diff --git a/Makefile b/Makefile
index d6e706e7..c26b039a 100644
--- a/Makefile
+++ b/Makefile
@@ -2,8 +2,10 @@ build-dockers:
 	docker build -f deploy/backend/Dockerfile -t metlo/backend:latest .
 	docker build -f deploy/frontend/Dockerfile -t metlo/frontend:latest .
 	docker build -f deploy/jobrunner/Dockerfile -t metlo/jobrunner:latest .
+	docker build -f deploy/suricata-daemon/Dockerfile -t metlo/suricata-daemon:latest .
 
 push-latest-dockers:
 	docker push metlo/backend:latest
 	docker push metlo/frontend:latest
-	docker push metlo/jobrunner:latest
\ No newline at end of file
+	docker push metlo/jobrunner:latest
+	docker push metlo/suricata-daemon:latest
\ No newline at end of file
diff --git a/ingestors/kubernetes/Dockerfile b/deploy/suricata-daemon/Dockerfile
similarity index 62%
rename from ingestors/kubernetes/Dockerfile
rename to deploy/suricata-daemon/Dockerfile
index 6af5a81f..8cf55ead 100644
--- a/ingestors/kubernetes/Dockerfile
+++ b/deploy/suricata-daemon/Dockerfile
@@ -8,23 +8,25 @@ RUN apk add --no-cache grep procps git suricata=$VERSION
 
 WORKDIR /app
 
-COPY . /app
+ADD ../../../deploy/suricata-daemon suricata-daemon
+ADD ../../../ingestors/suricata metlo-ingestor
 
-RUN  chmod +x /app/entrypoint.sh
+RUN chmod +x /app/suricata-daemon/entrypoint.sh
 
 # Setup pre-reqs
 RUN mkdir -p /etc/metlo-ingestor && \
         cd /etc/ && \
         rm -rf /etc/metlo-ingestor/* && \
-        git clone https://github.com/metlo-labs/metlo.git metlo-ingestor && \
+        mkdir -p /etc/metlo-ingestor/ingestors && \
+        cp -r /app/metlo-ingestor /etc/metlo-ingestor/ingestors/suricata && \
         cd /etc/metlo-ingestor && \
         mkdir -p /etc/suricata-logs && \
         chmod 777 /etc/suricata-logs && \
         mkdir -p /var/lib/suricata && \
         mkdir -p /var/lib/suricata/rules
 
-RUN cp /app/suricata.yaml /etc/suricata/suricata.yaml && \
-        cp /app/local.rules /var/lib/suricata/rules
+RUN cp /app/suricata-daemon/suricata.yaml /etc/suricata/suricata.yaml && \
+        cp /app/suricata-daemon/local.rules /var/lib/suricata/rules
 
 RUN cd /etc/metlo-ingestor/ingestors/suricata && \
         yarn install && \
diff --git a/ingestors/kubernetes/entrypoint.sh b/deploy/suricata-daemon/entrypoint.sh
similarity index 100%
rename from ingestors/kubernetes/entrypoint.sh
rename to deploy/suricata-daemon/entrypoint.sh
diff --git a/ingestors/kubernetes/local.rules b/deploy/suricata-daemon/local.rules
similarity index 100%
rename from ingestors/kubernetes/local.rules
rename to deploy/suricata-daemon/local.rules
diff --git a/ingestors/kubernetes/suricata.yaml b/deploy/suricata-daemon/suricata.yaml
similarity index 100%
rename from ingestors/kubernetes/suricata.yaml
rename to deploy/suricata-daemon/suricata.yaml
diff --git a/ingestors/kubernetes/daemonset.yaml b/ingestors/kubernetes/daemonset.yaml
new file mode 100644
index 00000000..53526967
--- /dev/null
+++ b/ingestors/kubernetes/daemonset.yaml
@@ -0,0 +1,26 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: metlo-daemonset-pod
+spec:
+  selector:
+    matchLabels:
+      name: metlo-app
+  template:
+    metadata:
+      labels:
+        name: metlo-app
+    spec:
+      containers:
+        - name: suricata-daemon
+          image: metlo/suricata-daemon
+          imagePullPolicy: Never
+          securityContext:
+            privileged: true
+          env:
+          - name: METLO_ADDR
+            value: <YOUR METLO HOST ADDRESS>
+          - name: METLO_KEY
+            value: <YOUR METLO API KEY>
+      nodeSelector:
+        <SOME APP SELECTOR>
\ No newline at end of file