Deployment Options Compared
Once your homelab grows past a couple of basic containers to host public web apps, Nextcloud instances, and WireGuard tunnels, basic syslog viewers and firewall graphs fall short. You need actionable security signals: file tampering alerts, SSH brute-force tracking, and automated CVE scans. Running a full security platform like Wazuh comes down to three realistic approaches.
1. Bare-Metal or Dedicated VM Installation
Installing Wazuh directly onto an Ubuntu or Debian VM gives you direct hardware access and native systemd management. The catch? Upgrades quickly become a headache. Keeping the Indexer, Manager, and Dashboard aligned means juggling APT dependencies across three distinct services, each with its own storage paths and permission quirks.
2. Cloud SIEM Services
SaaS platforms like Datadog Security, Wazuh Cloud, or Microsoft Sentinel save you the hassle of maintaining backend infrastructure. You deploy an agent, and ingestion starts right away. The real issue is the bill. Ingesting 20 GB of noisy container logs daily can easily rack up hundreds of dollars every month—hardly sustainable for a home setup.
3. Containerized Stack with Docker Compose
Docker Compose packages the entire engine trio—Wazuh Indexer (storage and search), Wazuh Manager (detection and rule evaluation), and Wazuh Dashboard (Kibana/OpenSearch UI)—into isolated containers. Environment files, TLS certificates, and persistent data live under one directory. Disaster recovery boils down to backing up that single folder.
Pros & Cons of Running Wazuh in Docker
Before carving out memory on your hypervisor, consider where containerization shines and where it demands extra care.
Pros
- Fast Turnaround: Bring up a complete three-tier SIEM in under ten minutes using standard YAML manifests.
- Painless Upgrades: Bumping versions requires changing image tags in
docker-compose.ymland pulling fresh layers, avoiding system library conflicts. - Predictable Storage: All event indexes, alerts, and state files stay contained in explicit Docker named volumes.
- Zero-Fuss Migrations: Moving your SIEM to a new mini-PC or Proxmox host takes just an
rsyncof your configuration directory and data volumes.
Cons
- Heavy RAM Consumption: Because the Indexer runs on OpenSearch, it needs at least 4 GB to 6 GB of dedicated RAM just to prevent Out-Of-Memory (OOM) crashes.
- Source IP Masking: Without proper host networking or proxy headers, Docker’s default bridge NAT can make incoming agent traffic look like it originates from
172.18.0.1instead of your real subnet. - Host Kernel Requirements: OpenSearch uses memory mapping heavily, which means you must modify
sysctlsettings on the host OS itself.
Hardware & Host Requirements
Running an enterprise-grade SIEM takes real resources. For a single-node cluster collecting logs from 5 to 15 homelab machines, aim for this hardware baseline:
- Host OS: Ubuntu Server 22.04 LTS or 24.04 LTS (x86_64 architecture).
- CPU: 4 physical or virtual cores (e.g., Intel 8th-gen i5 or AMD Ryzen 3000 series and up).
- Memory: 8 GB minimum; allocate 16 GB if you plan to keep 30+ days of raw index history.
- Disk: 100 GB or more on an NVMe or SATA SSD. Avoid running the Indexer on spinning HDDs or SD cards—random write latency will choke OpenSearch.
- Docker: Docker Engine 24.0+ with the Docker Compose V2 plugin (
docker compose, notdocker-compose).
Implementation Guide
Here is how to set up the host, generate certificates, spin up the stack, and register your first agent.
Step 1: Tune Host Virtual Memory Limits
The Wazuh Indexer will fail to start if your host’s memory map count is too low. By default, Linux distros cap this at 65530. Raise it to at least 262144.
# Check current limit
cat /proc/sys/vm/max_map_count
# Permanently apply the required limit
echo "vm.max_map_count=262144" | sudo tee -a /etc/sysctl.conf
sudo sysctl -pStep 2: Clone the Official Wazuh Docker Repository
Pull the official single-node deployment templates from the Wazuh repository:
git clone https://github.com/wazuh/wazuh-docker.git -b v4.9.0 --depth=1
cd wazuh-docker/single-nodeStep 3: Generate Internal TLS Certificates
The manager, indexer, and dashboard talk to each other over encrypted mTLS. Use Wazuh’s certificate generator container to issue self-signed certs for all internal components:
docker compose -f generate-indexer-certs.yml run --rm generatorConfirm the keys were written to disk before proceeding:
ls -la config/wazuh_indexer_ssl_certs/Step 4: Launch the Cluster
Start the three core containers in detached mode:
docker compose up -dWatch the startup progress. OpenSearch initialization takes roughly 60 to 90 seconds:
docker compose logs -f wazuh.indexerOnce the logs show green cluster health, point your browser to:
https://<YOUR_DOCKER_HOST_IP>:443Accept the self-signed certificate warning. Log in using the default credentials: username admin and password SecretPassword. Change this immediately under Server management > Security > Internal users, or update the credentials in your local environment file prior to starting the containers.
Step 5: Install the Wazuh Agent on a Client
Now give your SIEM something to monitor. Install the lightweight agent on another Linux host, such as an internal DNS server, Docker node, or reverse proxy.
SSH into the target machine, import the signing key, and configure the repository:
# Import repository key
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && sudo chmod 644 /usr/share/keyrings/wazuh.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | sudo tee /etc/apt/sources.list.d/wazuh.list
sudo apt update
# Install the agent, pointing it to your Wazuh Manager host IP
sudo WAZUH_MANAGER="192.168.1.100" apt install wazuh-agentEnable and start the agent daemon:
sudo systemctl daemon-reload
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agentStep 6: Confirm Ingestion and Security Telemetry
Switch back to the Wazuh Dashboard. Within 30 to 60 seconds, your client should appear under Endpoints Summary marked as Active.
The agent starts reporting local security posture immediately:
- File Integrity Monitoring (FIM): Generates real-time alerts if sensitive files like
/etc/passwd,/etc/sudoers, or system binaries change. - Vulnerability Auditing: Checks installed package versions against known CVE feeds from NVD and vendor advisories.
- Threat Hunting & Rootkit Detection: Flags anomalous processes, promiscuous network interfaces, and unauthorized listening ports.
You now have a fully functioning SIEM and XDR hub safeguarding your homelab, running cleanly inside Docker without cluttering the host system.
