ML-powered behavioral anomaly detector that learns normal log patterns and flags deviations using Isolation Forest

Author: robotizeit

.env.sample

@@ -7,7 +7,7 @@ DATABASE_URL=stackdog.db
 RUST_BACKTRACE=full
 
 # Log Sniff Configuration
-#STACKDOG_LOG_SOURCES=/var/log/syslog,/var/log/auth.log
+#STACKDOG_LOG_SOURCES=/var/log/syslog,/var/log/auth.log,/var/log/nginx/access.log
 #STACKDOG_SNIFF_INTERVAL=30
 #STACKDOG_SNIFF_OUTPUT_DIR=./stackdog-logs/
 #STACKDOG_SERVE_SNIFF_ENABLED=true

README.md

@@ -83,7 +83,8 @@ docker volume create stackdog-data
 
 docker run --rm -it \
   --name stackdog \
-  -p 5000:5000 \
+  --network host \
+  --cap-add=NET_ADMIN \
   -e APP_HOST=0.0.0.0 \
   -e APP_PORT=5000 \
   -e DATABASE_URL=/data/stackdog.db \
@@ -92,6 +93,8 @@ docker run --rm -it \
   trydirect/stackdog:latest
 ```
 
+> **Note:** `--network host` and `--cap-add=NET_ADMIN` are required for IP banning (iptables/nftables) to work. Without them, firewall rules from inside the container cannot affect host traffic.
+
 Then open another shell and hit the API:
 
 ```bash
@@ -127,7 +130,8 @@ docker build -f docker/backend/Dockerfile -t stackdog-local .
 
 docker run --rm -it \
   --name stackdog-local \
-  -p 5000:5000 \
+  --network host \
+  --cap-add=NET_ADMIN \
   -e APP_HOST=0.0.0.0 \
   -e APP_PORT=5000 \
   -e DATABASE_URL=/data/stackdog.db \
@@ -151,10 +155,12 @@ This starts:
 
 The compose stack uses:
 
-- `stackdog` service — builds `docker/backend/Dockerfile`, runs `stackdog serve`, and mounts `/var/run/docker.sock`
+- `stackdog` service — builds `docker/backend/Dockerfile`, runs `stackdog serve`, mounts `/var/run/docker.sock`, uses `network_mode: host`, and adds `NET_ADMIN` capability for IP banning
 - `stackdog-ui` service — builds the React app and serves it with Nginx
 - `stackdog-data` volume — persists the SQLite database between restarts
 
+> **Prerequisite for IP banning:** The `network_mode: host` and `cap_add: NET_ADMIN` settings are required so that `iptables`/`nftables` rules applied inside the container affect the host's network stack. Without them, IP ban firewall rules cannot reach host traffic.
+
 To stop it:
 
 ```bash

docker-compose.app.yml

@@ -5,12 +5,14 @@ services:
       dockerfile: docker/backend/Dockerfile
     command: ["serve"]
     container_name: stackdog
+    network_mode: host
+    cap_add:
+      - NET_ADMIN
     environment:
       APP_HOST: 0.0.0.0
       APP_PORT: 5000
       DATABASE_URL: /data/stackdog.db
-    ports:
-      - "5000:5000"
+      STACKDOG_SNIFF_INTERVAL: 30
     volumes:
       - stackdog-data:/data
       - /var/run/docker.sock:/var/run/docker.sock

docker-compose.yml

@@ -1,20 +1,20 @@
 services:
   stackdog:
     image: trydirect/stackdog:latest
-    ports:
-    - target: 5000
-      published: 5000
+    network_mode: host
+    cap_add:
+      - NET_ADMIN
     environment:
       APP_HOST: 0.0.0.0
       APP_PORT: 5000
       DATABASE_URL: /data/stackdog.db
-      STACKDOG_SNIFF_INTERVAL: 600
+      STACKDOG_SNIFF_INTERVAL: 30
       STACKDOG_AI_PROVIDER: openai
       STACKDOG_AI_API_URL: https://api.openai.com/v1
       STACKDOG_AI_MODEL: gpt-4o-mini
       STACKDOG_AI_API_KEY: <yourkeyhere>
       STACKDOG_SLACK_WEBHOOK_URL: <yourslackchannelwebhook?
-      STACKDOG_LOG_SOURCES: /var/log/syslog,/var/log/auth.log
+      STACKDOG_LOG_SOURCES: /var/log/syslog,/var/log/auth.log,/var/log/nginx/access.log
     restart: unless-stopped
     volumes:
     - source: stackdog-data
@@ -23,13 +23,7 @@ services:
     - source: /var/run/docker.sock
       target: /var/run/docker.sock
       type: bind
-    networks:
-    - default_network
     command: serve
 volumes:
   stackdog-data:
     name: stackdog-data
-networks:
-  default_network:
-    external: true
-    name: default_network

install.sh

@@ -155,6 +155,11 @@ main() {
   echo ""
   echo "  Run:  stackdog --help"
   echo ""
+  echo "  Prerequisites for IP banning (optional):"
+  echo "    - nftables or iptables must be installed"
+  echo "    - The binary requires root or CAP_NET_ADMIN to manage firewall rules"
+  echo "    - See https://stackdog.stacker.my/docs for full setup guide"
+  echo ""
 }
 
 main "$@"