From 82392ca998b9200cc09c25808a3b32662e0d577e Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Wed, 7 May 2025 10:25:07 -0300
Subject: [PATCH 01/14] Modify entrypoint and dockerfile

---
 build-docker-images/build-images.yml          |  10 +
 build-docker-images/wazuh-agent/Dockerfile    |  36 ++++
 .../wazuh-agent/config/check_repository.sh    |  15 ++
 .../config/etc/cont-init.d/0-wazuh-init       |  95 +++++++++
 .../config/etc/cont-init.d/1-agent            |  44 ++++
 .../config/etc/services.d/ossec-logs/run      |   4 +
 wazuh-agent/config/wazuh-agent-conf           | 194 ++++++++++++++++++
 wazuh-agent/docker-compose.yml                |  20 ++
 8 files changed, 418 insertions(+)
 create mode 100644 build-docker-images/wazuh-agent/Dockerfile
 create mode 100644 build-docker-images/wazuh-agent/config/check_repository.sh
 create mode 100644 build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init
 create mode 100644 build-docker-images/wazuh-agent/config/etc/cont-init.d/1-agent
 create mode 100644 build-docker-images/wazuh-agent/config/etc/services.d/ossec-logs/run
 create mode 100644 wazuh-agent/config/wazuh-agent-conf
 create mode 100644 wazuh-agent/docker-compose.yml

diff --git a/build-docker-images/build-images.yml b/build-docker-images/build-images.yml
index 90fbb897..c3789359 100644
--- a/build-docker-images/build-images.yml
+++ b/build-docker-images/build-images.yml
@@ -36,6 +36,16 @@ services:
       - filebeat_etc:/etc/filebeat
       - filebeat_var:/var/lib/filebeat
 
+  wazuh.agent:
+    build:
+      context: wazuh-agent/
+      args:
+        WAZUH_VERSION: ${WAZUH_VERSION}
+        WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
+    image: wazuh/wazuh-agent:${WAZUH_IMAGE_VERSION}
+    hostname: wazuh.manager
+    restart: always
+
   wazuh.indexer:
     build:
       context: wazuh-indexer/
diff --git a/build-docker-images/wazuh-agent/Dockerfile b/build-docker-images/wazuh-agent/Dockerfile
new file mode 100644
index 00000000..8a237787
--- /dev/null
+++ b/build-docker-images/wazuh-agent/Dockerfile
@@ -0,0 +1,36 @@
+# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
+FROM amazonlinux:2023
+
+RUN rm /bin/sh && ln -s /bin/bash /bin/sh
+
+ARG WAZUH_VERSION
+ARG WAZUH_TAG_REVISION
+ARG S6_VERSION="v2.2.0.3"
+ARG WAZUH_MANAGER='CHANGE_MANAGER_IP'
+ARG WAZUH_MANAGER_PORT='CHANGE_MANAGER_PORT'
+ARG WAZUH_REGISTRATION_SERVER='CHANGE_ENROLL_IP'
+ARG WAZUH_REGISTRATION_PORT='CHANGE_ENROLL_PORT'
+ARG WAZUH_AGENT_NAME='CHANGEE_AGENT_NAME'
+
+COPY config/check_repository.sh /
+
+RUN yum install curl-minimal tar gzip procps -y &&\
+    yum clean all
+
+RUN chmod 775 /check_repository.sh
+RUN source /check_repository.sh
+
+RUN yum install wazuh-agent-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
+    yum clean all && \
+    sed -i '/<authorization_pass_path>/d' /var/ossec/etc/ossec.conf && \
+    curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \
+    -o /tmp/s6-overlay-amd64.tar.gz && \
+    tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \
+    tar xzf /tmp/s6-overlay-amd64.tar.gz -C /usr ./bin && \
+    rm  /tmp/s6-overlay-amd64.tar.gz
+
+COPY config/etc/ /etc/
+
+RUN rm /etc/yum.repos.d/wazuh.repo
+
+ENTRYPOINT [ "/init" ]
diff --git a/build-docker-images/wazuh-agent/config/check_repository.sh b/build-docker-images/wazuh-agent/config/check_repository.sh
new file mode 100644
index 00000000..e49e69c2
--- /dev/null
+++ b/build-docker-images/wazuh-agent/config/check_repository.sh
@@ -0,0 +1,15 @@
+## variables
+APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
+GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
+REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
+WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/'  | cut -c 11- | grep ^v${WAZUH_VERSION}$)
+
+## check tag to use the correct repository
+if [[ -n "${WAZUH_TAG}" ]]; then
+  APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
+  GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
+  REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
+fi
+
+rpm --import "${APT_KEY}"
+echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo
\ No newline at end of file
diff --git a/build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init
new file mode 100644
index 00000000..44c5cc5a
--- /dev/null
+++ b/build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init
@@ -0,0 +1,95 @@
+#!/usr/bin/with-contenv bash
+# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
+
+WAZUH_INSTALL_PATH=/var/ossec
+WAZUH_CONFIG_MOUNT=/wazuh-config-mount
+WAZUH_MANAGER_SERVER=$WAZUH_MANAGER_SERVER
+WAZUH_MANAGER_PORT=${WAZUH_MANAGER_PORT:-"1514"}
+WAZUH_REGISTRATION_SERVER=${WAZUH_REGISTRATION_SERVER:-$WAZUH_MANAGER_SERVER}
+WAZUH_REGISTRATION_PORT=${WAZUH_REGISTRATION_PORT:-"1515"}
+WAZUH_REGISTRATION_PASSWORD=$WAZUH_REGISTRATION_PASSWORD
+WAZUH_AGENT_NAME=${WAZUH_AGENT_NAME:-"wazuh-agent-$HOSTNAME"}
+
+##############################################################################
+# Aux functions
+##############################################################################
+print() {
+  echo -e $1
+}
+
+error_and_exit() {
+  echo "Error executing command: '$1'."
+  echo 'Exiting.'
+  exit 1
+}
+
+exec_cmd() {
+  eval $1 > /dev/null 2>&1 || error_and_exit "$1"
+}
+
+exec_cmd_stdout() {
+  eval $1 2>&1 || error_and_exit "$1"
+}
+
+##############################################################################
+# Copy all files from $WAZUH_CONFIG_MOUNT to $WAZUH_INSTALL_PATH and respect
+# destination files permissions
+#
+# For example, to mount the file /var/ossec/data/etc/ossec.conf, mount it at
+# $WAZUH_CONFIG_MOUNT/etc/ossec.conf in your container and this code will
+# replace the ossec.conf file in /var/ossec/data/etc with yours.
+##############################################################################
+
+mount_files() {
+  if [ -e "$WAZUH_CONFIG_MOUNT" ]
+  then
+    print "Identified Wazuh configuration files to mount..."
+    exec_cmd_stdout "cp --verbose -r $WAZUH_CONFIG_MOUNT/* $WAZUH_INSTALL_PATH"
+  else
+    print "No Wazuh configuration files to mount..."
+  fi
+}
+
+##############################################################################
+# Allow users to set the manager ip and port, enrollment ip and port and
+# enroll dynamically on container start.
+#
+# To use this:
+# 1. Create your own ossec.conf file
+# 2. In your ossec.conf file, use the <agent> configuration
+# 3. Mount your custom ossec.conf file at $WAZUH_CONFIG_MOUNT/etc/ossec.conf
+##############################################################################
+
+set_manager_conn() {
+  echo "ossec.conf configuration"
+  #sed -i "s/<address>CHANGE_MANAGER_IP</address>/<address>$WAZUH_MANAGER_SERVER</address>/g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
+  sed -i "s#<address>CHANGE_MANAGER_IP</address>#<address>$WAZUH_MANAGER_SERVER</address>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
+  sed -i "s#<port>CHANGE_MANAGER_PORT</port>#<port>$WAZUH_MANAGER_PORT</port>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
+  sed -i "s#<manager_address>CHANGE_ENROLL_IP</manager_address>#<manager_address>$WAZUH_REGISTRATION_SERVER</manager_address>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
+  sed -i "s#<port>CHANGE_ENROLL_PORT</port>#<port>$WAZUH_REGISTRATION_PORT</port>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
+  sed -i "s#<agent_name>CHANGEE_AGENT_NAME</agent_name>#<agent_name>$WAZUH_AGENT_NAME</agent_name>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
+  #sed -i "s/<port>CHANGE_ENROLL_PORT</port>/<port>$WAZUH_MANAGER_PORT</port>/g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
+  #sed -i "s/<manager_address>CHANGE_ENROLL_IP</manager_address>/<manager_address>$WAZUH_REGISTRATION_SERVER</manager_address>/g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
+  #sed -i "s/<port>CHANGE_ENROLL_PORT</port>/<port>$WAZUH_REGISTRATION_PORT</port>/g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
+  #sed -i "s/<agent_name>CHANGEE_AGENT_NAME</agent_name>/<agent_name>$WAZUH_AGENT_NAME</agent_name>/g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
+  [ -n "$WAZUH_REGISTRATION_PASSWORD" ] && \
+  echo "$WAZUH_REGISTRATION_PASSWORD" > ${WAZUH_INSTALL_PATH}/etc/authd.pass && \
+  chown root:wazuh ${WAZUH_INSTALL_PATH}/etc/authd.pass && \
+  chmod 640 ${WAZUH_INSTALL_PATH}/etc/authd.pass
+}
+
+##############################################################################
+# Main function
+##############################################################################
+
+main() {
+
+  # Mount selected files (WAZUH_CONFIG_MOUNT) to container
+  mount_files
+
+  # Configure agent variables
+  set_manager_conn
+
+}
+
+main
diff --git a/build-docker-images/wazuh-agent/config/etc/cont-init.d/1-agent b/build-docker-images/wazuh-agent/config/etc/cont-init.d/1-agent
new file mode 100644
index 00000000..076ac6ce
--- /dev/null
+++ b/build-docker-images/wazuh-agent/config/etc/cont-init.d/1-agent
@@ -0,0 +1,44 @@
+#!/usr/bin/with-contenv bash
+
+##############################################################################
+# Migration sequence
+# Detect if there is a mounted volume on /wazuh-migration and copy the data
+# to /var/ossec, finally it will create a flag ".migration-completed" inside
+# the mounted volume
+##############################################################################
+
+function __colortext()
+{
+  echo -e " \e[1;$2m$1\e[0m"
+}
+
+function echogreen()
+{
+  echo $(__colortext "$1" "32")
+}
+
+function echoyellow()
+{
+  echo $(__colortext "$1" "33")
+}
+
+function echored()
+{
+  echo $(__colortext "$1" "31")
+}
+
+function_entrypoint_scripts() {
+  # It will run every .sh script located in entrypoint-scripts folder in lexicographical order
+  if [ -d "/entrypoint-scripts/" ]
+  then
+    for script in `ls /entrypoint-scripts/*.sh | sort -n`; do
+      bash "$script"
+    done
+  fi
+}
+
+# run entrypoint scripts
+function_entrypoint_scripts
+
+# Start Wazuh
+/var/ossec/bin/wazuh-control start
diff --git a/build-docker-images/wazuh-agent/config/etc/services.d/ossec-logs/run b/build-docker-images/wazuh-agent/config/etc/services.d/ossec-logs/run
new file mode 100644
index 00000000..e96cba8f
--- /dev/null
+++ b/build-docker-images/wazuh-agent/config/etc/services.d/ossec-logs/run
@@ -0,0 +1,4 @@
+#!/usr/bin/with-contenv sh
+
+# dumping ossec.log to standard output
+exec tail -F /var/ossec/logs/ossec.log
diff --git a/wazuh-agent/config/wazuh-agent-conf b/wazuh-agent/config/wazuh-agent-conf
new file mode 100644
index 00000000..73a355f1
--- /dev/null
+++ b/wazuh-agent/config/wazuh-agent-conf
@@ -0,0 +1,194 @@
+<!--
+  Wazuh - Agent - Default configuration for amzn 2023
+  More info at: https://documentation.wazuh.com
+  Mailing list: https://groups.google.com/forum/#!forum/wazuh
+-->
+
+<ossec_config>
+  <client>
+    <server>
+      <address>CHANGE_MANAGER_IP</address>
+      <port>CHANGE_MANAGER_PORT</port>
+      <protocol>tcp</protocol>
+    </server>
+    <config-profile>amzn, amzn2023</config-profile>
+    <notify_time>10</notify_time>
+    <time-reconnect>60</time-reconnect>
+    <auto_restart>yes</auto_restart>
+    <crypto_method>aes</crypto_method>
+    <enrollment>
+      <enabled>yes</enabled>
+      <manager_address>CHANGE_ENROLL_IP</manager_address>
+      <port>CHANGE_ENROLL_PORT</port>
+      <agent_name>CHANGEE_AGENT_NAME</agent_name>
+      <authorization_pass_path>etc/authd.pass</authorization_pass_path>
+    </enrollment>
+  </client>
+
+  <client_buffer>
+    <!-- Agent buffer options -->
+    <disabled>no</disabled>
+    <queue_size>5000</queue_size>
+    <events_per_second>500</events_per_second>
+  </client_buffer>
+
+  <!-- Policy monitoring -->
+  <rootcheck>
+    <disabled>no</disabled>
+    <check_files>yes</check_files>
+    <check_trojans>yes</check_trojans>
+    <check_dev>yes</check_dev>
+    <check_sys>yes</check_sys>
+    <check_pids>yes</check_pids>
+    <check_ports>yes</check_ports>
+    <check_if>yes</check_if>
+
+    <!-- Frequency that rootcheck is executed - every 12 hours -->
+    <frequency>43200</frequency>
+
+    <rootkit_files>etc/shared/rootkit_files.txt</rootkit_files>
+    <rootkit_trojans>etc/shared/rootkit_trojans.txt</rootkit_trojans>
+
+    <skip_nfs>yes</skip_nfs>
+
+    <ignore>/var/lib/containerd</ignore>
+    <ignore>/var/lib/docker/overlay2</ignore>
+  </rootcheck>
+
+  <wodle name="cis-cat">
+    <disabled>yes</disabled>
+    <timeout>1800</timeout>
+    <interval>1d</interval>
+    <scan-on-start>yes</scan-on-start>
+
+    <java_path>wodles/java</java_path>
+    <ciscat_path>wodles/ciscat</ciscat_path>
+  </wodle>
+
+  <!-- Osquery integration -->
+  <wodle name="osquery">
+    <disabled>yes</disabled>
+    <run_daemon>yes</run_daemon>
+    <log_path>/var/log/osquery/osqueryd.results.log</log_path>
+    <config_path>/etc/osquery/osquery.conf</config_path>
+    <add_labels>yes</add_labels>
+  </wodle>
+
+  <!-- System inventory -->
+  <wodle name="syscollector">
+    <disabled>no</disabled>
+    <interval>1h</interval>
+    <scan_on_start>yes</scan_on_start>
+    <hardware>yes</hardware>
+    <os>yes</os>
+    <network>yes</network>
+    <packages>yes</packages>
+    <ports all="no">yes</ports>
+    <processes>yes</processes>
+
+    <!-- Database synchronization settings -->
+    <synchronization>
+      <max_eps>10</max_eps>
+    </synchronization>
+  </wodle>
+
+  <sca>
+    <enabled>yes</enabled>
+    <scan_on_start>yes</scan_on_start>
+    <interval>12h</interval>
+    <skip_nfs>yes</skip_nfs>
+  </sca>
+
+  <!-- File integrity monitoring -->
+  <syscheck>
+    <disabled>no</disabled>
+
+    <!-- Frequency that syscheck is executed default every 12 hours -->
+    <frequency>43200</frequency>
+
+    <scan_on_start>yes</scan_on_start>
+
+    <!-- Directories to check  (perform all possible verifications) -->
+    <directories>/etc,/usr/bin,/usr/sbin</directories>
+    <directories>/bin,/sbin,/boot</directories>
+
+    <!-- Files/directories to ignore -->
+    <ignore>/etc/mtab</ignore>
+    <ignore>/etc/hosts.deny</ignore>
+    <ignore>/etc/mail/statistics</ignore>
+    <ignore>/etc/random-seed</ignore>
+    <ignore>/etc/random.seed</ignore>
+    <ignore>/etc/adjtime</ignore>
+    <ignore>/etc/httpd/logs</ignore>
+    <ignore>/etc/utmpx</ignore>
+    <ignore>/etc/wtmpx</ignore>
+    <ignore>/etc/cups/certs</ignore>
+    <ignore>/etc/dumpdates</ignore>
+    <ignore>/etc/svc/volatile</ignore>
+
+    <!-- File types to ignore -->
+    <ignore type="sregex">.log$|.swp$</ignore>
+
+    <!-- Check the file, but never compute the diff -->
+    <nodiff>/etc/ssl/private.key</nodiff>
+
+    <skip_nfs>yes</skip_nfs>
+    <skip_dev>yes</skip_dev>
+    <skip_proc>yes</skip_proc>
+    <skip_sys>yes</skip_sys>
+
+    <!-- Nice value for Syscheck process -->
+    <process_priority>10</process_priority>
+
+    <!-- Maximum output throughput -->
+    <max_eps>50</max_eps>
+
+    <!-- Database synchronization settings -->
+    <synchronization>
+      <enabled>yes</enabled>
+      <interval>5m</interval>
+      <max_eps>10</max_eps>
+    </synchronization>
+  </syscheck>
+
+  <!-- Log analysis -->
+  <localfile>
+    <log_format>command</log_format>
+    <command>df -P</command>
+    <frequency>360</frequency>
+  </localfile>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d</command>
+    <alias>netstat listening ports</alias>
+    <frequency>360</frequency>
+  </localfile>
+
+  <localfile>
+    <log_format>full_command</log_format>
+    <command>last -n 20</command>
+    <frequency>360</frequency>
+  </localfile>
+
+  <!-- Active response -->
+  <active-response>
+    <disabled>no</disabled>
+    <ca_store>etc/wpk_root.pem</ca_store>
+    <ca_verification>yes</ca_verification>
+  </active-response>
+
+  <!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
+  <logging>
+    <log_format>plain</log_format>
+  </logging>
+
+</ossec_config>
+
+<ossec_config>
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/ossec/logs/active-responses.log</location>
+  </localfile>
+
+</ossec_config>
diff --git a/wazuh-agent/docker-compose.yml b/wazuh-agent/docker-compose.yml
new file mode 100644
index 00000000..7b90ffb2
--- /dev/null
+++ b/wazuh-agent/docker-compose.yml
@@ -0,0 +1,20 @@
+# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
+version: '3.7'
+
+services:
+  wazuh.agent:
+    image: wazuh/wazuh-agent:4.10.1
+    hostname: wazuh.agent
+    restart: always
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+      nofile:
+        soft: 655360
+        hard: 655360
+    environment:
+      - WAZUH_MANAGER_SERVER=<WAZUH_MANAGER_IP>
+      - WAZUH_AGENT_NAME=<AGENT_NAME>
+    volumes:
+      - ./config/wazuh-agent-conf:/wazuh-config-mount/etc/ossec.conf
\ No newline at end of file

From 097c198e0cc6333e9538da672e828baee0d8bcd0 Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Wed, 7 May 2025 10:27:28 -0300
Subject: [PATCH 02/14] Remove comment lines

---
 .../wazuh-agent/config/etc/cont-init.d/0-wazuh-init          | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init
index 44c5cc5a..2fcf4a88 100644
--- a/build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init
+++ b/build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init
@@ -62,16 +62,11 @@ mount_files() {
 
 set_manager_conn() {
   echo "ossec.conf configuration"
-  #sed -i "s/<address>CHANGE_MANAGER_IP</address>/<address>$WAZUH_MANAGER_SERVER</address>/g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
   sed -i "s#<address>CHANGE_MANAGER_IP</address>#<address>$WAZUH_MANAGER_SERVER</address>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
   sed -i "s#<port>CHANGE_MANAGER_PORT</port>#<port>$WAZUH_MANAGER_PORT</port>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
   sed -i "s#<manager_address>CHANGE_ENROLL_IP</manager_address>#<manager_address>$WAZUH_REGISTRATION_SERVER</manager_address>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
   sed -i "s#<port>CHANGE_ENROLL_PORT</port>#<port>$WAZUH_REGISTRATION_PORT</port>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
   sed -i "s#<agent_name>CHANGEE_AGENT_NAME</agent_name>#<agent_name>$WAZUH_AGENT_NAME</agent_name>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
-  #sed -i "s/<port>CHANGE_ENROLL_PORT</port>/<port>$WAZUH_MANAGER_PORT</port>/g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
-  #sed -i "s/<manager_address>CHANGE_ENROLL_IP</manager_address>/<manager_address>$WAZUH_REGISTRATION_SERVER</manager_address>/g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
-  #sed -i "s/<port>CHANGE_ENROLL_PORT</port>/<port>$WAZUH_REGISTRATION_PORT</port>/g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
-  #sed -i "s/<agent_name>CHANGEE_AGENT_NAME</agent_name>/<agent_name>$WAZUH_AGENT_NAME</agent_name>/g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
   [ -n "$WAZUH_REGISTRATION_PASSWORD" ] && \
   echo "$WAZUH_REGISTRATION_PASSWORD" > ${WAZUH_INSTALL_PATH}/etc/authd.pass && \
   chown root:wazuh ${WAZUH_INSTALL_PATH}/etc/authd.pass && \

From e4cdd20c6a37e9ee3c9e1f58bc14d37e906eeca0 Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Wed, 7 May 2025 12:28:29 -0300
Subject: [PATCH 03/14] Modify docker-compose.yml file

---
 wazuh-agent/docker-compose.yml | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/wazuh-agent/docker-compose.yml b/wazuh-agent/docker-compose.yml
index 7b90ffb2..b53badfc 100644
--- a/wazuh-agent/docker-compose.yml
+++ b/wazuh-agent/docker-compose.yml
@@ -4,17 +4,8 @@ version: '3.7'
 services:
   wazuh.agent:
     image: wazuh/wazuh-agent:4.10.1
-    hostname: wazuh.agent
     restart: always
-    ulimits:
-      memlock:
-        soft: -1
-        hard: -1
-      nofile:
-        soft: 655360
-        hard: 655360
     environment:
       - WAZUH_MANAGER_SERVER=<WAZUH_MANAGER_IP>
-      - WAZUH_AGENT_NAME=<AGENT_NAME>
     volumes:
       - ./config/wazuh-agent-conf:/wazuh-config-mount/etc/ossec.conf
\ No newline at end of file

From aa2bc74977415a1441b1588e9b91a5fdaf497ea2 Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Fri, 9 May 2025 10:22:46 -0300
Subject: [PATCH 04/14] Add Wazuh agent into PR test workflow

---
 .github/workflows/push.yml     | 26 +++++++++++++++++++++++++-
 wazuh-agent/docker-compose.yml |  2 +-
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index c7d34d61..9ba6eb89 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -27,6 +27,7 @@ jobs:
         docker save wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar
         docker save wazuh/wazuh-indexer:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar
         docker save wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar
+        docker save wazuh/wazuh-agent:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-agent.tar
 
     - name: Temporarily save Wazuh manager Docker image
       uses: actions/upload-artifact@v3
@@ -49,6 +50,13 @@ jobs:
         path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar
         retention-days: 1
 
+    - name: Temporarily save Wazuh agent Docker image
+      uses: actions/upload-artifact@v3
+      with:
+        name: docker-artifact-agent
+        path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-agent.tar
+        retention-days: 1
+
     - name: Install Goss
       uses: e1himself/goss-installation-action@v1.0.3
       with:
@@ -91,12 +99,17 @@ jobs:
       with:
         name: docker-artifact-dashboard
 
+    - name: Retrieve saved Wazuh agent Docker image
+      uses: actions/download-artifact@v3
+      with:
+        name: docker-artifact-agent
+
     - name: Docker load
       run: |
         docker load --input ./wazuh-indexer.tar
         docker load --input ./wazuh-dashboard.tar
         docker load --input ./wazuh-manager.tar
-
+        docker load --input ./wazuh-agent.tar
 
     - name: Create single node certficates
       run: docker-compose -f single-node/generate-indexer-certs.yml run --rm generator
@@ -188,6 +201,17 @@ jobs:
     - name: Check errors in ossec.log
       run: ./.github/single-node-log-check.sh
 
+    - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file
+      run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
+
+    - name: Start single node stack
+      run: docker-compose -f wazuh-agent/docker-compose.yml up -d
+
+    - name: Check Wazuh agent enrollment
+      run: |
+        sleep 20
+        curl -k -s -X GET "curl -k -X GET "https://localhost:55000/agents?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}"
+
   check-multi-node:
     runs-on: ubuntu-latest
     needs: build-docker-images
diff --git a/wazuh-agent/docker-compose.yml b/wazuh-agent/docker-compose.yml
index b53badfc..ab35d9fe 100644
--- a/wazuh-agent/docker-compose.yml
+++ b/wazuh-agent/docker-compose.yml
@@ -6,6 +6,6 @@ services:
     image: wazuh/wazuh-agent:4.10.1
     restart: always
     environment:
-      - WAZUH_MANAGER_SERVER=<WAZUH_MANAGER_IP>
+      - WAZUH_MANAGER_SERVER=172.17.0.1
     volumes:
       - ./config/wazuh-agent-conf:/wazuh-config-mount/etc/ossec.conf
\ No newline at end of file

From dbe677b1c0c944614d7ed2fa1496d207b7dd03b6 Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Fri, 9 May 2025 10:30:49 -0300
Subject: [PATCH 05/14] Add Wazuh agent into PR test workflow

---
 .github/workflows/push.yml | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index 9ba6eb89..e24ffe89 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -8,7 +8,7 @@ jobs:
     steps:
 
     - name: Check out code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Install docker-compose
       run: |
@@ -30,28 +30,28 @@ jobs:
         docker save wazuh/wazuh-agent:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-agent.tar
 
     - name: Temporarily save Wazuh manager Docker image
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: docker-artifact-manager
         path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar
         retention-days: 1
 
     - name: Temporarily save Wazuh indexer Docker image
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: docker-artifact-indexer
         path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar
         retention-days: 1
 
     - name: Temporarily save Wazuh dashboard Docker image
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: docker-artifact-dashboard
         path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar
         retention-days: 1
 
     - name: Temporarily save Wazuh agent Docker image
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: docker-artifact-agent
         path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-agent.tar
@@ -74,7 +74,7 @@ jobs:
     steps:
 
     - name: Check out code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Install docker-compose
       run: |
@@ -85,22 +85,22 @@ jobs:
       run: cat .env > $GITHUB_ENV
 
     - name: Retrieve saved Wazuh indexer Docker image
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: docker-artifact-indexer
 
     - name: Retrieve saved Wazuh manager Docker image
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: docker-artifact-manager
 
     - name: Retrieve saved Wazuh dashboard Docker image
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: docker-artifact-dashboard
 
     - name: Retrieve saved Wazuh agent Docker image
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: docker-artifact-agent
 
@@ -218,7 +218,7 @@ jobs:
     steps:
 
     - name: Check out code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Install docker-compose
       run: |
@@ -237,17 +237,17 @@ jobs:
         df -h
 
     - name: Retrieve saved Wazuh dashboard Docker image
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: docker-artifact-dashboard
 
     - name: Retrieve saved Wazuh manager Docker image
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: docker-artifact-manager
 
     - name: Retrieve saved Wazuh indexer Docker image
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: docker-artifact-indexer
 

From 9d7910c0ed82e79fb658808f169467fd3769e4cd Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Fri, 9 May 2025 10:54:29 -0300
Subject: [PATCH 06/14] Add Wazuh agent into PR test workflow

---
 .github/.goss.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/.goss.yaml b/.github/.goss.yaml
index 81b4347f..9de88d1e 100644
--- a/.github/.goss.yaml
+++ b/.github/.goss.yaml
@@ -56,7 +56,7 @@ package:
   wazuh-manager:
     installed: true
     versions:
-    - 4.10.1-1
+    - 4.10.1
 port:
   tcp:1514:
     listening: true

From 9b19ca8b33c5b57284762b50542a9a54181820ff Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Fri, 9 May 2025 11:10:17 -0300
Subject: [PATCH 07/14] Add Wazuh agent into PR test workflow

---
 .github/workflows/push.yml | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index e24ffe89..b65232c0 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -198,13 +198,10 @@ jobs:
         exit 1
        fi
 
-    - name: Check errors in ossec.log
-      run: ./.github/single-node-log-check.sh
-
     - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file
       run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
 
-    - name: Start single node stack
+    - name: Start Wazuh agent
       run: docker-compose -f wazuh-agent/docker-compose.yml up -d
 
     - name: Check Wazuh agent enrollment
@@ -212,6 +209,9 @@ jobs:
         sleep 20
         curl -k -s -X GET "curl -k -X GET "https://localhost:55000/agents?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}"
 
+    - name: Check errors in ossec.log for Wazuh manager
+      run: ./.github/single-node-log-check.sh
+
   check-multi-node:
     runs-on: ubuntu-latest
     needs: build-docker-images
@@ -233,7 +233,6 @@ jobs:
         sudo swapoff -a
         sudo rm -f /swapfile
         sudo apt clean
-        docker rmi $(docker image ls -aq)
         df -h
 
     - name: Retrieve saved Wazuh dashboard Docker image

From 680b0ac72573c574b7d348582b2bc9560743f74c Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Fri, 9 May 2025 11:30:19 -0300
Subject: [PATCH 08/14] Add Wazuh agent into PR test workflow

---
 .github/workflows/push.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index b65232c0..05172caf 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -207,7 +207,7 @@ jobs:
     - name: Check Wazuh agent enrollment
       run: |
         sleep 20
-        curl -k -s -X GET "curl -k -X GET "https://localhost:55000/agents?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}"
+        curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}"
 
     - name: Check errors in ossec.log for Wazuh manager
       run: ./.github/single-node-log-check.sh

From 58033929935ba7b744a643d976e27028c972dc20 Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Fri, 9 May 2025 11:56:16 -0300
Subject: [PATCH 09/14] Add Wazuh agent into PR test workflow

---
 .github/workflows/push.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index 05172caf..870af1e0 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -208,6 +208,8 @@ jobs:
       run: |
         sleep 20
         curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}"
+      env:
+        TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
 
     - name: Check errors in ossec.log for Wazuh manager
       run: ./.github/single-node-log-check.sh

From 144301bf7c8f7b13c84177dee388e8d3ac2a6f32 Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Fri, 9 May 2025 14:05:58 -0300
Subject: [PATCH 10/14] Add Wazuh agent into multinode workflow

---
 .github/workflows/push.yml | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index 870af1e0..737dca7e 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -364,5 +364,18 @@ jobs:
         exit 1
        fi
 
-    - name: Check errors in ossec.log
-      run: ./.github/multi-node-log-check.sh
\ No newline at end of file
+    - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file
+      run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
+
+    - name: Start Wazuh agent
+      run: docker-compose -f wazuh-agent/docker-compose.yml up -d
+
+    - name: Check Wazuh agent enrollment
+      run: |
+        sleep 20
+        curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}"
+      env:
+        TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
+
+    - name: Check errors in ossec.log for Wazuh manager
+      run: ./.github/single-node-log-check.sh
\ No newline at end of file

From bc88c686aa67a794f10f65eb1d378079b1d1e27c Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Fri, 9 May 2025 15:46:11 -0300
Subject: [PATCH 11/14] Add agent load on multinode deployment

---
 .env                                               | 6 +++---
 .github/workflows/Procedure_push_docker_images.yml | 4 ++--
 .github/workflows/push.yml                         | 8 +++++++-
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/.env b/.env
index 87fd140c..b3b201d1 100755
--- a/.env
+++ b/.env
@@ -1,6 +1,6 @@
-WAZUH_VERSION=4.10.1
-WAZUH_IMAGE_VERSION=4.10.1
+WAZUH_VERSION=4.12.0
+WAZUH_IMAGE_VERSION=4.12.0
 WAZUH_TAG_REVISION=1
-FILEBEAT_TEMPLATE_BRANCH=4.10.1
+FILEBEAT_TEMPLATE_BRANCH=v4.12.0
 WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.4.tar.gz
 WAZUH_UI_REVISION=1
diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml
index e3568ee1..3a8adcb2 100644
--- a/.github/workflows/Procedure_push_docker_images.yml
+++ b/.github/workflows/Procedure_push_docker_images.yml
@@ -14,7 +14,7 @@ on:
         required: false
       products:
         description: 'Comma-separated list of the image names to build and push'
-        default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer'
+        default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
         required: true
       filebeat_module_version:
         description: 'Filebeat module version'
@@ -52,7 +52,7 @@ on:
         type: string
       products:
         description: 'Comma-separated list of the image names to build and push'
-        default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer'
+        default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
         required: true
         type: string
       filebeat_module_version:
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index 737dca7e..e8f3c2e6 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -252,12 +252,18 @@ jobs:
       with:
         name: docker-artifact-indexer
 
+    - name: Retrieve saved Wazuh agent Docker image
+      uses: actions/download-artifact@v4
+      with:
+        name: docker-artifact-agent
+
     - name: Docker load
       run: |
         docker load --input ./wazuh-manager.tar
         docker load --input ./wazuh-indexer.tar
         docker load --input ./wazuh-dashboard.tar
-        rm -rf wazuh-manager.tar wazuh-indexer.tar wazuh-dashboard.tar
+        docker load --input ./wazuh-agent.tar
+        rm -rf wazuh-manager.tar wazuh-indexer.tar wazuh-dashboard.tar wazuh-agent.tar
 
     - name: Create multi node certficates
       run: docker-compose -f multi-node/generate-indexer-certs.yml run --rm generator

From 00286586aa5f822fe2c0e642cf05820c3da53763 Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Fri, 9 May 2025 16:11:47 -0300
Subject: [PATCH 12/14] Add agent load on multinode deployment

---
 .github/workflows/push.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index e8f3c2e6..962c656a 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -384,4 +384,4 @@ jobs:
         TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
 
     - name: Check errors in ossec.log for Wazuh manager
-      run: ./.github/single-node-log-check.sh
\ No newline at end of file
+      run: ./.github/multi-node-log-check.sh
\ No newline at end of file

From f28a7068b136fe1fafb42677977f21555438f741 Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Mon, 12 May 2025 13:33:44 -0300
Subject: [PATCH 13/14] bump wazuh version into env file

---
 .env | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.env b/.env
index b3b201d1..e9682a59 100755
--- a/.env
+++ b/.env
@@ -1,6 +1,6 @@
-WAZUH_VERSION=4.12.0
-WAZUH_IMAGE_VERSION=4.12.0
+WAZUH_VERSION=4.10.2
+WAZUH_IMAGE_VERSION=4.10.2
 WAZUH_TAG_REVISION=1
-FILEBEAT_TEMPLATE_BRANCH=v4.12.0
+FILEBEAT_TEMPLATE_BRANCH=v4.10.2
 WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.4.tar.gz
 WAZUH_UI_REVISION=1

From eb95be535c62271cddea96098c7bdd9bc3d49fdb Mon Sep 17 00:00:00 2001
From: vcerenu <victor.erenu@wazuh.com>
Date: Mon, 12 May 2025 13:45:24 -0300
Subject: [PATCH 14/14] bump Wazuh agent version and add changelog

---
 CHANGELOG.md                   | 2 +-
 wazuh-agent/docker-compose.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 81dd3ec5..676edea7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,7 +5,7 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- None
+- BACKPORT: Agent Docker images code ([#1807](https://github.com/wazuh/wazuh-docker/pull/1807))
 
 ### Changed
 
diff --git a/wazuh-agent/docker-compose.yml b/wazuh-agent/docker-compose.yml
index ab35d9fe..9e5b11d2 100644
--- a/wazuh-agent/docker-compose.yml
+++ b/wazuh-agent/docker-compose.yml
@@ -3,7 +3,7 @@ version: '3.7'
 
 services:
   wazuh.agent:
-    image: wazuh/wazuh-agent:4.10.1
+    image: wazuh/wazuh-agent:4.10.2
     restart: always
     environment:
       - WAZUH_MANAGER_SERVER=172.17.0.1