# Crowdsec-firewall-bouncer in a container

**URL:** <https://discourse.crowdsec.net/t/crowdsec-firewall-bouncer-in-a-container/1730>\
**Category:** Uncategorized\
**Created:** [March 29, 2024, 11:42am UTC](https://discourse.crowdsec.net/t/crowdsec-firewall-bouncer-in-a-container/1730 "2024-03-29T11:42:50Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![stephdl](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@stephdl](https://discourse.crowdsec.net/u/stephdl)\
**Post date:** [March 29, 2024, 11:42am UTC](https://discourse.crowdsec.net/t/crowdsec-firewall-bouncer-in-a-container/1730/1 "2024-03-29T11:42:50Z")

</div>

Hello

Ready to get (in french) ‘une volée de bois vert’, but we are experimenting a way to use crowdsec-firewall-bouncer in a container.

We used to install it on the host with deb or rpm but this time we tried to get it workable within a rootfull container build with buildah and running by systemd and podman

[buildah script](https://github.com/NethServer/ns8-crowdsec/blob/sdl6900Bouncer/build-images.sh)

[systemd service](https://github.com/NethServer/ns8-crowdsec/blob/sdl6900Bouncer/imageroot/crowdsec-firewall-bouncer.service)

We decided to go to nftables, ipset is going to be really old school, nftables is working well with firewalld (or firewalld works well with nftables :p)

Once started the container can receive orders from crowdsec container and interacts with nftables as we wish…

Well if you have suggestions, I can accept also do not go that way 🙂

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [March 29, 2024, 4:41pm UTC](https://discourse.crowdsec.net/t/crowdsec-firewall-bouncer-in-a-container/1730/2 "2024-03-29T16:41:03Z")

</div>

Looks awesome! the only comment I had was installing the repositories is a great way, but you could also just grab the binary direct from the releases of github page. Then you can make a more minimal container size from scratch.

But other than that looks great!

---

<div class="post-metadata">

**Author:** ![shgew](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/shgew/32/1129_2.png) [@shgew](https://discourse.crowdsec.net/u/shgew)\
**Post date:** [February 6, 2025, 8:35pm UTC](https://discourse.crowdsec.net/t/crowdsec-firewall-bouncer-in-a-container/1730/3 "2025-02-06T20:35:07Z")

</div>

Hey

I also just published my version of cs-firewall-bouncer in a docker container at [GitHub - shgew/cs-firewall-bouncer-docker: A dockerized version of https://github.com/crowdsecurity/cs-firewall-bouncer](https://github.com/shgew/cs-firewall-bouncer-docker) 🙂

> installing the repositories is a great way, but you could also just grab the binary direct from the releases of github page. Then you can make a more minimal container size from scratch.

That’s a great advice! I didn’t think of that. I will implement it whenever I have the time.

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [February 6, 2025, 9:25pm UTC](https://discourse.crowdsec.net/t/crowdsec-firewall-bouncer-in-a-container/1730/4 "2025-02-06T21:25:09Z")

</div>

Awesome! and saw you added the binary grab, note also in the compose we should also add

```yaml
   security_opt:
      - no-new-privileges:true

```

Since we already added `NET_ADMIN` we dont need anything else added.

---

<div class="post-metadata">

**Author:** ![shgew](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/shgew/32/1129_2.png) [@shgew](https://discourse.crowdsec.net/u/shgew)\
**Post date:** [February 6, 2025, 9:42pm UTC](https://discourse.crowdsec.net/t/crowdsec-firewall-bouncer-in-a-container/1730/5 "2025-02-06T21:42:14Z")

</div>

Thanks for the tip! Will do.

---

<div class="post-metadata">

**Author:** ![sembio](https://avatars.discourse-cdn.com/v4/letter/s/3e96dc/32.png) [@sembio](https://discourse.crowdsec.net/u/sembio)\
**Post date:** [May 9, 2025, 8:02pm UTC](https://discourse.crowdsec.net/t/crowdsec-firewall-bouncer-in-a-container/1730/6 "2025-05-09T20:02:00Z")

</div>

Hi @shgew  
I have a setup where traefik and crowdsec are on a docker network called proxy.  
But when adding your containerized bouncer to that network, the bouncer cannot connect, it seems.  
Do you have an idea why?  
Verbose mode is not helpful either.

 ![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/2X/4/423db192ca9e163f1e17c4b9268ff236fd75bb24.jpeg)