Running LogPoint as Docker Container

I just managed to run LogPoint as a docker image/container.

It is relatively simpel and could help improving testing systems, where you want to start from a fresh logpoint for each test, make the desired configurations, run the test and discard the changes at the end.

Our use case was developing a unit testing framework for alert rules.

• Spin up the docker container
• Configurate repo, routing policy, normalization policy, processing policy, device and syslog collector
• Configurate the alert rule to test (test object)
• Send some pre-defined logs via syslog to the docker-logpoint
• Wait pre-defined time to see if the behaviour of the alert rule is as expected (triggers or doesn’t trigger)
• Stop the docker container, discarding all changes (configuration, log storage, etc.)
• Repeat with the next test scenario

Here is what I did to run logpoint in a container. I did this on a linux machine (debian 12) with docker.io installed:

• Download latest OVA (here logpoint_7.4.0.ova)
• Extract the OVA (which is a tarball at all)
  • tar xf logpoint_7.4.0.ova
• Convert the VMDK disk image to a raw disk image with qemu-img
  • qemu-img convert -O raw LogPoint-7.4.0.vmdk LogPoint-7.4.0.raw
• Figure out the start position of the LVM partition in the disk image
  • parted -s LogPoint-7.4.0.raw unit b print
  • Look for the start number of the 4th partition, copy it without the “B” at the end
• Create a mountpoint where you mount the LVM partitions to
  • mkdir /mnt/rootfs
• Create a loop device stating at the 4th partition postition we got from parted
  • losetup -o <START POSITION> -f LogPoint-7.4.0.raw
• Mount the LVM LVs to our mountpoint
  • mount /dev/LogPoint-vg/root /mnt/rootfs/
  • mount /dev/LogPoint-vg/application /mnt/rootfs/opt/
  • mount /dev/LogPoint-vg/app_store /mnt/rootfs/opt/makalu/app_store/
  • mount /dev/LogPoint-vg/storage /mnt/rootfs/opt/makalu/storage/
• Compress the whole filesystem into a gzip compress tarball for docker import
  • tar -czf image.tar.gz -C /mnt/rootfs/ .
• Import the tarball as docker image
  • docker import image.tar.gz logpoint:7.4.0
• Get the new logpoint docker image ID
  • docker images
• Spin up a container and run an interactive shell inside the container
  • docker run --security-opt seccomp=unconfined --privileged --ulimit core=0 --ulimit data=-1 --ulimit fsize=-1 --ulimit sigpending=62793 --ulimit memlock=65536 --ulimit rss=-1 --ulimit nofile=50000 --ulimit msgqueue=819200 --ulimit rtprio=0 --ulimit nproc=-1 -p 8443:443 -p 8514:514 -p 822:22 -i -t <IMAGE ID> /bin/bash
• Switch to the new less memory consuming shenandoah Java GC
  • sudo -u li-admin /opt/immune/bin/li-admin/shenandoah_manager.sh enable
• Start the logpoint processes
  • /opt/logpoint/embedded/bin/runsvdir-start

I hope this helps some of you!