Portainer Templates logo

Portainer Templates

Fail2ban Fail2ban

NetworkSecurity

Fail2ban is a daemon to ban hosts that cause multiple authentication errors.

Image details

Pulls: 395k
Architectures: amd64, arm64
Image size: 29 MB
Latest: 1.1.0
User: linuxserver
Created: Aug 09, 2022
Updated: 3 days ago
Status: active

Configuration

Type
Container
Platform
linux
Image
linuxserver/fail2ban:latest
Ports
80:80/tcp
Volumes
/config : /srv/lsio/fail2ban/config/var/log:ro : /srv/lsio/fail2ban/var/log:ro/remotelogs/airsonic:ro : /srv/lsio/fail2ban/remotelogs/airsonic:ro/remotelogs/apache2:ro : /srv/lsio/fail2ban/remotelogs/apache2:ro/remotelogs/authelia:ro : /srv/lsio/fail2ban/remotelogs/authelia:ro/remotelogs/emby:ro : /srv/lsio/fail2ban/remotelogs/emby:ro/remotelogs/filebrowser:ro : /srv/lsio/fail2ban/remotelogs/filebrowser:ro/remotelogs/homeassistant:ro : /srv/lsio/fail2ban/remotelogs/homeassistant:ro/remotelogs/lighttpd:ro : /srv/lsio/fail2ban/remotelogs/lighttpd:ro/remotelogs/nextcloud:ro : /srv/lsio/fail2ban/remotelogs/nextcloud:ro/remotelogs/nginx:ro : /srv/lsio/fail2ban/remotelogs/nginx:ro/remotelogs/nzbget:ro : /srv/lsio/fail2ban/remotelogs/nzbget:ro/remotelogs/overseerr:ro : /srv/lsio/fail2ban/remotelogs/overseerr:ro/remotelogs/prowlarr:ro : /srv/lsio/fail2ban/remotelogs/prowlarr:ro/remotelogs/radarr:ro : /srv/lsio/fail2ban/remotelogs/radarr:ro/remotelogs/sabnzbd:ro : /srv/lsio/fail2ban/remotelogs/sabnzbd:ro/remotelogs/sonarr:ro : /srv/lsio/fail2ban/remotelogs/sonarr:ro/remotelogs/unificontroller:ro : /srv/lsio/fail2ban/remotelogs/unificontroller:ro/remotelogs/vaultwarden:ro : /srv/lsio/fail2ban/remotelogs/vaultwarden:ro
Env vars
PUID=1000PGID=1000TZ=Etc/UTCVERBOSITY=-vv
Restart
unless-stopped

Template by technorabilia

Notes

Portainer App Templates by Technorabilia, based on data provided by LinuxServer.io.

Ensure to create the following volume directories on the host file system, or modify the paths in the volume mapping section under the advanced options below, as needed.

mkdir -p /srv/lsio/fail2ban/config
mkdir -p /srv/lsio/fail2ban/var/log:ro
mkdir -p /srv/lsio/fail2ban/remotelogs/airsonic:ro
mkdir -p /srv/lsio/fail2ban/remotelogs/apache2:ro
mkdir -p /srv/lsio/fail2ban/remotelogs/authelia:ro
mkdir -p /srv/lsio/fail2ban/remotelogs/emby:ro
mkdir -p /srv/lsio/fail2ban/remotelogs/filebrowser:ro
mkdir -p /srv/lsio/fail2ban/remotelogs/homeassistant:ro
mkdir -p /srv/lsio/fail2ban/remotelogs/lighttpd:ro
mkdir -p /srv/lsio/fail2ban/remotelogs/nextcloud:ro
mkdir -p /srv/lsio/fail2ban/remotelogs/nginx:ro
mkdir -p /srv/lsio/fail2ban/remotelogs/nzbget:ro
mkdir -p /srv/lsio/fail2ban/remotelogs/overseerr:ro
mkdir -p /srv/lsio/fail2ban/remotelogs/prowlarr:ro
mkdir -p /srv/lsio/fail2ban/remotelogs/radarr:ro
mkdir -p /srv/lsio/fail2ban/remotelogs/sabnzbd:ro
mkdir -p /srv/lsio/fail2ban/remotelogs/sonarr:ro
mkdir -p /srv/lsio/fail2ban/remotelogs/unificontroller:ro
mkdir -p /srv/lsio/fail2ban/remotelogs/vaultwarden:ro

Installation

  1. Ensure both Docker and Portainer are installed, and up-to-date
  2. Log into your Portainer web UI
  3. Under Settings → App Templates, paste the below URL
  4. Head to Home → App Templates, and the list of apps will show up
  5. Select the app you wish to deploy, fill in any config options, and hit Deploy

Template Import URL

https://raw.githubusercontent.com/Lissy93/portainer-templates/main/templates.json
Show Me demo

docker run -d --name Fail2ban \
  --network host \
  -p 80:80/tcp \
  -e 'PUID=1000' \
  -e 'PGID=1000' \
  -e 'TZ=Etc/UTC' \
  -e 'VERBOSITY=-vv' \
  -v /srv/lsio/fail2ban/config:/config \
  -v /srv/lsio/fail2ban/var/log:ro:/var/log:ro \
  -v /srv/lsio/fail2ban/remotelogs/airsonic:ro:/remotelogs/airsonic:ro \
  -v /srv/lsio/fail2ban/remotelogs/apache2:ro:/remotelogs/apache2:ro \
  -v /srv/lsio/fail2ban/remotelogs/authelia:ro:/remotelogs/authelia:ro \
  -v /srv/lsio/fail2ban/remotelogs/emby:ro:/remotelogs/emby:ro \
  -v /srv/lsio/fail2ban/remotelogs/filebrowser:ro:/remotelogs/filebrowser:ro \
  -v /srv/lsio/fail2ban/remotelogs/homeassistant:ro:/remotelogs/homeassistant:ro \
  -v /srv/lsio/fail2ban/remotelogs/lighttpd:ro:/remotelogs/lighttpd:ro \
  -v /srv/lsio/fail2ban/remotelogs/nextcloud:ro:/remotelogs/nextcloud:ro \
  -v /srv/lsio/fail2ban/remotelogs/nginx:ro:/remotelogs/nginx:ro \
  -v /srv/lsio/fail2ban/remotelogs/nzbget:ro:/remotelogs/nzbget:ro \
  -v /srv/lsio/fail2ban/remotelogs/overseerr:ro:/remotelogs/overseerr:ro \
  -v /srv/lsio/fail2ban/remotelogs/prowlarr:ro:/remotelogs/prowlarr:ro \
  -v /srv/lsio/fail2ban/remotelogs/radarr:ro:/remotelogs/radarr:ro \
  -v /srv/lsio/fail2ban/remotelogs/sabnzbd:ro:/remotelogs/sabnzbd:ro \
  -v /srv/lsio/fail2ban/remotelogs/sonarr:ro:/remotelogs/sonarr:ro \
  -v /srv/lsio/fail2ban/remotelogs/unificontroller:ro:/remotelogs/unificontroller:ro \
  -v /srv/lsio/fail2ban/remotelogs/vaultwarden:ro:/remotelogs/vaultwarden:ro \
  --restart=unless-stopped \
  linuxserver/fail2ban:latest

Save this file as compose.yaml and run docker compose up -d
Use this only as a guide.

services:
  fail2ban:
    image: linuxserver/fail2ban:latest
    ports:
      - 80:80/tcp
    volumes:
      - /srv/lsio/fail2ban/config:/config
      - /srv/lsio/fail2ban/var/log:ro:/var/log:ro
      - /srv/lsio/fail2ban/remotelogs/airsonic:ro:/remotelogs/airsonic:ro
      - /srv/lsio/fail2ban/remotelogs/apache2:ro:/remotelogs/apache2:ro
      - /srv/lsio/fail2ban/remotelogs/authelia:ro:/remotelogs/authelia:ro
      - /srv/lsio/fail2ban/remotelogs/emby:ro:/remotelogs/emby:ro
      - /srv/lsio/fail2ban/remotelogs/filebrowser:ro:/remotelogs/filebrowser:ro
      - >-
        /srv/lsio/fail2ban/remotelogs/homeassistant:ro:/remotelogs/homeassistant:ro
      - /srv/lsio/fail2ban/remotelogs/lighttpd:ro:/remotelogs/lighttpd:ro
      - /srv/lsio/fail2ban/remotelogs/nextcloud:ro:/remotelogs/nextcloud:ro
      - /srv/lsio/fail2ban/remotelogs/nginx:ro:/remotelogs/nginx:ro
      - /srv/lsio/fail2ban/remotelogs/nzbget:ro:/remotelogs/nzbget:ro
      - /srv/lsio/fail2ban/remotelogs/overseerr:ro:/remotelogs/overseerr:ro
      - /srv/lsio/fail2ban/remotelogs/prowlarr:ro:/remotelogs/prowlarr:ro
      - /srv/lsio/fail2ban/remotelogs/radarr:ro:/remotelogs/radarr:ro
      - /srv/lsio/fail2ban/remotelogs/sabnzbd:ro:/remotelogs/sabnzbd:ro
      - /srv/lsio/fail2ban/remotelogs/sonarr:ro:/remotelogs/sonarr:ro
      - >-
        /srv/lsio/fail2ban/remotelogs/unificontroller:ro:/remotelogs/unificontroller:ro
      - /srv/lsio/fail2ban/remotelogs/vaultwarden:ro:/remotelogs/vaultwarden:ro
    environment:
      PUID: '1000'
      PGID: '1000'
      TZ: Etc/UTC
      VERBOSITY: '-vv'
    network_mode: host
    restart: unless-stopped

Save each file below into a folder, then run kubectl apply -f .
Written for k3s, but works on any cluster: bind mounts use hostPath, named volumes get a persistent volume claim, and ports are exposed via a LoadBalancer service.

fail2ban-deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: fail2ban
  labels:
    app: fail2ban
spec:
  replicas: 1
  selector:
    matchLabels:
      app: fail2ban
  template:
    metadata:
      labels:
        app: fail2ban
    spec:
      hostNetwork: true
      containers:
        - name: fail2ban
          image: linuxserver/fail2ban:latest
          env:
            - name: PUID
              value: '1000'
            - name: PGID
              value: '1000'
            - name: TZ
              value: Etc/UTC
            - name: VERBOSITY
              value: '-vv'
          ports:
            - containerPort: 80
              protocol: TCP
          volumeMounts:
            - name: fail2ban-data-0
              mountPath: /config
            - name: fail2ban-data-1
              mountPath: /var/log:ro
            - name: fail2ban-data-2
              mountPath: /remotelogs/airsonic:ro
            - name: fail2ban-data-3
              mountPath: /remotelogs/apache2:ro
            - name: fail2ban-data-4
              mountPath: /remotelogs/authelia:ro
            - name: fail2ban-data-5
              mountPath: /remotelogs/emby:ro
            - name: fail2ban-data-6
              mountPath: /remotelogs/filebrowser:ro
            - name: fail2ban-data-7
              mountPath: /remotelogs/homeassistant:ro
            - name: fail2ban-data-8
              mountPath: /remotelogs/lighttpd:ro
            - name: fail2ban-data-9
              mountPath: /remotelogs/nextcloud:ro
            - name: fail2ban-data-10
              mountPath: /remotelogs/nginx:ro
            - name: fail2ban-data-11
              mountPath: /remotelogs/nzbget:ro
            - name: fail2ban-data-12
              mountPath: /remotelogs/overseerr:ro
            - name: fail2ban-data-13
              mountPath: /remotelogs/prowlarr:ro
            - name: fail2ban-data-14
              mountPath: /remotelogs/radarr:ro
            - name: fail2ban-data-15
              mountPath: /remotelogs/sabnzbd:ro
            - name: fail2ban-data-16
              mountPath: /remotelogs/sonarr:ro
            - name: fail2ban-data-17
              mountPath: /remotelogs/unificontroller:ro
            - name: fail2ban-data-18
              mountPath: /remotelogs/vaultwarden:ro
      volumes:
        - name: fail2ban-data-0
          hostPath:
            path: /srv/lsio/fail2ban/config
        - name: fail2ban-data-1
          hostPath:
            path: /srv/lsio/fail2ban/var/log:ro
        - name: fail2ban-data-2
          hostPath:
            path: /srv/lsio/fail2ban/remotelogs/airsonic:ro
        - name: fail2ban-data-3
          hostPath:
            path: /srv/lsio/fail2ban/remotelogs/apache2:ro
        - name: fail2ban-data-4
          hostPath:
            path: /srv/lsio/fail2ban/remotelogs/authelia:ro
        - name: fail2ban-data-5
          hostPath:
            path: /srv/lsio/fail2ban/remotelogs/emby:ro
        - name: fail2ban-data-6
          hostPath:
            path: /srv/lsio/fail2ban/remotelogs/filebrowser:ro
        - name: fail2ban-data-7
          hostPath:
            path: /srv/lsio/fail2ban/remotelogs/homeassistant:ro
        - name: fail2ban-data-8
          hostPath:
            path: /srv/lsio/fail2ban/remotelogs/lighttpd:ro
        - name: fail2ban-data-9
          hostPath:
            path: /srv/lsio/fail2ban/remotelogs/nextcloud:ro
        - name: fail2ban-data-10
          hostPath:
            path: /srv/lsio/fail2ban/remotelogs/nginx:ro
        - name: fail2ban-data-11
          hostPath:
            path: /srv/lsio/fail2ban/remotelogs/nzbget:ro
        - name: fail2ban-data-12
          hostPath:
            path: /srv/lsio/fail2ban/remotelogs/overseerr:ro
        - name: fail2ban-data-13
          hostPath:
            path: /srv/lsio/fail2ban/remotelogs/prowlarr:ro
        - name: fail2ban-data-14
          hostPath:
            path: /srv/lsio/fail2ban/remotelogs/radarr:ro
        - name: fail2ban-data-15
          hostPath:
            path: /srv/lsio/fail2ban/remotelogs/sabnzbd:ro
        - name: fail2ban-data-16
          hostPath:
            path: /srv/lsio/fail2ban/remotelogs/sonarr:ro
        - name: fail2ban-data-17
          hostPath:
            path: /srv/lsio/fail2ban/remotelogs/unificontroller:ro
        - name: fail2ban-data-18
          hostPath:
            path: /srv/lsio/fail2ban/remotelogs/vaultwarden:ro

Save this file as ~/.config/containers/systemd/fail2ban.container

[Unit]
Description=Fail2ban

[Container]
Image=linuxserver/fail2ban:latest
ContainerName=fail2ban
PublishPort=80:80/tcp
Environment=PUID=1000
Environment=PGID=1000
Environment=TZ=Etc/UTC
Environment=VERBOSITY=-vv
Volume=/srv/lsio/fail2ban/config:/config
Volume=/srv/lsio/fail2ban/var/log:ro:/var/log:ro
Volume=/srv/lsio/fail2ban/remotelogs/airsonic:ro:/remotelogs/airsonic:ro
Volume=/srv/lsio/fail2ban/remotelogs/apache2:ro:/remotelogs/apache2:ro
Volume=/srv/lsio/fail2ban/remotelogs/authelia:ro:/remotelogs/authelia:ro
Volume=/srv/lsio/fail2ban/remotelogs/emby:ro:/remotelogs/emby:ro
Volume=/srv/lsio/fail2ban/remotelogs/filebrowser:ro:/remotelogs/filebrowser:ro
Volume=/srv/lsio/fail2ban/remotelogs/homeassistant:ro:/remotelogs/homeassistant:ro
Volume=/srv/lsio/fail2ban/remotelogs/lighttpd:ro:/remotelogs/lighttpd:ro
Volume=/srv/lsio/fail2ban/remotelogs/nextcloud:ro:/remotelogs/nextcloud:ro
Volume=/srv/lsio/fail2ban/remotelogs/nginx:ro:/remotelogs/nginx:ro
Volume=/srv/lsio/fail2ban/remotelogs/nzbget:ro:/remotelogs/nzbget:ro
Volume=/srv/lsio/fail2ban/remotelogs/overseerr:ro:/remotelogs/overseerr:ro
Volume=/srv/lsio/fail2ban/remotelogs/prowlarr:ro:/remotelogs/prowlarr:ro
Volume=/srv/lsio/fail2ban/remotelogs/radarr:ro:/remotelogs/radarr:ro
Volume=/srv/lsio/fail2ban/remotelogs/sabnzbd:ro:/remotelogs/sabnzbd:ro
Volume=/srv/lsio/fail2ban/remotelogs/sonarr:ro:/remotelogs/sonarr:ro
Volume=/srv/lsio/fail2ban/remotelogs/unificontroller:ro:/remotelogs/unificontroller:ro
Volume=/srv/lsio/fail2ban/remotelogs/vaultwarden:ro:/remotelogs/vaultwarden:ro
Network=host

[Service]
Restart=always

[Install]
WantedBy=default.target

Then reload systemd and start the service:

systemctl --user daemon-reload
systemctl --user start fail2ban

For a system-wide service, use /etc/containers/systemd/ and drop --user.

For more installation options, see the Documentation in our GitHub repo

linuxserver.io
Blog Discord Discourse GitHub Open Collective
The LinuxServer.io team brings you another container release featuring:
  • regular and timely application updates
  • easy user mappings (PGID, PUID)
  • custom base image with s6 overlay
  • weekly base OS updates with common layers across the entire LinuxServer.io ecosystem to minimise space usage, down time and bandwidth
  • regular security updates

Find us at:
  • Blog - all the things you can do with our containers including How-To guides, opinions and much more!
  • Discord - realtime support / chat with the community and the team.
  • Discourse - post on our community forum.
  • GitHub - view the source for all of our repositories.
  • Open Collective - please consider helping us by either donating or contributing to our budget

linuxserver/fail2ban

Scarf.io pulls GitHub Stars GitHub Release GitHub Package Repository GitLab Container Registry Quay.io Docker Pulls Docker Stars Jenkins Build LSIO CI
Fail2ban is a daemon to ban hosts that cause multiple authentication errors.
fail2ban

Supported Architectures

We utilise the docker manifest for multi-platform awareness. More information is available from docker here and our announcement here.
Simply pulling lscr.io/linuxserver/fail2ban:latest should retrieve the correct image for your arch, but you can also pull specific arch images via tags.
The architectures supported by this image are:
| Architecture | Available | Tag | | :----: | :----: | ---- | | x86-64 | ✅ | amd64-\ | | arm64 | ✅ | arm64v8-\ |

Application Setup

This container is designed to allow fail2ban to function at the host level, as well as at the docker container level. If you are running applications on the host, you will need to set the chain to INPUT in the jail for that application.

Configuration Files

On first run, the container will create a number of folders and files in /config. The default configurations for fail2ban are all disabled by default.
Please refer to the Configuration README, which can be viewed in our repository, or in your config folder at /config/fail2ban/README.md.

Remote Logs

All jails require the ability to read the application log files. We recommend mounting each application's log folder as a volume to the container (illustrated by the optional volumes in our documentation). Mounting individual log files can cause issues and is not recommended.
The /remotelogs path is designed to act as a parent for all log files you would like fail2ban to be able to use. Each log file should be mounted in a subfolder underneath /remotelogs, ex:
  • /remotelogs/nginx/ would mount a folder containing the nginx logs to the container

Usage

To help you get started creating a container from this image you can either use docker-compose or the docker cli.
>!NOTE >Unless a parameter is flagged as 'optional', it is mandatory and a value must be provided.

docker-compose (recommended, click here for more info)

---
services:
  fail2ban:
    image: lscr.io/linuxserver/fail2ban:latest
    container_name: fail2ban
    cap_add:
      - NET_ADMIN
      - NET_RAW
    network_mode: host
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
      - VERBOSITY=-vv #optional
    volumes:
      - /path/to/fail2ban/config:/config
      - /var/log:/var/log:ro
      - /path/to/airsonic/log:/remotelogs/airsonic:ro #optional
      - /path/to/apache2/log:/remotelogs/apache2:ro #optional
      - /path/to/authelia/log:/remotelogs/authelia:ro #optional
      - /path/to/emby/log:/remotelogs/emby:ro #optional
      - /path/to/filebrowser/log:/remotelogs/filebrowser:ro #optional
      - /path/to/homeassistant/log:/remotelogs/homeassistant:ro #optional
      - /path/to/lighttpd/log:/remotelogs/lighttpd:ro #optional
      - /path/to/nextcloud/log:/remotelogs/nextcloud:ro #optional
      - /path/to/nginx/log:/remotelogs/nginx:ro #optional
      - /path/to/nzbget/log:/remotelogs/nzbget:ro #optional
      - /path/to/overseerr/log:/remotelogs/overseerr:ro #optional
      - /path/to/prowlarr/log:/remotelogs/prowlarr:ro #optional
      - /path/to/radarr/log:/remotelogs/radarr:ro #optional
      - /path/to/sabnzbd/log:/remotelogs/sabnzbd:ro #optional
      - /path/to/sonarr/log:/remotelogs/sonarr:ro #optional
      - /path/to/unificontroller/log:/remotelogs/unificontroller:ro #optional
      - /path/to/vaultwarden/log:/remotelogs/vaultwarden:ro #optional
    restart: unless-stopped

docker cli (click here for more info)

docker run -d \
  --name=fail2ban \
  --net=host \
  --cap-add=NET_ADMIN \
  --cap-add=NET_RAW \
  -e PUID=1000 \
  -e PGID=1000 \
  -e TZ=Etc/UTC \
  -e VERBOSITY=-vv `#optional` \
  -v /path/to/fail2ban/config:/config \
  -v /var/log:/var/log:ro \
  -v /path/to/airsonic/log:/remotelogs/airsonic:ro `#optional` \
  -v /path/to/apache2/log:/remotelogs/apache2:ro `#optional` \
  -v /path/to/authelia/log:/remotelogs/authelia:ro `#optional` \
  -v /path/to/emby/log:/remotelogs/emby:ro `#optional` \
  -v /path/to/filebrowser/log:/remotelogs/filebrowser:ro `#optional` \
  -v /path/to/homeassistant/log:/remotelogs/homeassistant:ro `#optional` \
  -v /path/to/lighttpd/log:/remotelogs/lighttpd:ro `#optional` \
  -v /path/to/nextcloud/log:/remotelogs/nextcloud:ro `#optional` \
  -v /path/to/nginx/log:/remotelogs/nginx:ro `#optional` \
  -v /path/to/nzbget/log:/remotelogs/nzbget:ro `#optional` \
  -v /path/to/overseerr/log:/remotelogs/overseerr:ro `#optional` \
  -v /path/to/prowlarr/log:/remotelogs/prowlarr:ro `#optional` \
  -v /path/to/radarr/log:/remotelogs/radarr:ro `#optional` \
  -v /path/to/sabnzbd/log:/remotelogs/sabnzbd:ro `#optional` \
  -v /path/to/sonarr/log:/remotelogs/sonarr:ro `#optional` \
  -v /path/to/unificontroller/log:/remotelogs/unificontroller:ro `#optional` \
  -v /path/to/vaultwarden/log:/remotelogs/vaultwarden:ro `#optional` \
  --restart unless-stopped \
  lscr.io/linuxserver/fail2ban:latest

Parameters

Containers are configured using parameters passed at runtime (such as those above). These parameters are separated by a colon and indicate <external>:<internal> respectively. For example, -p 8080:80 would expose port 80 from inside the container to be accessible from the host's IP on port 8080 outside the container.
| Parameter | Function | | :----: | --- | | --net=host | Shares host networking with container. | | -e PUID=1000 | for UserID - see below for explanation | | -e PGID=1000 | for GroupID - see below for explanation | | -e TZ=Etc/UTC | specify a timezone to use, see this list. | | -e VERBOSITY=-vv | Set the container log verbosity. Valid options are -v, -vv, -vvv, -vvvv, or leaving the value blank or not setting the variable. | | -v /config | Persistent config files | | -v /var/log:ro | Host logs. Mounted as Read Only. | | -v /remotelogs/airsonic:ro | Optional path to airsonic log folder. Mounted as Read Only. | | -v /remotelogs/apache2:ro | Optional path to apache2 log folder. Mounted as Read Only. | | -v /remotelogs/authelia:ro | Optional path to authelia log folder. Mounted as Read Only. | | -v /remotelogs/emby:ro | Optional path to emby log folder. Mounted as Read Only. | | -v /remotelogs/filebrowser:ro | Optional path to filebrowser log folder. Mounted as Read Only. | | -v /remotelogs/homeassistant:ro | Optional path to homeassistant log folder. Mounted as Read Only. | | -v /remotelogs/lighttpd:ro | Optional path to lighttpd log folder. Mounted as Read Only. | | -v /remotelogs/nextcloud:ro | Optional path to nextcloud log folder. Mounted as Read Only. | | -v /remotelogs/nginx:ro | Optional path to nginx log folder. Mounted as Read Only. | | -v /remotelogs/nzbget:ro | Optional path to nzbget log folder. Mounted as Read Only. | | -v /remotelogs/overseerr:ro | Optional path to overseerr log folder. Mounted as Read Only. | | -v /remotelogs/prowlarr:ro | Optional path to prowlarr log folder. Mounted as Read Only. | | -v /remotelogs/radarr:ro | Optional path to radarr log folder. Mounted as Read Only. | | -v /remotelogs/sabnzbd:ro | Optional path to sabnzbd log folder. Mounted as Read Only. | | -v /remotelogs/sonarr:ro | Optional path to sonarr log folder. Mounted as Read Only. | | -v /remotelogs/unificontroller:ro | Optional path to unificontroller log folder. Mounted as Read Only. | | -v /remotelogs/vaultwarden:ro | Optional path to vaultwarden log folder. Mounted as Read Only. | | --cap-add=NET_ADMIN | Required for fail2ban to be able to modify iptables rules. | | --cap-add=NET_RAW | Required for fail2ban to be able to bind to any interface & use RAW sockets. |

Portainer notice

This image utilises cap_add or sysctl to work properly. This is not implemented properly in some versions of Portainer, thus this image may not work if deployed through Portainer.

Environment variables from files (Docker secrets)

You can set any environment variable from a file by using a special prepend FILE__.
As an example:
-e FILE__MYVAR=/run/secrets/mysecretvariable

Will set the environment variable MYVAR based on the contents of the /run/secrets/mysecretvariable file.

Umask for running applications

For all of our images we provide the ability to override the default umask settings for services started within the containers using the optional -e UMASK=022 setting. Keep in mind umask is not chmod it subtracts from permissions based on it's value it does not add. Please read up here before asking for support.

User / Group Identifiers

When using volumes (-v flags), permissions issues can arise between the host OS and the container, we avoid this issue by allowing you to specify the user PUID and group PGID.
Ensure any volume directories on the host are owned by the same user you specify and any permissions issues will vanish like magic.
In this instance PUID=1000 and PGID=1000, to find yours use id your_user as below:
id your_user

Example output:
uid=1000(your_user) gid=1000(your_user) groups=1000(your_user)

Docker Mods

Docker Mods Docker Universal Mods
We publish various Docker Mods to enable additional functionality within the containers. The list of Mods available for this image (if any) as well as universal mods that can be applied to any one of our images can be accessed via the dynamic badges above.

Support Info

  • Shell access whilst the container is running:
```bash
docker exec -it fail2ban /bin/bash
```
  • To monitor the logs of the container in realtime:
```bash
docker logs -f fail2ban
```
  • Container version number:
```bash
docker inspect -f '{{ index .Config.Labels "build_version" }}' fail2ban
```
  • Image version number:
```bash
docker inspect -f '{{ index .Config.Labels "build_version" }}' lscr.io/linuxserver/fail2ban:latest
```

Updating Info

Most of our images are static, versioned, and require an image update and container recreation to update the app inside. With some exceptions (noted in the relevant readme.md), we do not recommend or support updating apps inside the container. Please consult the Application Setup section above to see if it is recommended for the image.
Below are the instructions for updating containers:

Via Docker Compose

  • Update images:
* All images:

    ```bash
    docker-compose pull
    ```

* Single image:

    ```bash
    docker-compose pull fail2ban
    ```
  • Update containers:
* All containers:

    ```bash
    docker-compose up -d
    ```

* Single container:

    ```bash
    docker-compose up -d fail2ban
    ```
  • You can also remove the old dangling images:
```bash
docker image prune
```

Via Docker Run

  • Update the image:
```bash
docker pull lscr.io/linuxserver/fail2ban:latest
```
  • Stop the running container:
```bash
docker stop fail2ban
```
  • Delete the container:
```bash
docker rm fail2ban
```
  • Recreate a new container with the same docker run parameters as instructed above (if mapped correctly to a host folder, your /config folder and settings will be preserved)
  • You can also remove the old dangling images:
```bash
docker image prune
```

Image Update Notifications - Diun (Docker Image Update Notifier)

>!TIP >We recommend Diun for update notifications. Other tools that automatically update containers unattended are not recommended or supported.

Building locally

If you want to make local modifications to these images for development purposes or just to customize the logic:
git clone https://github.com/linuxserver/docker-fail2ban.git
cd docker-fail2ban
docker build \
  --no-cache \
  --pull \
  -t lscr.io/linuxserver/fail2ban:latest .

The ARM variants can be built on x8664 hardware and vice versa using lscr.io/linuxserver/qemu-static
docker run --rm --privileged lscr.io/linuxserver/qemu-static --reset

Once registered you can define the dockerfile to use with -f Dockerfile.aarch64.

Versions

  • 11.02.25: - Rebase to Alpine 3.21.
  • 12.10.24: - Rebase to Alpine 3.20.
  • 05.03.24: - Rebase to Alpine 3.19.
  • 01.06.23: - Add optional VERBOSITY environment variable, allowing users to set the container log verbosity.
  • 25.05.23: - Rebase to Alpine 3.18, deprecate armhf.
  • 15.12.22: - Replace unmaintained ssmtp with msmtp.
  • 15.12.22: - Rebase to Alpine 3.17, Add ssmtp and whois packages. Symlink config to allow live reloading.
  • 25.08.22: - Update README to clarify remote log information.
  • 09.08.22: - Initial Release.

Serve Fail2ban on your own domain behind Caddy, Nginx or Traefik. Fill in your domain and copy the result. It's a starting point, some apps need their own base URL or extra headers set too.

Proxying fail2ban.example.com to http://localhost:80

Add this to your Caddyfile

fail2ban.example.com {
	reverse_proxy http://localhost:80
}

Check the logs first

Nine times out of ten the logs tell you exactly what went wrong.

  • In Portainer, go to Containers, click the container, then Logs. Or run docker logs Fail2ban
  • Exit codes help too: 137 means killed, usually out of memory. 126 or 127 means the command inside the image is broken.

Runs on the host network

This container shares your server's network directly, so port mappings are ignored and every port the app opens binds straight to the host.

  • If a port won't bind, find the clash with sudo ss -tlnp and stop the other service, or change the port in Fail2ban's own settings.

Running but the page won't load

The container is up but nothing appears in your browser.

  • Use your server's real IP: http://your-server-ip:80. The 0.0.0.0 link Portainer shows isn't a real address.
  • Give it a minute after first deploy, Fail2ban can take a while to initialise.
  • Make sure your firewall allows the port, e.g. sudo ufw allow 80

Permission denied on volumes

If the logs show "permission denied", the app can't write to its data folder on the host.

  • Fix the ownership: sudo chown -R 1000:1000 /srv/lsio/fail2ban/config (and the same for the other mapped folders)
  • Or set the PUID and PGID variables (defaults 1000:1000) to match your own user, found with id $USER

Image won't pull

Test the pull directly on the host: docker pull linuxserver/fail2ban:latest

  • "manifest unknown" means the tag no longer exists. This template uses latest, so try pinning a specific version instead.
  • "toomanyrequests" is the Docker Hub rate limit. Log in with docker login to raise it.
  • "no space left on device" means a full disk. Reclaim space with docker system prune

"exec format error"

This means the image was built for a different CPU architecture than your server.

  • This image supports: amd64, arm64
  • Check yours with uname -m: x86_64 is amd64, aarch64 is arm64. Raspberry Pi and other ARM boards are the usual culprits.

Container keeps restarting

The unless-stopped restart policy relaunches the app after every crash, so the real error can scroll past.

  • Check the logs right after a restart, the last few lines before it died are the useful ones.
  • Get the exit code with docker inspect Fail2ban --format '{{.State.ExitCode}}'
  • Still stuck? Redeploy once with the restart policy set to no so the failure stays visible.

Raise an issue

Found something which isn't working as it should? Here's how to report it.

Similar apps

Adguardhome-sync Adguardhome-sync NetworkCheckmate Checkmate NetworkDdclient Ddclient NetworkDradis Dradis SecurityDuckdns Duckdns Network iperf NetworkKali-linux Kali-linux SecurityLdap-auth Ldap-auth Security