Docker containers running OWASP Coraza WAF with the OWASP Core Rule Set (CRS).

Three web server variants are available:

The containers act as a reverse proxy, inspecting traffic with Coraza WAF and CRS before forwarding to a backend service.

Stable tags include the CRS version and a timestamp: <CRS version>-<variant>-<date>.

Examples:

• 4-caddy-alpine-202509051009
• 4.25-nginx-202509051009
• 4.25.0-apache-202509051009

Rolling tags are updated on every release and always point to the latest build. They should not be used in production.

Examples:

• caddy-alpine
• nginx
• apache

LTS (Long-Term Support) tags point to a designated LTS release and are updated less frequently than stable tags.

The LTS tag format is <CRS version>-<variant>-lts.

Examples:

• 4.25-caddy-alpine-lts
• 4.25.0-nginx-lts
• 4.25-apache-lts

• Coraza CRS Docker
  • Supported Tags
  • Quick Start
  • Env Variables
    • Coraza Specific
    • CRS Specific
    • Web Server Specific
  • Configuration Files/Directories
  • Build Arguments
  • Building
  • Advanced Configuration

Using docker compose:

# Caddy (port 8080)
docker compose --profile caddy up

# nginx (port 8081)
docker compose --profile nginx up

# Apache (port 8082)
docker compose --profile apache up

# All three
docker compose --profile all up

Or run directly:

# nginx (non-root, listens on 8080)
docker run -d -p 8080:8080 -e BACKEND=myapp:8080 ghcr.io/coreruleset/coraza-crs:nginx

# Apache
docker run -d -p 80:80 -e BACKEND=myapp:8080 ghcr.io/coreruleset/coraza-crs:apache

# Caddy
docker run -d -p 8080:8080 -e BACKEND=myapp:8080 ghcr.io/coreruleset/coraza-crs:caddy-alpine

Test that the WAF is working (adjust port to match the variant: 8080 for Caddy, 8081 for nginx, 8082 for Apache):

# Normal request — should return 200
curl http://localhost:8081/

# SQL injection — should return 403
curl "http://localhost:8081/?id=1%20AND%201=1"

These variables apply to all variants (nginx, Apache, Caddy). Not every setting translates perfectly across servers — when a variable doesn't map to something meaningful, it's ignored on that variant.

A self-signed certificate is generated automatically at startup if no certificate is mounted. To use your own certificate, mount it at the SSL_CERT_FILE and SSL_CERT_KEY_FILE paths. Caddy handles TLS automatically via its built-in ACME support.

• Caddy runs as a non-root user by default. The cap_net_bind_service capability is added to allow binding on ports < 1024. Default port is 8080.
• nginx uses nginxinc/nginx-unprivileged (Debian-based, non-root). Apache uses httpd (Debian-based). Both build libcoraza and connector modules from source. Platforms: linux/amd64 and linux/arm64.
• The audit log defaults to /dev/stdout (visible via docker logs).

The following configuration paths are shared across all variants:

We require buildx >= v0.9.1. See official documentation.

# See all build targets
docker buildx bake -f ./docker-bake.hcl --print

# Build all targets
docker buildx create --use --platform linux/amd64,linux/arm64
docker buildx bake -f docker-bake.hcl

# Build a single target
docker buildx bake -f docker-bake.hcl --set "*.platform=linux/amd64" nginx

Add Coraza configuration without overwriting defaults by mounting *.conf files into:

• /opt/coraza/config.d — additional configuration
• /opt/coraza/rules.d — additional rule sets

Download and mount plugins to /opt/coraza/plugins:

curl -sSL https://github.com/coreruleset/wordpress-rule-exclusions-plugin/archive/refs/tags/v1.0.0.tar.gz -o wordpress.tar.gz
tar xvf wordpress.tar.gz --strip-components 1 'wordpress-rule-exclusions-plugin*/plugins'
docker run -v $(pwd)/plugins:/opt/coraza/plugins ghcr.io/coreruleset/coraza-crs:nginx

To use your own web server configuration, mount it at:

• Caddy: /config/caddy/Caddyfile
• nginx: /config/nginx/nginx.conf
• Apache: /config/apache/coraza.conf

To replace the Coraza configuration entirely, mount at /config/coraza/coraza.conf.