velociraptor xboarder56/velociraptor:latest https://hub.docker.com/r/xboarder56/velociraptor bridge sh false https://github.com/Xboarder56/velociraptor-docker/issues https://github.com/Xboarder56/velociraptor-docker Velociraptor DFIR server running in Docker (xboarder56 fork), adapted for Unraid. Multi-arch image: linux/amd64 and linux/arm64. Mapped services: - Frontend / client ingress: 8000/tcp - API / gRPC gateway: 8001/tcp - Web GUI (HTTPS): 8889/tcp - Prometheus metrics: 8003/tcp Persistent path: - /mnt/user/appdata/velociraptor -> /velociraptor (config, keys, artifacts, repacked client bundles — all stored here) First run: The container auto-generates server.config.yaml and client.config.yaml and repacks Linux (.deb/.rpm amd64+arm64), macOS (amd64+arm64) and Windows (.exe/.msi) clients into /velociraptor/client_bundles/. A small build banner (version, arch, base image, git commit, build date) is printed to the log on every start. Login: Open https://[UNRAID-IP]:8889, accept the self-signed TLS certificate and log in with the credentials set via VELOX_DEFAULT_USER / VELOX_DEFAULT_PASSWORD. Change them immediately after first login! Security: - TLS is self-signed by default; rotate keys/certificates from the Velociraptor GUI. - Keep API port 8001 and metrics port 8003 restricted to trusted networks only. - VELOX_DEFAULT_USER/PASSWORD are only used for the initial bootstrap user. Troubleshooting: docker logs -f velociraptor docker exec -it velociraptor sh Source: https://github.com/Xboarder56/velociraptor-docker Fork of: https://github.com/weslambert/velociraptor-docker (Wes Lambert) Tools:System Security: https://[IP]:[PORT:8889] https://raw.githubusercontent.com/Gill-Bates/unraid-app-templates/main/templates/02_velociraptor.xml https://raw.githubusercontent.com/Gill-Bates/unraid-app-templates/refs/heads/main/icons/02_velociraptor.png --restart unless-stopped --security-opt=no-new-privileges:true 2026-06-07 Update template to xboarder56/velociraptor fork: new image/repo URLs, add Prometheus port 8003, replace manual server.config.yaml requirement with runtime env-var configuration (VELOX_DEFAULT_USER/PASSWORD, VELOX_FRONTEND_*, VELOX_GUI_*, VELOX_API_PORT, VELOX_MONITORING_PORT, VELOX_START_SERVER_VERBOSE), remove /var/logs volume (logs now in /velociraptor), update Overview for auto-generated config and multi-arch client repacks, add Security category. bridge 8000 8000 tcp 8001 8001 tcp 8889 8889 tcp 8003 8003 tcp /mnt/user/appdata/velociraptor /velociraptor rw TZ Etc/UTC VELOX_DEFAULT_USER admin VELOX_DEFAULT_PASSWORD changeme VELOX_DEFAULT_USER_ROLE administrator VELOX_FRONTEND_HOSTNAME localhost VELOX_FRONTEND_PORT 8000 VELOX_FRONTEND_SERVER_SCHEME https VELOX_GUI_HOSTNAME localhost VELOX_GUI_PORT 8889 VELOX_GUI_SCHEME https VELOX_API_PORT 8001 VELOX_MONITORING_PORT 8003 VELOX_START_SERVER_VERBOSE false