cyber-decoy

Cyber-decoy is a containerized network honeypot, meaning it is a defensive tool that pretends to be real services so it can watch and record who tries to break in. It advertises SSH, RDP, and SMB, the kinds of services attackers commonly probe on a network, and it is meant to be run only on networks the operator owns or is authorized to monitor.

The project splits its work into two parts. A broker container watches every incoming connection using eBPF, a Linux kernel technology that lets it observe network traffic efficiently, including scans against ports it does not even serve. The same broker then acts as a reverse proxy, forwarding real connections into isolated decoy containers for the matching service, so attackers interact with something that behaves like a genuine SSH, RDP, or SMB server while every byte is logged.

Four containers make up the system: the broker itself, and three separate decoys built on tools called OpenCanary and Impacket that simulate SSH, RDP, and SMB well enough to capture credentials attackers type in. The decoys sit on an internal Docker network with no route to the host or the wider internet, so nothing an attacker does inside a decoy can reach anything real.

Running it requires a Linux host with a fairly recent kernel, version 6.6 or newer, for the deepest eBPF observation, along with Docker and its Compose plugin. On older kernels or on macOS, where Docker runs inside a virtual machine, the eBPF observation layer simply turns itself off while the proxy and decoys keep working normally, which the project treats as an acceptable fallback rather than a failure. Everything can be started with a small set of make commands, and the broker and each decoy emit structured JSON logs that make it possible to watch scanning and login attempts as they happen. The full README is longer than what was shown.