BunkerWeb on Ubuntu 24.04 LTS by cloudimg

BunkerWeb is an open source Web Application Firewall and reverse proxy built on top of nginx. It sits in front of your web applications and APIs and inspects incoming traffic, applying a broad set of security defences out of the box: a ModSecurity engine with the OWASP Core Rule Set, automatic HTTPS, bad behaviour and rate limiting, bot and country filtering, and request and header hardening. Everything is driven by sensible secure defaults, so a site is protected the moment it is placed behind BunkerWeb rather than after a long tuning exercise. Because it is a reverse proxy it protects any HTTP backend regardless of language or framework, which makes it a practical way to add a consistent, auditable layer of web security in front of the apps you already run.

Why the cloudimg image

A WAF is only as good as the state it ships in, and a management dashboard exposed on a guessable path with a default login is a liability. cloudimg ships BunkerWeb secure by default. There is no default login in the image: a unique administrator password, a Flask session signing secret and a two factor encryption key are all generated on the first boot of every instance, and the dashboard is served over HTTPS through BunkerWeb itself at a per instance secret path, with the full login URL and credentials written to a root only file. The raw web UI port is bound to localhost only and never exposed, and the container that runs the whole stack is pinned by image digest so every instance runs exactly the reviewed release.

The image is a complete working platform rather than a bare install. BunkerWeb v1.6.13 is deployed as the supported single node All-In-One container - nginx, the scheduler, the web UI, a bundled database and Redis - on a fully patched Ubuntu 24.04 LTS base, with Docker Engine installed as the container runtime. The per-VM credential generation runs as a first boot service that gates the WAF until its secrets exist and then disables itself.

Licensing

BunkerWeb is AGPL-3.0 licensed and free. The cloudimg charge of $0.04 per vCPU hour covers packaging, security patching, image maintenance and 24/7 expert support.

Getting started

Deploy the VM on Standard_B2ms or larger, allow port 22 for SSH and ports 80 and 443 for the WAF and dashboard from your networks, then read the per instance admin password and secret dashboard path from the root only credentials file and sign in. Add the sites you want to protect from the dashboard, pointing each at its upstream application. The full walkthrough is in the deployment guide.