fail2ban

1.1.0-r2-ls46

fail2ban is a daemon to ban hosts that cause multiple authentication errors.

docker pull lscr.io/linuxserver/fail2ban:latest

Quick start

Generated from the image's own configuration. Replace the /path/to folders with real paths on your host.

---
services:
  fail2ban:
    image: lscr.io/linuxserver/fail2ban:latest
    container_name: fail2ban
    network_mode: host
    cap_add:
      - NET_ADMIN
      - NET_RAW
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
      - TZ=Europe/London
      - VERBOSITY=-vv # optional
    volumes:
      - /path/to/fail2ban/config:/config
      - /var/log:/var/log:ro
      - /path/to/airsonic/log:/remotelogs/airsonic:ro # optional
      - /path/to/apache2/log:/remotelogs/apache2:ro # optional
      - /path/to/authelia/log:/remotelogs/authelia:ro # optional
      - /path/to/emby/log:/remotelogs/emby:ro # optional
      - /path/to/filebrowser/log:/remotelogs/filebrowser:ro # optional
      - /path/to/homeassistant/log:/remotelogs/homeassistant:ro # optional
      - /path/to/lighttpd/log:/remotelogs/lighttpd:ro # optional
      - /path/to/nextcloud/log:/remotelogs/nextcloud:ro # optional
      - /path/to/nginx/log:/remotelogs/nginx:ro # optional
      - /path/to/nzbget/log:/remotelogs/nzbget:ro # optional
      - /path/to/overseerr/log:/remotelogs/overseerr:ro # optional
      - /path/to/prowlarr/log:/remotelogs/prowlarr:ro # optional
      - /path/to/radarr/log:/remotelogs/radarr:ro # optional
      - /path/to/sabnzbd/log:/remotelogs/sabnzbd:ro # optional
      - /path/to/sonarr/log:/remotelogs/sonarr:ro # optional
      - /path/to/unificontroller/log:/remotelogs/unificontroller:ro # optional
      - /path/to/vaultwarden/log:/remotelogs/vaultwarden:ro # optional
    restart: unless-stopped

Parameters

Environment variables
VariableFunctionRequired
PUID=1000User IDrequired
PGID=1000Group IDrequired
TZ=Etc/UTCTimezonerequired
TZ=Europe/LondonSpecify a timezone to use EG Europe/London.required
VERBOSITY=-vvSet the container log verbosity. Valid options are -v, -vv, -vvv, -vvvv, or leaving the value blank or not setting the variable.optional
Volumes
PathFunctionRequired
/configPersistent config filesrequired
/var/log:roHost logs. Mounted as Read Only.required
/remotelogs/airsonic:roOptional path to airsonic log folder. Mounted as Read Only.optional
/remotelogs/apache2:roOptional path to apache2 log folder. Mounted as Read Only.optional
/remotelogs/authelia:roOptional path to authelia log folder. Mounted as Read Only.optional
/remotelogs/emby:roOptional path to emby log folder. Mounted as Read Only.optional
/remotelogs/filebrowser:roOptional path to filebrowser log folder. Mounted as Read Only.optional
/remotelogs/homeassistant:roOptional path to homeassistant log folder. Mounted as Read Only.optional
/remotelogs/lighttpd:roOptional path to lighttpd log folder. Mounted as Read Only.optional
/remotelogs/nextcloud:roOptional path to nextcloud log folder. Mounted as Read Only.optional
/remotelogs/nginx:roOptional path to nginx log folder. Mounted as Read Only.optional
/remotelogs/nzbget:roOptional path to nzbget log folder. Mounted as Read Only.optional
/remotelogs/overseerr:roOptional path to overseerr log folder. Mounted as Read Only.optional
/remotelogs/prowlarr:roOptional path to prowlarr log folder. Mounted as Read Only.optional
/remotelogs/radarr:roOptional path to radarr log folder. Mounted as Read Only.optional
/remotelogs/sabnzbd:roOptional path to sabnzbd log folder. Mounted as Read Only.optional
/remotelogs/sonarr:roOptional path to sonarr log folder. Mounted as Read Only.optional
/remotelogs/unificontroller:roOptional path to unificontroller log folder. Mounted as Read Only.optional
/remotelogs/vaultwarden:roOptional path to vaultwarden log folder. Mounted as Read Only.optional
Other settings
SettingFunctionRequired
cap_add: NET_ADMINRequired for fail2ban to be able to modify iptables rules.required
cap_add: NET_RAWRequired for fail2ban to be able to bind to any interface & use RAW sockets.required
network_mode: hostRuns on the host network.required

Architectures

Pulling :latest picks the right one for your host automatically.

  • x86_64amd64-latest
  • arm64arm64v8-latest

Tags

  • :latestStable releases

Changelog

  1. Rebase to Alpine 3.21.

  2. Rebase to Alpine 3.20.

  3. Rebase to Alpine 3.19.

Writing

Posts about fail2ban

2 min read

Introducing SWAG Dashboard

SWAG Dashboard is a mod powered by GoAccess that provides a comprehensive overview of SWAG's operation. Follow latest the instructions on the mod's readme to set it up. Navigate…

Related

Browse all

wireguard

1.0.20260223-r0-ls127

WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. It is currently under heavy development, but already it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry.

1M pulls per month3.6K GitHub starsarm64

The unifi-network-application software is a powerful, enterprise wireless software engine ideal for high-density client deployments requiring low latency and high uptime performance.

899K pulls per month1.1K GitHub starsarm64

duckdns

8d8f7eba-ls94

duckdns is a free service which will point a DNS (sub domains of duckdns.org) to an IP of your choice. The service is completely free, and doesn't require reactivation or forum posts to maintain its existence.

772K pulls per month376 GitHub starsarm64

ddclient

v4.0.0-ls236

ddclient is a Perl client used to update dynamic DNS entries for accounts on Dynamic DNS Network Service Provider. It was originally written by Paul Burry and is now mostly by wimpunk. It has the capability to update more than just dyndns and it can fetch your WAN-ipaddress in a few different ways.

388K pulls per month182 GitHub starsarm64