[BUG] - Docker compose - java.lang.IllegalArgumentException: Could not instantiate implementation: org.janusgraph.diskstorage.cql.CQLStoreManager

[figueiredosandro666]

When starting the containers for the The Phish using docker composer, an error line appears more than one time:

thehive | [error] o.t.s.u.Retry [|] An error occurs
thehive | java.lang.IllegalArgumentException: Could not instantiate implementation: org.janusgraph.diskstorage.cql.CQLStoreManager
thehive | at org.janusgraph.util.system.ConfigurationUtil.instantiate(ConfigurationUtil.java:64)

...

thehive | Caused by: java.lang.reflect.InvocationTargetException: null
thehive | at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)

...

thehive | Caused by: com.datastax.driver.core.exceptions.NoHostAvailableException: All host(s) tried for query failed (tried: /172.21.0.2:9042 (com.datastax.driver.core.exceptions.TransportException: [/172.21.0.2:9042] Cannot connect))
thehive | at com.datastax.driver.core.ControlConnection.reconnectInternal(ControlConnection.java:268)

...

Here is the YAML file:

version: "3.8"
services:

cassandra:
image: cassandra:3.11
container_name: cassandra
restart: unless-stopped
hostname: cassandra
environment:
- MAX_HEAP_SIZE=1G
- HEAP_NEWSIZE=1G
- CASSANDRA_CLUSTER_NAME=thp
- CASSANDRA_LISTEN_ADDRESS=127.0.0.1
volumes:
- ./vol/cassandra-data:/var/lib/cassandra/data

thehive:
image: thehiveproject/thehive4:4.1.9-1
container_name: thehive
restart: unless-stopped
depends_on:
- cassandra
ports:
- '0.0.0.0:9005:9005'
volumes:
- ./thehive/application.conf:/etc/thehive/application.conf
- ./vol/data:/opt/data
- ./vol/index:/opt/index
command: '--no-config --no-config-secret --cortex-keys SGTlcSntWXJb/rzrcZSGlb/cidaTUl4U'

elasticsearch:
image: docker.elastic.co/elasticsearch/elasticsearch:7.11.1
container_name: elasticsearch
restart: unless-stopped
ports:
- '0.0.0.0:9200:9200'
environment:
- http.host=0.0.0.0
- discovery.type=single-node
- cluster.name=hive
- script.allowed_types= inline
- thread_pool.search.queue_size=100000
- thread_pool.write.queue_size=10000
- gateway.recover_after_nodes=1
- xpack.security.enabled=false
- bootstrap.memory_lock=true
- 'ES_JAVA_OPTS=-Xms256m -Xmx256m'
ulimits:
nofile:
soft: 65536
hard: 65536
volumes:
- ./vol/elasticsearch_data:/usr/share/elasticsearch/data
- ./vol/elasticsearch_logs:/usr/share/elasticsearch/logs

cortex:
image: thehiveproject/cortex:3.1.1-1
container_name: cortex
restart: unless-stopped
volumes:
- ./cortex/application.conf:/etc/cortex/application.conf
- /var/run/docker.sock:/var/run/docker.sock
- /tmp:/tmp
environment:
- http_proxy=${http_proxy}
- https_proxy=${https_proxy}
depends_on:
- elasticsearch
ports:
- '0.0.0.0:9001:9001'

redis:
image: redis:6.2.5
container_name: redis
restart: unless-stopped

mysql:
image: mysql:8.0.26
container_name: mysql
restart: unless-stopped
command: --default-authentication-plugin=mysql_native_password
environment:
- "MYSQL_USER=misp"
- "MYSQL_PASSWORD=example"
- "MYSQL_ROOT_PASSWORD=password"
- "MYSQL_DATABASE=misp"
volumes:
- ./vol/mysql:/var/lib/mysql

misp:
image: coolacid/misp-docker:core-v2.4.148a
container_name: misp
restart: unless-stopped
depends_on:
- redis
- mysql
ports:
- '0.0.0.0:80:80'
- '0.0.0.0:443:443'
environment:
- "MYSQL_HOST=mysql"
- "HOSTNAME=https://localhost"
- "REDIS_FQDN=redis"
- "INIT=true"
- "CRON_USER_ID=1"
- "DISIPV6=true"

thephish:
image: emalderson/thephish:latest
container_name: thephish
restart: unless-stopped
depends_on:
- thehive
- cortex
- misp
ports:
- '0.0.0.0:8080:8080'
volumes:
- ./thephish_conf_files/analyzers_level_conf.json:/root/thephish/analyzers_level_conf.json
- ./thephish_conf_files/configuration.json:/root/thephish/configuration.json
- ./thephish_conf_files/whitelist.json:/root/thephish/whitelist.json

I don't know if it's related, but when I try to access TheHive, the browser does not find the app on port 9000 or gives a "Connection Reset" on port 9005.

Thanks for any help you can provide.

[figueiredosandro666]

I think I got this. I configured all containers to their original configuration, but added this to the compose.yml file, regarding cassandra container:

healthcheck:
test: ["CMD-SHELL", "[ $$(nodetool statusgossip) = running ]"]
interval: 30s
timeout: 10s
retries: 5

But even with this configuration, the only way to put this to work, was to restart the thehive container after ensuring, manually, that cassandra was responding on its port.

If anyone has a working healthcheck for cassandra, I would appreciate :)

Hope this helps