Updated Python virtual environment creation command and changed Elastic Stack version in the .env file. Added usage instructions for the elastic-container.py script.
- Simplify CLI docstring to avoid duplicate command listings
- Remove verbose command descriptions from main help text
- Click automatically generates clean command list from decorators
- Results in cleaner, more professional help output
- Delete elastic-container.sh
- Python script (elastic-container.py) fully replaces bash functionality
- Tested on macOS, Ubuntu, and Rocky Linux
- All features working: intelligent container detection, Detection Engine, Fleet Server
- Add Rocky Linux to tested platforms list
- Fix RPM distributions Docker installation instructions
- Use Docker's official repository instead of distro packages
- Add docker-ce installation steps for proper compose plugin support
- Update Operating System section with specific tested distributions
- Maintain consistent formatting across all OS sections
- Remove untested platforms (Arch, Windows native)
- Add _is_wsl() helper function to detect Windows Subsystem for Linux
- Checks /proc/version for microsoft/wsl keywords
- Checks WSL environment variables (WSL_DISTRO_NAME, WSL_INTEROP)
- Enhance get_host_ip() to support all platforms:
- Native Linux: hostname -I (unchanged)
- WSL: Automatically detected, uses hostname -I
- macOS: ifconfig en0 (unchanged)
- Native Windows: Parse ipconfig output for IPv4 address
- Fallback: 0.0.0.0 for local Docker (unchanged)
- No changes to existing Linux/macOS behavior
- Script now automatically adapts to environment
- Tested and working on macOS and Ubuntu
- Add check_containers_exist() method to DockerManager
- Detects if containers exist and if they're running
- Returns tuple (containers_exist, containers_running)
- Enhance start command with smart behavior:
- Already running: instant exit (no-op)
- Stopped: quick start without reconfiguration (~30 sec)
- Not exist: full setup with Detection Engine and Fleet (~5 min)
- Add --force-setup flag to force reconfiguration
- Enhance stop command:
- Already stopped: instant exit (no-op)
- Not exist: helpful error message
- Enhance restart command:
- Not exist: error with guidance to run start
- Stopped: starts containers instead of restarting
- Running: normal restart behavior
- Major improvement: subsequent starts are 10x faster
- Better user experience with clear status messages
- Idempotent operations - safe to run multiple times
- Create elastic-container.py as the main executable script
- Click-based command-line interface
- Commands implemented: stage, start, stop, destroy, restart, status, clear, help
- Support for -v/--verbose flag across all commands
- Full orchestration of Config, DockerManager, and KibanaManager
- Main 'start' command workflow:
- Check prerequisites (Python version, Docker)
- Validate passwords changed from defaults
- Start containers via DockerManager
- Configure Detection Engine and install rules via KibanaManager
- Wait for Fleet Server initialization
- Configure Fleet Server settings and agent policies
- Display success message with login URL and credentials (verbose mode)
- All commands include:
- Proper error handling and user-friendly messages
- Keyboard interrupt (Ctrl+C) handling
- Verbose mode with detailed output and stack traces
- Consistent exit codes
- Add .gitignore for Python artifacts and sensitive files
- 344 lines completing the Python conversion
- Full feature parity with bash script achieved
- Create KibanaManager class for Detection Engine and Fleet setup
- configure_detection_engine() method:
- Wait for Kibana to be ready with retry logic
- Enable Detection Engine API
- Install prepackaged detection rules
- Bulk enable rules by OS (Linux/Windows/macOS)
- setup_fleet() method:
- Check if Fleet is already initialized
- Extract and configure CA certificate fingerprint
- Configure Fleet Server host URLs
- Set up Elasticsearch output with SSL verification
- Create default agent policy with monitoring
- Install Elastic Defend integration with EDRComplete preset
- Full API integration with Kibana Fleet and Detection Engine APIs
- Comprehensive error handling with helpful messages
- Support for verbose logging mode
- 475 lines implementing bash script parity
- Create DockerManager class for all container operations
- Auto-detect docker compose vs docker-compose
- Implement stage, start, stop, destroy, restart, status
- Add clear_documents() for data stream clearing
- Extract CA fingerprint for Fleet configuration
- Comprehensive error handling and validation
- Create utility functions module
- get_host_ip() for Linux/macOS IP detection
- check_python_version() requiring 3.10+
- run_command() helper with verbose support
- show_docker_error() for formatted error messages
- check_prerequisites() for system validation
- Create Config class to load and validate .env file
- Validate passwords are changed from default 'changeme'
- Provide type-safe access to all configuration values
- Support detection rule flags (Linux/Windows/macOS)
- Helpful error messages for missing or invalid config
Andrew Pease