Docker Container for Expedition

[jlegarreta]

I created a Docker container for the Palo Alto Expedition tool as of version 1.1.38 and published it to Docker Hub. I rebuilt it on Alpine Linux and stripped the binaries, reducing the image size to a mere 1.43 GB. Optionally, you can make the database persistent by binding a directory on your host machine to /var/lib/mysql. Likewise you can bind a directory to /data for data persistence. I made a tweak to the MySQL config to store the innodb temp file to /tmp within the container, which allows the container to support database persistence on Mac OS (and presumably Windows) in addition to Linux. This was necessary due to an issue with the Alpine host on Mac OS/Windows using a ZFS backend and MariaDB being incompatible https://jira.mariadb.org/browse/MDEV-16015

Docker Hub Repo:

https://hub.docker.com/r/jlegarreta/expedition

GitHub Repo (Docker source):
https://github.com/jlegarreta/expedition

Among other things, these are some of the dashboard errors I fixed:

- Remediated the "log_bin flag in MariaDB is set to off" issue by turning it on in the MySQL config

- Remediated the DBSQL_LOG_BIN value issue by setting it to 0 in /home/userSpace/userDefinitions.php

Assuming you have sufficient disk space, your dashboard should be all green out of the box 🙂

Enjoy!

[chrisbo]

Hi,

the username/password (admin/paloalto) does not work for the admin gui.

Did you change it?

[jlegarreta]

Hello,

First off I just want to say thank you for the feedback. As it turns out, the password was not being recognized because the DB could not be communicated with due to a permissions issue.

Please delete your current image and pull the latest image from Docker Hub and give it a shot. Let me know if it works for you.

Thanks!

[chrisbo]

Hi,

the new image worked great!

Thanks for your hard work with creating the image.

[dgildelaig]

This is a good initiative.

 I didn't test the container. Some things you could check if they work:

- RabbitMQ works correctly to execute background tasks, such as API calls

- Perl packages are working correctly for Checkpoint migrations

- Python modules work correctly for BPA modules

- Spark and JDK 1.8 is correctly installed and settings tunned for CSV processing, Rule Enrichment and Machine Learning.

- Modules for AD and Radius work correctly for external authentication (if required)

[jlegarreta]

Thanks! These are some great ideas, perhaps unit tests could be written for the items that you listed. A coworker of mine is more familiar with the user-end of the product, so I might have him test some of these features. I also encourange anyone on these forums to pull the Docker image and test out the features for themselves, and report the results.

[andrewohanian]

Thanks for the image! Is it possible to update expedition from the image?

[lychiang]

@andrewohanian 

Try issue below commands:

$sudo apt-get update

$sudo apt-get install expedition-beta

[John_Merry]

Hello,

Can any one help?

How can I run this

$sudo apt-get update

$sudo apt-get install expedition-beta

"inside" the docker image?  I tried to bash inside the image but can't run the commands - what am I missing? 😕

As I can't update the expedition application 😞

Many thanks

John

[lychiang]

Hi @John_Merry  The commands only works in Ubuntu VM not on the docker container, you might want to contact the author for the docker image and see if he has any instructions.

[jlegarreta]

@John_Merry try pulling the latest docker image. I just pushed an update for version 1.1.96. This time I made it Ubuntu-based, so the commands you described will work in the future.

[John_Merry]

Hi @jlegarreta ,

Thank you 🙂 I have pulled the new service and seems to be working and the bash update inside to run expedition updates 🙂

However I can't run if using the following code (it crashes)

docker run --detach --volume ${HOME}/expedition/data:/data --volume ${HOME}/expedition/db:/var/lib/mysql --publish 443:443 --publish 4050:4050 jlegarreta/expedition:latest

I guess the mapping of the --volumes is different for ubuntu?

If I remove the mapping it works 🙂

Finally will you be updating if new version of ubuntu is release or v2.0 of expedition?

Many thanks again for your support

John

[slp-security]

Hi all,

I installed the last version of expedtion docker image on Ubuntu (running on AWS).

The installation was running fine but once I created the fist project (and importing a PA config file) the docker image refuse to start...

Starting all services for expedition...
* Starting rsyslogd...
* Starting enhanced syslogd rsyslogd
rsyslogd: imklog: cannot open kernel log (/proc/kmsg): Operation not permitted.
rsyslogd: activation of module imklog failed [v8.2102.0 try https://www.rsyslog.com/e/2145 ]
...done.
* Starting sshd...
* Starting OpenBSD Secure Shell server sshd
...done.
* Starting rabbitmq...
* Starting RabbitMQ Messaging Server rabbitmq-server
...done.
* Starting mysql...
* Starting MariaDB database server mysqld
...fail!

root@ip-100-64-6-5:/efs/expedition# cat docker-compose.yml
version: '3'

services:
expedition:
image: jlegarreta/expedition:latest
restart: always
volumes:
- ./data:/data
- ./db:/var/lib/mysql
ports:
- 8006:80
- 8106:443
- 8107:4050

What could be the problem ??

Regards,

HA

[jlegarreta]

@slp-security try adding this flag to the docker run command

--cap-add syslog

[slp-security]

Hi,

What will be the syntax in the docker-compose file (very newbie with docker...) ?

Many thanks for your help.

Regards,

HA