Skip to content

Commit

Permalink
Add zaproxy docker details
Browse files Browse the repository at this point in the history
Signed-off-by: Simon Bennetts <[email protected]>
  • Loading branch information
psiinon committed Apr 30, 2024
1 parent 21df8e1 commit db6ab44
Show file tree
Hide file tree
Showing 4 changed files with 33 additions and 13 deletions.
4 changes: 2 additions & 2 deletions site/content/docs/contribute/social.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,11 @@ links:
desc: follow the official ZAP Twitter account (low volume)

- name: 'Docker: ZAP Stable'
link: https://hub.docker.com/r/softwaresecurityproject/zap-stable/
link: https://hub.docker.com/r/zaproxy/zap-stable/
desc: like the ZAP stable Docker image

- name: 'Docker: ZAP Weekly'
link: https://hub.docker.com/r/softwaresecurityproject/zap-weekly/
link: https://hub.docker.com/r/zaproxy/zap-weekly/
desc: like the ZAP weekly Docker image

- name: 'OpenHub: zaproxy'
Expand Down
24 changes: 14 additions & 10 deletions site/content/docs/docker/about.md
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ changes are included.
```bash
docker pull ghcr.io/zaproxy/zaproxy:stable
docker pull softwaresecurityproject/zap-stable
docker pull zaproxy/zap-stable
```

#### Weekly
Expand All @@ -36,6 +37,7 @@ core and add-ons. It is the same as the [Cross Platform Weekly Release](/downloa
```bash
docker pull ghcr.io/zaproxy/zaproxy:weekly
docker pull softwaresecurityproject/zap-weekly
docker pull zaproxy/zap-weekly
```

#### Nightly
Expand All @@ -46,6 +48,7 @@ core and add-ons.
```bash
docker pull ghcr.io/zaproxy/zaproxy:nightly
docker pull softwaresecurityproject/zap-nightly
docker pull zaproxy/zap-nightly
```

#### Bare
Expand All @@ -56,6 +59,7 @@ It is updated on the same schedule as the stable image.
```bash
docker pull ghcr.io/zaproxy/zaproxy:bare
docker pull softwaresecurityproject/zap-bare
docker pull zaproxy/zap-bare
```
The Dockerfiles can be found [here](https://github.com/zaproxy/zaproxy/tree/main/docker).

Expand All @@ -73,15 +77,15 @@ One can _get_ the CWD using various forms of _printing_ the (current) working di
# ...linux / MacOS / PowerShell
# The $(pwd) command substitution will get the current directory as a variable
# The classic form `pwd` must be used for csh and tsch / is still supported in bash/zsh/etc.
docker run -v $(pwd):/zap/wrk/:rw -t softwaresecurityproject/zap-stable zap.sh ...
docker run -v $(pwd):/zap/wrk/:rw -t zaproxy/zap-stable zap.sh ...

# ...linux / MacOS / PowerShell
# The ${PWD} _environment variable_ is your current directory
docker run -v ${PWD}:/zap/wrk/:rw -t softwaresecurityproject/zap-stable zap.sh ...
docker run -v ${PWD}:/zap/wrk/:rw -t zaproxy/zap-stable zap.sh ...

# ...windows CMD
# The %cd% Windows CMD environment variable is your current directory
docker run -v %cd%:/zap/wrk/:rw -t softwaresecurityproject/zap-stable zap.sh ...
docker run -v %cd%:/zap/wrk/:rw -t zaproxy/zap-stable zap.sh ...
```

The examples use `$(pwd)` [command substitution](https://en.wikipedia.org/wiki/Command_substitution), which runs the `pwd` command, substituting the _result_.
Expand Down Expand Up @@ -130,7 +134,7 @@ for people who want more control over ZAP. The packaged scans will not be remove
You can run the Automation Framework in docker using the zap.yaml file in the current directory using:

```bash
docker run -v $(pwd):/zap/wrk/:rw -t softwaresecurityproject/zap-stable zap.sh -cmd -autorun /zap/wrk/zap.yaml
docker run -v $(pwd):/zap/wrk/:rw -t zaproxy/zap-stable zap.sh -cmd -autorun /zap/wrk/zap.yaml
```

Note that `$(pwd)` is supported on Linux, MacOS and PowerShell.
Expand All @@ -141,13 +145,13 @@ Remaining examples use the Linux approach.
If you want to make sure that ZAP is up to date before running the yaml file then the recommended approach is:

```bash
docker run -v $(pwd):/zap/wrk/:rw -t softwaresecurityproject/zap-stable bash -c "zap.sh -cmd -addonupdate; zap.sh -cmd -autorun /zap/wrk/zap.yaml"
docker run -v $(pwd):/zap/wrk/:rw -t zaproxy/zap-stable bash -c "zap.sh -cmd -addonupdate; zap.sh -cmd -autorun /zap/wrk/zap.yaml"
```

The latest version of the Automation Framework will set the ZAP exit value based on the result of the plan, in order to have access to this you need to use a command like:

```bash
docker container run -v $(pwd):/zap/wrk/:rw -t softwaresecurityproject/zap-weekly zap.sh -cmd -autorun /zap/wrk/zap.yaml
docker container run -v $(pwd):/zap/wrk/:rw -t zaproxy/zap-weekly zap.sh -cmd -autorun /zap/wrk/zap.yaml
```

### ZAP GUI in a Browser
Expand All @@ -157,15 +161,15 @@ See the [Webswing](../webswing/) page for details.
### ZAP Headless
You can also start the ZAP in headless mode with following command:
```bash
docker run -u zap -p 8080:8080 -i softwaresecurityproject/zap-stable zap.sh -daemon -host 0.0.0.0 -port 8080 -config api.addrs.addr.name=.* -config api.addrs.addr.regex=true -config api.key=<api-key>
docker run -u zap -p 8080:8080 -i zaproxy/zap-stable zap.sh -daemon -host 0.0.0.0 -port 8080 -config api.addrs.addr.name=.* -config api.addrs.addr.regex=true -config api.key=<api-key>
```
<sub>**Note**: `-config api.addrs.addr.name=.*` opens the API up for connections from any other host, it is prudent to configure this more specifically for your network/setup.</sub>

### ZAP Headless with xvfb
You can start the ZAP in headless mode with xvfb following command:

```bash
docker run -u zap -p 8080:8080 -i softwaresecurityproject/zap-stable zap-x.sh -daemon -host 0.0.0.0 -port 8080 -config api.addrs.addr.name=.* -config api.addrs.addr.regex=true
docker run -u zap -p 8080:8080 -i zaproxy/zap-stable zap-x.sh -daemon -host 0.0.0.0 -port 8080 -config api.addrs.addr.name=.* -config api.addrs.addr.regex=true
```
<sub>**Note**: `-config api.addrs.addr.name=.*` opens the API up for connections from any other host, it is prudent to configure this more specifically for your network/setup.</sub>

Expand All @@ -179,7 +183,7 @@ Docker appears to assign 'random' IP addresses, so an approach that appears to w
Run ZAP as a daemon listening on "0.0.0.0":

```bash
docker run -p 8090:8090 -i softwaresecurityproject/zap-stable zap.sh -daemon -port 8090 -host 0.0.0.0
docker run -p 8090:8090 -i zaproxy/zap-stable zap.sh -daemon -port 8090 -host 0.0.0.0
```
Find out the container id:
```bash
Expand All @@ -205,7 +209,7 @@ $(ip -f inet -o addr show docker0 | awk '{print $4}' | cut -d '/' -f 1)
```
For example:
```bash
docker run -t softwaresecurityproject/zap-weekly zap-baseline.py -t http://$(ip -f inet -o addr show docker0 | awk '{print $4}' | cut -d '/' -f 1):10080
docker run -t zaproxy/zap-weekly zap-baseline.py -t http://$(ip -f inet -o addr show docker0 | awk '{print $4}' | cut -d '/' -f 1):10080
```

### Scanning an app running in another Docker container
Expand Down
16 changes: 16 additions & 0 deletions site/data/download/d_docker.yml
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,10 @@ table:
id: docker-ssp-stable
cmd: docker pull softwaresecurityproject/zap-stable
link: https://hub.docker.com/r/softwaresecurityproject/zap-stable
zaproxy:
id: docker-zaproxy-stable
cmd: docker pull zaproxy/zap-stable
link: https://hub.docker.com/r/zaproxy/zap-stable
- name: Bare
notes: Minimal release, ideal for CI
ghcr:
Expand All @@ -20,6 +24,10 @@ table:
id: docker-ssp-bare
cmd: docker pull softwaresecurityproject/zap-bare
link: https://hub.docker.com/r/softwaresecurityproject/zap-bare
zaproxy:
id: docker-zaproxy-bare
cmd: docker pull zaproxy/zap-bare
link: https://hub.docker.com/r/zaproxy/zap-bare
- name: Weekly
notes: Updated every week
ghcr:
Expand All @@ -30,6 +38,10 @@ table:
id: docker-ssp-weekly
cmd: docker pull softwaresecurityproject/zap-weekly
link: https://hub.docker.com/r/softwaresecurityproject/zap-weekly
zaproxy:
id: docker-zaproxy-weekly
cmd: docker pull zaproxy/zap-weekly
link: https://hub.docker.com/r/zaproxy/zap-weekly
- name: Nightly
notes: The very latest source code
ghcr:
Expand All @@ -40,5 +52,9 @@ table:
id: docker-ssp-nightly
cmd: docker pull softwaresecurityproject/zap-nightly
link: https://hub.docker.com/r/softwaresecurityproject/zap-nightly
zaproxy:
id: docker-zaproxy-nightly
cmd: docker pull zaproxy/zap-nightly
link: https://hub.docker.com/r/zaproxy/zap-nightly
info:
- See [Docker](/docs/docker/) for more information.
2 changes: 1 addition & 1 deletion site/layouts/page/download.html
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,7 @@ <h3 id="docker">{{ .title }}</h3>
<tr>
<td>{{ .name }}</td>
<td>{{ .notes }}</td>
<td><code>{{ .ghcr.cmd }}</code><br><code>{{ .ssp.cmd }}</code></td>
<td><code>{{ .ghcr.cmd }}</code><br><code>{{ .ssp.cmd }}</code><br><code>{{ .zaproxy.cmd }}</code></td>
<td>
<a track-event="download.core.{{ .ghcr.id }}" href="{{ .ghcr.link }}" class="button button--orange">GHCR Page</a>
<a track-event="download.core.{{ .ssp.id }}" href="{{ .ssp.link }}" class="button button--orange">Docker Hub Page</a>
Expand Down

0 comments on commit db6ab44

Please sign in to comment.