Hi,
I’m using suricata 5.0.2 in docker.
I send all my network trafic on an interface of my server and my suricata capture it.
I start my docker with the parameter --net=host and -i enXXXX
It works perfectly.
I want to increase my security of my docker and i activate the user namespace.
And now, i have a problem because i can’t use the parameter --net=host with the user namesapce
The following standard Docker features are incompatible with running a Docker daemon with user namespaces enabled:
- sharing PID or NET namespaces with the host (–pid=host or --network=host).
Do you have any ideas on how can i start my docker image to capture the network traffic on this enXXXX interface ?
Many thanks