...
| Code Block |
|---|
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
360db972caa9 us-central1-docker.pkg.dev/dev-api-protect-api/cloud-protect-registry/analyzer:latest "supervisord -c /etc…" 1 hours ago Up 1 hours (healthy) 0.0.0.0:8081->8081/tcp, :::8081->8081/tcp api-protect-analyzer-1 |
Deploy Podman Container With Packet Capture Support
Requirements
| Code Block |
|---|
sudo yum install -y vim tcpdump podman |
Step 1: Download or create analyzer_env_file in /usr/share/containers/systemd/
| Code Block |
|---|
# copy/paste from portal or get from sales
BEARER_TOKEN="<replace with bearer token>"
#CAPTURE_ARGS='tcp and dst port 80'
#START_OPENAPI_SERVICE=false
#UVICORN_EXTRA_ARGS="--no-access-log"
#LOG_LEVEL=DEBUG |
Step 2: Start the container
| Code Block |
|---|
|
sudo podman run \
--network host \
--privileged \
--env-file=analyzer_env_file \
us-central1-docker.pkg.dev/prod-api-protect-api/cloud-protect-registry/pc-analyzer:latest |
Verify Deployment
To verify the network traffic analyzer services have started properly run the following command:
If the service has started properly you should see something mostly the same as the following:
| Code Block |
|---|
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
360db972caa9 us-central1-docker.pkg.dev/prod-api-protect-api/cloud-protect-registry/pc-analyzer:latest "supervisord -c /etc…" 1 min ago Up 1 min (healthy) 0.0.0.0:8081->8081/tcp, :::8081->8081/tcp api-protect-analyzer-1 |
Stop container and replace with systemd service in next step
| Code Block |
|---|
|
sudo podman kill <container_name> |
Step 3: Create systemd unit file /usr/share/containers/systemd/analyzer.container
| Code Block |
|---|
# /usr/share/containers/systemd/analyzer.container
[Unit]
Description=Data Theorem Analyzer
After=local-fs.target
[Container]
Image=us-central1-docker.pkg.dev/prod-api-protect-api/cloud-protect-registry/pc-analyzer:latest
AutoUpdate=registry
EnvironmentFile=/usr/share/containers/systemd/analyzer_env_file
PodmanArgs=--privileged
Network=host
Pull=always
[Service]
Restart=always
# allow time for container to pull
TimeoutStartSec=900
[Install]
# Start by default on boot
WantedBy=default.target |
Verify systemd service
| Code Block |
|---|
|
sudo systemctl daemon-reload
sudo systemctl start analyzer.service
sudo systemctl status analyzer.service |