cid 03129a73858e633b1b92739814e20f6661ba66ff5a276b94ccf8cb8ea595dc66 · original · open access · via openalex
Title: docker-osint-stack: A single-command Docker Compose OSINT collection environment with audit logging and encrypted export Authors: Ali Murtaza Bhutto Venue: Zenodo (CERN European Organization for Nuclear Research) Year: 2026 Canonical: doi:10.5281/zenodo.20480469 URL: https://doi.org/10.5281/zenodo.20480469 Collector: openalex OA: true ABSTRACT A reproducible Docker Compose stack bundling SpiderFoot v4.0 (passive reconnaissance), theHarvester 4.10.1 (subdomain and email enumeration), a PostgreSQL 16 audit-log database, and an Nginx 1.27 reverse proxy. The stack ships with four investigation workflow templates (domain reconnaissance, social media OSINT, credential exposure, custom blank template), a secure teardown.sh that stops containers, removes volumes, and shreds logs, and an export_findings.sh that GPG-encrypts a pg_dump of the audit log. All Dockerfiles are hadolint-clean; both custom images are scanned with Trivy and Dockle; raw scan outputs and live boot measurements are committed under results/ so every claim in the README is reproducible. The README serves as the methodology document for this artefact. No separate paper accompanies this release.