From c64411b4f57aa7a64ef1402f80155974012ba908 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 12 Mar 2026 18:16:18 +0700 Subject: [PATCH 1/5] Add healthchecks to docker deployments --- multi-node/docker-compose.yml | 69 ++++++++++++++++++++++++++++------ single-node/docker-compose.yml | 30 +++++++++++++-- 2 files changed, 83 insertions(+), 16 deletions(-) diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 8eafe5ce..035fd9ab 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -5,6 +5,14 @@ services: hostname: wazuh.master container_name: multi-node-wazuh.master restart: always + depends_on: + wazuh1.indexer: + condition: service_healthy + healthcheck: + test: [ "CMD-SHELL", "curl -s -k -I -u $$API_USERNAME:$$API_PASSWORD https://localhost:55000/security/user/authenticate > /dev/null || exit 1" ] + interval: 15s + timeout: 5s + retries: 5 ulimits: memlock: soft: -1 @@ -36,11 +44,18 @@ services: - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem - ./wazuh-certificates/wazuh.master.pem:/var/wazuh-manager/etc/certs/manager.pem - ./wazuh-certificates/wazuh.master-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem + wazuh.worker: image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.worker container_name: multi-node-wazuh.worker restart: always + healthcheck: + test: [ "CMD-SHELL", "timeout 2 bash -c ' + /bin/sh -c " echo 'Waiting for wazuh1.indexer...'; sleep 5; until getent hosts wazuh1.indexer; do sleep 2; done; /entrypoint.sh opensearch" + depends_on: + - wazuh1.indexer environment: - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g - bootstrap.memory_lock=true - - network.host=wazuh2.indexer + - network.host=0.0.0.0 - node.name=wazuh2.indexer - cluster.initial_cluster_manager_nodes=wazuh1.indexer,wazuh2.indexer,wazuh3.indexer - discovery.seed_hosts=wazuh1.indexer,wazuh2.indexer,wazuh3.indexer @@ -123,6 +151,12 @@ services: nofile: soft: 65536 hard: 65536 + healthcheck: + test: [ "CMD-SHELL", "curl -s -k -u $$INDEXER_USERNAME:$$INDEXER_PASSWORD https://localhost:9200/_cluster/health" ] + interval: 10s + timeout: 5s + retries: 10 + start_period: 30s volumes: - wazuh-indexer-data-2:/var/lib/wazuh-indexer - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem @@ -134,10 +168,14 @@ services: hostname: wazuh3.indexer container_name: multi-node-wazuh3.indexer restart: always + entrypoint: > + /bin/sh -c " echo 'Waiting for wazuh1.indexer...'; sleep 5;until getent hosts wazuh1.indexer; do sleep 2; done; /entrypoint.sh opensearch" + depends_on: + - wazuh1.indexer environment: - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g - bootstrap.memory_lock=true - - network.host=wazuh3.indexer + - network.host=0.0.0.0 - node.name=wazuh3.indexer - cluster.initial_cluster_manager_nodes=wazuh1.indexer,wazuh2.indexer,wazuh3.indexer - discovery.seed_hosts=wazuh1.indexer,wazuh2.indexer,wazuh3.indexer @@ -151,6 +189,12 @@ services: nofile: soft: 65536 hard: 65536 + healthcheck: + test: [ "CMD-SHELL", "curl -s -k -u $$INDEXER_USERNAME:$$INDEXER_PASSWORD https://localhost:9200/_cluster/health" ] + interval: 10s + timeout: 5s + retries: 10 + start_period: 30s volumes: - wazuh-indexer-data-3:/var/lib/wazuh-indexer - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem @@ -162,6 +206,12 @@ services: hostname: wazuh.dashboard container_name: multi-node-wazuh.dashboard restart: always + healthcheck: + test: [ "CMD", "curl", "-k", "-s", "-o", "/dev/null", "https://localhost:5601/login" ] + interval: 30s + timeout: 10s + retries: 3 + start_period: 30s ports: - 443:5601 environment: @@ -185,11 +235,10 @@ services: - wazuh-dashboard-config:/usr/share/wazuh-dashboard/config - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom depends_on: - - wazuh1.indexer - - wazuh.master - links: - - wazuh1.indexer:wazuh1.indexer - - wazuh.master:wazuh.master + wazuh1.indexer: + condition: service_healthy + wazuh.master: + condition: service_healthy nginx: image: nginx:stable @@ -202,10 +251,6 @@ services: - wazuh.master - wazuh.worker - wazuh.dashboard - links: - - wazuh.master:wazuh.master - - wazuh.worker:wazuh.worker - - wazuh.dashboard:wazuh.dashboard volumes: - ./config/nginx/nginx.conf:/etc/nginx/nginx.conf:ro diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 58a74613..a473cf16 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -5,6 +5,14 @@ services: hostname: wazuh.manager container_name: single-node-wazuh.manager restart: always + depends_on: + wazuh.indexer: + condition: service_healthy + healthcheck: + test: [ "CMD-SHELL", "curl -s -k -I -u $$API_USERNAME:$$API_PASSWORD https://localhost:55000/security/user/authenticate > /dev/null || exit 1" ] + interval: 15s + timeout: 5s + retries: 5 ulimits: memlock: soft: -1 @@ -60,6 +68,14 @@ services: nofile: soft: 65536 hard: 65536 + healthcheck: + test: + - "CMD-SHELL" + - "curl -k -s -u $${INDEXER_USERNAME}:$${INDEXER_PASSWORD} https://localhost:9200/_cluster/health | grep -vq '\"status\":\"red\"'" + interval: 30s + timeout: 10s + retries: 5 + start_period: 60s volumes: - wazuh-indexer-data:/var/lib/wazuh-indexer - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem @@ -73,6 +89,12 @@ services: hostname: wazuh.dashboard container_name: single-node-wazuh.dashboard restart: always + healthcheck: + test: [ "CMD", "curl", "-k", "-s", "-o", "/dev/null", "https://localhost:5601/login" ] + interval: 30s + timeout: 10s + retries: 3 + start_period: 30s ports: - 443:5601 environment: @@ -96,10 +118,10 @@ services: - wazuh-dashboard-config:/usr/share/wazuh-dashboard/config - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom depends_on: - - wazuh.indexer - links: - - wazuh.indexer:wazuh.indexer - - wazuh.manager:wazuh.manager + wazuh.indexer: + condition: service_healthy + wazuh.manager: + condition: service_healthy volumes: wazuh_api_configuration: From 1f6977a06b8f198fdaf91516ec517945b5c9e54c Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Mon, 16 Mar 2026 21:51:00 +0700 Subject: [PATCH 2/5] Add healthchecks for single node deployment --- single-node/docker-compose.yml | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index a473cf16..1519d23f 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -55,7 +55,7 @@ services: environment: - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g - bootstrap.memory_lock=true - - network.host=wazuh.indexer + - network.host=0.0.0.0 - node.name=wazuh.indexer - cluster.initial_cluster_manager_nodes=wazuh.indexer - node.max_local_storage_nodes=1 @@ -69,13 +69,11 @@ services: soft: 65536 hard: 65536 healthcheck: - test: - - "CMD-SHELL" - - "curl -k -s -u $${INDEXER_USERNAME}:$${INDEXER_PASSWORD} https://localhost:9200/_cluster/health | grep -vq '\"status\":\"red\"'" - interval: 30s - timeout: 10s - retries: 5 - start_period: 60s + test: [ "CMD-SHELL", "curl -s -k -u $$INDEXER_USERNAME:$$INDEXER_PASSWORD https://localhost:9200/_cluster/health" ] + interval: 10s + timeout: 5s + retries: 10 + start_period: 30s volumes: - wazuh-indexer-data:/var/lib/wazuh-indexer - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem From 554cc10c5b343e69b25d2d64c7cf21e3541a7a4d Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Mon, 16 Mar 2026 21:54:11 +0700 Subject: [PATCH 3/5] Add changelog --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index dc9ae35f..28e2358b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file. ### Changed +- Add deployment healthchecks ([#2251](https://github.com/wazuh/wazuh-docker/pull/2251)) - Fix set_correct_permOwner function ([#2238](https://github.com/wazuh/wazuh-docker/pull/2238)) - Add workflow dispatch option ([#2231](https://github.com/wazuh/wazuh-docker/pull/2231)) - Change Wazuh manager certificates names ([#2223](https://github.com/wazuh/wazuh-docker/pull/2223)) From 75aceb19a47c46406a22c1a6b25675969601dc67 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Mon, 16 Mar 2026 23:56:55 +0700 Subject: [PATCH 4/5] Delete permanent_data folder and exceptions for Active Response on Wazuh manager --- .../wazuh-manager/config/permanent_data.env | 14 -------------- multi-node/docker-compose.yml | 2 -- single-node/docker-compose.yml | 1 - 3 files changed, 17 deletions(-) diff --git a/build-docker-images/wazuh-manager/config/permanent_data.env b/build-docker-images/wazuh-manager/config/permanent_data.env index 5b34c009..7ca694af 100644 --- a/build-docker-images/wazuh-manager/config/permanent_data.env +++ b/build-docker-images/wazuh-manager/config/permanent_data.env @@ -5,28 +5,14 @@ PERMANENT_DATA[((i++))]="/var/wazuh-manager/etc" PERMANENT_DATA[((i++))]="/var/wazuh-manager/logs" PERMANENT_DATA[((i++))]="/var/wazuh-manager/queue" PERMANENT_DATA[((i++))]="/var/wazuh-manager/var/multigroups" -PERMANENT_DATA[((i++))]="/var/wazuh-manager/active-response/bin" export PERMANENT_DATA # Files mounted in a volume that should not be permanent i=0 PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/etc/internal_options.conf" -PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/default-firewall-drop" -PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/disable-account" -PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/firewalld-drop" -PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/firewall-drop" -PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/host-deny" -PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/ip-customblock" -PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/ipfw" PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/kaspersky.py" -PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/kaspersky" -PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/npf" -PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/wazuh-slack" -PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/pf" -PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/restart-wazuh" PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/restart.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/route-null" export PERMANENT_DATA_EXCP diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 035fd9ab..257d9a1a 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -40,7 +40,6 @@ services: - master-wazuh-logs:/var/wazuh-manager/logs - master-wazuh-queue:/var/wazuh-manager/queue - master-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups - - master-wazuh-active-response:/var/wazuh-manager/active-response/bin - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem - ./wazuh-certificates/wazuh.master.pem:/var/wazuh-manager/etc/certs/manager.pem - ./wazuh-certificates/wazuh.master-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem @@ -82,7 +81,6 @@ services: - worker-wazuh-logs:/var/wazuh-manager/logs - worker-wazuh-queue:/var/wazuh-manager/queue - worker-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups - - worker-wazuh-active-response:/var/wazuh-manager/active-response/bin - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem - ./wazuh-certificates/wazuh.worker.pem:/var/wazuh-manager/etc/certs/manager.pem - ./wazuh-certificates/wazuh.worker-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 1519d23f..9dfb76c4 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -40,7 +40,6 @@ services: - wazuh_logs:/var/wazuh-manager/logs - wazuh_queue:/var/wazuh-manager/queue - wazuh_var_multigroups:/var/wazuh-manager/var/multigroups - - wazuh_active_response:/var/wazuh-manager/active-response/bin - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem - ./wazuh-certificates/wazuh.manager.pem:/var/wazuh-manager/etc/certs/manager.pem - ./wazuh-certificates/wazuh.manager-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem From 270b755548a2fec7504e7a53288cbb8ed8ee4d13 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 17 Mar 2026 00:02:08 +0700 Subject: [PATCH 5/5] Delete permanent_data exceptions --- build-docker-images/wazuh-manager/config/permanent_data.env | 2 -- 1 file changed, 2 deletions(-) diff --git a/build-docker-images/wazuh-manager/config/permanent_data.env b/build-docker-images/wazuh-manager/config/permanent_data.env index 7ca694af..ad38a5fb 100644 --- a/build-docker-images/wazuh-manager/config/permanent_data.env +++ b/build-docker-images/wazuh-manager/config/permanent_data.env @@ -11,8 +11,6 @@ export PERMANENT_DATA # Files mounted in a volume that should not be permanent i=0 PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/etc/internal_options.conf" -PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/kaspersky.py" -PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/restart.sh" export PERMANENT_DATA_EXCP