Update Python to 3.10 or 3.12

[j0nny55555]

Feature Request:

The Python version in the Suricata Docker Image is Python 3.9.21 for Suricata 8.0.2 and I am curious if a more up to date Python would allow suricata-update to use more resources and/or run faster?

Thank you again for providing this image to us!!

[jasonish]

Python 3.9 is used because it's included in AlmaLinux 9, keeping things simple. I don't think you'll find newer versions of Python to be faster or use fewer resources than this version. The resources used by Suricata-Update itself are for storing the complete ruleset in memory (a dict), so that is unlikely to change with a different version of Python.

The other resource usage is when Suricata-Update has Suricata do a test load of the ruleset, in this case the resources are actually used by Suricata, not Suricata-Update itself.

Is there a specific performance or resource issue you are having?

[j0nny55555]

My suricata containers gets 8 cores and other resource enablers (SYS_NICE and others), and it maxes out at 20% VM utilization (Proxmox), and otherwise 100% container utilization (Portainer). The VM has 8 cores, and RAM isn't constrained, so I have been curious why it seems to complete in about 8 minutes but appears to have room to go faster.

Thought it might be neat to update the Python version to see if a newer pre-compiled set of Python would speed things up.

Also, just noticed you build from an Alma image, and Alma/RedHat hasn't updated beyond 3.9 yet, and you have to custom build 3.12 to get it - https://shape.host/resources/almalinux-9-a-comprehensive-guide-on-python-installation - and I gotta admit, that probably isn't the last straw to find to get there.

[jasonish]

Do you have a lot of enable/disable/modify rules? Some regular expressions can be slow. Plus it would be nice to know how much time is spent in Suricata-Update vs Suricata.

The time before:

18/11/2025 -- 14:20:38 - <Info> -- Testing with suricata -T.

is in Suricata-Update, the time after is spent in Suricata, doing a rule test.

[j0nny55555]

Yes I have quite a few - if interested, please see here (it seems Github is having an issue currently, so I cannot send the most recent minor update repo updated):
https://github.com/j0nny55555/noiseless-suricata-update/blob/main/modify.conf

It is not an exact copy of my config environment, but very close and I do not test the rules --no-test --no-reload and it takes about a solid 8 minutes.

Also, I figured out how to do a 'suricata-update' run only:
docker-compose.yml:

services:
  suricata:
    ...
    command: /etc/suricata/update.sh
...

And my update.sh is:

#!/bin/bash

# Get Updated Sources
suricata-update update-sources --config /etc/suricata/update.yaml --suricata-conf /etc/suricata/suricata.yaml

# Get Rule Updates from Sources
nice -n -15 suricata-update update --config /etc/suricata/update.yaml --suricata-conf /etc/suricata/suricata.yaml \
  --show-advanced --output /etc/suricata/homelab -v --no-test --no-reload

# Catch exit code
exit_code=$?

# Check exit code and rerun in offline mode
if [ $exit_code -ne 0 ]; then
  nice -n -15 suricata-update update --config /etc/suricata/update.yaml --suricata-conf /etc/suricata/suricata.yaml \
    --show-advanced --output /etc/suricata/homelab -v --offline --no-test --no-reload
  echo "2nd suricata-update now finished, 1st suricata-update did not return 0."
else
  echo "Already finished, 1st suricata-update returned 0."
fi