
Quick start
Generated from the image's own configuration. Replace the /path/to folders with real paths on your host.
---
services:
fail2ban:
image: lscr.io/linuxserver/fail2ban:latest
container_name: fail2ban
network_mode: host
cap_add:
- NET_ADMIN
- NET_RAW
environment:
- PUID=1000
- PGID=1000
- TZ=Etc/UTC
- TZ=Europe/London
- VERBOSITY=-vv # optional
volumes:
- /path/to/fail2ban/config:/config
- /var/log:/var/log:ro
- /path/to/airsonic/log:/remotelogs/airsonic:ro # optional
- /path/to/apache2/log:/remotelogs/apache2:ro # optional
- /path/to/authelia/log:/remotelogs/authelia:ro # optional
- /path/to/emby/log:/remotelogs/emby:ro # optional
- /path/to/filebrowser/log:/remotelogs/filebrowser:ro # optional
- /path/to/homeassistant/log:/remotelogs/homeassistant:ro # optional
- /path/to/lighttpd/log:/remotelogs/lighttpd:ro # optional
- /path/to/nextcloud/log:/remotelogs/nextcloud:ro # optional
- /path/to/nginx/log:/remotelogs/nginx:ro # optional
- /path/to/nzbget/log:/remotelogs/nzbget:ro # optional
- /path/to/overseerr/log:/remotelogs/overseerr:ro # optional
- /path/to/prowlarr/log:/remotelogs/prowlarr:ro # optional
- /path/to/radarr/log:/remotelogs/radarr:ro # optional
- /path/to/sabnzbd/log:/remotelogs/sabnzbd:ro # optional
- /path/to/sonarr/log:/remotelogs/sonarr:ro # optional
- /path/to/unificontroller/log:/remotelogs/unificontroller:ro # optional
- /path/to/vaultwarden/log:/remotelogs/vaultwarden:ro # optional
restart: unless-stoppedParameters
| Variable | Function | Required |
|---|---|---|
| PUID=1000 | User ID | required |
| PGID=1000 | Group ID | required |
| TZ=Etc/UTC | Timezone | required |
| TZ=Europe/London | Specify a timezone to use EG Europe/London. | required |
| VERBOSITY=-vv | Set the container log verbosity. Valid options are -v, -vv, -vvv, -vvvv, or leaving the value blank or not setting the variable. | optional |
| Path | Function | Required |
|---|---|---|
| /config | Persistent config files | required |
| /var/log:ro | Host logs. Mounted as Read Only. | required |
| /remotelogs/airsonic:ro | Optional path to airsonic log folder. Mounted as Read Only. | optional |
| /remotelogs/apache2:ro | Optional path to apache2 log folder. Mounted as Read Only. | optional |
| /remotelogs/authelia:ro | Optional path to authelia log folder. Mounted as Read Only. | optional |
| /remotelogs/emby:ro | Optional path to emby log folder. Mounted as Read Only. | optional |
| /remotelogs/filebrowser:ro | Optional path to filebrowser log folder. Mounted as Read Only. | optional |
| /remotelogs/homeassistant:ro | Optional path to homeassistant log folder. Mounted as Read Only. | optional |
| /remotelogs/lighttpd:ro | Optional path to lighttpd log folder. Mounted as Read Only. | optional |
| /remotelogs/nextcloud:ro | Optional path to nextcloud log folder. Mounted as Read Only. | optional |
| /remotelogs/nginx:ro | Optional path to nginx log folder. Mounted as Read Only. | optional |
| /remotelogs/nzbget:ro | Optional path to nzbget log folder. Mounted as Read Only. | optional |
| /remotelogs/overseerr:ro | Optional path to overseerr log folder. Mounted as Read Only. | optional |
| /remotelogs/prowlarr:ro | Optional path to prowlarr log folder. Mounted as Read Only. | optional |
| /remotelogs/radarr:ro | Optional path to radarr log folder. Mounted as Read Only. | optional |
| /remotelogs/sabnzbd:ro | Optional path to sabnzbd log folder. Mounted as Read Only. | optional |
| /remotelogs/sonarr:ro | Optional path to sonarr log folder. Mounted as Read Only. | optional |
| /remotelogs/unificontroller:ro | Optional path to unificontroller log folder. Mounted as Read Only. | optional |
| /remotelogs/vaultwarden:ro | Optional path to vaultwarden log folder. Mounted as Read Only. | optional |
| Setting | Function | Required |
|---|---|---|
| cap_add: NET_ADMIN | Required for fail2ban to be able to modify iptables rules. | required |
| cap_add: NET_RAW | Required for fail2ban to be able to bind to any interface & use RAW sockets. | required |
| network_mode: host | Runs on the host network. | required |
Architectures
Pulling :latest picks the right one for your host automatically.
- x86_64
amd64-latest - arm64
arm64v8-latest
Tags
:latestStable releases
Changelog
Rebase to Alpine 3.21.
Rebase to Alpine 3.20.
Rebase to Alpine 3.19.
Writing
Posts about fail2ban


7 min read
Blocking Malicious Connections With CrowdSec and SWAG
CrowdSec is a free, open-source and collaborative IPS; it's like Fail2Ban but you share your bans with all of the other users to try and pre-emptively block malicious hosts. We…

2 min read
Introducing SWAG Dashboard
SWAG Dashboard is a mod powered by GoAccess that provides a comprehensive overview of SWAG's operation. Follow latest the instructions on the mod's readme to set it up. Navigate…
Related
Similar images
wireguard
1.0.20260223-r0-ls127
WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. It is currently under heavy development, but already it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry.
unifi-network-application
10.6.106-ls151
The unifi-network-application software is a powerful, enterprise wireless software engine ideal for high-density client deployments requiring low latency and high uptime performance.
duckdns
8d8f7eba-ls94
duckdns is a free service which will point a DNS (sub domains of duckdns.org) to an IP of your choice. The service is completely free, and doesn't require reactivation or forum posts to maintain its existence.
ddclient
v4.0.0-ls236
ddclient is a Perl client used to update dynamic DNS entries for accounts on Dynamic DNS Network Service Provider. It was originally written by Paul Burry and is now mostly by wimpunk. It has the capability to update more than just dyndns and it can fetch your WAN-ipaddress in a few different ways.
