Question about deploying Velociraptor on ECS as a Docker container

[dgilmore82]

Hello,

I had a quick question about the best way to have velociraptor configured to deploy on a ECS cluster as a Docker container. I'm getting stuck with the deployment. It looks like I am able to push the image to the cluster but it will not run. Im not to familiar with Docker so im not to sure if it is the entrypoint file that I need to add the docker run commands or with in the dockerfile?

Any assistance with this would be greatly appreciated.

[weslambert]

Are you by chance using the Docker image referenced here, or your own image?

What is the output of docker logs $container?

[dgilmore82]

We are building our own image. I was trying to do something like the following at the end of our Dockerfile:

ENTRYPOINT ["docker"]
CMD ["run", "parm1", "parm2"]

I thought this would work but then I realized that I had not called my actual entrypoint file that will start the velociraptor front end. I didn't add CMD ["/entrypoint"] at the end of the file because I wasn't sure if it would run the first CMD commands. I believe I saw somewhere that the last CMD parameter will be recognized.

Also, can't get the container to run locally at the moment so we don't have any logs for the container at the moment.

[weslambert]

You can have a look at the repo and see how it is done there. The entrypoint is copied into the image and referenced.

You might also consider using wlambert/velociraptor to see if it works for you. I keep it updated and make changes as needed.

[dgilmore82]

I was able to pull your image and get it to successfully run a container and access the UI. When i continued to test with the image we created i got an error saying the container couldn't start the frontend because it couldn't parse the PEM file ( im assuming its one of the certs ). We are using the env file along with the -e flag to pass in cert files and nonce. We were able to run a diff from the two server configs we have and we could see the values are being pushed to the server.config the container is going to use. I don't know much about yq but it looks like it is adding a extra character at the beginning of each cert in the server config file.

It looks something like this:

gw_cert: |2
adsadakfnkmvokafvam

Im not sure why the 2 was placed at the beginning of each cert but I believe it is due to yq or not. Have you seen this kind of behavior before?

[weslambert]

I can take a look at it if you can provide some more information.

Would you mind closing this issue and opening an issue in the github.com/weslambert/velociraptor-docker repository since it might be more of an issue with how the Docker image is configured?

In the issue, please provide the command you are using.

[dgilmore82]

Just opened the following issue Unable to parse PEM when running container with environment variables

Thanks again!!