Binsight is published to the GitHub Container Registry as ghcr.io/adrijshikhar/binsight:latest with multi-architecture support for linux/amd64 and linux/arm64.
Quick Run with Docker
Mount your binlog directory as a read-only volume and expose port 8080:
Terminal
docker run -d \
--name binsight \
-p 8080:8080 \
-v /var/log/mysql:/binlogs:ro \
-v binsight-state:/var/lib/binsight \
ghcr.io/adrijshikhar/binsight:latest /binlogs
Docker Compose Setup
For long-running staging environments or shared forensic workstations, define a docker-compose.yml:
docker-compose.yml
version: '3.8'
services:
binsight:
image: ghcr.io/adrijshikhar/binsight:latest
container_name: binsight
restart: unless-stopped
ports:
- "8080:8080"
environment:
- BINSIGHT_BIND=0.0.0.0
- BINSIGHT_PORT=8080
- BINSIGHT_DATA_DIR=/var/lib/binsight
volumes:
# Mount binlogs strictly read-only (:ro)
- /data/mysql-binlogs:/binlogs:ro
# Persist SQLite index cache across container restarts
- binsight-state:/var/lib/binsight
command: ["/binlogs"]
volumes:
binsight-state:
Air-Gapped Container Hardening
For defense, banking, or medical audits where zero outbound network access is permitted:
- Disable Container Networking: If only reading local files on disk, pass
--network hostor attach only to an internal loopback network. - Read-Only Root Filesystem: Pass
--read-onlyto Docker. Binsight only requires write access to the mounted state volume at/var/lib/binsight. - Drop All Capabilities: Pass
--cap-drop=ALL. Binsight runs as an unprivileged user and requires no Linux kernel capabilities.
Hardened Execution
docker run --rm \
--cap-drop=ALL \
--read-only \
-p 127.0.0.1:8080:8080 \
-v /data/binlogs:/binlogs:ro \
-v /tmp/binsight-state:/var/lib/binsight \
ghcr.io/adrijshikhar/binsight:latest /binlogs