{"id":47356702,"url":"https://github.com/shgew/cs-firewall-bouncer-docker","last_synced_at":"2026-04-01T07:01:00.719Z","repository":{"id":276196311,"uuid":"928409090","full_name":"shgew/cs-firewall-bouncer-docker","owner":"shgew","description":"A dockerized version of https://github.com/crowdsecurity/cs-firewall-bouncer","archived":false,"fork":false,"pushed_at":"2026-03-06T15:42:27.000Z","size":64,"stargazers_count":26,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2026-03-06T19:05:14.088Z","etag":null,"topics":["attacks-prevention","bouncer","crowdsec","detection","docker","firewall","homelab","nftables","protection","security","truenas"],"latest_commit_sha":null,"homepage":"","language":"Dockerfile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/shgew.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-02-06T15:37:42.000Z","updated_at":"2026-03-06T15:42:29.000Z","dependencies_parsed_at":"2025-02-06T20:35:35.920Z","dependency_job_id":"82a9309f-6973-4c05-bf33-d454711ce593","html_url":"https://github.com/shgew/cs-firewall-bouncer-docker","commit_stats":null,"previous_names":["shgew/cs-firewall-bouncer-docker"],"tags_count":6,"template":false,"template_full_name":null,"purl":"pkg:github/shgew/cs-firewall-bouncer-docker","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shgew%2Fcs-firewall-bouncer-docker","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shgew%2Fcs-firewall-bouncer-docker/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shgew%2Fcs-firewall-bouncer-docker/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shgew%2Fcs-firewall-bouncer-docker/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/shgew","download_url":"https://codeload.github.com/shgew/cs-firewall-bouncer-docker/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shgew%2Fcs-firewall-bouncer-docker/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31269194,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-01T06:57:45.811Z","status":"ssl_error","status_checked_at":"2026-04-01T06:57:42.389Z","response_time":53,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["attacks-prevention","bouncer","crowdsec","detection","docker","firewall","homelab","nftables","protection","security","truenas"],"created_at":"2026-03-18T03:00:19.120Z","updated_at":"2026-04-01T07:01:00.708Z","avatar_url":"https://github.com/shgew.png","language":"Dockerfile","funding_links":[],"categories":["Bouncers"],"sub_categories":["Firewall"],"readme":"# CrowdSec Firewall Bouncer Docker\n\nDocker image for [CrowdSec Firewall Bouncer](https://github.com/crowdsecurity/cs-firewall-bouncer), based on Alpine.\n\n## What this image does\n\n- Runs `crowdsec-firewall-bouncer` in a container.\n- Substitutes environment variables in `/config/crowdsec-firewall-bouncer.yaml` at startup.\n\n## Runtime requirements\n\n- `network_mode: host`\n- `cap_add: [NET_ADMIN, NET_RAW]`\n- Config file mounted at `/config/crowdsec-firewall-bouncer.yaml`\n\n## Docker Compose\n\n```yaml\nservices:\n  crowdsec-firewall-bouncer:\n    image: ghcr.io/shgew/cs-firewall-bouncer-docker:latest\n    container_name: crowdsec-firewall-bouncer\n    network_mode: host\n    # Optional non-root mode:\n    # user: 1000:1000\n    cap_add:\n      - NET_ADMIN\n      - NET_RAW\n    security_opt: # In non-root mode, remove this block.\n      - no-new-privileges:true\n    environment:\n      API_URL: ${API_URL}\n      API_KEY: ${API_KEY}\n    volumes:\n      - ./config/crowdsec-firewall-bouncer.yaml:/config/crowdsec-firewall-bouncer.yaml:ro\n      - /etc/localtime:/etc/localtime:ro\n    restart: unless-stopped\n```\n\n## Configuration\n\nStart from the upstream example config:\n\n- https://github.com/crowdsecurity/cs-firewall-bouncer/blob/main/config/crowdsec-firewall-bouncer.yaml\n\nAt startup, the entrypoint runs `envsubst` on the config file.\nPlaceholders like `${API_KEY}` are replaced with values from container\nenvironment variables before the bouncer starts.\n\nExample:\n\n- Config: `api_key: ${API_KEY}`\n- Container env: `API_KEY=abc123`\n- Final runtime config: `api_key: abc123`\n\n## Usage\n\n1. Choose an image tag from [published packages](https://github.com/shgew/cs-firewall-bouncer-docker/pkgs/container/cs-firewall-bouncer-docker).\n2. Create `./config/crowdsec-firewall-bouncer.yaml`.\n3. Start:\n\n```sh\ndocker compose up -d\n```\n\n4. Check logs:\n\n```sh\ndocker compose logs -f\n```\n\n## Release and version flow\n\n- `version.txt` pins the upstream `cs-firewall-bouncer` version used during image build.\n- Repository release tags can include internal suffixes (for example `v0.0.34+patch1`) without changing the pinned upstream binary version.\n\n## Firewall backend note\n\nDocker Engine uses `iptables` by default. Native `nftables` mode in Docker is still [experimental](https://docs.docker.com/engine/network/firewall-nftables/).\n\nMore context on backend choice: https://github.com/shgew/cs-firewall-bouncer-docker/issues/6\n\n## License\n\nThis project is licensed under the MIT License.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fshgew%2Fcs-firewall-bouncer-docker","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fshgew%2Fcs-firewall-bouncer-docker","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fshgew%2Fcs-firewall-bouncer-docker/lists"}