krain

ACTIVE

The honeypot solo devs can actually run and maintain

Launched July 28, 2026

About krain

krain-sec is an open‑source sidecar honeypot written in Go and packaged as a Docker container. It runs alongside a real web service (ports 80/443) and presents believable decoy services—SSH, MySQL, Grafana, and a fake SOC console—on ports 22, 3306, 3000 and 8080. The decoys include fake secrets, PDFs and tarpits, aiming to attract scanners and curious intruders while keeping the production site boring. It is lightweight (≈256 MB image, 0.5 GB RAM) and licensed under AGPL‑3.0.

Pricing

Pricing information isn't available yet.

Capabilities

Single‑container deployment

Runs as one Docker container beside the real site, simplifying setup and maintenance.

Decoy SSH service

Provides a fake SSH endpoint that logs authentication attempts and command execution.

Decoy MySQL service

Offers a simulated MySQL server that records handshake and query attempts.

Decoy Grafana service

Emulates a Grafana console to lure explorers into a fake monitoring UI.

Fake SOC console

Shows a counterfeit security operations console (Aetheris) with fabricated secrets and PDFs.

Low resource footprint

Docker image ~23 MB, requires ~256 MB storage and 0.5 GB RAM/CPU.

Open‑source AGPL‑3.0 license

Source code is publicly available on GitHub for audit and customization.

Use Cases

Traffic diversion for solo developers
Diverts noisy scanners away from the production site, protecting small‑team or solo‑run web services.
For: Small teams & solo operators
Blue‑team / SOC lab training
Provides a lightweight decoy asset that lights up on scanner activity for detection practice without a full SIEM.
For: Blue teams / SOC labs
Detection engineering
Generates decoy interaction logs that can be used as signals in security rules and pipelines.
For: Detection engineers
Research and education
Enables researchers and students to study deception techniques and attribution without impacting real identity providers.
For: Researchers & students
Homelab / purple‑team playground
Offers an isolated, inexpensive honeypot for attacker simulations on a VLAN or throwaway VPS.
For: Homelab / purple team