joshuapfritz/spiderfoot

By joshuapfritz

Updated 10 months ago

Non-root SpiderFoot OSINT scanner for Docker/K8s. UI on 5001, data in /data, versioned tags.

Image
Networking
Security
Web analytics
0

5.3K

joshuapfritz/spiderfoot repository overview

Containerized SpiderFoot OSINT scanner with a non-root runtime, sane defaults, and versioned tags. Runs the SpiderFoot web UI on port 5001, persists data to /data, and is ready for Docker or Kubernetes.

Features

  • 🐳 Based on python:3.12-slim
  • 👤 Runs as non-root (UID/GID 10001)
  • 💾 Persistent state at /data (configs, DB, scans)
  • 🔒 No elevated caps; compatible with Kubernetes Pod Security restricted
  • 🏷️ Semantic tags (e.g., v4.0) + latest
  • 🧱 Arch: linux/amd64

Tags

  • latest – rolling
  • vX.Y – semantic tag (e.g., v4.0) matching the upstream SpiderFoot release used at build time

Note: SpiderFoot’s UI does not include built-in auth. Put it behind a reverse proxy (e.g., Traefik, Nginx) with auth or an access gateway (e.g., Cloudflare Access).


Quick start (Docker)

docker run -d --name spiderfoot \
  -p 5001:5001 \
  -v $PWD/spiderfoot-data:/data \
  joshuapfritz/spiderfoot:v4.0
# Open http://localhost:5001
docker-compose
services:
  spiderfoot:
    image: joshuapfritz/spiderfoot:v4.0
    ports:
      - "5001:5001"
    volumes:
      - ./spiderfoot-data:/data
    restart: unless-stopped

Kubernetes (example)

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: spiderfoot-data
spec:
  accessModes: ["ReadWriteOnce"]
  resources: { requests: { storage: 5Gi } }

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: spiderfoot
spec:
  replicas: 1
  selector:
    matchLabels: { app: spiderfoot }
  template:
    metadata:
      labels: { app: spiderfoot }
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        runAsGroup: 10001
        fsGroup: 10001
        seccompProfile: { type: RuntimeDefault }
      containers:
        - name: spiderfoot
          image: joshuapfritz/spiderfoot:v4.0
          ports:
            - containerPort: 5001
          env:
            - name: HOME
              value: /data
          volumeMounts:
            - name: data
              mountPath: /data
          securityContext:
            allowPrivilegeEscalation: false
            capabilities: { drop: ["ALL"] }
          readinessProbe:
            httpGet: { path: "/", port: 5001 }
            initialDelaySeconds: 10
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: spiderfoot-data

---
apiVersion: v1
kind: Service
metadata:
  name: spiderfoot
spec:
  type: ClusterIP
  ports:
    - port: 5001
      targetPort: 5001
  selector:
    app: spiderfoot

With Kustomize, you can pin the tag centrally:

# kustomization.yaml (overlay)
images:
  - name: joshuapfritz/spiderfoot
    newTag: v4.0

Reverse proxy tips

  • No base path: SpiderFoot serves from /. If exposing under a path (e.g., /spider), use a proxy that strips the prefix.
  • TLS: terminate at your proxy or edge (e.g., Cloudflare), pass HTTP to the pod.

Ports & volumes

  • 5001/tcp – web UI
  • /data – persistent app data (mounted writable)

Health checks

  • Readiness: GET / (HTTP 200)
  • Liveness: TCP :5001

License & source

  • SpiderFoot is © its respective authors. See the upstream project for license and usage details.
  • This image packages the open-source SpiderFoot application for convenience.

Tag summary

Content type

Image

Digest

sha256:b7bf0e68d

Size

222.8 MB

Last updated

10 months ago

docker pull joshuapfritz/spiderfoot