Hedgehog Linux in Docker

[devilman85]

I hope this message finds you well. I would like to propose the idea of creating a Dockerized version of Hedgehog Linux as part of the Malcolm ecosystem.

This would provide several advantages:

Simplified deployment: Users could quickly deploy Hedgehog Linux alongside Malcolm without needing separate hardware or complex configurations.

Improved compatibility: A Docker container would ensure consistent environments, making it easier to integrate Hedgehog Linux with Malcolm.

Enhanced flexibility: Users could scale and test Hedgehog Linux instances as needed, taking advantage of the modularity of Docker.

Given the growing importance of Hedgehog Linux in traffic analysis workflows, I believe this addition could greatly enhance the overall user experience for the Malcolm community.

Thank you for considering this suggestion, and I would be happy to provide more details if needed.

Best regards

[mmguero]

This is already possible using the Hedgehog run profile.

“Hedgehog” run profile

Another configuration for monitoring local network interfaces is to use the hedgehog run profile. During Malcolm configuration users are prompted “Run with Malcolm (all containers) or Hedgehog (capture only) profile?” Docker Compose can use profiles to selectively start services. While the malcolm run profile runs all of Malcolm’s containers (OpenSearch, Dashboards, LogStash, etc.), the hedgehog profile runs only the containers necessary for traffic capture.

When configuring the hedgehog profile, users must provide connection details for another Malcolm instance to which to forward its network traffic logs.

Closing as duplicate of idaholab#254