diff --git a/packages/zeek/_dev/deploy/docker/Dockerfile b/packages/zeek/_dev/deploy/docker/Dockerfile
deleted file mode 100644
index c8a33228586..00000000000
--- a/packages/zeek/_dev/deploy/docker/Dockerfile
+++ /dev/null
@@ -1,5 +0,0 @@
-FROM alpine
-
-COPY ./*.log /sample_logs/
-
-ENTRYPOINT [ "/bin/sh" ]
diff --git a/packages/zeek/_dev/deploy/docker/docker-compose.yml b/packages/zeek/_dev/deploy/docker/docker-compose.yml
index 42ae07623a5..41784c10922 100644
--- a/packages/zeek/_dev/deploy/docker/docker-compose.yml
+++ b/packages/zeek/_dev/deploy/docker/docker-compose.yml
@@ -1,8 +1,8 @@
 version: '2.3'
 services:
   zeek:
-    tty: true
-    build: .
+    image: alpine
     volumes:
-      - ${SERVICE_LOGS_DIR}:/logs
-    command: -c "cp /sample_logs/*.log /logs/"
+      - ./sample_logs:/sample_logs:ro
+      - ${SERVICE_LOGS_DIR}:/var/log
+    command: /bin/sh -c "cp /sample_logs/* /var/log/"
diff --git a/packages/zeek/_dev/deploy/docker/capture_loss.log b/packages/zeek/_dev/deploy/docker/sample_logs/capture_loss.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/capture_loss.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/capture_loss.log
diff --git a/packages/zeek/_dev/deploy/docker/conn.log b/packages/zeek/_dev/deploy/docker/sample_logs/conn.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/conn.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/conn.log
diff --git a/packages/zeek/_dev/deploy/docker/dce_rpc.log b/packages/zeek/_dev/deploy/docker/sample_logs/dce_rpc.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/dce_rpc.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/dce_rpc.log
diff --git a/packages/zeek/_dev/deploy/docker/dhcp.log b/packages/zeek/_dev/deploy/docker/sample_logs/dhcp.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/dhcp.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/dhcp.log
diff --git a/packages/zeek/_dev/deploy/docker/dnp3.log b/packages/zeek/_dev/deploy/docker/sample_logs/dnp3.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/dnp3.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/dnp3.log
diff --git a/packages/zeek/_dev/deploy/docker/dns.log b/packages/zeek/_dev/deploy/docker/sample_logs/dns.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/dns.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/dns.log
diff --git a/packages/zeek/_dev/deploy/docker/dpd.log b/packages/zeek/_dev/deploy/docker/sample_logs/dpd.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/dpd.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/dpd.log
diff --git a/packages/zeek/_dev/deploy/docker/files.log b/packages/zeek/_dev/deploy/docker/sample_logs/files.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/files.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/files.log
diff --git a/packages/zeek/_dev/deploy/docker/http.log b/packages/zeek/_dev/deploy/docker/sample_logs/http.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/http.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/http.log
diff --git a/packages/zeek/_dev/deploy/docker/intel.log b/packages/zeek/_dev/deploy/docker/sample_logs/intel.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/intel.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/intel.log
diff --git a/packages/zeek/_dev/deploy/docker/irc.log b/packages/zeek/_dev/deploy/docker/sample_logs/irc.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/irc.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/irc.log
diff --git a/packages/zeek/_dev/deploy/docker/kerberos.log b/packages/zeek/_dev/deploy/docker/sample_logs/kerberos.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/kerberos.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/kerberos.log
diff --git a/packages/zeek/_dev/deploy/docker/modbus.log b/packages/zeek/_dev/deploy/docker/sample_logs/modbus.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/modbus.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/modbus.log
diff --git a/packages/zeek/_dev/deploy/docker/mysql.log b/packages/zeek/_dev/deploy/docker/sample_logs/mysql.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/mysql.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/mysql.log
diff --git a/packages/zeek/_dev/deploy/docker/notice.log b/packages/zeek/_dev/deploy/docker/sample_logs/notice.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/notice.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/notice.log
diff --git a/packages/zeek/_dev/deploy/docker/ntlm.log b/packages/zeek/_dev/deploy/docker/sample_logs/ntlm.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/ntlm.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/ntlm.log
diff --git a/packages/zeek/_dev/deploy/docker/pe.log b/packages/zeek/_dev/deploy/docker/sample_logs/pe.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/pe.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/pe.log
diff --git a/packages/zeek/_dev/deploy/docker/radius.log b/packages/zeek/_dev/deploy/docker/sample_logs/radius.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/radius.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/radius.log
diff --git a/packages/zeek/_dev/deploy/docker/rdp.log b/packages/zeek/_dev/deploy/docker/sample_logs/rdp.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/rdp.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/rdp.log
diff --git a/packages/zeek/_dev/deploy/docker/rfb.log b/packages/zeek/_dev/deploy/docker/sample_logs/rfb.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/rfb.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/rfb.log
diff --git a/packages/zeek/_dev/deploy/docker/sip.log b/packages/zeek/_dev/deploy/docker/sample_logs/sip.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/sip.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/sip.log
diff --git a/packages/zeek/_dev/deploy/docker/smb_cmd.log b/packages/zeek/_dev/deploy/docker/sample_logs/smb_cmd.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/smb_cmd.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/smb_cmd.log
diff --git a/packages/zeek/_dev/deploy/docker/smb_files.log b/packages/zeek/_dev/deploy/docker/sample_logs/smb_files.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/smb_files.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/smb_files.log
diff --git a/packages/zeek/_dev/deploy/docker/smb_mapping.log b/packages/zeek/_dev/deploy/docker/sample_logs/smb_mapping.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/smb_mapping.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/smb_mapping.log
diff --git a/packages/zeek/_dev/deploy/docker/smtp.log b/packages/zeek/_dev/deploy/docker/sample_logs/smtp.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/smtp.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/smtp.log
diff --git a/packages/zeek/_dev/deploy/docker/snmp.log b/packages/zeek/_dev/deploy/docker/sample_logs/snmp.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/snmp.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/snmp.log
diff --git a/packages/zeek/_dev/deploy/docker/socks.log b/packages/zeek/_dev/deploy/docker/sample_logs/socks.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/socks.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/socks.log
diff --git a/packages/zeek/_dev/deploy/docker/ssh.log b/packages/zeek/_dev/deploy/docker/sample_logs/ssh.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/ssh.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/ssh.log
diff --git a/packages/zeek/_dev/deploy/docker/ssl.log b/packages/zeek/_dev/deploy/docker/sample_logs/ssl.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/ssl.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/ssl.log
diff --git a/packages/zeek/_dev/deploy/docker/stats.log b/packages/zeek/_dev/deploy/docker/sample_logs/stats.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/stats.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/stats.log
diff --git a/packages/zeek/_dev/deploy/docker/traceroute.log b/packages/zeek/_dev/deploy/docker/sample_logs/traceroute.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/traceroute.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/traceroute.log
diff --git a/packages/zeek/_dev/deploy/docker/tunnel.log b/packages/zeek/_dev/deploy/docker/sample_logs/tunnel.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/tunnel.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/tunnel.log
diff --git a/packages/zeek/_dev/deploy/docker/weird.log b/packages/zeek/_dev/deploy/docker/sample_logs/weird.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/weird.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/weird.log
diff --git a/packages/zeek/_dev/deploy/docker/x509.log b/packages/zeek/_dev/deploy/docker/sample_logs/x509.log
similarity index 100%
rename from packages/zeek/_dev/deploy/docker/x509.log
rename to packages/zeek/_dev/deploy/docker/sample_logs/x509.log