Pi.Alert in Docker: detect unknown devices on the LAN

Mục Lục

Pi.Alert monitors Wi-Fi/LAN devices and can alert on unknown devices or devices that should remain online. I run it on a Linux Docker host with host networking so it can observe the local network; that also requires a trust boundary and the UI should not be exposed directly to the Internet.¹

The original i12bretro video was validated for title and author through oEmbed.²

Install Docker on Linux

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
# install prerequisites
sudo apt install apt-transport-https ca-certificates curl software-properties-common gnupg-agent -y
# add docker gpg key
curl -fsSL https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release)/gpg | sudo apt-key add -
# add docker software repository
sudo add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release) $(lsb_release -cs) stable"
# install docker
sudo apt install docker-ce docker-compose containerd.io -y
# enable and start docker service
sudo systemctl enable docker && sudo systemctl start docker
# add the current user to the docker group
sudo usermod -aG docker $USER
# reauthenticate for the new group membership to take effect
su - $USER

After re-authenticating for Docker group membership, check docker version and the user's permissions before continuing.

Run Pi.Alert

Create the directory, start a temporary container to obtain the default config/database, copy both directories to the host, remove the temporary container, and start the persistent container:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
# create working directory
mkdir ~/docker/pialert -p
# set ownership on the working directories
sudo chown "$USER":"$USER" ~/docker -R
# run temp pialert container
docker run -d --name=pialert --net=host -e TZ=America/New_York jokobsk/pi.alert
# copy default config files to host
docker cp pialert:/home/pi/pialert/config ~/docker/pialert/
# copy db to host
docker cp pialert:/home/pi/pialert/db ~/docker/pialert/
# remove the temp container
docker rm pialert --force
# run the pialert container
docker run -d --name=pialert --net=host -e TZ=America/New_York -v ~/docker/pialert/db:/home/pi/pialert/db -v ~/docker/pialert/config/:/home/pi/pialert/config/ --restart=unless-stopped jokobsk/pi.alert

--net=host lets Pi.Alert see host interfaces but widens the application's reach; I run it only on a trusted machine and inspect docker inspect pialert.

Open and verify the UI

Open:

http://DNSorIP:20211/pialert

The welcome page confirms that the container is running. The source notes that Pi.Alert's cron job checks for new devices every five minutes; I inspect logs, the database, and the device list before trusting alerts.

Backup and limits

Back up ~/docker/pialert/config and ~/docker/pialert/db before changing the image. Host networking does not create a firewall boundary, and MAC/IP identification can change when clients use randomized MAC addresses. Pi.Alert is a monitoring signal, not a replacement for firewalling, IDS, or VLAN isolation.

Sources

https://i12bretro.github.io/tutorials/0780.html — i12bretro tutorial 0780. Independently edited from the numbered HTML page; host networking and the five-minute cron note are retained. ↩︎
https://www.youtube.com/watch?v=qpDptKzTepc — Running Pi.Alert - A Network Intrusion Monitor - Containerized in Docker — i12bretro ↩︎

AIoT.IO.VN