Wazuh Docker Installation: Complete Setup Guide

Running Wazuh in Docker is the quickest way to stand up the full stack on a single host without polluting the system with services. The official `wazuh-docker` repository ships docker-compose files for both single-node and multi-node modes.

Prerequisites

• Linux host with Docker Engine 20.10+ and Docker Compose v2
• At least 6 GB RAM available to containers (8 GB recommended)
• Outbound internet to pull images from Docker Hub

1. Raise vm.max_map_count

The Wazuh indexer requires:

sudo sysctl -w vm.max_map_count=262144
echo "vm.max_map_count=262144" | sudo tee -a /etc/sysctl.conf

2. Clone the official repo

git clone https://github.com/wazuh/wazuh-docker.git -b v4.9.0
cd wazuh-docker/single-node

Use the `multi-node` directory instead if you want a 3-node indexer cluster from the start.

3. Generate certificates

The repo ships a one-shot certificate generator container:

docker compose -f generate-indexer-certs.yml run --rm generator

Certificates land under `./config/wazuh_indexer_ssl_certs/` and are mounted into the stack on start.

4. Start the stack

docker compose up -d

Verify the containers are healthy:

docker compose ps

Expect to see `wazuh.indexer`, `wazuh.manager` and `wazuh.dashboard` all in the `running` state.

5. Default ports

• 443/tcp: Wazuh dashboard UI
• 1514/tcp: agent log shipping
• 1515/tcp: agent enrollment
• 55000/tcp: Wazuh API
• 9200/tcp: Wazuh indexer (do not expose publicly)

6. First login

Open `https://<docker-host>` and sign in with the default `admin` / `SecretPassword` credentials baked into the compose file. Rotate them immediately for anything that is not throwaway, the official docs include a password-change procedure.

Persistence and upgrades

• Named volumes under `wazuh_*` persist indexer data, manager config and certificates across restarts.
• To upgrade, edit the image tag in `docker-compose.yml` to the new version and run `docker compose up -d`.
• For host-bind data directories on Linux, ensure the volumes are on fast disk, the indexer is IO heavy.

If you plan to put the dockerized stack behind a reverse proxy or run it in production, we can help design persistence, certificate rotation and update workflows that match your environment.