The first thing you need to do is to set up a system with the requirements needed to run Docker and Docker compose. Then install Docker and Docker compose if you don’t have them already.
You need root user privileges to run all the commands described below.
We recommend configuring the Docker host with at least 6 GB of memory. Depending on the deployment and usage, Wazuh indexer memory consumption varies. Therefore, allocate the recommended memory for a complete stack deployment to work properly.
Wazuh indexer creates many memory-mapped areas. So you need to set the kernel to give a process at least 262,144 memory-mapped areas.
max_map_counton your Docker host:
# sysctl -w vm.max_map_count=262144
/etc/sysctl.confto set this value permanently. To verify after rebooting, run “
If you don’t set the
max_map_counton your host, the Wazuh indexer will NOT work properly.
For Linux/Unix machines, Docker requires an amd64 architecture system running kernel version 3.10 or later.
Open a terminal and use
uname -rto display and check your kernel version:
# uname -r
Run the Docker installation script:
Start the Docker service:
If you would like to use Docker as a non-root user, you should add your user to the
docker group with something like the following command:
usermod -aG docker your-user. Log out and log back in for this to take effect.
The Wazuh Docker deployment requires Docker Compose 1.29 or later. Follow these steps to install it:
Download the Docker Compose binary:
# curl -L "https://github.com/docker/compose/releases/download/v2.12.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
Grant execution permissions:
# chmod +x /usr/local/bin/docker-compose
Test the installation to ensure everything is fine:
# docker-compose --version
Docker Compose version v2.12.2
If the command
docker-composefails after installation. Create a symbolic link to
/usr/binor any other directory in your path:
ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose