CrowdSec-Threat-Map

CrowdSec-Threat-Map

Docker app from Railloune's Repository

Overview

CrowdSec Threat Map displays local CrowdSec alerts on an interactive world map with a live feed, English/French UI, larger readable text, CSV export, themes, optional unban support and optional dynamic whitelist support. Mount your CrowdSec database read-only for a safe dashboard-only setup.

Readme

View on GitHub

CrowdSec Threat Map

CrowdSec Threat Map displays local CrowdSec alerts on an interactive world map with a live feed, search, filters and optional dashboard actions.

This Railline fork adds:

  • English and French UI (LANGUAGE=en or LANGUAGE=fr)
  • Larger dashboard text for readability
  • Unraid-friendly template defaults

Safe Default

For a dashboard-only setup:

  • Mount /crowdsec/data read-only.
  • Leave Docker socket empty.
  • Leave WHITELIST_ENABLED=false.

The Docker socket is only needed for dashboard unban or dynamic whitelist restart actions.

Links

Requirements

CrowdSec Docker Container

Categories

Tools > Network > Security

Related apps

Explore more like this

Explore all
Security apps

Links

Projectgithub.comSupportgithub.comRegistrygithub.comTemplateraw.githubusercontent.com

Details

Repository
ghcr.io/railline/crowdsec-threat-map-docker:latest
Registry
https://github.com/Railline/crowdsec-threat-map-docker/pkgs/container/crowdsec-threat-map-docker
Last Updated2026-10-07
First Seen2026-06-19

Runtime arguments

Web UI
http://[IP]:[PORT:8080]/
Network
bridge
Shell
sh
Privileged
false
Extra Params
--security-opt=no-new-privileges:true

Template configuration

WebUI - HTTP host portPorttcp

Host port for the CrowdSec Threat Map web dashboard.

Target
8080
Default
8095
Value
8095
Paths - CrowdSec dataPathro

CrowdSec data directory containing crowdsec.db and optionally GeoLite2-City.mmdb. Keep read-only for dashboard-only deployments.

Target
/crowdsec/data
Default
/mnt/user/appdata/crowdsec/data
Value
/mnt/user/appdata/crowdsec/data
Paths - CrowdSec postoverflowsPathrw

Optional CrowdSec postoverflows directory. Required only if WHITELIST_ENABLED=true.

Target
/crowdsec/postoverflows
Default
/mnt/user/appdata/crowdsec/postoverflows
Paths - Docker socketPathro

Optional Docker socket. Required only for dashboard unban or dynamic whitelist CrowdSec restart actions.

Target
/var/run/docker.sock
Default
/var/run/docker.sock
Core - SERVER_LATVariable

Server marker latitude. Example for Paris: 48.8566.

Target
SERVER_LAT
Default
0.0
Value
0.0
Core - SERVER_LONVariable

Server marker longitude. Example for Paris: 2.3522.

Target
SERVER_LON
Default
0.0
Value
0.0
Core - SERVER_NAMEVariable

Display name for the server marker.

Target
SERVER_NAME
Default
MyServer
Value
MyServer
Core - TZVariable

Container timezone.

Target
TZ
Default
Europe/Paris
Value
Europe/Paris
Core - LANGUAGEVariable

Dashboard language: en or fr.

Target
LANGUAGE
Default
en
Value
en
CrowdSec - Container nameVariable

CrowdSec Docker container name. Used only when Docker socket access is mounted for unban/whitelist actions.

Target
CROWDSEC_CONTAINER
Default
crowdsec
Value
crowdsec
CrowdSec - Dynamic whitelist enabledVariable

Enable only if the postoverflows path is mounted read-write and Docker socket access is intentionally enabled.

Target
WHITELIST_ENABLED
Default
false
Value
false
CrowdSec - Whitelist fileVariable

Whitelist YAML path inside the container.

Target
WHITELIST_FILE
Default
/crowdsec/postoverflows/s01-whitelist/my-whitelist.yaml
Value
/crowdsec/postoverflows/s01-whitelist/my-whitelist.yaml
CrowdSec - Whitelist intervalVariable

How often the public IP is checked for dynamic whitelist updates, in seconds.

Target
WHITELIST_INTERVAL
Default
900
Value
900
CrowdSec - Restart waitVariable

Wait time after restarting CrowdSec for whitelist updates.

Target
CROWDSEC_RESTART_WAIT
Default
15
Value
15
CrowdSec - Restart cooldownVariable

Minimum time between automatic CrowdSec restarts for whitelist updates.

Target
CROWDSEC_RESTART_COOLDOWN
Default
300
Value
300
CrowdSec - Unban API tokenVariable

Recommended when /unban is enabled. Generate with: openssl rand -hex 32. Leave empty only on trusted LAN deployments.

Target
UNBAN_API_TOKEN
Data - Cache TTLVariable

Metric cache time in seconds.

Target
CACHE_TTL
Default
60
Value
60
Data - Days backVariable

How many days of CrowdSec alert history to display.

Target
DAYS_BACK
Default
365
Value
365