The first thing you need to do is to set up a system with the requirements needed to run Docker and Docker compose. Then install Docker and Docker compose if you don’t have them already.
It is recommended to configure the Docker host preferences to give at least 6GB of memory for the host that creates the containers. This is because, depending on the deployment and usage, Wazuh indexer memory consumption can vary. Therefore, allocate the recommended memory for a complete stack deployment to work properly.
Wazuh Indexer needs to be able to create many memory-mapped areas. So the kernel has to be set to give a process at least 262,144 memory-mapped areas.
You need to increase
max_map_counton your Docker host:
$ sysctl -w vm.max_map_count=262144
To set this value permanently, update the
/etc/sysctl.conf. To verify after rebooting, run
If you don’t set the
max_map_counton your host, Wazuh indexer will NOT work properly.
For Linux/Unix machines, Docker requires an amd64 architecture system running kernel version 3.10 or higher.
Check your current kernel version. Open a terminal and use
uname -rto display your kernel version:
# uname -r
Run the Docker installation script:
Start the Docker service:
If you would like to use Docker as a non-root user, you should now consider adding your user to the
dockergroup with something like the following command (remember that you’ll have to log out and log back in for this to take effect):# usermod -aG docker your-user
Docker Compose 1.29 or newer is required. Follow these steps to install it:
Download the Docker Compose binary:
# curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
Grant execution permissions:
# chmod +x /usr/local/bin/docker-compose
If the command
docker-composefails after installation, check your path. You can also create a symbolic link to
/usr/binor any other directory in your path.
$ sudo ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose
Test the installation to ensure everything went properly:
$ docker-compose --version
docker-compose version 1.29.2, build 5becea4c