siem-backend/CPU-COMPATIBILITY-FIX.md

CPU compatibility and host-port fix

This release adds a real ClickHouse binary probe before the SIEM stack starts.

• docker run ... clickhouse local --query 'SELECT 1' validates the configured image on the actual Docker CPU.
• Exit 132 / Illegal instruction is treated as a CPU/VM instruction-set incompatibility, not as a credential or schema failure.
• A current 26.3 LTS image is probed as a safe fallback if the configured 26.6 image SIGILLs.
• If both official images fail, deployment stops with exit 42 and instructions for CPU passthrough / hardware compatibility.
• Existing unrelated containers occupying host ports are detected. With AUTO_PORTS=true, conflicting ports are moved to free alternatives and persisted in .env.
• host-info.sh prints host architecture, CPU features, Docker architecture, published ports and performs the direct ClickHouse CPU probe.

On the reported host, the supplied docker ps already shows two conflicts:

• host port 8080 is occupied by tradingdiscordbot-starauftrag-bot-1
• host port 9000 is occupied by peertube-nginx-1

The updated preflight therefore moves these defaults automatically when deploying on that host.