Docker Snort3

Description

Unofficial snort3 IDS/IPS software docker image.

Information

• From : Debian Bookworm Slim
• Size : 755 MB
• Snort : 3.7.2.0
• Libdaq : 3.0.19

Installation

git clone https://github.com/MikeHorn-git/docker-snort3.git
cd docker-snort3/
docker compose up

Usage

To use file from your host :

• Create a directory in your home with the name snort
• Modify the docker-compose.yml, to replace the $USER var to your username in the volumes section
• Place the files you want in host : /home/$USER/snort
• In the docker container they are available at /files

Example 1

docker compose run --rm snort3 -i eth0

Example 2

docker compose run --rm snort3 -r /files/file.pcap

Security

• Lint with hadolint
• Scan with trivy