How to Install Wazuh with Docker Compose

To install Wazuh with Docker Compose, clone the official repository, run docker-compose up -d and in minutes you'll have the three components up: Indexer, Server and Dashboard. You only need Docker and Docker Compose installed on the server.

How to install Wazuh with Docker Compose step by step?

In this guide I'll show you how to install Wazuh using Docker Compose, one of the fastest and simplest ways to deploy the full environment. With just 4 commands you'll have Wazuh running with all its components: Indexer, Server and Dashboard.

Why should you use Docker for Wazuh?

Docker offers several advantages for deploying Wazuh:

Speed: The full environment is ready in minutes
Portability: It works the same on any system with Docker installed
Isolation: The containers don't interfere with other system services
Easy upgrades: Changing version is as simple as editing the tag
Ideal for testing: Perfect for labs and development environments

What do you need before you start?

Before you start, you need to have installed:

Docker (version 20.10 or higher)
Docker Compose (version 2.0 or higher)
Git to clone the repository

Resource	Minimum	Recommended
CPU	2 cores	4 cores
RAM	4 GB	8 GB
Disk	20 GB	50 GB SSD

What are the installation commands?

The installation is done in 4 simple steps:

1. Clone the official repository

git clone https://github.com/wazuh/wazuh-docker.git -b v4.14.3

This downloads the official Wazuh repository for Docker on version 4.14.3.

2. Enter the single-node directory

cd wazuh-docker/single-node/

The single-node directory contains the configuration to deploy all components on a single server. There's also multi-node for distributed deployments.

3. Generate SSL certificates

docker compose -f generate-indexer-certs.yml run --rm generator

This command generates the certificates needed for secure communication between components.

4. Bring up the containers

docker compose up -d

The -d flag runs the containers in the background (detached mode).

All the commands together:

git clone https://github.com/wazuh/wazuh-docker.git -b v4.14.3
cd wazuh-docker/single-node/
docker compose -f generate-indexer-certs.yml run --rm generator
docker compose up -d

How do you access the Dashboard?

Once the containers are up, access the Dashboard at:

https://server-IP or https://localhost (if it's on your own machine)

The default credentials are:

Username: admin
Password: SecretPassword

How do you get container information?

To see the configuration and environment variables of the server container:

docker inspect server-container-id

Important: Change the default password in production environments. You can do it by editing the docker-compose.yml file before bringing up the containers.

Useful commands

Some commands that will come in handy for managing the deployment:

# Check container status
docker compose ps

# View logs in real time
docker compose logs -f

# Stop the containers
docker compose down

# Restart the containers
docker compose restart

What should you watch out for in production?

Docker is the fastest way to get a lab running, but a production deployment needs a few extra precautions. First, raise the host's vm.max_map_count kernel parameter to at least 262144, or the Indexer container will fail to start. Second, the named volumes hold all your indexed alerts, so back them up and never run docker compose down -v on a live system, since the -v flag deletes the data volumes. Finally, restrict the exposed ports (the Dashboard on 443 and the agent listener on 1514/1515) with a firewall so only trusted networks can reach them.

For environments beyond a small lab, plan for resource limits and log rotation. The Indexer can consume several gigabytes of RAM under load, so set explicit memory limits in docker-compose.yml and monitor disk usage, because indexed data grows continuously. When it is time to upgrade, change the version tag (for example from v4.14.3 to a newer release), pull the new images and recreate the containers; your data persists in the volumes between versions.

Additional resources

Frequently Asked Questions

What do I need before installing Wazuh with Docker?

You need Docker version 20.10 or higher, Docker Compose 2.0 or higher, and Git to clone the repository. The minimum hardware is 2 CPU cores, 4 GB of RAM and 20 GB of disk, with 4 cores, 8 GB and 50 GB SSD recommended.

How many commands does it take to deploy Wazuh on Docker?

Just 4: clone the official wazuh-docker repository, enter the single-node directory, generate the SSL certificates, and run docker compose up -d. In a few minutes the Indexer, Server and Dashboard are running.

What are the default Wazuh Docker credentials?

The default login is the user admin with the password SecretPassword. You should change this password in production by editing the docker-compose.yml file before bringing up the containers.

What is the difference between single-node and multi-node?

The single-node directory deploys all components on one server, which is ideal for testing and small environments. The multi-node directory is for distributed production deployments where components run across several hosts for scalability and high availability.

How do I check the status of the Wazuh containers?

Run docker compose ps to see the container status, docker compose logs -f to follow logs in real time, and docker compose down or docker compose restart to stop or restart the deployment.

Related articles:

Get Wazuh deployed the right way

This article is just the beginning. We can configure agents, build custom rules, integrate with other tools and much more.

Professional implementation