open port 57012 about malcolm

[mmguero]

I'm sorry, I don't have any experience using polarproxy, and I'm not sure whether or not what you're trying to do is going to work with how malcolm uses its arkime containers.

Malcolm has got two arkime containers, one is arkime which processes PCAP files that are either 1) uploaded through the arkime upload interface or 2) periodically processed "live" PCAP captured by tcpdump or netsniff-ng rolled over every so many minutes or megabytes. The other container is the arkime-live which runs capture on live traffic, but this can only be used when running a remote opensearch or elastic instance, not Malcolm's internally managed one.

In either case, this entrypoint script is used to generate Arkime's config.ini using environment variables using a file docker bind-mounted as /opt/arkime/etc/config.orig.ini as a basis. You could add a line like - ./arkime/etc/config.ini:/opt/arkime/etc/config.orig.ini:ro into the volumes section of the arkime-live container, but again, it's only going to be running that container if you're using an external opensearch or elasticsearch instance. As far as ports being open, you'd have to specify that in the ports section for the appropriate container as well.

I'm going to close this bug as it's not going to be a supported configuration for us to help you out with, but good luck and I hope you can figure out a way to do what you're trying to do.