Choose a lab topology
Decide whether BunkerWeb will sit in front of one test app or a small group of services. Keep the first test narrow.
- Upstream service is reachable.
- Docker networking is understood.
- Expected ports are free.
WAF installation guide
BunkerWeb Docker Evaluation Guide
A BunkerWeb Docker evaluation guide for self-hosted web security, reverse proxy deployment, validation checks, and WAF-like controls.
Guide data
- Difficulty
- Intermediate
- Time
- 45-90 minutes for a lab deployment
- Updated
- 2026-05-30
- Intent
- Users evaluating BunkerWeb as a self-hosted web security and WAF-like stack.
Prerequisites
- A Docker-capable Linux host.
- A test web application or upstream container.
- Control over test hostname routing.
- Basic reverse proxy and container logging knowledge.
Deployment workflow
Use a narrow, reversible rollout.
Deploy from official documentation
Use current official BunkerWeb documentation for compose files and configuration examples. Treat third-party snippets as stale until verified.
- Containers are healthy.
- Logs are visible.
- Admin or management surfaces are not publicly exposed.
Validate security behavior
Test clean traffic first, then review security events and WAF-like controls with safe lab payloads.
- Clean traffic passes.
- Security logs are understandable.
- Rollback route is documented.
Validation checklist
- Confirm upstream app responses through BunkerWeb.
- Review logs for clean and suspicious requests.
- Measure baseline latency impact.
- Document how configuration changes are versioned.
Rollback planning
- Keep original container or reverse proxy route available.
- Save known-good compose and config files.
- Avoid changing DNS and WAF policy in the same step.
Common mistakes
- Treating web server hardening and WAF evaluation as identical.
- Skipping Docker network and port mapping documentation.
- Routing multiple apps before one app is validated.
Related WAF profiles
FAQ
Is this BunkerWeb Docker Evaluation Guide official documentation?
No. WAFWiki is independent. Always verify commands, pricing, and support terms with the linked official documentation before production use.
Should I enable blocking immediately?
No. Start with a lab route or observation mode where possible, collect clean traffic, tune false positives, and document rollback first.