# Docker

**English** · [Português](pt-BR/docker.md)

The image is for lab and research use. It runs the same `acaua` binary as a
native install, with the embedded UI. The skeleton does not enable the DuckDB
feature in the image; the store remains reserved for a later release.

## Build

```bash
docker build -t acaua .
docker run --rm -p 127.0.0.1:8787:8787 -v "$PWD/data/acaua:/data/acaua" acaua
```

The build stage uses `rust:1-slim-bookworm`; the runtime stage uses
`debian:bookworm-slim` and installs only `ca-certificates`, `curl` and `tar`
(the updater needs `curl` and `tar`).

## Compose

```bash
cp .env.example .env   # optional: set ZEEK_INTERFACE
docker compose up --build
```

The Compose file starts two services:

| Service | Purpose | Notes |
|---|---|---|
| `zeek` | Capture and write Zeek logs to `./data/zeek` | Host network and `NET_RAW`/`NET_ADMIN` |
| `acaua` | Read logs and serve the UI/API | Host port bound to `127.0.0.1:8787` |

`acaua` mounts `./data/zeek` read-only at `/data/zeek` and `./data/acaua`
read-write at `/data/acaua`. The daemon inside the container binds
`0.0.0.0:8787`, but the published port is loopback-only on the host.

## Data layout

```text
data/
  zeek/      # Zeek logs, written by the zeek service
  acaua/     # store, exports and runtime files
```

Do not mount the host root or a directory containing unrelated sensitive files.
The parser is expected to confine paths to the dataset root; the skeleton does
not parse records yet.

## Security notes

- The `zeek` service needs packet capture privileges. Run it only on an
  interface and network you are authorized to monitor.
- Do not change the host port mapping to `0.0.0.0:8787` without an
  authenticating reverse proxy.
- The image has no telemetry and no outbound connection except an explicit
  `acaua update`.
- The container is not a sandbox for hostile datasets. Treat a malformed capture
  as hostile input and keep the container unprivileged.

## Limitations

- No DuckDB build in the image; the analytical store is not active.
- The UI is a shell and `analyze` returns a stub report.
- The image does not include Zeek; the Compose file uses the upstream Zeek
  image.
- There is no published image registry yet. Build locally.