Docker Deployment Guide

Quick Start

docker run -d \
  --name crowdsec \
  --volume /etc/crowdsec:/etc/crowdsec \
  --volume /var/lib/crowdsec/data/:/var/lib/crowdsec/data/ \
  --volume /var/log:/var/log:ro \
  --env COLLECTIONS="crowdsecurity/linux" \
  -p 127.0.0.1:8080:8080 \
  crowdsecurity/crowdsec:latest

Docker Compose (Recommended)

services:
  crowdsec:
    image: crowdsecurity/crowdsec:latest
    restart: always
    ports:
      - 127.0.0.1:8080:8080   # LAPI for bouncers on host or Docker
      - 127.0.0.1:6060:6060   # Prometheus metrics
      - 127.0.0.1:7422:7422   # AppSec WAF
    environment:
      COLLECTIONS: "crowdsecurity/traefik crowdsecurity/http-cve crowdsecurity/base-http-scenarios crowdsecurity/sshd crowdsecurity/linux"
      GID: "${GID-1000}"
      TZ: "UTC"
    volumes:
      - ./crowdsec/config:/etc/crowdsec
      - ./crowdsec/data:/var/lib/crowdsec/data
      # Log sources — mount from host or shared volume
      - /var/log/auth.log:/var/log/auth.log:ro
      - /var/log/syslog:/var/log/syslog:ro
      - ./traefik/logs:/var/log/traefik:ro
    networks:
      - proxy

networks:
  proxy:
    external: true

Key Aspects

1. Log Access

Mount log files from the host or shared volumes:

volumes:
  - /var/log/auth.log:/var/log/auth.log:ro
  - /var/log/syslog:/var/log/syslog:ro
  - logs-volume:/var/log/nginx:ro   # Shared volume with nginx container

2. Persist Data

Persisting these volumes is mandatory since CrowdSec v1.7.0:

volumes:
  - crowdsec-db:/var/lib/crowdsec/data/
  - crowdsec-config:/etc/crowdsec/

3. Use `depends_on`

If reading logs from a container that writes logs to a shared volume:

depends_on:
  - "reverse-proxy"

4. Network

CrowdSec must be on the same Docker network as bouncers (e.g., Traefik).

Environment Variables

Variable	Default	Description
`COLLECTIONS`	(none)	Space-separated list of collections to install
`TZ`	`UTC`	Timezone
`CONFIG_FILE`	`/etc/crowdsec/config.yaml`	Main config path
`LOCAL_API_URL`	`http://0.0.0.0:8080`	LAPI listen address
`DISABLE_LOCAL_API`	`false`	Agent-only mode (no LAPI)
`DISABLE_AGENT`	`false`	LAPI-only mode (no agent)
`AGENT_USERNAME`	(none)	For connecting to remote LAPI
`AGENT_PASSWORD`	(none)	For connecting to remote LAPI
`BOUNCER_KEY_<name>`	(none)	Seed API key for a bouncer

Enrolling in Console (Docker)

docker exec crowdsec cscli console enroll -e context <YOUR_ENROLL_KEY>

Execing Commands in Docker

All cscli commands work via docker exec:

docker exec crowdsec cscli collections list
docker exec crowdsec cscli bouncers add traefik-bouncer
docker exec crowdsec cscli metrics
docker exec crowdsec cscli decisions list

Volumes vs Bind Mounts

Approach	Pros	Cons
Named volumes	Managed by Docker, portable	Harder to inspect/modify
Bind mounts	Easy to edit config directly	Permissions issues on some hosts

For production, use bind mounts for config (so you can edit) and named volumes for data.

Logrotate for Docker

Log files can grow quickly. Configure logrotate on the host:

# /etc/logrotate.d/traefik
compress
/mnt/docker-volumes/traefik/logs/*.log {
  size 20M
  daily
  rotate 14
  missingok
  notifempty
  postrotate
    docker kill --signal="USR1" traefik
  endscript
}

3.4 KiB Raw Blame History