A Docker-based honeypot that creates disposable containers to capture and analyze attack attempts.
Dockerpot is a Docker-based honeypot designed to simulate vulnerable services and capture malicious activity in isolated containers. It helps security professionals analyze attack patterns by providing a safe, disposable environment that logs attacker interactions. The project focuses on simplicity and isolation, using Docker to ensure honeypots are fully separated from the host system.
Security researchers, system administrators, and DevOps engineers who need to monitor and study network attacks in a controlled, low-risk environment.
Developers choose Dockerpot for its lightweight, containerized approach that simplifies deployment and cleanup, reducing the overhead of traditional honeypot setups. Its integration with auditd and customizable service configurations offers detailed logging and flexibility for various attack scenarios.
A docker based honeypot.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses Docker to run each honeypot in isolated containers, ensuring complete separation from the host system to prevent compromise, as emphasized in the installation guide.
Includes cron jobs to automatically remove old containers every 5 minutes via honeypot.clean, preventing resource exhaustion as specified in the crond configuration.
Integrates with auditd to log system calls like execve for in-depth analysis, with rules appended to /etc/audit/audit.rules per the README.
Passes the attacker's IP address to the container via the REMOTE_HOST environment variable, enabling easy identification and logging of malicious sources.
Requires installing multiple dependencies (docker.io, socat, xinetd, auditd), copying scripts, and configuring system services manually, which is time-consuming and error-prone.
Primarily designed for SSH honeypots on port 22; adapting to other services requires modifying iptables rules and xinetd configurations, adding to setup effort.
The README directs users to a 2015 blog post for a better summary, indicating core documentation may be incomplete or not maintained.
Relies on specific tools like xinetd and auditd, which are not universally available across all Linux distributions, limiting cross-platform compatibility.