Deployment of the Wallarm Docker Image to Alibaba Cloud¶

This quick guide provides the steps to deploy the Docker image of the NGINX-based Wallarm node to the Alibaba Cloud platform using the Alibaba Cloud Elastic Compute Service (ECS).

Use cases¶

Among all supported Wallarm deployment options, Wallarm deployment on Alibaba Cloud ECS using the Docker image is recommended in these use cases:

• If your applications leverage a microservices architecture, and are already containerized and operational on Alibaba Cloud ECS.

• If you require fine-grained control over each container, the Docker image excels. It affords a greater level of resource isolation than typically possible with traditional VM-based deployments.

Requirements¶

• Access to the Alibaba Cloud Console

• Access to the account with the Administrator role and two‑factor authentication disabled in Wallarm Console for the US Cloud or EU Cloud

• Access to the IP addresses below for downloading updates to attack detection rules and API specifications, as well as retrieving precise IPs for your allowlisted, denylisted, or graylisted countries, regions, or data centers

  US CloudEU Cloud

  34.96.64.17
  34.110.183.149
  35.235.66.155
  34.102.90.100
  34.94.156.115
  35.235.115.105
  

  34.160.38.183
  34.144.227.90
  34.90.110.226
  

Options for the Wallarm node Docker container configuration¶

The filtering node configuration parameters should be passed to the deployed Docker container in one of the following ways:

• In the environment variables. This option allows for the configuration of only basic filtering node parameters. Most directives cannot be configured through environment variables.

• In the mounted configuration file. This option allows full filtering node configuration via any directives. With this configuration method, environment variables with the filtering node and Wallarm Cloud connection settings are also passed to the container.

Deploying the Wallarm node Docker container configured through environment variables¶

To deploy the containerized Wallarm filtering node configured only through environment variables, you should create the Alibaba Cloud instance and run the Docker container in this instance. You can perform these steps via the Alibaba Cloud Console or Alibaba Cloud CLI. In these instructions, Alibaba Cloud Console is used.

1. Get Wallarm token of the appropriate type:

   API tokenNode token

   1. Open Wallarm Console → Settings → API tokens in the US Cloud or EU Cloud.
   2. Find or create API token with the Deploy source role.
   3. Copy this token.

   1. Open Wallarm Console → Nodes in the US Cloud or EU Cloud.
   2. Do one of the following:
      • Create the node of the Wallarm node type and copy the generated token.
      • Use existing node group - copy token using node's menu → Copy token.

2. Open the Alibaba Cloud Console → the list of services → Elastic Compute Service → Instances.

3. Create the instance following the Alibaba Cloud instructions and the guidelines below:

   • The instance can be based on the image of any operating system.
   • Since the instance should be available for external resources, public IP address or domain should be configured in the instance settings.
   • The instance settings should reflect the method used to connect to the instance.

4. Connect to the instance by one of the methods described in the Alibaba Cloud documentation.

5. Install the Docker packages in the instance following the instructions for an appropriate operating system.

6. Set the instance environment variable with the copied Wallarm token to be used to connect the instance to the Wallarm Cloud:

   export WALLARM_API_TOKEN='<WALLARM_API_TOKEN>'
   

7. Run the Wallarm node Docker container by using the docker run command with passed environment variables and mounted configuration file:

   Command for the Wallarm US CloudCommand for the Wallarm EU Cloud

   docker run -d -e WALLARM_API_TOKEN=${WALLARM_API_TOKEN} -e WALLARM_LABELS='group=<GROUP>' -e NGINX_BACKEND=<HOST_TO_PROTECT_WITH_WALLARM> -e WALLARM_API_HOST='us1.api.wallarm.com' -p 80:80 wallarm/node:5.2.1
   

   docker run -d -e WALLARM_API_TOKEN=${WALLARM_API_TOKEN} -e WALLARM_LABELS='group=<GROUP>' -e NGINX_BACKEND=<HOST_TO_PROTECT_WITH_WALLARM> -p 80:80 wallarm/node:5.2.1
   

   • -p: port the filtering node listens to. The value should be the same as the instance port.

   • -e: environment variables with the filtering node configuration (available variables are listed in the table below). Please note that it is not recommended to pass the value of WALLARM_API_TOKEN explicitly.

     Environment variable	Description	Required
     WALLARM_API_TOKEN	Wallarm node or API token.	Yes
     WALLARM_LABELS	Available starting from node 4.6. Works only if WALLARM_API_TOKEN is set to API token with the Deploy role. Sets the group label for node instance grouping, for example: WALLARM_LABELS="group=<GROUP>" ...will place node instance into the <GROUP> instance group (existing, or, if does not exist, it will be created).	Yes (for API tokens)
     NGINX_BACKEND	Domain or IP address of the resource to protect with the Wallarm solution.	Yes
     WALLARM_API_HOST	Wallarm API server: us1.api.wallarm.com for the US Cloud api.wallarm.com for the EU Cloud By default: api.wallarm.com.	No
     WALLARM_MODE	Node mode: block to block malicious requests safe_blocking to block only those malicious requests originated from graylisted IP addresses monitoring to analyze but not block requests off to disable traffic analyzing and processing By default: monitoring. Detailed description of filtration modes →	No
     WALLARM_APPLICATION	Unique identifier of the protected application to be used in the Wallarm Cloud. The value can be a positive integer except for 0. Default value (if the variable is not passed to the container) is -1 which indicates the default application displayed in Wallarm Console → Settings → Application. More details on setting up applications →	No
     TARANTOOL_MEMORY_GB	Amount of memory allocated to Tarantool. The value can be an integer or a float (a dot . is a decimal separator). By default: 1 gygabytes.	No
     NGINX_PORT	Sets a port that NGINX will use inside the Docker container. Starting from the Docker image 4.0.2-1, the wallarm-status service automatically runs on the same port as NGINX. Default value (if the variable is not passed to the container) is 80. Syntax is NGINX_PORT='443'.	No
     WALLARM_STATUS_ALLOW	Custom CIDRs that are allowed to access the /wallarm-status endpoint from outside the Docker container. Example value: 10.0.0.0/8. If you need to pass several values, use a comma , as a separator. To access the service externally, use the Docker container's IP, specifying the /wallarm-status endpoint path.	No
     DISABLE_IPV6	The variable with any value except for an empty one deletes the listen [::]:80 default_server ipv6only=on; line from the NGINX configuration file which will stop NGINX from IPv6 connection processing. If the variable is not specified explicitly or has an empty value "", NGINX processes both IPv6 and IPv4 connections.	No
     WALLARM_APIFW_ENABLE	This setting toggles API Specification Enforcement on or off, available from release 4.10 onwards. Please note that activating this feature does not substitute for the required subscription and configuration through the Wallarm Console UI. Its default value is true, enabling the functionality.	No

8. Test the filtering node operation.

Deploying the Wallarm node Docker container configured through the mounted file¶

To deploy the containerized Wallarm filtering node configured through environment variables and mounted file, you should create the Alibaba Cloud instance, locate the filtering node configuration file in this instance file system and run the Docker container in this instance. You can perform these steps via the Alibaba Cloud Console or Alibaba Cloud CLI. In these instructions, Alibaba Cloud Console is used.

1. Get Wallarm token of the appropriate type:

   API tokenNode token

   1. Open Wallarm Console → Settings → API tokens in the US Cloud or EU Cloud.
   2. Find or create API token with the Deploy source role.
   3. Copy this token.

   1. Open Wallarm Console → Nodes in the US Cloud or EU Cloud.
   2. Do one of the following:
      • Create the node of the Wallarm node type and copy the generated token.
      • Use existing node group - copy token using node's menu → Copy token.

2. Open the Alibaba Cloud Console → the list of services → Elastic Compute Service → Instances.

3. Create the instance following the Alibaba Cloud instructions and the guidelines below:

   • The instance can be based on the image of any operating system.
   • Since the instance should be available for external resources, public IP address or domain should be configured in the instance settings.
   • The instance settings should reflect the method used to connect to the instance.

4. Connect to the instance by one of the methods described in the Alibaba Cloud documentation.

5. Install the Docker packages in the instance following the instructions for an appropriate operating system.

6. Set the instance environment variable with the copied Wallarm token to be used to connect the instance to the Wallarm Cloud:

   export WALLARM_API_TOKEN='<WALLARM_API_TOKEN>'
   

7. In the instance, create the directory with the file default containing the filtering node configuration (for example, the directory can be named as configs). An example of the file with minimal settings:

   server {
       listen 80 default_server;
       listen [::]:80 default_server ipv6only=on;
       #listen 443 ssl;
   
       server_name localhost;
   
       #ssl_certificate cert.pem;
       #ssl_certificate_key cert.key;
   
       root /usr/share/nginx/html;
   
       index index.html index.htm;
   
       wallarm_mode monitoring;
       # wallarm_application 1;
   
       location / {
               proxy_pass http://example.com;
               include proxy_params;
       }
   }
   

   Set of filtering node directives that can be specified in the configuration file →

8. Run the Wallarm node Docker container by using the docker run command with passed environment variables and mounted configuration file:

   Command for the Wallarm US CloudCommand for the Wallarm EU Cloud

   docker run -d -e WALLARM_API_TOKEN=${WALLARM_API_TOKEN} -e WALLARM_LABELS='group=<GROUP>' -e WALLARM_API_HOST='us1.api.wallarm.com' -v <INSTANCE_PATH_TO_CONFIG>:<DIRECTORY_FOR_MOUNTING> -p 80:80 wallarm/node:5.2.1
   

   docker run -d -e WALLARM_API_TOKEN=${WALLARM_API_TOKEN} -e WALLARM_LABELS='group=<GROUP>' -v <INSTANCE_PATH_TO_CONFIG>:<CONTAINER_PATH_FOR_MOUNTING> -p 80:80 wallarm/node:5.2.1
   

   • <INSTANCE_PATH_TO_CONFIG>: path to the configuration file created in the previous step. For example, configs.

   • <DIRECTORY_FOR_MOUNTING>: directory of the container to mount the configuration file to. Configuration files can be mounted to the following container directories used by NGINX:

     • /etc/nginx/conf.d — common settings
     • /etc/nginx/sites-enabled — virtual host settings
     • /var/www/html — static files

     The filtering node directives should be described in the /etc/nginx/sites-enabled/default file.

   • -p: port the filtering node listens to. The value should be the same as the instance port.

   • -e: environment variables with the filtering node configuration (available variables are listed in the table below). Please note that it is not recommended to pass the value of WALLARM_API_TOKEN explicitly.

     Environment variable	Description	Required
     WALLARM_API_TOKEN	Wallarm node or API token.	Yes
     WALLARM_API_HOST	Wallarm API server: us1.api.wallarm.com for the US Cloud api.wallarm.com for the EU Cloud By default: api.wallarm.com.	No
     WALLARM_LABELS	Available starting from node 4.6. Works only if WALLARM_API_TOKEN is set to API token with the Deploy role. Sets the group label for node instance grouping, for example: WALLARM_LABELS="group=<GROUP>" ...will place node instance into the <GROUP> instance group (existing, or, if does not exist, it will be created).	Yes (for API tokens)

9. Test the filtering node operation.

Testing the filtering node operation¶

1. Open the Alibaba Cloud Console → the list of services → Elastic Compute Service → Instances and copy the public IP address of the instance from the IP address column.

   

   If the IP address is empty, please ensure the instance is in the Running status.

2. Send the request with the test Path Traversal attack to the copied address:

   curl http://<COPIED_IP>/etc/passwd
   

3. Open Wallarm Console → Attacks in the US Cloud or EU Cloud and make sure the attack is displayed in the list.
   

To view details on errors that occurred during the container deployment, please connect to the instance by one of the methods and review the container logs. If the instance is unavailable, please ensure required filtering node parameters with correct values are passed to the container.

Was this page helpful?

How can we improve this article? (Optional)

Information is unclear or confusing

Insufficient information

Outdated or incorrect information

0/240

Send