Agent package for Alpine linux

[issacg]

Hi all,

Is there an agent binary package available for alpine linux?

[okynos]

Hello @issacg,

Unfortunately Wazuh doesn't officially support Alpine Linux so we couldn't provide a package, but you could try to compile the source code.
Take a look to this thread wazuh/wazuh#4592 (comment)

By the way if you are using Alpine inside docker container as it is usually used, it isn't recommended to install the agent inside a container because you lost system layer and it doesn't have too much sense in terms of monitoring host activity. We recommend to install on the docker host and monitor apps that are inside containers and containers activity.

Anyway feel free to add a comment at the related Alpine issue ttps://github.com/wazuh/wazuh/issues/4592 and we will add to our road map as soon as possible.

[issacg]

Hi @okynos!

I've seen the thread for building Wazuh in alpine, but was hoping to see a binary on the roadmap at some point, so opened an issue so it could be tracked.

Regarding the use-case, my understanding after speaking with some of the folks at Wazuh on Slack was that the recommendation was to run both in the host and in the individual containers because the docker wodle did not monitor anything inside the containers; only the docker daemon itself (e.g., container started, container stopped, image pulled, etc) is covered.
If I want to be monitoring application logs, or the system inside the container itself, I'd need to run inside the container, too.

Did I misunderstand something?

Thanks!

[okynos]

You understood perfectly. The Wazuh agent can't monitor activity that is running inside container but, if you are using Docker as a virtual machine instead of an isolated application/service, is understandable the Wazuh agent installation inside a container.

If you have the chance of avoiding the installation inside the container I would suggest creating volumes of the relevant logs and data that you want to monitor and add such folders/files to the agent located at docker host, this will give to you the part of application monitoring plus docker activity monitoring and in addition it doesn't break the maintenance cycle of the docker (you can destroy pull a new image and run). In the case that you need to monitor processes, inventory, etc inside the docker, it's fair to install the Wazuh agent inside the docker.

I hope it helps to you, don't hesitate to ask us if you have any doubts, thanks.

Regards.

[alberpilot]

Hello @issacg

I proceed to close this issue. Please don't hesitate to open it again if necessary.

Best regards,
Alberto R