Image: mikirisec/mikiri-waf-captcha. Volume: /mikiri-waf-captcha. Port inside the Docker network: 8080.
The image runs Memcached and Gunicorn from mikiri-waf-captcha. Challenge sessions stay in Memcached inside the container. Deploy the Filter Docker container on the same Docker network. The exchange is described in Integrating with CAPTCHA.
mkdir -p /opt/mikiri-waf/mikiri-waf-captcha
touch /opt/mikiri-waf/mikiri-waf-captcha/first-launch
docker run -d --name mikiri-waf-captcha --network mikiri-waf \
-v /opt/mikiri-waf/mikiri-waf-captcha:/mikiri-waf-captcha \
mikirisec/mikiri-waf-captcha:latest
The first start copies init.py into the volume, changes bind from 127.0.0.1:8080 to 0.0.0.0:8080 the container exits. Do not add a restart policy to this first start. Do not publish port 8080 when API or WMC already use it on the host. Filter reaches this container as mikiri-waf-captcha:8080.
docker start mikiri-waf-captcha
docker update --restart unless-stopped mikiri-waf-captcha
This start runs Memcached and mikiri-waf-captcha.
waf_ban_captcha_url to http://mikiri-waf-captcha:8080. The other options are described in Connecting the filter.Logs are in log/mikiri-waf/captcha/.
| In the volume | In the container | Contents |
|---|---|---|
init.py |
/var/www/mikiri-waf-captcha/init.py |
Listen address and worker count |
log/mikiri-waf/ |
/var/log/mikiri-waf/ |
api.log and error.log |
version |
— | Git revision built into the image |
The Python virtual environment and the application code stay in the image. Memcached data is not stored: a challenge lives for 60 seconds.
docker pull mikirisec/mikiri-waf-captcha:latest
docker stop mikiri-waf-captcha
docker rm mikiri-waf-captcha
docker run -d --name mikiri-waf-captcha --network mikiri-waf --restart unless-stopped \
-v /opt/mikiri-waf/mikiri-waf-captcha:/mikiri-waf-captcha \
mikirisec/mikiri-waf-captcha:latest
Do not create first-launch again. If the git revision changed, the previous volume contents are copied to old/. The working files stay in place.