16 lines
486 B
Plaintext
16 lines
486 B
Plaintext
include::../../libbeat/docs/shared-docker.asciidoc[]
|
|
|
|
[float]
|
|
==== Special requirements
|
|
|
|
Under Docker, {beatname_uc} runs as a non-root user, but requires some privileged
|
|
capabilities to operate correctly. Ensure that the +AUDIT_CONTROL+ and +AUDIT_READ+
|
|
capabilities are available to the container.
|
|
|
|
It is also essential to run {beatname_uc} in the host PID namespace.
|
|
|
|
["source","sh",subs="attributes"]
|
|
----
|
|
docker run --cap-add=AUDIT_CONTROL,AUDIT_READ --pid=host {dockerimage}
|
|
----
|