Wazuh SIEM (indexer + manager + dashboard)

Security rootless 3 containers

Open in Generator

indexer docker.io/wazuh/wazuh-indexer:4.14.9

manager docker.io/wazuh/wazuh-manager:4.14.9 · 1514:1514, 1515:1515

dashboard docker.io/wazuh/wazuh-dashboard:4.14.9 · 8443:5601

Deployment rootless

1. Prepare the host

Operating System:

Prerequisites once as root

Install Podman (needs podman 4.3 or newer; Ubuntu 22.04 ships 3.4 and is too old, use 24.04)

apt update && apt install -y podman

Create user (if not existing)

useradd -m -s /bin/bash wazuh
passwd wazuh

Enable linger (services keep running after logout and start after reboot)

loginctl enable-linger wazuh

↪

Switch to deployment user

su - wazuh

Use su - with the dash — this creates a proper login shell as wazuh. Without the dash, root environment variables carry over and rootless Podman will not work correctly.

Fix environment for rootless systemd (new users only — skip if already set)

Required once so systemctl --user works in non-login sessions.

cat << 'EOF' >> ~/.bashrc

# Fix for systemd user services (rootless Podman/systemctl)
export XDG_RUNTIME_DIR=/run/user/$(id -u)
export DBUS_SESSION_BUS_ADDRESS=unix:path=$XDG_RUNTIME_DIR/bus
EOF
source ~/.bashrc

2. Choose a format and deploy

The same pod in four forms. Pick one and follow only its steps.

Each tab says which podman it needs. Check yours with podman --version: Debian 12 ships 4.3, Ubuntu 24.04 4.9, Debian 13 5.4, Fedora 5.8, Arch 6.x.

Kubernetes YAML for podman kube play, started by systemd through a Quadlet .kube unit (podman 4.4+; older podman like Debian 12 uses podman-kube@, see the version check below).

Kubernetes YAML

apiVersion: v1
kind: Pod
metadata:
  name: wazuh
  labels:
    app: wazuh
spec:
  restartPolicy: Always
  containers:
  - name: indexer
    image: docker.io/wazuh/wazuh-indexer:4.14.9
    env:
    - name: OPENSEARCH_JAVA_OPTS
      value: -Xms1g -Xmx1g
    volumeMounts:
    - name: vol-0
      mountPath: /var/lib/wazuh-indexer
    - name: vol-1
      mountPath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
    - name: vol-2
      mountPath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
    - name: vol-3
      mountPath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
    - name: vol-4
      mountPath: /usr/share/wazuh-indexer/config/certs/admin.pem
    - name: vol-5
      mountPath: /usr/share/wazuh-indexer/config/certs/admin-key.pem
    - name: vol-6
      mountPath: /usr/share/wazuh-indexer/config/opensearch.yml
    - name: vol-7
      mountPath: /usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
  - name: manager
    image: docker.io/wazuh/wazuh-manager:4.14.9
    ports:
    - containerPort: 1514
      hostPort: 1514
    - containerPort: 1515
      hostPort: 1515
    env:
    - name: INDEXER_URL
      value: https://wazuh.indexer:9200
    - name: INDEXER_USERNAME
      value: admin
    - name: INDEXER_PASSWORD
      value: Ahga81A80ujob6NVBjSV6g
    - name: FILEBEAT_SSL_VERIFICATION_MODE
      value: full
    - name: SSL_CERTIFICATE_AUTHORITIES
      value: /etc/ssl/root-ca.pem
    - name: SSL_CERTIFICATE
      value: /etc/ssl/filebeat.pem
    - name: SSL_KEY
      value: /etc/ssl/filebeat.key
    - name: API_USERNAME
      value: wazuh-wui
    - name: API_PASSWORD
      value: Ahga81A80ujob6NVBjSV6g
    volumeMounts:
    - name: vol-8
      mountPath: /var/ossec/api/configuration
    - name: vol-9
      mountPath: /var/ossec/etc
    - name: vol-10
      mountPath: /var/ossec/logs
    - name: vol-11
      mountPath: /var/ossec/queue
    - name: vol-12
      mountPath: /var/ossec/var/multigroups
    - name: vol-13
      mountPath: /var/ossec/integrations
    - name: vol-14
      mountPath: /var/ossec/active-response/bin
    - name: vol-15
      mountPath: /var/ossec/agentless
    - name: vol-16
      mountPath: /var/ossec/wodles
    - name: vol-17
      mountPath: /etc/filebeat
    - name: vol-18
      mountPath: /var/lib/filebeat
    - name: vol-19
      mountPath: /etc/ssl/root-ca.pem
    - name: vol-20
      mountPath: /etc/ssl/filebeat.pem
    - name: vol-21
      mountPath: /etc/ssl/filebeat.key
    - name: vol-22
      mountPath: /wazuh-config-mount/etc/ossec.conf
  - name: dashboard
    image: docker.io/wazuh/wazuh-dashboard:4.14.9
    ports:
    - containerPort: 5601
      hostPort: 8443
    env:
    - name: INDEXER_USERNAME
      value: admin
    - name: INDEXER_PASSWORD
      value: Ahga81A80ujob6NVBjSV6g
    - name: WAZUH_API_URL
      value: https://wazuh.manager
    - name: DASHBOARD_USERNAME
      value: kibanaserver
    - name: DASHBOARD_PASSWORD
      value: Ahga81A80ujob6NVBjSV6g
    - name: API_USERNAME
      value: wazuh-wui
    - name: API_PASSWORD
      value: Ahga81A80ujob6NVBjSV6g
    volumeMounts:
    - name: vol-23
      mountPath: /usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
    - name: vol-24
      mountPath: /usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
    - name: vol-1
      mountPath: /usr/share/wazuh-dashboard/certs/root-ca.pem
    - name: vol-25
      mountPath: /usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
    - name: vol-26
      mountPath: /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
    - name: vol-27
      mountPath: /usr/share/wazuh-dashboard/data/wazuh/config
    - name: vol-28
      mountPath: /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
  volumes:
  - name: vol-0
    persistentVolumeClaim:
      claimName: wazuh-indexer-data
  - name: vol-1
    hostPath:
      path: /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem
      type: FileOrCreate
  - name: vol-2
    hostPath:
      path: /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem
      type: FileOrCreate
  - name: vol-3
    hostPath:
      path: /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer.pem
      type: FileOrCreate
  - name: vol-4
    hostPath:
      path: /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/admin.pem
      type: FileOrCreate
  - name: vol-5
    hostPath:
      path: /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/admin-key.pem
      type: FileOrCreate
  - name: vol-6
    hostPath:
      path: /home/wazuh/wazuh/config/wazuh_indexer/wazuh.indexer.yml
      type: FileOrCreate
  - name: vol-7
    hostPath:
      path: /home/wazuh/wazuh/config/wazuh_indexer/internal_users.yml
      type: FileOrCreate
  - name: vol-8
    persistentVolumeClaim:
      claimName: wazuh-api-configuration
  - name: vol-9
    persistentVolumeClaim:
      claimName: wazuh-etc
  - name: vol-10
    persistentVolumeClaim:
      claimName: wazuh-logs
  - name: vol-11
    persistentVolumeClaim:
      claimName: wazuh-queue
  - name: vol-12
    persistentVolumeClaim:
      claimName: wazuh-var-multigroups
  - name: vol-13
    persistentVolumeClaim:
      claimName: wazuh-integrations
  - name: vol-14
    persistentVolumeClaim:
      claimName: wazuh-active-response
  - name: vol-15
    persistentVolumeClaim:
      claimName: wazuh-agentless
  - name: vol-16
    persistentVolumeClaim:
      claimName: wazuh-wodles
  - name: vol-17
    persistentVolumeClaim:
      claimName: wazuh-filebeat-etc
  - name: vol-18
    persistentVolumeClaim:
      claimName: wazuh-filebeat-var
  - name: vol-19
    hostPath:
      path: /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem
      type: FileOrCreate
  - name: vol-20
    hostPath:
      path: /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager.pem
      type: FileOrCreate
  - name: vol-21
    hostPath:
      path: /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem
      type: FileOrCreate
  - name: vol-22
    hostPath:
      path: /home/wazuh/wazuh/config/wazuh_cluster/wazuh_manager.conf
      type: FileOrCreate
  - name: vol-23
    hostPath:
      path: /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem
      type: FileOrCreate
  - name: vol-24
    hostPath:
      path: /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem
      type: FileOrCreate
  - name: vol-25
    hostPath:
      path: /home/wazuh/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml
      type: FileOrCreate
  - name: vol-26
    hostPath:
      path: /home/wazuh/wazuh/config/wazuh_dashboard/wazuh.yml
      type: FileOrCreate
  - name: vol-27
    persistentVolumeClaim:
      claimName: wazuh-dashboard-config
  - name: vol-28
    persistentVolumeClaim:
      claimName: wazuh-dashboard-custom

Save the YAML file

mkdir -p ~/.config/containers/
nano ~/.config/containers/wazuh.yaml

Test the pod (without autostart)

podman kube play ~/.config/containers/wazuh.yaml

# Check status:
podman pod ps && podman ps

# Stop:
podman kube down ~/.config/containers/wazuh.yaml

Check your podman version

podman --version

4.4 or newer: continue with step 3 below.

Older, e.g. 4.3 on Debian 12? There is no Quadlet yet: use podman's own podman-kube@ service instead of steps 3–5

systemctl --user enable --now podman-kube@$(systemd-escape ~/.config/containers/wazuh.yaml).service

# Status & logs:
systemctl --user status podman-kube@$(systemd-escape ~/.config/containers/wazuh.yaml).service
journalctl --user -u podman-kube@$(systemd-escape ~/.config/containers/wazuh.yaml).service -f

The day-to-day commands below have a block for this service.

Create Quadlet .kube file

wazuh.kube

[Unit]
Description=wazuh pod
After=network-online.target
Wants=network-online.target

[Kube]
Yaml=%h/.config/containers/wazuh.yaml

[Service]
Restart=always

[Install]
WantedBy=default.target

%h is a systemd home-directory specifier — do not replace it with ~/.

Save to ~/.config/containers/systemd/:

mkdir -p ~/.config/containers/systemd/
nano ~/.config/containers/systemd/wazuh.kube

Start systemd service

systemctl --user daemon-reload
systemctl --user start wazuh.service

Status & Logs

systemctl --user status wazuh.service
journalctl --user -u wazuh.service -f
podman pod ps
podman ps

Enable automatic image updates optional

Requires AutoUpdate=registry in the .kube file. Podman then checks for new images and restarts the pod automatically:

systemctl --user enable --now podman.socket
systemctl --user daemon-reload
systemctl --user enable --now podman-auto-update.timer

# Check status:
systemctl --user status podman-auto-update.timer

# Trigger manually:
podman auto-update

Day-to-day logs, restart, update, remove (click to open)

Logs & shell into a container

podman logs -f wazuh-indexer
podman logs -f wazuh-manager
podman logs -f wazuh-dashboard
podman exec -it wazuh-indexer /bin/sh

Restart

systemctl --user restart wazuh.service

Update an image by hand

Pull the new version, the restart recreates the containers from it:

podman pull <image>:<tag>
systemctl --user restart wazuh.service

Stop & remove

Stop through systemd, otherwise Restart=always brings the pod back. To remove it for good, delete the unit files and reload:

systemctl --user stop wazuh.service
rm ~/.config/containers/systemd/wazuh.kube
systemctl --user daemon-reload

podman older than 4.4 (podman-kube@ from step 3)

systemctl --user restart podman-kube@$(systemd-escape ~/.config/containers/wazuh.yaml).service

# Update an image: pull, then restart as above
podman pull <image>:<tag>

# Stop and remove from autostart:
systemctl --user disable --now podman-kube@$(systemd-escape ~/.config/containers/wazuh.yaml).service

Delete the data — permanent, only after stop & remove

podman volume rm wazuh-indexer-data
podman volume rm wazuh-api-configuration
podman volume rm wazuh-etc
podman volume rm wazuh-logs
podman volume rm wazuh-queue
podman volume rm wazuh-var-multigroups
podman volume rm wazuh-integrations
podman volume rm wazuh-active-response
podman volume rm wazuh-agentless
podman volume rm wazuh-wodles
podman volume rm wazuh-filebeat-etc
podman volume rm wazuh-filebeat-var
podman volume rm wazuh-dashboard-config
podman volume rm wazuh-dashboard-custom
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/admin.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/admin-key.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer/wazuh.indexer.yml
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer/internal_users.yml
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_cluster/wazuh_manager.conf
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_dashboard/wazuh.yml

Files created by containers belong to root in the user namespace — podman unshare is required to delete them.

Native systemd units without the Kubernetes YAML: one .pod plus one .container per container. Each container becomes its own systemd service (restart, logs and ordering per container). Needs podman 5.0 or newer — Debian 12 ships 4.3, use the Kube YAML tab there.

Save the unit files

wazuh.pod

[Unit]
Description=wazuh pod

[Pod]
PodName=wazuh
PublishPort=1514:1514
PublishPort=1515:1515
PublishPort=8443:5601

wazuh-indexer.container

[Unit]
Description=wazuh-indexer container

[Container]
Image=docker.io/wazuh/wazuh-indexer:4.14.9
Pod=wazuh.pod
ContainerName=wazuh-indexer
Environment="OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
Volume=wazuh-indexer-data:/var/lib/wazuh-indexer
Volume=/home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
Volume=/home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
Volume=/home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
Volume=/home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
Volume=/home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
Volume=/home/wazuh/wazuh/config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
Volume=/home/wazuh/wazuh/config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml

[Service]
Restart=always

[Install]
WantedBy=default.target

wazuh-manager.container

[Unit]
Description=wazuh-manager container

[Container]
Image=docker.io/wazuh/wazuh-manager:4.14.9
Pod=wazuh.pod
ContainerName=wazuh-manager
Environment=INDEXER_URL=https://wazuh.indexer:9200
Environment=INDEXER_USERNAME=admin
Environment=INDEXER_PASSWORD=Ahga81A80ujob6NVBjSV6g
Environment=FILEBEAT_SSL_VERIFICATION_MODE=full
Environment=SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
Environment=SSL_CERTIFICATE=/etc/ssl/filebeat.pem
Environment=SSL_KEY=/etc/ssl/filebeat.key
Environment=API_USERNAME=wazuh-wui
Environment=API_PASSWORD=Ahga81A80ujob6NVBjSV6g
Volume=wazuh-api-configuration:/var/ossec/api/configuration
Volume=wazuh-etc:/var/ossec/etc
Volume=wazuh-logs:/var/ossec/logs
Volume=wazuh-queue:/var/ossec/queue
Volume=wazuh-var-multigroups:/var/ossec/var/multigroups
Volume=wazuh-integrations:/var/ossec/integrations
Volume=wazuh-active-response:/var/ossec/active-response/bin
Volume=wazuh-agentless:/var/ossec/agentless
Volume=wazuh-wodles:/var/ossec/wodles
Volume=wazuh-filebeat-etc:/etc/filebeat
Volume=wazuh-filebeat-var:/var/lib/filebeat
Volume=/home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
Volume=/home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
Volume=/home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
Volume=/home/wazuh/wazuh/config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf

[Service]
Restart=always

[Install]
WantedBy=default.target

wazuh-dashboard.container

[Unit]
Description=wazuh-dashboard container

[Container]
Image=docker.io/wazuh/wazuh-dashboard:4.14.9
Pod=wazuh.pod
ContainerName=wazuh-dashboard
Environment=INDEXER_USERNAME=admin
Environment=INDEXER_PASSWORD=Ahga81A80ujob6NVBjSV6g
Environment=WAZUH_API_URL=https://wazuh.manager
Environment=DASHBOARD_USERNAME=kibanaserver
Environment=DASHBOARD_PASSWORD=Ahga81A80ujob6NVBjSV6g
Environment=API_USERNAME=wazuh-wui
Environment=API_PASSWORD=Ahga81A80ujob6NVBjSV6g
Volume=/home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
Volume=/home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
Volume=/home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
Volume=/home/wazuh/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
Volume=/home/wazuh/wazuh/config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
Volume=wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config
Volume=wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom

[Service]
Restart=always

[Install]
WantedBy=default.target

Save all of them to ~/.config/containers/systemd/:

mkdir -p ~/.config/containers/systemd/
nano ~/.config/containers/systemd/wazuh.pod
nano ~/.config/containers/systemd/wazuh-indexer.container
nano ~/.config/containers/systemd/wazuh-manager.container
nano ~/.config/containers/systemd/wazuh-dashboard.container

Start the pod

The pod service pulls in every container service. Autostart at boot comes from the [Install] section of the units, no enable needed.

systemctl --user daemon-reload
systemctl --user start wazuh-pod.service

Status & Logs

systemctl --user status wazuh-pod.service
journalctl --user -u wazuh-indexer.service -f
journalctl --user -u wazuh-manager.service -f
journalctl --user -u wazuh-dashboard.service -f
podman pod ps && podman ps

Day-to-day logs, restart, update, remove (click to open)

Logs & shell into a container

podman logs -f wazuh-indexer
podman logs -f wazuh-manager
podman logs -f wazuh-dashboard
podman exec -it wazuh-indexer /bin/sh

Restart

systemctl --user restart wazuh-pod.service

Update an image by hand

Pull the new version, the restart recreates the containers from it:

podman pull <image>:<tag>
systemctl --user restart wazuh-pod.service

Stop & remove

Stop through systemd, otherwise Restart=always brings the pod back. To remove it for good, delete the unit files and reload:

systemctl --user stop wazuh-pod.service
rm ~/.config/containers/systemd/wazuh.pod
rm ~/.config/containers/systemd/wazuh-indexer.container
rm ~/.config/containers/systemd/wazuh-manager.container
rm ~/.config/containers/systemd/wazuh-dashboard.container
systemctl --user daemon-reload

Delete the data — permanent, only after stop & remove

podman volume rm wazuh-indexer-data
podman volume rm wazuh-api-configuration
podman volume rm wazuh-etc
podman volume rm wazuh-logs
podman volume rm wazuh-queue
podman volume rm wazuh-var-multigroups
podman volume rm wazuh-integrations
podman volume rm wazuh-active-response
podman volume rm wazuh-agentless
podman volume rm wazuh-wodles
podman volume rm wazuh-filebeat-etc
podman volume rm wazuh-filebeat-var
podman volume rm wazuh-dashboard-config
podman volume rm wazuh-dashboard-custom
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/admin.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/admin-key.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer/wazuh.indexer.yml
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer/internal_users.yml
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_cluster/wazuh_manager.conf
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_dashboard/wazuh.yml

Files created by containers belong to root in the user namespace — podman unshare is required to delete them.

A docker-compose.yml for podman-compose. Handy if you already work with Compose; there are no per-container systemd services.

Install podman-compose as root

Run this as root, e.g. together with the prerequisites before su - wazuh.

apt install -y podman-compose

dnf install -y podman-compose

pacman -S podman-compose

apk add podman-compose

Save the compose file

docker-compose.yml

services:
  indexer:
    image: docker.io/wazuh/wazuh-indexer:4.14.9
    restart: always
    environment:
    - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g
    volumes:
    - wazuh-indexer-data:/var/lib/wazuh-indexer
    - /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
    - /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
    - /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
    - /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
    - /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
    - /home/wazuh/wazuh/config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
    - /home/wazuh/wazuh/config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
    ports:
    - 1514:1514
    - 1515:1515
    - 8443:5601
  manager:
    image: docker.io/wazuh/wazuh-manager:4.14.9
    restart: always
    environment:
    - INDEXER_URL=https://wazuh.indexer:9200
    - INDEXER_USERNAME=admin
    - INDEXER_PASSWORD=Ahga81A80ujob6NVBjSV6g
    - FILEBEAT_SSL_VERIFICATION_MODE=full
    - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
    - SSL_CERTIFICATE=/etc/ssl/filebeat.pem
    - SSL_KEY=/etc/ssl/filebeat.key
    - API_USERNAME=wazuh-wui
    - API_PASSWORD=Ahga81A80ujob6NVBjSV6g
    volumes:
    - wazuh-api-configuration:/var/ossec/api/configuration
    - wazuh-etc:/var/ossec/etc
    - wazuh-logs:/var/ossec/logs
    - wazuh-queue:/var/ossec/queue
    - wazuh-var-multigroups:/var/ossec/var/multigroups
    - wazuh-integrations:/var/ossec/integrations
    - wazuh-active-response:/var/ossec/active-response/bin
    - wazuh-agentless:/var/ossec/agentless
    - wazuh-wodles:/var/ossec/wodles
    - wazuh-filebeat-etc:/etc/filebeat
    - wazuh-filebeat-var:/var/lib/filebeat
    - /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
    - /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
    - /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
    - /home/wazuh/wazuh/config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
    network_mode: service:indexer
    depends_on:
      indexer:
        condition: service_started
  dashboard:
    image: docker.io/wazuh/wazuh-dashboard:4.14.9
    restart: always
    environment:
    - INDEXER_USERNAME=admin
    - INDEXER_PASSWORD=Ahga81A80ujob6NVBjSV6g
    - WAZUH_API_URL=https://wazuh.manager
    - DASHBOARD_USERNAME=kibanaserver
    - DASHBOARD_PASSWORD=Ahga81A80ujob6NVBjSV6g
    - API_USERNAME=wazuh-wui
    - API_PASSWORD=Ahga81A80ujob6NVBjSV6g
    volumes:
    - /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
    - /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
    - /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
    - /home/wazuh/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
    - /home/wazuh/wazuh/config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
    - wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config
    - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
    network_mode: service:indexer
    depends_on:
      indexer:
        condition: service_started
volumes:
  wazuh-indexer-data: null
  wazuh-api-configuration: null
  wazuh-etc: null
  wazuh-logs: null
  wazuh-queue: null
  wazuh-var-multigroups: null
  wazuh-integrations: null
  wazuh-active-response: null
  wazuh-agentless: null
  wazuh-wodles: null
  wazuh-filebeat-etc: null
  wazuh-filebeat-var: null
  wazuh-dashboard-config: null
  wazuh-dashboard-custom: null

mkdir -p ~/wazuh
nano ~/wazuh/docker-compose.yml

Start, status & logs

cd ~/wazuh
podman-compose up -d
podman-compose ps
podman-compose logs -f

# Stop:
podman-compose down

Start after reboot

podman-restart.service starts every container with restart: always at boot:

systemctl --user enable podman-restart.service

Update images

cd ~/wazuh
podman-compose pull
podman-compose up -d

Day-to-day logs, restart, update, remove (click to open)

Logs & shell into a container

podman logs -f wazuh_indexer_1
podman logs -f wazuh_manager_1
podman logs -f wazuh_dashboard_1
podman exec -it wazuh_indexer_1 /bin/sh

Restart

cd ~/wazuh
podman-compose restart

Stop & remove

cd ~/wazuh
podman-compose down

Delete the data — permanent, only after stop & remove

podman volume rm wazuh_wazuh-indexer-data
podman volume rm wazuh_wazuh-api-configuration
podman volume rm wazuh_wazuh-etc
podman volume rm wazuh_wazuh-logs
podman volume rm wazuh_wazuh-queue
podman volume rm wazuh_wazuh-var-multigroups
podman volume rm wazuh_wazuh-integrations
podman volume rm wazuh_wazuh-active-response
podman volume rm wazuh_wazuh-agentless
podman volume rm wazuh_wazuh-wodles
podman volume rm wazuh_wazuh-filebeat-etc
podman volume rm wazuh_wazuh-filebeat-var
podman volume rm wazuh_wazuh-dashboard-config
podman volume rm wazuh_wazuh-dashboard-custom
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/admin.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/admin-key.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer/wazuh.indexer.yml
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer/internal_users.yml
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_cluster/wazuh_manager.conf
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_dashboard/wazuh.yml

Files created by containers belong to root in the user namespace — podman unshare is required to delete them.

Plain podman pod create / podman create commands. Good for a quick test or to see what happens under the hood.

Save the script

wazuh.sh

#!/bin/bash
set -e

# ── Create named volumes ───────────────────────────────────────────
# Named volumes are created automatically — no UID/GID permission adjustment needed.
podman volume exists wazuh-indexer-data || podman volume create wazuh-indexer-data
podman volume exists wazuh-api-configuration || podman volume create wazuh-api-configuration
podman volume exists wazuh-etc || podman volume create wazuh-etc
podman volume exists wazuh-logs || podman volume create wazuh-logs
podman volume exists wazuh-queue || podman volume create wazuh-queue
podman volume exists wazuh-var-multigroups || podman volume create wazuh-var-multigroups
podman volume exists wazuh-integrations || podman volume create wazuh-integrations
podman volume exists wazuh-active-response || podman volume create wazuh-active-response
podman volume exists wazuh-agentless || podman volume create wazuh-agentless
podman volume exists wazuh-wodles || podman volume create wazuh-wodles
podman volume exists wazuh-filebeat-etc || podman volume create wazuh-filebeat-etc
podman volume exists wazuh-filebeat-var || podman volume create wazuh-filebeat-var
podman volume exists wazuh-dashboard-config || podman volume create wazuh-dashboard-config
podman volume exists wazuh-dashboard-custom || podman volume create wazuh-dashboard-custom

# ── Create pod ─────────────────────────────────────────────────────
podman pod create \
  --name wazuh \
  -p 1514:1514 \
  -p 1515:1515 \
  -p 8443:5601

# ── Container: wazuh-indexer ─────────────────────────────────────────────
podman create \
  --pod wazuh \
  --name wazuh-indexer \
  --restart always \
  -e OPENSEARCH_JAVA_OPTS='-Xms1g -Xmx1g' \
  -v wazuh-indexer-data:/var/lib/wazuh-indexer \
  -v /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem \
  -v /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key \
  -v /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem \
  -v /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem \
  -v /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem \
  -v /home/wazuh/wazuh/config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml \
  -v /home/wazuh/wazuh/config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml \
  docker.io/wazuh/wazuh-indexer:4.14.9

# ── Container: wazuh-manager ─────────────────────────────────────────────
podman create \
  --pod wazuh \
  --name wazuh-manager \
  --restart always \
  -e INDEXER_URL='https://wazuh.indexer:9200' \
  -e INDEXER_USERNAME='admin' \
  -e INDEXER_PASSWORD='Ahga81A80ujob6NVBjSV6g' \
  -e FILEBEAT_SSL_VERIFICATION_MODE='full' \
  -e SSL_CERTIFICATE_AUTHORITIES='/etc/ssl/root-ca.pem' \
  -e SSL_CERTIFICATE='/etc/ssl/filebeat.pem' \
  -e SSL_KEY='/etc/ssl/filebeat.key' \
  -e API_USERNAME='wazuh-wui' \
  -e API_PASSWORD='Ahga81A80ujob6NVBjSV6g' \
  -v wazuh-api-configuration:/var/ossec/api/configuration \
  -v wazuh-etc:/var/ossec/etc \
  -v wazuh-logs:/var/ossec/logs \
  -v wazuh-queue:/var/ossec/queue \
  -v wazuh-var-multigroups:/var/ossec/var/multigroups \
  -v wazuh-integrations:/var/ossec/integrations \
  -v wazuh-active-response:/var/ossec/active-response/bin \
  -v wazuh-agentless:/var/ossec/agentless \
  -v wazuh-wodles:/var/ossec/wodles \
  -v wazuh-filebeat-etc:/etc/filebeat \
  -v wazuh-filebeat-var:/var/lib/filebeat \
  -v /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem \
  -v /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem \
  -v /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key \
  -v /home/wazuh/wazuh/config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf \
  docker.io/wazuh/wazuh-manager:4.14.9

# ── Container: wazuh-dashboard ─────────────────────────────────────────────
podman create \
  --pod wazuh \
  --name wazuh-dashboard \
  --restart always \
  -e INDEXER_USERNAME='admin' \
  -e INDEXER_PASSWORD='Ahga81A80ujob6NVBjSV6g' \
  -e WAZUH_API_URL='https://wazuh.manager' \
  -e DASHBOARD_USERNAME='kibanaserver' \
  -e DASHBOARD_PASSWORD='Ahga81A80ujob6NVBjSV6g' \
  -e API_USERNAME='wazuh-wui' \
  -e API_PASSWORD='Ahga81A80ujob6NVBjSV6g' \
  -v /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem \
  -v /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem \
  -v /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem \
  -v /home/wazuh/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml \
  -v /home/wazuh/wazuh/config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml \
  -v wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config \
  -v wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom \
  docker.io/wazuh/wazuh-dashboard:4.14.9

# ── Start pod ──────────────────────────────────────────────────────
podman pod start wazuh

# ── Stop & clean up ───────────────────────────────────────────────
# podman pod stop wazuh
# podman pod rm wazuh

nano wazuh.sh

Run it, status & logs

bash wazuh.sh
podman pod ps && podman ps
podman logs -f <container-name>

Start after reboot

podman-restart.service starts every container with --restart always at boot:

systemctl --user enable podman-restart.service

Remove or rebuild

The script creates the pod once. To apply changes or new images, remove the pod and run the script again (named volumes stay):

podman pod rm -f wazuh
bash wazuh.sh

Day-to-day logs, restart, update, remove (click to open)

Logs & shell into a container

podman logs -f wazuh-indexer
podman logs -f wazuh-manager
podman logs -f wazuh-dashboard
podman exec -it wazuh-indexer /bin/sh

Restart

podman pod stop wazuh
podman pod start wazuh

Stop & remove

podman pod rm -f wazuh

Delete the data — permanent, only after stop & remove

podman volume rm wazuh-indexer-data
podman volume rm wazuh-api-configuration
podman volume rm wazuh-etc
podman volume rm wazuh-logs
podman volume rm wazuh-queue
podman volume rm wazuh-var-multigroups
podman volume rm wazuh-integrations
podman volume rm wazuh-active-response
podman volume rm wazuh-agentless
podman volume rm wazuh-wodles
podman volume rm wazuh-filebeat-etc
podman volume rm wazuh-filebeat-var
podman volume rm wazuh-dashboard-config
podman volume rm wazuh-dashboard-custom
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/admin.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/admin-key.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer/wazuh.indexer.yml
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer/internal_users.yml
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_cluster/wazuh_manager.conf
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml
podman unshare rm -rf /home/wazuh/wazuh/config/wazuh_dashboard/wazuh.yml

Files created by containers belong to root in the user namespace — podman unshare is required to delete them.

Useful Tips

Ports < 1024 (e.g. 80, 443)

Rootless cannot open privileged ports. Solution:

sysctl net.ipv4.ip_unprivileged_port_start=80

Make persistent in /etc/sysctl.d/99-podman.conf.

Containers communicate via localhost

All containers in the pod share the same network namespace. Always use localhost, not container names.

# Correct (e.g. app → db):
localhost:5432

# Wrong (doesn't work in a pod):
db-container:5432

List open ports

Which ports are the running containers publishing? See the PORTS column:

podman ps

Custom DNS for the pod

Set a custom DNS server (e.g. local Pi-hole) in the generator under DNS server. Every format picks it up.

Set volume ownership

Fix permission errors by adjusting UID/GID in the user namespace:

podman unshare chown 1000:1000 /path/to/volume

SELinux volume labels

On SELinux systems (RHEL, Fedora) set the volume suffix:

/host/path:/container/path:Z   # private
/host/path:/container/path:z   # shared

List all volumes

podman volume ls
podman volume inspect <volume-name>

Volume backup

Back up data from a named volume:

podman run --rm \
  -v <volume-name>:/data:ro \
  -v $(pwd):/backup \
  busybox tar czf /backup/backup.tar.gz /data

Cleanup

Remove unused images, containers and volumes:

podman system prune -f        # containers + images
podman image prune -f         # untagged images only
podman volume prune -f        # unused volumes

Check for outdated images

List local images; auto-update only covers units with AutoUpdate= (Kube and Quadlet tabs):

podman images
podman auto-update --dry-run

All containers, including stopped ones

podman pod ps
podman ps -a

Resource usage

podman stats --no-stream

Customize this stack

Change ports, volumes, environment variables and more in the generator.

Open in Generator