topic Re: Docker Container for Expedition in Expedition Discussions

Docker Container for Expedition

jlegarreta — Tue, 01 Oct 2019 17:36:52 GMT

I created a Docker container for the Palo Alto Expedition tool as of version 1.1.38 and published it to Docker Hub. I rebuilt it on Alpine Linux and stripped the binaries, reducing the image size to a mere 1.43 GB. Optionally, you can make the database persistent by binding a directory on your host machine to /var/lib/mysql. Likewise you can bind a directory to /data for data persistence. I made a tweak to the MySQL config to store the innodb temp file to /tmp within the container, which allows the container to support database persistence on Mac OS (and presumably Windows) in addition to Linux. This was necessary due to an issue with the Alpine host on Mac OS/Windows using a ZFS backend and MariaDB being incompatible https://jira.mariadb.org/browse/MDEV-16015

Docker Hub Repo:

https://hub.docker.com/r/jlegarreta/expedition

GitHub Repo (Docker source):
https://github.com/jlegarreta/expedition

Among other things, these are some of the dashboard errors I fixed:

- Remediated the "log_bin flag in MariaDB is set to off" issue by turning it on in the MySQL config

- Remediated the DBSQL_LOG_BIN value issue by setting it to 0 in /home/userSpace/userDefinitions.php

Assuming you have sufficient disk space, your dashboard should be all green out of the box 🙂

Enjoy!

Re: Docker Container for Expedition

chrisbo — Thu, 03 Oct 2019 06:59:10 GMT

Hi,

the username/password (admin/paloalto) does not work for the admin gui.

Did you change it?

Re: Docker Container for Expedition

jlegarreta — Fri, 04 Oct 2019 03:46:41 GMT

Hello,

First off I just want to say thank you for the feedback. As it turns out, the password was not being recognized because the DB could not be communicated with due to a permissions issue.

Please delete your current image and pull the latest image from Docker Hub and give it a shot. Let me know if it works for you.

Thanks!

Re: Docker Container for Expedition

chrisbo — Fri, 04 Oct 2019 08:08:48 GMT

Hi,

the new image worked great!

Thanks for your hard work with creating the image.

Re: Docker Container for Expedition

dgildelaig — Fri, 04 Oct 2019 21:06:56 GMT

This is a good initiative.

I didn't test the container. Some things you could check if they work:

- RabbitMQ works correctly to execute background tasks, such as API calls

- Perl packages are working correctly for Checkpoint migrations

- Python modules work correctly for BPA modules

- Spark and JDK 1.8 is correctly installed and settings tunned for CSV processing, Rule Enrichment and Machine Learning.

- Modules for AD and Radius work correctly for external authentication (if required)

Re: Docker Container for Expedition

jlegarreta — Sat, 05 Oct 2019 21:07:13 GMT

Thanks! These are some great ideas, perhaps unit tests could be written for the items that you listed. A coworker of mine is more familiar with the user-end of the product, so I might have him test some of these features. I also encourange anyone on these forums to pull the Docker image and test out the features for themselves, and report the results.

Re: Docker Container for Expedition

andrewohanian — Fri, 20 Nov 2020 03:11:41 GMT

Thanks for the image! Is it possible to update expedition from the image?

Re: Docker Container for Expedition

lychiang — Fri, 20 Nov 2020 21:32:56 GMT

@andrewohanian

Try issue below commands:

$sudo apt-get update

$sudo apt-get install expedition-beta

Re: Docker Container for Expedition

John_Merry — Wed, 14 Apr 2021 10:08:54 GMT

Hello,

Can any one help?

How can I run this

$sudo apt-get update

$sudo apt-get install expedition-beta

"inside" the docker image? I tried to bash inside the image but can't run the commands - what am I missing? 😕

As I can't update the expedition application 😞

Many thanks

John

Re: Docker Container for Expedition

lychiang — Wed, 14 Apr 2021 20:19:26 GMT

Hi @John_Merry The commands only works in Ubuntu VM not on the docker container, you might want to contact the author for the docker image and see if he has any instructions.

Re: Docker Container for Expedition

jlegarreta — Mon, 19 Apr 2021 08:40:09 GMT

@John_Merry try pulling the latest docker image. I just pushed an update for version 1.1.96. This time I made it Ubuntu-based, so the commands you described will work in the future.

Re: Docker Container for Expedition

John_Merry — Mon, 19 Apr 2021 14:09:40 GMT

Hi @jlegarreta ,

Thank you 🙂 I have pulled the new service and seems to be working and the bash update inside to run expedition updates 🙂

However I can't run if using the following code (it crashes)

docker run --detach --volume ${HOME}/expedition/data:/data --volume ${HOME}/expedition/db:/var/lib/mysql --publish 443:443 --publish 4050:4050 jlegarreta/expedition:latest

I guess the mapping of the --volumes is different for ubuntu?

If I remove the mapping it works 🙂

Finally will you be updating if new version of ubuntu is release or v2.0 of expedition?

Many thanks again for your support

John

Re: Docker Container for Expedition

slp-security — Tue, 18 May 2021 05:59:20 GMT

Hi all,

I installed the last version of expedtion docker image on Ubuntu (running on AWS).

The installation was running fine but once I created the fist project (and importing a PA config file) the docker image refuse to start...

Starting all services for expedition...
* Starting rsyslogd...
* Starting enhanced syslogd rsyslogd
rsyslogd: imklog: cannot open kernel log (/proc/kmsg): Operation not permitted.
rsyslogd: activation of module imklog failed [v8.2102.0 try https://www.rsyslog.com/e/2145 ]
...done.
* Starting sshd...
* Starting OpenBSD Secure Shell server sshd
...done.
* Starting rabbitmq...
* Starting RabbitMQ Messaging Server rabbitmq-server
...done.
* Starting mysql...
* Starting MariaDB database server mysqld
...fail!

root@ip-100-64-6-5:/efs/expedition# cat docker-compose.yml
version: '3'

services:
expedition:
image: jlegarreta/expedition:latest
restart: always
volumes:
- ./data:/data
- ./db:/var/lib/mysql
ports:
- 8006:80
- 8106:443
- 8107:4050

What could be the problem ??

Regards,

Re: Docker Container for Expedition

jlegarreta — Tue, 18 May 2021 06:27:44 GMT

@slp-security try adding this flag to the docker run command

--cap-add syslog

Re: Docker Container for Expedition

slp-security — Tue, 18 May 2021 15:24:57 GMT

Hi,

What will be the syntax in the docker-compose file (very newbie with docker...) ?

Many thanks for your help.

Regards,

Re: Docker Container for Expedition

slp-security — Tue, 18 May 2021 15:27:44 GMT

Current file...

version: '3'

services:
expedition:
image: jlegarreta/expedition:latest
restart: always
volumes:
- ./data:/data
- ./db:/var/lib/mysql
ports:
- 8006:80
- 8106:443
- 8107:4050

Re: Docker Container for Expedition

jlegarreta — Tue, 18 May 2021 18:10:02 GMT

@slp-security The syntax for docker compose is here https://docs.docker.com/compose/compose-file/compose-file-v2/#cap_add-cap_drop

cap_add:
  - SYSLOG

Re: Docker Container for Expedition

slp-security — Wed, 26 May 2021 17:47:22 GMT

Hi,

We applied the recommended command. After that the container starts correctly, but...

If we stop it, the container cannot start once again...

# cat docker-compose.yml
version: '3'

services:
expedition:
image: jlegarreta/expedition:latest
restart: always
volumes:
- ./data:/data
- ./db:/var/lib/mysql
ports:
- 8006:80
- 8106:443
- 8107:4050
cap_add:
- SYSLOG

Starting all services for expedition...
* Starting rsyslogd...
* Starting enhanced syslogd rsyslogd
...done.
* Starting sshd...
* Starting OpenBSD Secure Shell server sshd
...done.
* Starting rabbitmq...
* Starting RabbitMQ Messaging Server rabbitmq-server
...done.
* Starting mysql...
* Starting MariaDB database server mysqld
...fail!

We are a little bit lost...

Regards,

Re: Docker Container for Expedition

YeungHing — Fri, 13 May 2022 02:46:03 GMT

I get this error when I upload a 15M config file.
I want to modify the php.ini. Yet, is the file in the docker container which I can modified?
Please advise what can I do to fix it

Re: Docker Container for Expedition

lychiang — Fri, 13 May 2022 15:39:41 GMT

@YeungHing You will need to login to the CLI of the VM, Please refer below article for how to modify the file:

https://live.paloaltonetworks.com/t5/expedition-discussions/how-to-upload-configuration-files-bigger-than-2mb/m-p/215689#M14