Hey everyone,

Today I'm sharing a project I initially built to solve a personal problem that has quickly been picking up traction: HoneyWire v2.0. Hopefully it will help you out as well!

I wanted to run high-fidelity network canaries in my network, but I couldn’t justify enterprise pricing, and I wasn’t a fan of managing custom orchestration across all my VMs to make available OSS solutions work.

So, I built HoneyWire. It’s a completely free, open-source distributed deception platform.

It uses a point-in-time CLI wizard to deploy hardened, distroless Docker traps. You run the command once, it spins up the decoy, registers it to your centralized Hub dashboard, and the setup agent completely exits. No persistent background daemons.

Main Features:

Zero-Agent: No ongoing background overhead on your hosts.

Centralized UI: Manage fleet settings, deployments, View fleet health, uptime, and lateral movement alerts.

Alerting: Built-in push notifications and SIEM forwarding.

Privacy: 100% free, open-source.

UX: 60 seconds from a fresh Linux box to an active cyber canary.

GitHub Repo: https://github.com/andreicscs/HoneyWire Landing Page: https://honeywire.dev/

Would love to hear your thoughts on the architecture or any feedback if you test it out!

AI Disclosure: As a student and solo developer/maintainer, I used AI as a “junior dev” during project development to help accelerate boilerplate writing and documentation. All core architecture, system structure, and security logic were fully designed and implemented by me.

Hey everyone,

I wanted to run high-fidelity network canaries in my network, but I couldn’t justify enterprise pricing, and I wasn’t a fan of managing custom orchestration across all my VMs to make available OSS solutions work.

So, I built HoneyWire. It’s a completely free, open-source distributed deception platform.

It uses a point-in-time CLI wizard to deploy hardened, distroless Docker traps. You run the command once, it spins up the decoy, registers it to your centralized Hub dashboard, and the setup agent completely exits. No persistent background daemons.

Features:

Zero-Agent: No ongoing background overhead on your hosts.

Centralized UI: View fleet health, uptime, and lateral movement alerts in dark mode.

Alerting: Built-in push notifications and SIEM forwarding.

Privacy: 100% free, open-source, and strictly zero telemetry.

GitHub Repo: https://github.com/andreicscs/HoneyWire Landing Page: https://honeywire.dev/

Would love to hear your thoughts on the architecture or any feedback if you test it out!

AI Disclosure: As a student and solo developer/maintainer, I used AI as a “junior dev” during project development to help accelerate boilerplate writing and documentation. All core architecture, system structure, and security logic were fully designed and implemented by me.

Hey folks,

Just open-sourced a project called HoneyWire, a distributed deception platform built as an alternative to commercial honeypots and traditional agent-heavy canary setups.

It allows you to turn any Linux asset into a network canary in about a minute. Instead of installing heavy background daemons, a transient CLI wrapper configures and launches lightweight, distroless decoy containers that check back into a centralized management dashboard.

If an attacker attempts lateral movement and touches one of these decoys, it triggers an instant alert to your SIEM or webhook notifications.

Project Links:

GitHub: https://github.com/andreicscs/HoneyWire

Site: https://honeywire.dev/

It's completely free, self-hostable, and transparent. Let me know if you have any questions about the detection mechanisms or the tech stack!

Hey everyone,

I wanted to run high-fidelity network canaries in my homelab, but I couldn't justify enterprise pricing, and I wasn't a fan of managing custom orchestration across all my VMs to make available oss solutions work.

So, I built HoneyWire. It’s a completely free, open-source distributed deception platform.

It uses a point-in-time CLI wizard to deploy hardened, distroless Docker traps. You run the command once, it spins up the decoy, registers it to your centralized Hub dashboard, and the setup agent completely exits. No persistent background daemons.

Features:

Zero-Agent: No ongoing background overhead on your hosts.

Centralized UI: View fleet health, uptime, and lateral movement alerts in dark mode.

Alerting: Built-in push notifications and SIEM forwarding.

Privacy: 100% free, open-source, and strictly zero telemetry.

GitHub Repo: https://github.com/andreicscs/HoneyWire Landing Page: https://honeywire.dev/

Would love to hear your thoughts on the architecture or any feedback if you test it out!

AI Disclosure: As a student and solo developer/maintainer, I used AI as a “junior dev” during project development to help accelerate boilerplate writing and documentation. All core architecture, system structure, and security logic were fully designed and implemented by me.