Base
Hardened build
minimal ports, security patches applied at build time
Wallarm API Firewall
Azure
Security
Wallarm API Firewall, a fast API security proxy that validates every request and every response against your OpenAPI specification and blocks anything that does not conform.
Overview
Wallarm API Firewall is an open source security proxy for REST APIs. You give it the OpenAPI 3.0 specification your API already publishes, and it sits in front of that API validating traffic in both directions: every incoming request is checked against the declared paths, parameters, types and body schemas, and every response the service sends back is checked against the declared response schemas. Anything that does not match the contract is rejected with a configurable status code rather than reaching your service or your client.
This is a positive security model. Instead of maintaining a list of attacks to look for, you allow only the traffic your specification describes, so malformed payloads, wrongly typed parameters and calls to endpoints you never documented are all refused by default. Because it also validates responses, a service that starts returning a field it should not is stopped before that data leaves the perimeter. Undocumented endpoints that answer requests are surfaced as shadow APIs, which is often the first time a team discovers them. It is written in Go, runs as a single process, and is built for near zero added latency in front of production traffic.
Why the cloudimg image
API Firewall has no accounts, no datastore and no interface of its own, so a bare install proves nothing and demonstrates nothing. The cloudimg image ships a complete working deployment instead: the firewall pinned to the official upstream release binary and verified by checksum, a demo upstream API, the real OpenAPI specification that describes it, and a browser console that fires live conforming and non conforming requests through the firewall so you can watch the positive security model work before you point it at your own service. Nothing usable is baked into the image: the console credential is generated uniquely on every first boot and written to a root only file, and the appliance refuses to serve at all until that boot has proved the gate denies an unauthenticated request. The firewall, its health endpoint and the demo upstream are all bound to loopback, so a single hardened reverse proxy is the whole external surface, and every blocked request is written to a structured log with the exact schema rule that rejected it. Every deployment ships fully patched with unattended security updates enabled, a paired deploy guide that walks through swapping in your own specification and upstream, and 24/7 cloudimg support.
Common uses
- Enforce an OpenAPI contract in front of a REST API so only declared traffic reaches it
- Stop malformed responses leaving a service before sensitive data is exposed
- Discover shadow endpoints that answer requests but were never documented
See it running
Real screenshots taken while testing this image against its deployment guide.
More in Security
AliasVault Self-Hosted Password Manager & Aliases
Security
The cloudimg image ships the free and open source, AGPL-3.0 licensed AliasVault, run the officially supported way as the...
Apache Directory Server LDAP - Managed Support
Security
This image runs Apache Directory Server (ApacheDS) 2.0, the Apache Software Foundation's extensible, embeddable director...
Apache SpamAssassin Anti-Spam Filter
Security
This image runs Apache SpamAssassin, the open source, Apache-2.0 licensed anti-spam platform.
Authentik - Self-Hosted Identity Provider and SSO Platform
Security
Authentik is an open source identity provider: single sign-on, multi-factor authentication, user management and access c...
Authgear - Open Source Identity Provider
Security
This image runs Authgear, the open source authentication server and identity provider.
Bl
Beelzebub Low-Code Honeypot Framework
Security
This image runs Beelzebub, the open source low code honeypot and deception framework.