velociraptor
xboarder56/velociraptor:latest
https://hub.docker.com/r/xboarder56/velociraptor
bridge
sh
false
https://github.com/Xboarder56/velociraptor-docker/issues
https://github.com/Xboarder56/velociraptor-docker
Velociraptor DFIR server running in Docker (xboarder56 fork), adapted for Unraid.
Multi-arch image: linux/amd64 and linux/arm64.
Mapped services:
- Frontend / client ingress: 8000/tcp
- API / gRPC gateway: 8001/tcp
- Web GUI (HTTPS): 8889/tcp
- Prometheus metrics: 8003/tcp
Persistent path:
- /mnt/user/appdata/velociraptor -> /velociraptor
(config, keys, artifacts, repacked client bundles — all stored here)
First run:
The container auto-generates server.config.yaml and client.config.yaml and
repacks Linux (.deb/.rpm amd64+arm64), macOS (amd64+arm64) and Windows
(.exe/.msi) clients into /velociraptor/client_bundles/.
A small build banner (version, arch, base image, git commit, build date)
is printed to the log on every start.
Login:
Open https://[UNRAID-IP]:8889, accept the self-signed TLS certificate and
log in with the credentials set via VELOX_DEFAULT_USER / VELOX_DEFAULT_PASSWORD.
Change them immediately after first login!
Security:
- TLS is self-signed by default; rotate keys/certificates from the Velociraptor GUI.
- Keep API port 8001 and metrics port 8003 restricted to trusted networks only.
- VELOX_DEFAULT_USER/PASSWORD are only used for the initial bootstrap user.
Troubleshooting:
docker logs -f velociraptor
docker exec -it velociraptor sh
Source: https://github.com/Xboarder56/velociraptor-docker
Fork of: https://github.com/weslambert/velociraptor-docker (Wes Lambert)
Tools:System Security:
https://[IP]:[PORT:8889]
https://raw.githubusercontent.com/Gill-Bates/unraid-app-templates/main/templates/02_velociraptor.xml
https://raw.githubusercontent.com/Gill-Bates/unraid-app-templates/refs/heads/main/icons/02_velociraptor.png
--restart unless-stopped --security-opt=no-new-privileges:true
2026-06-07
Update template to xboarder56/velociraptor fork: new image/repo URLs, add Prometheus port
8003, replace manual server.config.yaml requirement with runtime env-var configuration
(VELOX_DEFAULT_USER/PASSWORD, VELOX_FRONTEND_*, VELOX_GUI_*, VELOX_API_PORT,
VELOX_MONITORING_PORT, VELOX_START_SERVER_VERBOSE), remove /var/logs volume (logs now in
/velociraptor), update Overview for auto-generated config and multi-arch client repacks, add
Security category.
bridge
8000
8000
tcp
8001
8001
tcp
8889
8889
tcp
8003
8003
tcp
/mnt/user/appdata/velociraptor
/velociraptor
rw
TZ
Etc/UTC
VELOX_DEFAULT_USER
admin
VELOX_DEFAULT_PASSWORD
changeme
VELOX_DEFAULT_USER_ROLE
administrator
VELOX_FRONTEND_HOSTNAME
localhost
VELOX_FRONTEND_PORT
8000
VELOX_FRONTEND_SERVER_SCHEME
https
VELOX_GUI_HOSTNAME
localhost
VELOX_GUI_PORT
8889
VELOX_GUI_SCHEME
https
VELOX_API_PORT
8001
VELOX_MONITORING_PORT
8003
VELOX_START_SERVER_VERBOSE
false