoint from windows into WSL linux 😅

On standard linux, the mount doesn't seem to mess up the permissions.

jasonish commented 2 years ago

Yep, i was testing on WSL and permissions with docker doesn't behave like in real linux.

It was indeed a bind-mout to a host volume, but the host volume in this particular case was itself a mountpoint from windows into WSL linux 😅

On standard linux, the mount doesn't seem to mess up the permissions.

Oh it can in Linux as well. But you've added yet another layer of abstraction.

I've played with WSL a little, but with no real access from WSL to a real network interface I haven't got far.