datmanslo/alpine-snort3 repository overview

⁠alpine-snort3

snort.org/snort3 ⁠

Image Download Size:

⁠Alpine Linux Snort 3 Runtime

⁠TL;DR

docker run -it --rm datmanslo/alpine-snort3 snort --version

or

docker run -it --rm datmanslo/alpine-snort3 ash

...if you want to see what's in there. Hint, look in /usr/local/

⁠Wait...what is this thing for?

This image is intentionally basic. It is intended to provide a clean (thin-ish) base layer upon which to build a functional Snort 3 service container tailored to your use case. YMMV

The Dockerfile leverages a multi-stage build from the Snort3 source in order to build a minimally sized base container upon which you can add your own special sauce

If you are looking for an image to hack on the Snort 3 source code, go check out Xiche's dockerhub repositories⁠. He has built functional dev environments for a number of popular distros.

⁠Obligatory Alpine Caveats

As Alpine Linux uses musl, you may run into some issues with environments expecting glibc-like behavior – especially if you try to use binaries compiled with glibc. You should recompile these binaries to use musl (compiling on Alpine is probably the easiest way to do this).

Note that Alpine 3.8 has shifted from OpenSSL to LibreSSL.

⁠To Do

My goal is to set up automated builds tracking the Snort 3 repo⁠ in the near future.