xTag

Overview

Full name
docker.io/uusec/waf
Registry
docker.io
Namespace
uusec
Repository
waf
Cached tags
14
Last synced
07/06/2026, 03:18 PM

Introduction

uUseC 开源 Web 应用防火墙镜像，基于 OpenResty 过滤 SQLi/XSS 等攻击并支持 CC 限速，通常置于业务 Ingress 前端，需挂载规则与证书。

Details

uusec/waf 提供反向代理层 WAF，通过 Lua 规则检测恶意请求、IP 黑白名单与 CC 防御，可对接 Redis 共享计数。镜像监听 80/443，规则与站点配置经 volume 或 env 加载。与 ModSecurity+nginx 相比部署更一体化；生产应固定 tag、TLS 证书 volume、Redis 高可用，并将管理 API 限制内网，定期更新规则库。

快速启动

docker run -d --name uusec-waf \
  -p 80:80 -p 443:443 \
  -v $(pwd)/waf-conf:/opt/waf/conf \
  docker.io/uusec/waf:latest

推荐实践

docker run -d --name uusec-waf \
  --restart unless-stopped \
  -p 80:80 -p 443:443 \
  -e REDIS_HOST=redis.internal \
  -e REDIS_PASSWORD=change-me \
  -v /etc/waf/conf:/opt/waf/conf \
  -v /etc/waf/certs:/opt/waf/certs \
  docker.io/uusec/waf:2.0.0

核心参数说明

  • -p 80:80 / 443:443 — HTTP/HTTPS 入口
  • -v .../conf — 站点与 WAF 规则
  • -v .../certs — TLS 证书链
  • -e REDIS_HOST — CC 计数共享后端
  • -e REDIS_PASSWORD — Redis 认证
  • --restart unless-stopped — 网关持续防护

Kubernetes

apiVersion: apps/v1
kind: Deployment
metadata:
  name: uusec-waf
spec:
  replicas: 2
  selector:
    matchLabels:
      app: uusec-waf
  template:
    metadata:
      labels:
        app: uusec-waf
    spec:
      containers:
        - name: waf
          image: docker.io/uusec/waf:2.0.0
          ports:
            - containerPort: 80
            - containerPort: 443
          envFrom:
            - secretRef:
                name: waf-redis
          volumeMounts:
            - name: conf
              mountPath: /opt/waf/conf
            - name: certs
              mountPath: /opt/waf/certs
      volumes:
        - name: conf
          configMap:
            name: waf-conf
        - name: certs
          secret:
            secretName: waf-tls
---
apiVersion: v1
kind: Service
metadata:
  name: uusec-waf
spec:
  type: LoadBalancer
  selector:
    app: uusec-waf
  ports:
    - port: 443
      targetPort: 443

LoadBalancer 或 Ingress 前置；ConfigMap/Secret 管理规则与证书，Redis 独立部署。

Latest tags (20)

View all 14 tags →
TagArchPushed AtSizeDigestSyncWishAction
docker.io/uusec/waf
:latest
linux/amd64
2026/06/08 22:47156.1 MBsha256:fd76b404fe2d…
docker.io/uusec/waf
:7.2.3
linux/amd64
2026/05/30 22:05155.9 MBsha256:3c8a1cb9c169…
docker.io/uusec/waf
:7.2.2
linux/amd64
2026/05/26 23:25155.9 MBsha256:21a5f0fa88d4…
docker.io/uusec/waf
:7.2.1
linux/amd64
2026/05/16 13:57155.9 MBsha256:6b9afb4d1b6d…
docker.io/uusec/waf
:7.2.0
linux/amd64
2026/03/20 20:13161.4 MBsha256:fa92b9cfaba8…
docker.io/uusec/waf
:7.1.2
linux/amd64
2026/03/08 23:52161.4 MBsha256:cf7ffedc08ff…
docker.io/uusec/waf
:7.1.1
linux/amd64
2025/10/15 17:17161.2 MBsha256:e109436fda54…
docker.io/uusec/waf
:7.1.0
linux/amd64
2025/10/14 21:56161.2 MBsha256:d94519215142…
docker.io/uusec/waf
:7.0.6
linux/amd64
2025/09/13 17:09161.2 MBsha256:c1e95d571e16…
docker.io/uusec/waf
:7.0.5
linux/amd64
2025/09/11 08:28161.2 MBsha256:354ff4c4862f…
docker.io/uusec/waf
:7.0.3
linux/amd64
2025/07/19 10:47161.2 MBsha256:84829678aead…
docker.io/uusec/waf
:7.0.2
linux/amd64
2025/07/11 11:17161.2 MBsha256:f3d6ba55acc9…
docker.io/uusec/waf
:7.0.1
linux/amd64
2025/07/07 17:06161.2 MBsha256:4d9b362f2aef…
docker.io/uusec/waf
:7.0.0
linux/amd64
2025/07/05 22:22161.2 MBsha256:842667726753…