Dockerfile.zeek

# Dockerfile.zeek - Network Traffic Analyzer
FROM ubuntu:22.04

ENV DEBIAN_FRONTEND=noninteractive
ENV ZEEK_VERSION=6.0.0

RUN apt-get update && apt-get install -y \
    curl \
    gnupg2 \
    ca-certificates \
    libpcap0.8 \
    python3 \
    python3-pip \
    && rm -rf /var/lib/apt/lists/*

# Install Zeek from official repository
RUN echo 'deb http://download.opensuse.org/repositories/security:/zeek/xUbuntu_22.04/ /' > /etc/apt/sources.list.d/zeek.list \
    && curl -fsSL https://download.opensuse.org/repositories/security:/zeek/xUbuntu_22.04/Release.key | gpg --dearmor > /etc/apt/trusted.gpg.d/zeek.gpg \
    && apt-get update \
    && apt-get install -y zeek \
    && rm -rf /var/lib/apt/lists/*

# Add Zeek to PATH
ENV PATH="/opt/zeek/bin:${PATH}"

# Create log directory
RUN mkdir -p /opt/zeek/logs

# Copy custom scripts
COPY configs/zeek/local.zeek /opt/zeek/share/zeek/site/local.zeek
COPY scripts/zeek-entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

WORKDIR /opt/zeek

ENTRYPOINT ["/entrypoint.sh"]