[{"_1":2,"_142":-5,"_143":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_135":136},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.layers.$namespace.$reponame.$tag.(images).($imageUrlDigest)",{"_23":24,"_25":26,"_67":68,"_69":-7,"_70":-7,"_71":-7,"_72":-7,"_73":-5,"_74":-5,"_75":11,"_76":11,"_61":77,"_126":11,"_96":58,"_127":95,"_128":60,"_38":39,"_129":11,"_130":17,"_131":41,"_132":-5,"_133":11,"_134":11},"scanningType","none","tagData",{"_27":28,"_29":30,"_31":32,"_33":34,"_54":55,"_56":28,"_57":58,"_59":60,"_61":62,"_63":43,"_64":55,"_65":52,"_66":17},"creator",7374052,"full_size",45021892,"id",120900999,"images",[35],{"_36":37,"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":41,"_49":-5,"_50":30,"_51":52,"_53":-5},"architecture","arm64","digest","sha256:032c368098ca2fed2085b5a79235e1c3acdb65c54beae6ba5ac7d6af06aeebfe","features","","last_pulled","2026-09-26T13:57:10.078787467Z","last_pushed","2021-06-07T12:16:47Z","os","linux","os_features","os_version","size","status","active","variant","last_updated","2021-06-07T12:16:46.552677Z","last_updater","last_updater_username","bunkerity","name","arm64v8","repository",7580788,"tag_last_pulled","tag_last_pushed","tag_status","v2","tagImages",[],"layerOrdinals","packageName","cveId","sbom","scoutSummary","staticSummary","isScoutPaymentRequired","canSeeVulnerabilities",{"_78":79,"_80":81,"_83":84,"_85":86,"_87":11,"_54":88,"_89":90,"_91":92,"_59":95,"_96":58,"_97":98,"_99":82,"_100":101,"_51":102,"_103":52,"_104":-5,"_105":106,"_107":108,"_109":11,"_110":58,"_111":112,"_117":11,"_118":119,"_123":58,"_124":125},"categories",[],"content_types",[82],"image","date_registered","2019-08-20T21:53:09.835917Z","description","🛡️ Make your web services secure by default ! ","is_private","2021-10-24T20:55:35.715273Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[93,94],"application/vnd.docker.container.image.v1+json","application/vnd.docker.distribution.manifest.list.v2+json","bunkerized-nginx","namespace","pull_count",451790,"repository_type","star_count",12,1,"status_description","source","collaborator_count",0,"full_description","

\n\t\n

\n\n

\n \n \n \n \n \n \n

\n\n

\n\t\n\t\tDocumentation\n\t\t | \n\t\tExamples\n\t\t | \n\t\tBlog posts\n\t\t | \n\t\tCommunity chat\n\t\t | \n\t\tFollow us\n\t\n

\n\n> Make security by default great again !\n\nbunkerized-nginx is a web server based on the notorious nginx and focused on security. It integrates into existing environments (Linux, Docker, Swarm, Kubernetes, ...) to make your web services \"secure by default\" without any hassle. The security best practices are automatically applied for you while keeping control of every settings to meet your own use case.\n\n

\n\nNon-exhaustive list of features :\n- HTTPS support with transparent Let's Encrypt automation\n- State-of-the-art web security : HTTP security headers, prevent leaks, TLS hardening, ...\n- Integrated ModSecurity WAF with the OWASP Core Rule Set\n- Automatic ban of strange behaviors\n- Antibot challenge through cookie, javascript, captcha or recaptcha v3\n- Block TOR, proxies, bad user-agents, countries, ...\n- Block known bad IP with DNSBL and distributed blacklist\n- Prevent bruteforce attacks and protect API resources with rate limiting\n- Plugins system for external security checks (ClamAV, CrowdSec, ...)\n- Easy to configure with environment variables or web UI\n- Seamless integration into existing environments : Linux, Docker, Swarm, Kubernetes, ...\n\nFooling automated tools/scanners :\n\n

\n\nYou can find a live demo at [https://demo-nginx.bunkerity.com](https://demo-nginx.bunkerity.com), feel free to do some security tests.\n\n# Table of contents\n

\n\t

Click to show

\n\n- [Table of contents](#table-of-contents)\n- [Integrations](#integrations)\n * [Docker](#docker)\n * [Docker autoconf](#docker-autoconf)\n * [Swarm](#swarm)\n * [Kubernetes](#kubernetes)\n * [Linux](#linux)\n- [Configuration](#configuration)\n * [Singlesite](#singlesite)\n * [Multisite](#multisite)\n * [Special folders](#special-folders)\n- [Web UI](#web-ui)\n- [Security tuning](#security-tuning)\n- [Going further](#going-further)\n- [License](#license)\n- [Contributing](#contributing)\n- [Security policy](#security-policy)\n

\n\n# Integrations\n\n## Docker\n\nYou can get official prebuilt Docker images of bunkerized-nginx for x86, x64, armv7 and aarch64/arm64 architectures on Docker Hub :\n```shell\n$ docker pull bunkerity/bunkerized-nginx\n```\n\nOr you can build it from source if you wish :\n```shell\n$ git clone https://github.com/bunkerity/bunkerized-nginx.git\n$ cd bunkerized-nginx\n$ docker build -t bunkerized-nginx .\n```\n\nTo use bunkerized-nginx as a Docker container you have to pass specific environment variables, mount volumes and redirect ports to make it accessible from the outside.\n\n

\n\nYou will find more information about Docker integration in the [documentation](https://bunkerized-nginx.readthedocs.io/en/latest/integrations.html#docker).\n\n## Docker autoconf\n\nThe downside of using environment variables is that the container needs to be recreated each time there is an update which is not very convenient. To counter that issue, you can use another image called bunkerized-nginx-autoconf which will listen for Docker events and automatically configure bunkerized-nginx instance in real time without recreating the container. Instead of defining environment variables for the bunkerized-nginx container, you simply add labels to your web services and bunkerized-nginx-autoconf will \"automagically\" take care of the rest.\n\n

\n\nYou will find more information about Docker autoconf feature in the [documentation](https://bunkerized-nginx.readthedocs.io/en/latest/integrations.html#docker-autoconf).\n\n## Swarm\n\nThe deployment and configuration is very similar to the \"Docker autoconf\" one but with services instead of containers. A service based on the bunkerized-nginx-autoconf image needs to be scheduled on a manager node (don't worry it doesn't expose any network port for obvious security reasons). This service will listen for Docker Swarm events like service creation or deletion and generate the configuration according to the labels of each service. Once configuration generation is done, the bunkerized-nginx-autoconf service will send the configuration files and a reload order to all the bunkerized-nginx tasks so they can apply the new configuration. If you need to deliver static files (e.g., html, images, css, js, ...) a shared folder accessible from all bunkerized-nginx instances is needed (you can use a storage system like NFS, GlusterFS, CephFS on the host or a [Docker volume plugin](https://docs.docker.com/engine/extend/)).\n\n

\n\nYou will find more information about Docker Swarm integration in the [documentation](https://bunkerized-nginx.readthedocs.io/en/latest/integrations.html#docker-swarm).\n\n## Kubernetes\n\n**This integration is still in beta, please fill an issue if you find a bug or have an idea on how to improve it.**\n\nThe bunkerized-nginx-autoconf acts as an Ingress Controller and connects to the k8s API to get cluster events and generate a new configuration when it's needed. Once the configuration is generated, the Ingress Controller sends the configuration files and a reload order to the bunkerized-nginx instances running in the cluster. If you need to deliver static files (e.g., html, images, css, js, ...) a shared folder accessible from all bunkerized-nginx instances is needed (you can use a storage system like NFS, GlusterFS, CephFS on the host or a [Kubernetes Volume that supports ReadOnlyMany access](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes)).\n\n

\n\nYou will find more information about Kubernetes integration in the [documentation](https://bunkerized-nginx.readthedocs.io/en/latest/integrations.html#kubernetes).\n\n## Linux\n\n**This integration is still in beta, please fill an issue if you find a bug or have an idea on how to improve it.**\n\nList of supported Linux distributions :\n- Debian buster (10)\n- Ubuntu focal (20.04)\n- CentOS 7\n- Fedora 34\n- Arch Linux\n\nUnlike containers, Linux integration can be tedious because bunkerized-nginx has a bunch of dependencies that need to be installed before we can use it. Fortunately, we provide a [helper script](https://github.com/bunkerity/bunkerized-nginx/blob/master/helpers/install.sh) to make the process easier and automatic. Once installed, the configuration is really simple, all you have to do is to edit the `/opt/bunkerized-nginx/variables.env` configuration file and run the `bunkerized-nginx` command to apply it.\n\nYou will find more information about Linux integration in the [documentation](https://bunkerized-nginx.readthedocs.io/en/latest/integrations.html#linux).\n\n# Configuration\n\nThe configuration is made through what we call \"environment variables\" as a form of key/value pairs. You will find the [quickstart guide](https://bunkerized-nginx.readthedocs.io/en/latest/quickstart_guide.html) and the complete [list of environment variables](https://bunkerized-nginx.readthedocs.io/en/latest/environment_variables.html) in the documentation.\n\n## Singlesite\n\nBy default, bunkerized-nginx will only create one server block in the nginx configuration. This cover the simplest use-case where you want to protect one service easily and quickly.\n\nHere is a dummy configuration as an example :\n```conf\nSERVER_NAME=example.com www.example.com\nAUTO_LETS_ENCRYPT=yes\nDISABLE_DEFAULT_SERVER=yes\nUSE_REVERSE_PROXY=yes\nREVERSE_PROXY_URL=/\nREVERSE_PROXY_HOST=http://internal-service.example.local:8080\n# Uncomment the HTTP_PORT and HTTPS_PORTS variables when using Linux configuration\n#HTTP_PORT=80\n#HTTPS_PORT=443\n```\n\n## Multisite\n\nIf you have multiple services to protect, the easiest way to do it is by enabling the \"multisite\" mode. When using multisite, bunkerized-nginx will create one server block per server defined in the `SERVER_NAME` environment variable. You can configure each servers independently by adding the server name as a prefix.\n\nHere is a dummy configuration as an example :\n```conf\nSERVER_NAME=app1.example.com app2.example.com\n# Without prefix the variables are applied globally but can still be overriden\nAUTO_LETS_ENCRYPT=yes\nDISABLE_DEFAULT_SERVER=yes\n# Specific configurations for first service\napp1.example.com_USE_REVERSE_PROXY=yes\napp1.example.com_REVERSE_PROXY_URL=/\napp1.example.com_REVERSE_PROXY_HOST=http://internal-service.example.local:8080\n# Specific configuration for second service\napp2.example.com_REMOTE_PHP=my-fpm\napp2.example.com_REMOTE_PHP_PATH=/var/www/html\n# Uncomment the HTTP_PORT and HTTPS_PORTS variables when using Linux configuration\n#HTTP_PORT=80\n#HTTPS_PORT=443\n```\n\n## Special folders\n\n| Name | Location | Purpose | Multisite |\n|:----------------:|:--------------------------------------------------------------------------------:|:-----------------------------------------------------------------------:|:---------:|\n| www | /www (container)
/opt/bunkerized-nginx/www (Linux) | Static files that need to be delivered by bunkerized-nginx. | Yes |\n| http-confs | /http-confs (container)
/opt/bunkerized-nginx/http-confs (Linux) | Custom nginx configuration files loaded at http context. | No |\n| server-confs | /server-confs (container)
/opt/bunkerized-nginx/server-confs (Linux) | Custom nginx configuration files loaded at server context. | Yes |\n| modsec-confs | /modsec-confs (container)
/opt/bunkerized-nginx/modsec-confs (Linux) | Custom ModSecurity configuration files loaded before the Core Rule Set. | Yes |\n| modsec-crs-confs | /modsec-crs-confs (container)
/opt/bunkerized-nginx/modsec-crs-confs (Linux) | Custom ModSecurity configuration files loaded after the Core Rule Set. | Yes |\n| plugins | /plugins (container)
/opt/bunkerized-nginx/plugins (Linux) | Location of bunkerized-nginx plugins. | No |\n| cache | /cache (container)
/opt/bunkerized-nginx/plugins (Linux) | Placeholder for caching data like external blacklists. | No |\n| acme-challenge | /acme-challenge (container)
/opt/bunkerized-nginx/acme-challenge (Linux) | Placeholder for Let's Encrypt challenges. | No |\n\nYou will find more information about the special folders in the [documentation](https://bunkerized-nginx.readthedocs.io/en/latest/special_folders.html).\n\n# Web UI\n\n

\n\nYou will find more information about the web UI in the [documentation](https://bunkerized-nginx.readthedocs.io/en/latest/web_ui.html).\n\n# Security tuning\n\nbunkerized-nginx comes with a set of predefined security settings that you can (and you should) tune to meet your own use case. We recommend you to read the [security tuning](https://bunkerized-nginx.readthedocs.io/en/latest/security_tuning.html) section of the documentation.\n\n# Going further\n\n- [Official documentation](https://bunkerized-nginx.readthedocs.io/)\n- [Full concrete examples](https://github.com/bunkerity/bunkerized-nginx/tree/master/examples)\n- [Tutorials in our blog](https://www.bunkerity.com/blog)\n\n# License\n\nThis project is licensed under the terms of the [GNU Affero General Public License (AGPL) version 3](https://github.com/bunkerity/bunkerized-nginx/blob/master/LICENSE.md).\n\n# Contributing\n\nIf you would like to contribute to the project you can read the [contributing guidelines](https://github.com/bunkerity/bunkerized-nginx/blob/master/CONTRIBUTING.md) to get started.\n\n# Security policy\n\nWe take security bugs as serious issues and encourage responsible disclosure, see our [security policy](https://github.com/bunkerity/bunkerized-nginx/blob/master/SECURITY.md) for more information.","has_starred","hub_user","immutable_tags_settings",{"_113":11,"_114":115},"enabled","rules",[116],".*","is_automated","permissions",{"_120":17,"_121":11,"_122":11},"read","write","admin","user","storage_size",168705888071,"isOrg","reponame","tag","canDeleteTags","isHubSbxKitsEnabled","currentTab","tagAttestations","displaySecurityMetadata","showSbxLogoOverride","routes/_layout.layers.$namespace.$reponame.$tag.(images).($imageUrlDigest)._index",{"_23":24,"_71":-7,"_69":-7,"_70":-7,"_25":137,"_38":39,"_140":-7,"_141":11},{"_27":28,"_29":30,"_31":32,"_33":138,"_54":55,"_56":28,"_57":58,"_59":60,"_61":62,"_63":43,"_64":55,"_65":52,"_66":17},[139],{"_36":37,"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":41,"_49":-5,"_50":30,"_51":52,"_53":-5},"imageWithLayers","hasPermissionToViewRepoSettings","actionData","errors"]

bunkerity/bunkerized-nginx:arm64v8