Base
Hardened build
minimal ports, security patches applied at build time
OpenCanary Honeypot on Ubuntu 24.04
Azure
Security
OpenCanary, the open source honeypot daemon, stands up decoy network services and raises a high signal alert the moment anyone touches them.
Overview
OpenCanary is a lightweight, low interaction honeypot daemon from Thinkst. It runs a set of decoy network services, such as FTP, HTTP, Telnet, MySQL and SSH, and logs an alert on any interaction with them. Because nothing legitimate should ever connect to a decoy, every hit is a high signal, low noise indicator of reconnaissance or compromise, delivered without the false positive fatigue of traditional intrusion detection. Alerts are written as structured JSON, ready to forward to a SIEM, to email, to a webhook or to syslog.
It suits security teams and operators who want an early warning tripwire inside their own network, on infrastructure they run and own, rather than relying on a hosted service.
Why the cloudimg image
cloudimg delivers OpenCanary fully installed and running as a hardened, managed systemd service, with a functional decoy surface enabled from the first boot so it produces useful alerts with no configuration. Security is designed in and the two planes are kept cleanly separate: the decoy services listen on their own ports while the operating system's own SSH stays key only for real administration, with no image baked password and no shared bootstrap credential. On each instance's first boot the appliance mints a fresh, unique alert node identity, so no two deployments share a fingerprint and the image gives nothing away about its origin. Every decoy interaction is written to a structured JSON alert log ready to forward to your log pipeline, and every deployment carries a paired deployment guide and 24/7 support.
Common uses
- Deploy an early warning tripwire that alerts on the first sign of network reconnaissance
- Detect lateral movement inside a segment with high signal, low noise decoy services
- Forward structured honeypot alerts to a SIEM, email, webhook or syslog
More in Security
KeePass Password Manager
Security
KeePass is a free, open source password manager that stores all your passwords in a highly encrypted database. The datab...
CrowdSec
Security
This image runs CrowdSec, the free and open source collaborative behavioural security engine.
Ollama GPU-Accelerated LLM Server
Security
This image runs Ollama 0.30, the easiest way to run open large language models locally - pull and serve Llama, Mistral, ...
OWASP ZAP
Security
This image runs OWASP ZAP (the Zed Attack Proxy), the world's most widely used open source web-application security scan...
step-ca
Security
This image runs step-ca, the open source online certificate authority from Smallstep for secure, automated X.509 and ACM...
Trivy Security Scanner
Security
This image runs Trivy, the open source, Apache-2.0 licensed all-in-one security scanner from Aqua Security.