This repository contains the files to build a Docker image of the Arkime software:

https://arkime.com/

Ready to use Docker images can be pulled from https://hub.docker.com/r/mammo0/docker-arkime

To run this image a working Elasticsearch environment is required. Please stick to their documentation for setting this up. (E.g. for docker: https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html)

This image can be run with

docker run \
    -e ES_HOST=elasticsearch \
    -e ES_PORT 9200 \
    -v <config_volume>:/data/config \
    -v <pcap_volume>:/data/pcap \
    -v <log_volume>:/data/logs \
    mammo0/docker-arkime:<tag>

These parameters are available:

You can use docker-compose if you want to setup Elasticsearch together with Arkime in one step.

1. Please copy or rename the file docker-compose.env to .env before running docker-compose up. You may want to change some of the variables inside. Each variable is documented there.

2. Please ensure you have done this step (otherwise Elasticsearch won't start): https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html

3. Run chmod -R 777 es_data OR chown -R 1000:1000 es_data. This is needed for the Elasticsearch containers to be able to write to that direcotry.

Simply run

docker-compose up -d

It can take some time until the Elasticsearch instances are fully started.

The Arkime viewer instance can be accessed via

http://localhost:8005

Assuming you don't changed the default port in the .env file.

To import existing pcap files have a look at scripts/arkime-parse-pcap-folder.sh script. It can be run within the running container:

docker exec -it <container_name> \
    /data/arkime-parse-pcap-folder.sh -d <directory_with_pcap_files> -t <tag>

If parameter -d is omitted, the script asks if you want to import the default direcotry /data/pcap.