readystack/crowdsec repository overview

⁠CrowdSec (Local API)

readystack/crowdsec:v1.7.8-CE-ubuntu24.04-r1

A hardened, cosign-signed, offline-rebuildable build of github.com/crowdsecurity/crowdsec v1.7.8 (MIT), built clean-room from official upstream source by ReadyStack⁠.

⁠What you get

• Docker Scout Grade A — all 8 default policies pass, 0 fixable Critical/High.
• Signed — cosign signature by the ReadyStack release key; verify with cosign verify --key <(curl -fsSL https://readystack.dev/keys/cosign.pub) readystack/crowdsec:v1.7.8-CE-ubuntu24.04-r1.
• Built from source, non-root, on the current toolchain.

⁠Pulling

docker pull readystack/crowdsec:v1.7.8-CE-ubuntu24.04-r1

⁠Deployment

Single container, two static CGO-free Go binaries (crowdsec + cscli), foreground process running the CrowdSec LOCAL API (LAPI) only (crowdsec -c /etc/crowdsec/config.yaml -no-cs). The LAPI is the decision store + REST API that security bouncers query for ban decisions and that remote log-processing agents push alerts to. Its database is an EMBEDDED sqlite engine (pure-Go modernc) on the local filesystem at /var/lib/crowdsec/data/crowdsec.db - NO external/relational DB, NO sidecar, NO web UI. The image IS the complete running LAPI instance.

docker run -d --name crowdsec -p 8080:8080 -p 6060:6060 -v crowdsec-data:/var/lib/crowdsec readystack/crowdsec:v1.7.8-CE-ubuntu24.04-r1

⁠The full ReadyStack Agent-ready Archive

The complete --network=none build kit to recreate this exact image yourself — plus admin/DB/API handbooks, seed data, a validated test suite, and signed provenance — is at readystack.dev/buy.html⁠.

— ReadyStack · readystack.dev