Sign inSign up

digitaldriveio/crowdsec-rsyslog

By digitaldriveio

•Updated about 3 hours ago

Minimal rsyslog on Debian Trixie with s6-overlay and single-file output.

Image
0

6.4K

digitaldriveio/crowdsec-rsyslog repository overview

⁠digitaldriveio/crowdsec-rsyslog

Minimal Debian Trixie image running rsyslog under s6 supervision. The container renders /etc/rsyslog.conf at boot and writes all logs to a single file in a mountable directory.

⁠Key Features

  • Debian Trixie base with s6-overlay init (/init).
  • Foreground rsyslogd managed by s6; container exits on failure.
  • Boot-time config rendering and optional UID/GID ownership control.
  • Optional UDP/TCP listeners with local-network allowlist.

⁠Quick Start

docker run --rm -it \
  -v "$(pwd)/logs:/var/log/rsyslog" \
  -e RSYSLOG_FILE_UID=1000 \
  -e RSYSLOG_FILE_GID=1000 \
  digitaldriveio/crowdsec-rsyslog:latest

⁠Environment Variables

VariableDefaultDescription
RSYSLOG_OUTPUT_DIR/var/log/rsyslogDirectory created at boot for log output.
RSYSLOG_OUTPUT_FILE${RSYSLOG_OUTPUT_DIR}/rsyslog.logFull log file path.
RSYSLOG_FILE_UID(unset)Optional UID for output directory and file ownership.
RSYSLOG_FILE_GID(unset)Optional GID for output directory and file ownership.
RSYSLOG_ENABLE_NETWORKfalseEnable UDP/TCP listeners for remote syslog.
RSYSLOG_NETWORK_PROTOCOLSudp,tcpProtocols to enable (comma-separated).
RSYSLOG_NETWORK_PORT514Port for network listeners.
RSYSLOG_NETWORK_BIND0.0.0.0IPv4 bind address.
RSYSLOG_NETWORK_BIND6::IPv6 bind address (disable to skip IPv6).
RSYSLOG_ALLOW_REGEX(unset)Regex filter for $fromhost-ip.

⁠Notes

  • The default config only enables local socket logging (imuxsock).
  • To accept remote logs, set RSYSLOG_ENABLE_NETWORK=true.

Tag summary

Content type

Image

Digest

sha256:c1dc1a39d…

Size

90.1 MB

Last updated

about 3 hours ago

docker pull digitaldriveio/crowdsec-rsyslog:snapshot