# Docker NGINX‑tabanlı Görüntüyü Çalıştırma
Wallarm NGINX‑tabanlı filtreleme düğümü, [Docker image](https://hub.docker.com/r/wallarm/node) kullanılarak dağıtılabilir. Bu düğüm, kurulum sırasında otomatik olarak tanımlanan hem x86_64 hem de ARM64 mimarilerini destekler. Bu makale, Docker görüntüsünden düğümün nasıl çalıştırılacağı konusunda yol gösterir.
Docker görüntüsü, Alpine Linux üzerine kuruludur ve Alpine tarafından sağlanan NGINX sürümünü içerir. Şu anda, en son görüntü Alpine Linux sürüm 3.20 kullanır; bu sürümde NGINX stable 1.26.2 yer alır.
## Kullanım Durumları
Among all supported [Wallarm deployment options][platform], NGINX-based Docker image is recommended for Wallarm deployment in these **use cases**:
* If your organization utilizes Docker-based infrastructure, Wallarm Docker image is the ideal choice. It integrates effortlessly into your existing setup, whether you are employing a microservice architecture running on AWS ECS, Alibaba ECS, or other similar services. This solution also applies to those using virtual machines seeking a more streamlined management through Docker containers.
* If you require fine-grained control over each container, the Docker image excels. It affords a greater level of resource isolation than typically possible with traditional VM-based deployments.
For more information on running Wallarm's NGINX-based Docker image on popular public cloud container orchestration services, refer to our guides: [AWS ECS][aws-ecs-docs], [GCP GCE][gcp-gce-docs], [Azure Container Instances][azure-container-docs], [Alibaba ECS][alibaba-ecs-docs].
## Gereksinimler
* [Docker](https://docs.docker.com/engine/install/) installed on your host system
* Access to `https://hub.docker.com/r/wallarm/node` to download the Docker image. Please ensure the access is not blocked by a firewall
* Access to the account with the **Administrator** role in Wallarm Console in the [US Cloud](https://us1.my.wallarm.com/) or [EU Cloud](https://my.wallarm.com/)
* Access to `https://us1.api.wallarm.com` if working with US Wallarm Cloud or to `https://api.wallarm.com` if working with EU Wallarm Cloud. Please ensure the access is not blocked by a firewall
* Access to the IP addresses below for downloading updates to attack detection rules and [API specifications][api-policy-enf-docs], as well as retrieving precise IPs for your [allowlisted, denylisted, or graylisted][ip-lists-docs] countries, regions, or data centers
=== "US Cloud"
```
34.96.64.17
34.110.183.149
35.235.66.155
34.102.90.100
34.94.156.115
35.235.115.105
```
=== "EU Cloud"
```
34.160.38.183
34.144.227.90
34.90.110.226
```
## Konteyneri Çalıştırma Seçenekleri
The filtering node configuration parameters should be passed to the deployed Docker container in one of the following ways:
* **In the environment variables**. This option allows for the configuration of only basic filtering node parameters. Most [directives][nginx-waf-directives] cannot be configured through environment variables.
* **In the mounted configuration file**. This option allows full filtering node configuration via any [directives][nginx-waf-directives]. With this configuration method, environment variables with the filtering node and Wallarm Cloud connection settings are also passed to the container.
## Ortam Değişkenlerini Geçirerek Konteyneri Çalıştırma
Konteyneri çalıştırmak için:
1. Get Wallarm token of the [appropriate type][wallarm-token-types]:
=== "API token"
1. Open Wallarm Console → **Settings** → **API tokens** in the [US Cloud](https://us1.my.wallarm.com/settings/api-tokens) or [EU Cloud](https://my.wallarm.com/settings/api-tokens).
1. Find or create API token with the `Node deployment/Deployment` usage type.
1. Copy this token.
=== "Node token"
1. Open Wallarm Console → **Nodes** in the [US Cloud](https://us1.my.wallarm.com/nodes) or [EU Cloud](https://my.wallarm.com/nodes).
1. Do one of the following:
* Create the node of the **Wallarm node** type and copy the generated token.
* Use existing node group - copy token using node's menu → **Copy token**.
1. Düğüm ile konteyneri çalıştırın:
=== "US Cloud"
```bash
docker run -d -e WALLARM_API_TOKEN='XXXXXXX' -e WALLARM_LABELS='group=<GROUP>' -e NGINX_BACKEND='example.com' -e WALLARM_API_HOST='us1.api.wallarm.com' -p 80:80 wallarm/node:5.3.0
```
=== "EU Cloud"
```bash
docker run -d -e WALLARM_API_TOKEN='XXXXXXX' -e WALLARM_LABELS='group=<GROUP>' -e NGINX_BACKEND='example.com' -p 80:80 wallarm/node:5.3.0
```
Konteynerin içine `-e` seçeneğiyle aşağıdaki temel filtreleme düğümü ayarlarını geçirebilirsiniz:
Environment variable | Description| Required
--- | ---- | ----
`WALLARM_API_TOKEN` | Wallarm node or API token. | Yes
`WALLARM_LABELS` | <p>Available starting from node 4.6. Works only if `WALLARM_API_TOKEN` is set to [API token][api-token] with the `Deploy` role. Sets the `group` label for node instance grouping, for example:</p> <p>`WALLARM_LABELS="group=<GROUP>"`</p> <p>...will place node instance into the `<GROUP>` instance group (existing, or, if does not exist, it will be created).</p> | Yes (for API tokens)
`NGINX_BACKEND` | Domain or IP address of the resource to protect with the Wallarm solution. | Yes
`WALLARM_API_HOST` | Wallarm API server:<ul><li>`us1.api.wallarm.com` for the US Cloud</li><li>`api.wallarm.com` for the EU Cloud</li></ul>By default: `api.wallarm.com`. | No
`WALLARM_MODE` | Node mode:<ul><li>`block` to block malicious requests</li><li>`safe_blocking` to block only those malicious requests originated from [graylisted IP addresses][graylist-docs]</li><li>`monitoring` to analyze but not block requests</li><li>`off` to disable traffic analyzing and processing</li></ul>By default: `monitoring`.<br>[Detailed description of filtration modes →][filtration-modes-docs] | No
`WALLARM_APPLICATION` | Unique identifier of the protected application to be used in the Wallarm Cloud. The value can be a positive integer except for `0`.<br><br>Default value (if the variable is not passed to the container) is `-1` which indicates the **default** application displayed in Wallarm Console → **Settings** → **Application**.<br><br>[More details on setting up applications →][application-configuration] | No
`SLAB_ALLOC_ARENA` (`TARANTOOL_MEMORY_GB` [NGINX Node 5.x and earlier][what-is-new-wstore]) | [Amount of memory][allocating-memory-guide] allocated to wstore. The value can be a float (a dot <code>.</code> is a decimal separator). By default: 1.0 (1 gygabyte). | No
`NGINX_PORT` | Sets a port that NGINX will use inside the Docker container.<br><br>Starting from the Docker image `4.0.2-1`, the [`wallarm-status`][node-status-docs] service automatically runs on the same port as NGINX.<br><br>Default value (if the variable is not passed to the container) is `80`.<br><br>Syntax is `NGINX_PORT='443'`. | No
<a name="wallarm-status-allow-env-var"></a>`WALLARM_STATUS_ALLOW` | Custom CIDRs that are allowed to access the [`/wallarm-status` endpoint][node-status-docs] from outside the Docker container. Example value: `10.0.0.0/8`. If you need to pass several values, use a comma `,` as a separator. To access the service externally, use the Docker container's IP, specifying the `/wallarm-status` endpoint path. | No
`DISABLE_IPV6`| The variable with any value except for an empty one deletes the `listen [::]:80 default_server ipv6only=on;` line from the NGINX configuration file which will stop NGINX from IPv6 connection processing.<br><br>If the variable is not specified explicitly or has an empty value `""`, NGINX processes both IPv6 and IPv4 connections. | No
`WALLARM_APIFW_ENABLE` | This setting toggles [API Specification Enforcement][api-policy-enf-docs] on or off, available from release 4.10 onwards. Please note that activating this feature does not substitute for the required subscription and configuration through the Wallarm Console UI.<br><br>Its default value is `true`, enabling the functionality. | No
`WALLARM_APID_ONLY` (5.3.7 and higher) | In this mode, attacks detected in your traffic are blocked locally by the node (if [enabled][filtration-modes]) but not exported to Wallarm Cloud. Meanwhile, [API Discovery][api-discovery-docs] and some other features remain fully functional, detecting your API inventory and uploading it to the Cloud for visualization. This mode is for those who want to review their API inventory and identify sensitive data first, and plan controlled attack data export accordingly. However, disabling attack export is rare, as Wallarm securely processes attack data and provides [sensitive attack data masking][sensitive-data-rule] if needed. [More details][apid-only-mode-details]<br>By default: `false`. | No
Komut şunları yapar:
* Minimal NGINX yapılandırması bulunan `default` dosyasını oluşturur ve filtreleme düğümü yapılandırmasını konteynerdeki `/etc/nginx/sites-enabled` dizinine aktarır.
* Wallarm Cloud'a erişim için filtreleme düğümü kimlik bilgilerini içeren dosyaları konteynerdeki `/opt/wallarm/etc/wallarm` dizininde oluşturur:
* Filtreleme düğümü UUID'si ve gizli anahtarı içeren `node.yaml`
* Wallarm özel anahtarını içeren `private.key`
* `http://NGINX_BACKEND:80` kaynağını korur.
## Yapılandırma Dosyasını Bağlayarak Konteyneri Çalıştırma
Hazırlanan yapılandırma dosyasını Docker konteynerine `-v` seçeneği ile bağlayabilirsiniz. Dosya aşağıdaki ayarları içermelidir:
* [Filtering node directives][nginx-directives-docs]
* [NGINX settings](https://nginx.org/en/docs/beginners_guide.html)
Konteyneri çalıştırmak için:
1. Get Wallarm token of the [appropriate type][wallarm-token-types]:
=== "API token"
1. Open Wallarm Console → **Settings** → **API tokens** in the [US Cloud](https://us1.my.wallarm.com/settings/api-tokens) or [EU Cloud](https://my.wallarm.com/settings/api-tokens).
1. Find or create API token with the `Node deployment/Deployment` usage type.
1. Copy this token.
=== "Node token"
1. Open Wallarm Console → **Nodes** in the [US Cloud](https://us1.my.wallarm.com/nodes) or [EU Cloud](https://my.wallarm.com/nodes).
1. Do one of the following:
* Create the node of the **Wallarm node** type and copy the generated token.
* Use existing node group - copy token using node's menu → **Copy token**.
1. Düğüm ile konteyneri çalıştırın:
=== "US Cloud"
```bash
docker run -d -e WALLARM_API_TOKEN='XXXXXXX' -e WALLARM_LABELS='group=<GROUP>' -e WALLARM_API_HOST='us1.api.wallarm.com' -v /configs/default:/etc/nginx/sites-enabled/default -p 80:80 wallarm/node:5.3.0
```
=== "EU Cloud"
```bash
docker run -d -e WALLARM_API_TOKEN='XXXXXXX' -e WALLARM_LABELS='group=<GROUP>' -v /configs/default:/etc/nginx/sites-enabled/default -p 80:80 wallarm/node:5.3.0
```
* `-e` seçeneği, konteynere aşağıdaki gerekli ortam değişkenlerini geçirir:
Environment variable | Description| Required
--- | ---- | ----
`WALLARM_API_TOKEN` | Wallarm node or API token. | Yes
`WALLARM_API_HOST` | Wallarm API server:<ul><li>`us1.api.wallarm.com` for the US Cloud</li><li>`api.wallarm.com` for the EU Cloud</li></ul>By default: `api.wallarm.com`. | No
`WALLARM_LABELS` | <p>Available starting from node 4.6. Works only if `WALLARM_API_TOKEN` is set to [API token][api-token] with the `Deploy` role. Sets the `group` label for node instance grouping, for example:</p> <p>`WALLARM_LABELS="group=<GROUP>"`</p> <p>...will place node instance into the `<GROUP>` instance group (existing, or, if does not exist, it will be created).</p> | Yes (for API tokens)
`SLAB_ALLOC_ARENA` (`TARANTOOL_MEMORY_GB` [NGINX Node 5.x and earlier][what-is-new-wstore]) | [Amount of memory][allocating-memory-guide] allocated to wstore. The value can be a float (a dot <code>.</code> is a decimal separator). By default: 1.0 (1 gygabyte). | No
`WALLARM_APID_ONLY` (5.3.7 and higher) | In this mode, attacks detected in your traffic are blocked locally by the node (if [enabled][filtration-modes]) but not exported to Wallarm Cloud. Meanwhile, [API Discovery][api-discovery-docs] and some other features remain fully functional, detecting your API inventory and uploading it to the Cloud for visualization. This mode is for those who want to review their API inventory and identify sensitive data first, and plan controlled attack data export accordingly. However, disabling attack export is rare, as Wallarm securely processes attack data and provides [sensitive attack data masking][sensitive-data-rule] if needed. [More details][apid-only-mode-details]<br>By default: `false`. | No
* `-v` seçeneği, yapılandırma dosyası `default`'ın bulunduğu dizini konteynerdeki `/etc/nginx/sites-enabled` dizinine bağlar.
??? info "Örnek `/etc/nginx/sites-enabled` minimal içeriğini görün"
```bash
server {
listen 80 default_server;
listen [::]:80 default_server ipv6only=on;
#listen 443 ssl;
server_name localhost;
#ssl_certificate cert.pem;
#ssl_certificate_key cert.key;
root /usr/share/nginx/html;
index index.html index.htm;
wallarm_mode monitoring;
location / {
proxy_pass http://example.com;
include proxy_params;
}
}
```
??? info "Diğer yapılandırma dosyalarını bağlama"
NGINX tarafından kullanılan konteyner dizinleri:
* `/etc/nginx/nginx.conf` - Bu, ana NGINX yapılandırma dosyasıdır. Bu dosyayı bağlamaya karar verirseniz, Wallarm’ın doğru çalışması için ek adımlar gereklidir:
1. `nginx.conf` dosyasının en üst seviyesine aşağıdaki ayarı ekleyin:
```
include /etc/nginx/modules-enabled/*.conf;
```
1. `nginx.conf` dosyasında, `http` bloğu içerisinde [API Specification Enforcement][api-policy-enf-docs] yapılandırma dosyasına işaret eden `wallarm_srv_include /etc/nginx/wallarm-apifw-loc.conf;` yönergesini ekleyin.
1. `wallarm-apifw-loc.conf` dosyasını belirtilen yola bağlayın. İçeriği şu şekilde olmalıdır:
```
location ~ ^/wallarm-apifw(.*)$ {
wallarm_mode off;
proxy_pass http://127.0.0.1:8088$1;
error_page 404 431 = @wallarm-apifw-fallback;
error_page 500 502 503 504 = @wallarm-apifw-fallback;
allow 127.0.0.0/8;
deny all;
}
location @wallarm-apifw-fallback {
wallarm_mode off;
return 500 "API FW fallback";
}
```
1. `/etc/nginx/conf.d/wallarm-status.conf` dosyasını aşağıdaki içerikle bağlayın. Verilen yapılandırmadaki her hangi bir satırın değiştirilmemesi, düğüm metriklerinin Wallarm Cloud’a başarılı bir şekilde yüklenmesi için çok önemlidir:
```
server {
# Port, NGINX_PORT değişkeni değeriyle eşleşmelidir
listen 127.0.0.8:80;
server_name localhost;
allow 127.0.0.0/8;
deny all;
wallarm_mode off;
disable_acl "on";
wallarm_enable_apifw off;
access_log off;
location ~/wallarm-status$ {
wallarm_status on;
}
}
```
1. NGINX yapılandırma dosyanız içerisinde, `/wallarm-status` uç noktası için aşağıdaki yapılandırmayı ayarlayın:
```
location /wallarm-status {
# İzin verilen adresler WALLARM_STATUS_ALLOW değişkeni değeriyle eşleşmelidir
allow xxx.xxx.x.xxx;
allow yyy.yyy.y.yyy;
deny all;
wallarm_status on format=prometheus;
wallarm_mode off;
}
```
* `/etc/nginx/conf.d` — ortak ayarlar
* `/etc/nginx/sites-enabled` — sanal sunucu ayarları
* `/opt/wallarm/usr/share/nginx/html` — statik dosyalar
Gerekirse, listelenen konteyner dizinlerine herhangi bir dosya bağlayabilirsiniz. Filtreleme düğümü yönergeleri, `/etc/nginx/sites-enabled/default` dosyasında tanımlanmalıdır.
Komut şunları yapar:
* `default` dosyasını konteynerdeki `/etc/nginx/sites-enabled` dizinine bağlar.
* Wallarm Cloud’a erişmek için filtreleme düğümü kimlik bilgilerini içeren dosyaları konteynerdeki `/opt/wallarm/etc/wallarm` dizininde oluşturur:
* Filtreleme düğümü UUID'si ve gizli anahtarı içeren `node.yaml`
* Wallarm özel anahtarını içeren `private.key`
* `http://example.com` kaynağını korur.
## Günlük Kaydı Yapılandırması
Günlük kaydı varsayılan olarak etkindir. Günlük dizinleri şunlardır:
* `/var/log/nginx` — NGINX günlükleri
* `/opt/wallarm/var/log/wallarm` — [Wallarm node günlükleri][logging-instr]
## Wallarm Düğüm İşleyişinin Test Edilmesi
1. Send the request with test [Path Traversal][ptrav-attack-docs] attack to a protected resource address:
```
curl http://localhost/etc/passwd
```
If traffic is configured to be proxied to `example.com`, include the `-H "Host: example.com"` header in the request.
1. Open Wallarm Console → **Attacks** section in the [US Cloud](https://us1.my.wallarm.com/search) or [EU Cloud](https://my.wallarm.com/search) and make sure the attack is displayed in the list.
![Attacks in the interface][attacks-in-ui-image]
1. Optionally, [test][link-wallarm-health-check] other aspects of the node functioning.
## Kullanım Durumlarının Yapılandırılması
Docker konteynerine bağlanan yapılandırma dosyası, [mevcut yönerge][nginx-directives-docs] içerisindeki filtreleme düğümü yapılandırmasını tanımlamalıdır. Aşağıda, yaygın olarak kullanılan bazı filtreleme düğümü yapılandırma seçenekleri bulunmaktadır:
* [Configuration of the filtration mode][waf-mode-instr]
* [Logging Wallarm node variables][logging-instr]
* [Limiting the single request processing time in the directive `wallarm_process_time_limit`][process-time-limit-instr]
* [Limiting the server reply waiting time in the NGINX directive `proxy_read_timeout`](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_read_timeout)
* [Limiting the maximum request size in the NGINX directive `client_max_body_size`](https://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size)