phantomski/ntopng repository overview

⁠What is this

ntopng Docker images for arm64 architectures like Raspberry Pi 4 / 400 / 3 / Zero 2 W, Odroid C2 / C4 / N2+, Apple M1 / M2 Macs, Amazon EC2 on AWS Graviton, Microsoft Project Volterra, etc.

Latest version of this image build process is as following:

• built directly from my GitHub ntopng Docker fork repo Dockerfile.ntopng-arm64
• due to systemd limitation (single process in containers enforced) built using docker-in-docker docker:20.10.23-dind
• using official Docker Debian 12.12 Bookworm Slim debian:bookworm-slim as a base image
• using ntopng arm64 Debian Bookworm Raspberry Pi specific nightly (weekly) dev build 6.5.250907
• tested and runs well on Raspberry Pi 5 8GB in Ubuntu 24.04.3 LTS on Docker 28.3.3 | containerd 1.7.27 | runc v1.2.5, using 64-bit aarch64 Linux kernel v6.8.0 (1036-raspi)
• possibly also compatible with other arm64 architecture based systems (Odroid C2, Odroid C4, Odroid N2+, Apple M1/M2 Macs, Amazon EC2 on AWS Graviton, Microsoft Project Volterra, etc.), but not tested there

I attempt to manually build and test the Docker images from the above mentioned Dockerfile periodically, using the latest nightly package builds and debian:bookworm-slim as a base image (versions up to 5.1.211121 were debian:buster-slim only and versions up to 5.1.231015 were debian:bullseye-slim only). The resulting images that passed the test are available here with the bookworm-arm64, latest and version specific x.x.xxxxxx-bookworm-arm64 tags.

⁠Install & Run

docker run -it -v $(pwd)/ntopng.license:/etc/ntopng.license:ro --net=host phantomski/ntopng -i eth0

Please replace eth0 with the host interface you want to capture traffic from.

Unless you use the community edition of ntopng, the -v $(pwd)/ntopng.license:/etc/ntopng.license is necessary to let ntopng running inside the container to recognise the optional purchased license. If you want to run free community version, this part of the command can be omitted, but please see the note below. For further information please read https://www.ntop.org/support/faq/license-inside-a-container/⁠

Please note: If you're running community edition (free) without a license in versions 211003, 211010 and 211017, don't forget to include --community command line argument, i.e. docker run -it -v --net=host phantomski/ntopng --community -i eth0, otherwise ntopng will crash on script errors after the enterprise trial period expires (10 minutes after container start). This bug is now resolved in builds 211024 and later.

⁠Historical context

With the release of version 5.1 the team behind ntop-ng software⁠ stopped providing Raspberry Pi specific Dockerfiles in their official ntop Docker GitHub repository⁠. The new official Docker images provided on Docker Hub were based on full version of Ubuntu 20.04 instead of previous Debian Buster and were amd64 architecture only. In their own packages repository⁠, they offered a wide variety of Debian and Ubuntu packages for stable and nightly builds, which were almost exclusively amd64 architecture as well, with the exception of Raspberry Pi, which was also available in 32-bit armhf version. This probably runs well on Pi up to version 2, but is not natively supported on Pi 4 / Pi 400, which is using BCM2711 / ARM Cortex-A72 and Pi 3 / Zero 2 W using BCM2837 / Cortex-A53 CPUs, which are 64-bit arm64 architecture (ARMv8.0-A to be exact).

To mitigate this issue and enable ntop-ng to run on rPi 4/400/3/Zero2W, I've created the custom arm64 Dockerfile in my custom fork of ntop Docker GitHub repo⁠. Instead of relying directly on the latest arm64 versions (which were old) in the official Ubuntu, Debian and/or ntop.org repositories, it added the specific Raspberry Pi http://packages.ntop.org/RaspberryPI/⁠ repository and then added armhf as foreign architecture to Debian's dpkg package tool, so it installed more recent 32bit armhf versions if and where available.

Using latest versions (available only in armhf) needed few modifications:

• armhf architecture had to be added to apt package manager as possible source, otherwise ntopng won't install (not available in all repository for Raspberry Pi)
• ntopng had to be forced to install with armhf specified, otherwise it looked for arm64 which was not available
• it then installed its dependencies as armhf also, if required (as dpkg recognises additional architecture)
• libcap2:armhf and libzstd1:armhf were missing in dependencies, but required, so they're installed manually

The resulting containers mostly ran without problems on 64bit Linux kernel automatically using the /lib/ld-linux-armhf.so.3 interpreter, but please bear in mind this armhf on arm64 combination is basically a hack, potentially unstable and not officially supported. Indeed some 4.3.x version packages I've tested were crashing with the bus error, most likely caused by memory allocation problems.

Starting in the end of November 2021, the team started providing debian:bullseye builds as well. Unfortunately these were somehow lagging behind debian:buster versions in their repository, so a the moment, I was trying to build both, until Bullseye became primary. The tags changed accordingly.

Throughout the 2022, once ntopng v5.5 became available, the team finally started releasing arm64 nightly builds as well. These are now officially supported in the Raspberry Pi Debian Bullseye repository so can be basically accepted without major changes.

I intend to keep this Raspberry Pi arm64 specific fork updated for a while, until it becomes officially supported platform in all Github, Docker and Linux system repositories.

Further details are in the repository in the associated PRs and in the Dockerfile itself.