ARM64 support🐞🐋 <title>

[okoklets]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Scirius, arkime and suricata dont have arm64 docker support. I have altered Dockerfiles to build the first two successfully and used the ARCH=arm64v8 env variable for the suricata build.sh and now have a fully operational SELKS running on arm64. please see below Dockerfiles as requested by pevma on discord.

i also edited compose.yml as i stored the arm64 images on a local repository, but if someone was to build and release these officially that would not be required. i will attach te compose.ywl anyway.

i also linked this to my mikrotik by loosly following mikrocata2selks (https://github.com/angolo40/mikrocata2selks)

i'm unsure if i forgot anything else i may have edited but if so please to alert me.

Expected Behavior

build and install on arm64.

Steps To Reproduce

checkout SELKS, run easy-setup.sh

Docker version

Docker version 27.0.1-rc.1, build 0d415ad

Docker version

Docker version 27.0.1-rc.1, build 0d415ad

OS Version

Description: Debian GNU/Linux 12 (bookworm)

Content of the environnement File

COMPOSE_PROJECT_NAME=selks
INTERFACES= -i tzsp0
SCIRIUS_SECRET_KEY=
ML_ENABLED=false
PWD=${PWD}

Version of SELKS

commit 8719e3514f05d28e1e6f1a1244cbf3160d10f467 (HEAD -> master)
Author: Michael Vale [email protected]
Date: Sat Jun 22 16:15:15 2024 +1000

initial commit

commit b46b2246182a24049fb2b3079c9caf39f59d3dfb
Author: Michael Vale [email protected]
Date: Sat Jun 22 16:07:09 2024 +1000

initial commit

commit 4af455c
Author: Peter Manev [email protected]
Date: Thu Jun 13 13:18:18 2024 +0200

docker: Add Logstash/Kibana docker versions

commit 76cd4f1 (tag: selks-10.0)
Author: Peter Manev [email protected]

Anything else?

Arkime.dockerfile.arm64.txt
scirius.Dockerfile.arm64.txt
compose.yml.txt

[13653216371]

能否推送到docker hub ?

正好使用树莓派搭建该方案，遇到了同样的问题

[okoklets]

I'm going to do a merge request.  I can push the images to docker but that's just doubling up.  It would be better if it all takes effect in mainline.

…

-- Sent from Canary On Thursday, Jun 27, 2024 at 5:33 PM, 13653216371 ***@***.***> wrote: 能否推送到docker hub ? —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you authored the thread.Message ID: ***@***.***> ***@***.***": ***@***.***": "EmailMessage","potentialAction": ***@***.***": "ViewAction","target": "#472 (comment)","url": "#472 (comment)","name": "View Issue"},"description": "View this Issue on GitHub","publisher": ***@***.***": "Organization","name": "GitHub","url": "https://github.com"}}]

[13653216371]

那我先尝试自行构建..

[okoklets]

Best of luck.  It worked for me.  If you get stuck just holler.

…

-- Sent from Canary On Thursday, Jun 27, 2024 at 5:37 PM, 13653216371 ***@***.***> wrote: 那我先尝试自行构建.. —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you authored the thread.Message ID: ***@***.***> ***@***.***": ***@***.***": "EmailMessage","potentialAction": ***@***.***": "ViewAction","target": "#472 (comment)","url": "#472 (comment)","name": "View Issue"},"description": "View this Issue on GitHub","publisher": ***@***.***": "Organization","name": "GitHub","url": "https://github.com"}}]

[13653216371]

Step 13/32 : RUN wget -q "https://github.com/arkime/arkime/releases/download/last-commit/ARKIME_DEB_PACKAGE"
---> Running in b7b5081b3a0a
The command '/bin/sh -c wget -q "https://github.com/arkime/arkime/releases/download/last-commit/ARKIME_DEB_PACKAGE"' returned a non-zero code: 8

走到这一步时遇到错误，这个url似乎已经404丢失了

[okoklets]

The variable should have a $ in front of it like so $ARKIME_DEB_PACKAGE. I apologize that's my fault. If it still doesn't work the " might have to go before the " instead of at the end of the line.  I can't confirm that right now, I'm sure you'll figure it out.  Sorry I can't be of more help right now.

…

-- Sent from Canary On Thursday, Jun 27, 2024 at 7:25 PM, 13653216371 ***@***.***> wrote: Step 13/32 : RUN wget -q "https://github.com/arkime/arkime/releases/download/last-commit/ARKIME_DEB_PACKAGE"---> Running in b7b5081b3a0aThe command '/bin/sh -c wget -q "https://github.com/arkime/arkime/releases/download/last-commit/ARKIME_DEB_PACKAGE"' returned a non-zero code: 8 走到这一步时遇到错误，这个url似乎已经404丢失了 —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you authored the thread.Message ID: ***@***.***> ***@***.***": ***@***.***": "EmailMessage","potentialAction": ***@***.***": "ViewAction","target": "#472 (comment)","url": "#472 (comment)","name": "View Issue"},"description": "View this Issue on GitHub","publisher": ***@***.***": "Organization","name": "GitHub","url": "https://github.com"}}]

[13653216371]

看来我还需要把树莓派换成ubuntu系统，arkime 似乎并不支持树莓派os

[okoklets]

The use of Ubuntu is isolated to the docker container irrespective of the OS you are using.  You should be right to continue.

…

-- Sent from Canary On Thursday, Jun 27, 2024 at 9:50 PM, 13653216371 ***@***.***> wrote: 看来我还需要把树莓派换成ubuntu系统，arkime 似乎并不支持树莓派os —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you authored the thread.Message ID: ***@***.***> ***@***.***": ***@***.***": "EmailMessage","potentialAction": ***@***.***": "ViewAction","target": "#472 (comment)","url": "#472 (comment)","name": "View Issue"},"description": "View this Issue on GitHub","publisher": ***@***.***": "Organization","name": "GitHub","url": "https://github.com"}}]