Ubuntu
Instructions to install Docker and deploy the GuardDog AI Sensor container on Ubuntu 24.04 LTS (Noble)
- Network traffic visibility is mandatory: Port mirroring is preferred (ingress + egress) or SPAN/TAP equivalent must be configured so the sensor can see packets and communicate out on the same network being able to receive and IP on the network that is protecting.
- Firewall/network rules must allow cloud communication: Ensure required egress/return traffic is permitted before starting the container.
- Host network interfaces must be configured first: VLANs/logical/physical interfaces should be ready on the host; the container will detect host ethernet interfaces via host networking.
-
Persistent configuration: This deployment mounts
/etc/guarddogto persist configuration across reboots and image updates. - License required: You need a valid license tied to the email used to create your account.
- Create an account at
https://dcx.guarddog.ai, verify it, and log in. - Contact GuardDog AI support/sales with the email you used and request your license parameters.
sudo apt update
sudo apt upgrade -y
sudo reboot
On your admin machine:
ssh-keygen -t rsa -b 4096
ssh-copy-id <user>@<server_ip>
On the Ubuntu host:
sudo nano /etc/ssh/sshd_config
Set (or ensure) these values:
PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
ChallengeResponseAuthentication no
sudo systemctl restart ssh
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status
sudo apt install -y irqbalance
sudo systemctl enable --now irqbalance
sudo apt remove -y docker docker-engine docker.io containerd runc || true
sudo apt update
sudo apt install -y ca-certificates curl gnupg
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
$(. /etc/os-release && echo ${UBUNTU_CODENAME:-$VERSION_CODENAME}) stable" | \
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo systemctl enable --now docker
docker --version
sudo systemctl status docker --no-pager
sudo usermod -aG docker $USER
newgrp docker
sudo mkdir -p /etc/guarddog
sudo chmod 755 /etc/guarddog
docker pull guarddogai/prod:latest
export EMAIL="customer@email.com"
export LICENSE="YOUR-LICENSE-KEY"
export NAME="sensor_name"
If you want a different device name, replace gdai01 in both --name and --device_name.
docker run -it --cap-add NET_ADMIN --net=host --restart unless-stopped -v /etc/guarddog:/etc/guarddog --name $NAME guarddogai/prod:latest gdai --device_name=$NAME --email=$EMAIL --license=$LICENSE
Note: If Support/Engineering requests it, add --cap-add NET_RAW to the docker run command.
docker ps
docker logs -f gdai01 (use the name of the container)
docker stop gdai01 (use the name of the container)
docker start gdai01 (use the name of the container)
docker rm -f gdai01 (use the name of the container)
- The container will automatically restart after a host reboot or Docker daemon restart because of
--restart unless-stopped. - If you manually stop the container, Docker will not restart it until you start it again.
resolvectl status || true
cat /etc/resolv.conf
nslookup dcx.guarddog.ai 8.8.8.8 || true
sudo mkdir -p /etc/systemd/resolved.conf.d
sudo tee /etc/systemd/resolved.conf.d/guarddog-dns.conf >/dev/null <<'EOF'
[Resolve]
DNS=8.8.8.8 8.8.4.4
EOF
sudo systemctl restart systemd-resolved
Optional per-interface DNS (quick testing):
sudo resolvectl dns <iface> 8.8.8.8 8.8.4.4
sudo nano /etc/default/grub
Add net.ifnames=0 biosdevname=0 to GRUB_CMDLINE_LINUX_DEFAULT, for example:
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash net.ifnames=0 biosdevname=0"
sudo update-grub
sudo reboot
docker pull guarddogai/prod:latest
docker stop gdai01
docker rm gdai01
# Re-run the same docker run command from section 6.3
- Do not share your license key publicly (GitHub, tickets, screenshots, etc.).
- Keep Ubuntu patched.
- Because
--net=hostreduces isolation, run on a dedicated host and keep exposure minimal.