# wazuh-docker

Companion files for the lesson **Wazuh Docker Deployment**:
<https://maheshtata.com/wazuh/wazuh-docker/>

Tested against: Wazuh 5.0.0-beta5, official single-node Docker stack, lab-verified 23 September 2026.

| File | What it is |
|---|---|
| `docker-compose.single-node.yml` | Annotated copy of `single-node/docker-compose.yml` from `wazuh/wazuh-docker` at tag `v5.0.0-beta5`. Services, images, ports, environment variables and volumes are unchanged; only `NOTE:` comments were added. |
| `config.yml` | Certificate configuration for the single-node stack, as published in the Docker deployment documentation. |
| `docker-compose.agent.yml` | Annotated copy of `wazuh-agent/docker-compose.yml` from the same tag. |

## How to use these

These are a reading aid, not a replacement for the upstream repository. The
supported path is to clone it and compare:

```bash
git clone https://github.com/wazuh/wazuh-docker.git -b v5.0.0-beta5
cd wazuh-docker/single-node/
```

Then, on the Docker host:

```bash
sysctl -w vm.max_map_count=262144
```

Generate certificates with `config.yml` in place:

```bash
curl -o wazuh-certs-tool.sh https://packages-staging.xdrsiem.wazuh.info/pre-release/5.x/installation-assistant/wazuh-certs-tool-5.0.0-beta5.sh
bash ../tools/utils/deployment/certificates-conf.sh --cert --copy --priv
```

The certificate tool needs bash 4 or newer and GNU awk. Verified on 5.0.0-beta5:
macOS bash 3.2 fails with `mapfile: command not found`, `declare: -n: invalid option`
and `ERROR: Invalid certificate temporary path.`, and BusyBox awk in a plain Alpine
container fails on the same parser. Both still print `Process completed.` at the end,
so check for `.pem` files before trusting it. Run it in a Linux container with `gawk`
installed and the `single-node` directory bind-mounted.

On Docker Desktop and OrbStack the `--priv` chown cannot apply to a bind mount
(`chown: ./config/wazuh_indexer/certs: Operation not permitted`). Follow up with:

```bash
chmod -R go+rX config
```

Start the stack:

```bash
docker compose up -d
```

## Before this is anything other than a lab

- Change every default credential. The dashboard login is `admin` / `admin`, and the
  service accounts are plain-text environment variables in the compose file.
- Raise `OPENSEARCH_JAVA_OPTS` above the 1 GB default if the stack will hold real volume.
- Put `wazuh-indexer-data` on a dedicated device and alert on its usage.
- Replace the self-signed certificates.
- Publish 1517 only to agent subnets and 55000 only to automation hosts. Keep 9200 closed.
- Delete the `1514:1514`, `1515:1515` and `514:514/udp` manager port mappings unless you
  still run Wazuh 4.x agents. The listeners stay up inside the container either way, because
  `<remote><legacy><enabled>` ships as `yes`, but nothing on the network can reach them.

## Caveats

- Wazuh 5.0 is in beta. Image tags, variable names and file layouts change between betas.
  The Docker documentation instructs appending `-latest` to image tags when testing beta5.
- Do not run the single-node and multi-node stacks on the same host. They collide on
  container names, ports and volumes.
- `docker compose down -v` deletes the volume holding `client.keys`, which means every
  agent has to enrol again.