Image: mikirisec/mikiri-waf-scanner. Volume: /mikiri-waf-scanner. The image does not publish a port.
The process is recheck.pyc from the image. It rechecks attacks and runs the scheduled scan through main.pyc. Settings are loaded from API. Deploy the API Docker container first.
mkdir -p /opt/mikiri-waf/mikiri-waf-scanner
touch /opt/mikiri-waf/mikiri-waf-scanner/first-launch
docker run -d --name mikiri-waf-scanner --network mikiri-waf \
-v /opt/mikiri-waf/mikiri-waf-scanner:/mikiri-waf-scanner \
mikirisec/mikiri-waf-scanner:latest
The first start copies scanner.conf into the volume, deletes first-launch the container exits. Do not add a restart policy to this first start.
/opt/mikiri-waf/mikiri-waf-scanner/scanner.conf:waf_api_url = http://mikiri-waf-api:8080
The same parameter on a package installation is described in integration with API.
docker start mikiri-waf-scanner
docker update --restart unless-stopped mikiri-waf-scanner
Logs are written to /opt/mikiri-waf/mikiri-waf-scanner/log/mikiri-waf/. The files scanner.pid and recheck.pid in tmp/ are removed on every start. The classic scan schedule is kept in memory and is not stored in the volume.
| In the volume | In the container | Contents |
|---|---|---|
scanner.conf |
/etc/mikiri-waf-scanner/scanner.conf |
Main configuration |
db/ |
/etc/mikiri-waf-scanner/db/ |
Scanner settings cached from the API |
tmp/ |
/etc/mikiri-waf-scanner/tmp/ |
Process identifiers scanner.pid and recheck.pid |
log/mikiri-waf/ |
/var/log/mikiri-waf/ |
Scanner logs |
version |
— | Package version recorded from the image |
docker pull mikirisec/mikiri-waf-scanner:latest
docker stop mikiri-waf-scanner
docker rm mikiri-waf-scanner
docker run -d --name mikiri-waf-scanner --network mikiri-waf --restart unless-stopped \
-v /opt/mikiri-waf/mikiri-waf-scanner:/mikiri-waf-scanner \
mikirisec/mikiri-waf-scanner:latest
Do not create first-launch again. If the package version changed, the previous volume contents are copied to old/. The working files stay in place.