Coding & Development
krain
25d agokrain-sec is an open‑source Go‑based Docker sidecar honeypot that runs in a single low‑resource container (≈256 MB, 0.5 CPU). It presents believable decoy services – fake SSH, MySQL, Grafana and a SOC console – on ports 22, 3306, 3000 and 8080, diverting commodity scanners and curious intruders while the real website remains on ports 80/443. Licensed under AGPL‑3.0, it logs interactions for detection engineers and serves as a lightweight deception tool for small teams, SOC labs, researchers and homelabs.
Single‑container deploymentDecoy servicesInteraction loggingLow resource footprintOpen‑source licensing
Key Capabilities
01
Single‑container deployment
Runs as one Docker container with minimal RAM and CPU usage.
02
Decoy services
Simulates SSH, MySQL, Grafana and a fake SOC console on separate ports.
03
Interaction logging
Records authentication attempts, commands, and other probe activity for analysis.
04
Low resource footprint
Uses about 256 MB storage and 0.5 CPU, suitable for VPS environments.
05
Open‑source licensing
Released under the AGPL‑3.0 license, allowing community contributions and transparency.
Use Cases
Scanner diversion for small sitesDiverts automated scanners and bots to fake services, keeping the production site less attractive.Small teams and solo operators running a public website.
SOC and blue‑team toolingProvides a decoy asset that generates signals for detection rules without needing a full SIEM stack.Blue‑team and SOC lab engineers.
Research and educationEnables researchers and students to study deception techniques and lightweight attribution without affecting real services.Researchers, students, and security enthusiasts.
Homelab or purple‑team playgroundOffers an isolated, safe environment to observe attacker behavior on a throwaway VPS or VLAN.Homelab operators and purple‑team practitioners.
Update History
Updated 25d ago▲ 0% mentionsProduct HuntWeb