Running Docker Envoy‑based image¶

These instructions describe the steps to run the Wallarm Docker image based on Envoy 1.18.4. The image contains all systems required for correct Wallarm node operation:

• Envoy proxy services with embedded Wallarm API Security module

• Tarantool modules for postanalytics

• Other services and scripts

Wallarm API Security module is designed as an Envoy HTTP filter for requests proxying.

yum list wallarm-node

Requirements¶

• Access to the account with the Administrator role in Wallarm Console in the US Cloud or EU Cloud

• Access to https://us1.api.wallarm.com if working with US Wallarm Cloud or to https://api.wallarm.com if working with EU Wallarm Cloud. Please ensure the access is not blocked by a firewall

Options for running the container¶

The filtering node configuration parameters can be passed to the docker run command in the following ways:

• In the environment variables. This option allows for configuration of only basic filtering node parameters, the most parameters cannot be changed through environment variables.

• In the mounted configuration file. This option allows for configuration of all the filtering node parameters.

Run the container passing the environment variables¶

1. Open Wallarm Console → Nodes in the US Cloud or EU Cloud and create the node of the Wallarm node type.

   

2. Copy the generated token.

3. Run the container with the created node:

   US CloudEU Cloud

   docker run -d -e WALLARM_API_TOKEN='XXXXXXX' -e ENVOY_BACKEND='example.com' -e WALLARM_API_HOST='us1.api.wallarm.com' -p 80:80 wallarm/envoy:4.2.0-1
   

   docker run -d -e WALLARM_API_TOKEN='XXXXXXX' -e ENVOY_BACKEND='example.com' -p 80:80 wallarm/envoy:4.2.0-1
   

You can pass the following basic filtering node settings to the container via the option -e:

The command does the following:

• Creates the file envoy.yaml with minimal Envoy configuration in the /etc/envoy container directory.

• Creates files with filtering node credentials to access the Wallarm Cloud in the /etc/wallarm container directory:

  • node.yaml with filtering node UUID and secret key
  • private.key with Wallarm private key

• Protects the resource http://ENVOY_BACKEND:80.

Run the container mounting envoy.yaml¶

You can mount the prepared file envoy.yaml to the Docker container via the -v option. The file must contain the following settings:

• Filtering node settings as described in the instructions

• Envoy settings as described in the Envoy instructions

To run the container:

1. Open Wallarm Console → Nodes in the US Cloud or EU Cloud and create the node of the Wallarm node type.

   

2. Copy the generated token.

3. Run the container with the created node:

   US CloudEU Cloud

   docker run -d -e WALLARM_API_TOKEN='XXXXXXX' -e WALLARM_API_HOST='us1.api.wallarm.com' -v /configs/envoy.yaml:/etc/envoy/envoy.yaml -p 80:80 wallarm/envoy:4.2.0-1
   

   docker run -d -e WALLARM_API_TOKEN='XXXXXXX' -v /configs/envoy.yaml:/etc/envoy/envoy.yaml -p 80:80 wallarm/envoy:4.2.0-1
   

   • The -e option passes the following required environment variables to the container:

   Environment variable	Description	Required
   WALLARM_API_TOKEN	Wallarm node token. Previous variables configuring access to the Wallarm Cloud Before the release of version 4.0, the variables prior to WALLARM_API_TOKEN were DEPLOY_USERNAME and DEPLOY_PASSWORD. Starting from the new release, it is recommended to use the new token-based approach to access the Wallarm Cloud. More details on migrating to the new node version	Yes
   WALLARM_API_HOST	Wallarm API server: us1.api.wallarm.com for the US Cloud api.wallarm.com for the EU Cloud By default: api.wallarm.com.	No
   DEPLOY_FORCE	Replaces an existing Wallarm node with a new one if an existing Wallarm node name matches the identifier of the container you are running. The following values can be assigned to a variable: true to replace the filtering node false to disable the replacement of the filtering node Default value (if the variable is not passed to the container) is false. The Wallarm node name always matches the identifier of the container you are running. Filtering node replacement is helpful if the Docker container identifiers in your environment are static and you are trying to run another Docker container with the filtering node (for example, a container with a new version of the image). If in this case the variable value is false, the filtering node creation process will fail.	No

   • The -v option mounts the directory with the configuration file envoy.yaml to the /etc/envoy container directory.

The command does the following:

• Mounts the file envoy.yaml into the /etc/envoy container directory.

• Creates files with filtering node credentials to access the Wallarm Cloud in the /etc/wallarm container directory:

  • node.yaml with filtering node UUID and secret key
  • private.key with Wallarm private key

• Protects the resource specified in the mounted configuration file.

Configuration of log rotation (optional)¶

The log file rotation is preconfigured and enabled by default. You can adjust the rotation settings if necessary. These settings are located in the /etc/logrotate.d directory of the container.

Testing Wallarm node operation¶

1. Send the request with test SQLI and XSS attacks to the protected resource address:

   curl http://localhost/?id='or+1=1--a-<script>prompt(1)</script>'
   

2. Open the Wallarm Console → Events section in the US Cloud or EU Cloud and ensure attacks are displayed in the list.