Lucas RayanandClaude Sonnet 5
8a80504c45
Acaua is a collective SOC daemon consuming only Zeek log files, not a single-user tool needing local hardware like its siblings. Drop the Tauri desktop shell, installers and self-update entirely; the server and its web dashboard ship as a container, updated by pulling a new image tag. Link against the official prebuilt libduckdb instead of compiling it from source via the bundled feature, cutting image build time from 15+ minutes to about 3. Fix a real bug found along the way: as PID 1 in a container, the daemon ignored SIGTERM and was always killed after the stop timeout; it now shuts down gracefully. Also corrects the Pillar 1 beaconing score: the period estimate had a harmonic alias (a perfectly periodic 4h series resolved to 600s), and the old score formula flagged pure random traffic as suspicious (p95 = 0.839 on Poisson noise). The new formula was validated against 300 samples per scenario. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
2.6 KiB
Docker
English · Português
Acauã is distributed as an official container image:
git.lucasrguerra.dev.br/ciberfauna/acaua.
Available image tags:
latest: Most recent stable release.X.Y.Z/X.Y: Pinned semantic versions.edge: Built automatically from themainbranch.
The container runs as an unprivileged system user (acaua, UID 10001), with a
read-only root filesystem (read_only: true), all capabilities dropped
(cap_drop: [ALL]), and security hardening (no-new-privileges:true).
Compose deployment
The recommended production and lab deployment uses Docker Compose:
cp .env.example .env # configure ZEEK_INTERFACE (authorized networks only)
docker compose pull && docker compose up -d
To build and run locally from source:
docker compose up -d --build
The stack coordinates two services:
| Service | Image | Purpose | Security profile |
|---|---|---|---|
zeek |
zeek/zeek:9.0.1 |
Network packet capture and hourly log rotation | Host network, NET_RAW and NET_ADMIN capabilities |
acaua |
git.lucasrguerra.dev.br/ciberfauna/acaua |
Analytical processing, API and web dashboard | Unprivileged (UID 10001), read-only rootfs, no capabilities |
Volumes and data layout
The stack uses named volumes to manage ownership and permissions cleanly:
zeek-logs: Shared volume mounted at/logsin the Zeek service and mounted read-only at/data/zeek:roin the Acauã service.acaua-data: Dedicated read-write volume mounted at/data/acauafor DuckDB analytical store, Parquet partitions and runtime files.
To inspect or extract data on the host:
docker compose cp acaua:/data/acaua ./local-acaua-backup
Or run a one-off inspection container:
docker run --rm -v acaua_acaua-data:/data:ro debian:trixie-slim ls -la /data
Updating
Because Acauã runs as a multi-user collective SOC daemon, updates are performed by pulling the latest verified image:
docker compose pull && docker compose up -d
The running daemon shuts down cleanly on SIGTERM within sub-second intervals,
ensuring Parquet writes and DuckDB transactions are committed properly.
Security notes
- The
zeekservice requires packet capture privileges (NET_RAW,NET_ADMIN). Run it only on interfaces and networks you are explicitly authorized to monitor. - The default dashboard binding is loopback-only (
ACAUA_PUBLISH=127.0.0.1:8787). Do not expose the service on external interfaces without an authenticating reverse proxy. - The image contains no telemetry. Outbound traffic is restricted to operator-initiated update checks against the Gitea Releases API.