Giters

WithSecureLabs / snake

snake - a malware storage zoo

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Add docker support

pieterbork opened this issue · comments

commented

I found your project while looking for a place to house some malware and wanted to give it a quick look, however I didn't want to run it on my host machine and have been having some issues getting it to work in docker (no systemd, 404 on web ui when trying to run everything individually).

I see that the last update to snake was about 11 months at this point - are there plans to continue support for this application? If so it would be great to have a docker-compose file so that spinning up an instance is trivial. I'd be happy to help with this if there is interest - seems like there should be 3 or 4 docker containers - mongo/redis/snake backend/snake frontend.

Cheers,
Pieter

commented

Hi Pieter,

Its not dead just a little dormant! There are new changes sitting in development that need merging into master, I was waiting for celery to update and now that it has been, the blocker is gone. On the dormant front there is quite a lot I would like to do but very little time my side at the moment especially as it currently serves our need adequately internally at the time of writing.

So, someone mentioned wanting docker support in an earlier issue and said that they would submit a PR, but that never happened and at the time my docker knowledge was non existent. As that has now changed and I know how to go about making scales persistent, creating some Dockerfiles should be trivial.

I will set some time aside today to squash the last couple of bugs in the development branch, merge that into master, create initial docker support, and update the docs where required.

As docker containers have to be individual services, I would split it like so with a shared volume for the samples: mongo/redis/snake core/snake pit/snake skin. This would also allow scaling of workers as required, ideally we should remove the shared volume too and get core to send the samples to the workers but that is on the list...

Alex

commented

Hey Alex,

Thanks for the quick and detailed response. I haven't worked with submodules too much - I should've thought to check for development branches there. This sounds great and I can't wait to try it out - thanks for all your hard work!

Cheers,
Pieter

commented

As usual, took longer than I wanted but have an initial version ready now if you want to test before I bump snake to version 1.1 and update the docs.

So you should be able to get an instance running with:

git clone https://github.com/countercept/snake.git
git submodule init
git submodule update
sudo docker-compose up

If you want to install scales once the system is up:

sudo docker exec -it snake_snake_1 /entrypoint.sh /bin/bash
snake install SCALE_NAME

When I update the README, I will add how to use custom volumes for persistence, etc.

commented

This is fantastic! All containers launched with no problems at all.

Thanks for the quick turnaround - I'll be testing this the next few days and replacing my current solution with snake sometime next week if everything works out. I'll be sure to let you know if I have any issues.

Cheers,
Pieter