Pi.Alert in Docker: detect unknown devices on the LAN
TABLE OF CONTENTS (Nhấn để xem)
Pi.Alert monitors Wi-Fi/LAN devices and can alert on unknown devices or devices that should remain online. I run it on a Linux Docker host with host networking so it can observe the local network; that also requires a trust boundary and the UI should not be exposed directly to the Internet.1
Install Docker on Linux
Log in to the Linux device and run the source block:
# install prerequisites
sudo apt install apt-transport-https ca-certificates curl software-properties-common gnupg-agent -y
# add docker gpg key
curl -fsSL https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release)/gpg | sudo apt-key add -
# add docker software repository
sudo add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release) $(lsb_release -cs) stable"
# install docker
sudo apt install docker-ce docker-compose containerd.io -y
# enable and start docker service
sudo systemctl enable docker && sudo systemctl start docker
# add the current user to the docker group
sudo usermod -aG docker $USER
# reauthenticate for the new group membership to take effect
su - $USER
After re-authenticating for Docker group membership, check docker version and the user’s permissions before continuing.
Run Pi.Alert
Create the directory, start a temporary container to obtain the default config/database, copy both directories to the host, remove the temporary container, and start the persistent container:
# create working directory
mkdir ~/docker/pialert -p
# set ownership on the working directories
sudo chown "$USER":"$USER" ~/docker -R
# run temp pialert container
docker run -d --name=pialert --net=host -e TZ=America/New_York jokobsk/pi.alert
# copy default config files to host
docker cp pialert:/home/pi/pialert/config ~/docker/pialert/
# copy db to host
docker cp pialert:/home/pi/pialert/db ~/docker/pialert/
# remove the temp container
docker rm pialert --force
# run the pialert container
docker run -d --name=pialert --net=host -e TZ=America/New_York -v ~/docker/pialert/db:/home/pi/pialert/db -v ~/docker/pialert/config/:/home/pi/pialert/config/ --restart=unless-stopped jokobsk/pi.alert
--net=host lets Pi.Alert see host interfaces but widens the application’s reach; I run it only on a trusted machine and inspect docker inspect pialert.
Open and verify the UI
Open:
http://DNSorIP:20211/pialert
The welcome page confirms that the container is running. The source notes that Pi.Alert’s cron job checks for new devices every five minutes; I inspect logs, the database, and the device list before trusting alerts.
Backup and limits
Back up ~/docker/pialert/config and ~/docker/pialert/db before changing the image. Host networking does not create a firewall boundary, and MAC/IP identification can change when clients use randomized MAC addresses. Pi.Alert is a monitoring signal, not a replacement for firewalling, IDS, or VLAN isolation.
Sources
https://i12bretro.github.io/tutorials/0780.html — i12bretro tutorial 0780. ↩︎