docker-compose.example.yml

version: '3.2'

services:
  zeek:
    image: activecm/zeek
    build: .

    cap_add:
      - net_raw
      - net_admin
    network_mode: host

    volumes:
      - type: bind
        source: /etc/localtime
        target: /etc/localtime
        read_only: true

      - type: bind
        source: ${LOGS:-./logs}   # Edit this to the path you want zeek logs to be written
        target: /usr/local/zeek/logs

      - type: bind
        source: ${NODCFG:-./etc/node.sample.cfg}
        target: /usr/local/zeek/etc/node.cfg

      # Uncomment this block if you want to customize the zeek scripts loaded
      #- type: bind
      #  source: ./share/zeek/site/local.zeek
      #  target: /usr/local/zeek/share/zeek/site/local.zeek

      # Uncomment this block if you want to customize your internal network ranges
      #- type: bind
      #  source: ./etc/networks.cfg  # Edit this file with your custom networks
      #  target: /usr/local/zeek/etc/networks.cfg

      # Uncomment this block if you want to customize zeekctl settings (unlikely)
      #- type: bind
      #  source: ./etc/zeekctl.cfg
      #  target: /usr/local/zeek/etc/zeekctl.cfg