You can also deploy the Lacework agent using a container orchestrator such as Docker Compose.
You can download the docker-compose YAML files during the initial installation or from the Lacework Console. For more information, see Download Agent Installers and Get the Agent Access Token.
In agent v3.8 and higher, non-US users must specify the agent server URL. For more information, see Agent Server URL.
If you download the docker-compose-v3.yml and docker-compose.yml files from the Lacework Console, you do not need any additional configuration. The agent server URL is automatically included in the files.
If you download the docker-compose-v3.yml and docker-compose.yml files from Lacework Agent GitHub repository, you must provide the agent server URL in the docker-compose files.
The following example shows you how to add the agent server URL in the docker-compose files:
services: lacework: container_name: datacollector image: lacework/datacollector:latest pid: "host" network_mode: "host" privileged: true restart: always volumes: - /var/lib/lacework:/var/lib/lacework - /var/log:/var/log - /var/run:/var/run - /etc/passwd:/etc/passwd:ro - /etc/group:/etc/group:ro - /:/laceworkfim:ro environment: - LaceworkAccessToken=YourAccessToken - LaceworkServerUrl=YourAPIEndpoint
Replace YourAccessToken with your Lacework agent access token and YourAPIEndpoint with your agent server URL.
After you install the agent, it takes 10 to 15 minutes for agent data to appear in the Lacework Console under Resources > Agents.