Add app

serving/audit-collector/Dockerfile

@@ -0,0 +1,17 @@
+# syntax=docker/dockerfile:1
+#
+# rsyslog as a remote log/audit collector (RECEIVE side only) for the diskless
+# fleet serving stack. Booted hosts forward auditd + syslog here; records land
+# under /var/log/remote/<sender-ip>/. See rsyslog.conf + README.md.
+
+FROM alpine:3.20
+
+RUN apk add --no-cache rsyslog tzdata \
+    && mkdir -p /var/log/remote /var/spool/rsyslog
+
+COPY rsyslog.conf /etc/rsyslog.conf
+
+EXPOSE 514/tcp
+# Foreground (-n), our config only (-f). rsyslog logs its own startup to stderr,
+# captured by `docker compose logs audit`.
+ENTRYPOINT ["rsyslogd", "-n", "-f", "/etc/rsyslog.conf"]