github bunkerity/bunkerweb v1.6.17
on GitHub

5 hours ago

Documentation : https://docs.bunkerweb.io/1.6.17/

Docker tags :

  • All-in-one : bunkerity/bunkerweb-all-in-one:1.6.17 or ghcr.io/bunkerity/bunkerweb-all-in-one:1.6.17
  • BunkerWeb : bunkerity/bunkerweb:1.6.17 or ghcr.io/bunkerity/bunkerweb:1.6.17
  • Scheduler : bunkerity/bunkerweb-scheduler:1.6.17 or ghcr.io/bunkerity/bunkerweb-scheduler:1.6.17
  • Autoconf : bunkerity/bunkerweb-autoconf:1.6.17 or ghcr.io/bunkerity/bunkerweb-autoconf:1.6.17
  • UI : bunkerity/bunkerweb-ui:1.6.17 or ghcr.io/bunkerity/bunkerweb-ui:1.6.17
  • API : bunkerity/bunkerweb-api:1.6.17 or ghcr.io/bunkerity/bunkerweb-api:1.6.17
    GitLab mirror : registry.gitlab.com/bunkerity/bunkerweb/<image>:1.6.17 (same digests)

Linux packages : https://packagecloud.io/app/bunkerity/bunkerweb/search?q=1.6.17&filter=all&dist=

Changelog :

FEATURES

  • [FEATURE] db: DATABASE_CONNECT_TIMEOUT (default 10s) and DATABASE_READ_TIMEOUT (default 5m) bound MySQL and MariaDB calls, and PostgreSQL gets the connect timeout and TCP keepalives but no query deadline, so a database that vanishes without a reset no longer blocks the scheduler, UI or API forever.
  • [FEATURE] headers: the default PERMISSIONS_POLICY also denies unbounded-element.

WEB UI

  • [UI] Web UI: clarify applying changed global settings to all services and confirm service overrides before saving.

BUG FIXES

Security, Access Control & Protection

  • [BUGFIX] bans: the ban check at the TLS ClientHello uses the same address as nginx for IPv4-mapped IPv6 clients and for IPv6 addresses ending in an IPv4 tail.
  • [BUGFIX] core: a URI rewrite in a custom config no longer skips the access checks (bans, lists, rate limit, antibot, authentication, ModSecurity). With ENABLE_INTERNAL=false, CrowdSec still checks rewritten requests.
  • [BUGFIX] core: the whitelist, blacklist, greylist and antibot checks skip the reverse DNS lookup when no rDNS entry is configured. (Fixes #4057)
  • [BUGFIX] modsecurity: multipart strict-validation and filename* denials (HTTP 400) are reported, and the matched request data stored per report is bounded. (Fixes #4012)
  • [BUGFIX] badbehavior: a ban keeps only its newest events as evidence, at most BAD_BEHAVIOR_REPORT_MAX_EVENTS (default 100, never more than the threshold), with URLs and methods cut at BAD_BEHAVIOR_REPORT_MAX_STRING_SIZE (default 512 bytes), so the report written for every request rejected during the ban no longer fills Redis. The Reports page shows the real request count.

Configuration, Reloads & Database

  • [BUGFIX] all-in-one: a reload signal (docker kill -s HUP) waits for a configuration install in progress before it restarts the services, instead of starting them on a half-written configuration.
  • [BUGFIX] core: on the all-in-one image and on Linux, the generator renders aside and installs under a lock, and a reload or a configuration push waits for it and for any reload in flight, so a reload no longer loads a half-written /etc/nginx and leaves BunkerWeb without its settings until a restart. An orphaned reload marker is cleared once its monotonic stamp shows it is more than five minutes old; a marker whose age cannot be established keeps blocking until a restart.
  • [BUGFIX] core: a configuration generation in which any template fails to render is refused and the running configuration is kept, in every integration; fix or remove the failing template to apply changes again.
  • [BUGFIX] core: a reload whose initialization fails (settings that cannot be loaded, a plugin that fails to load) is rejected and the running configuration is kept, and later reloads are not blocked.
  • [BUGFIX] core: a reload with an unreadable or invalid plugin.json is rejected before anything changes, so the running configuration keeps its protections, and the error names the file instead of attempt to concatenate a nil value. Directories without a plugin.json are still skipped.
  • [BUGFIX] core: an interrupted configuration install (container kill, out of memory) is no longer kept on restart with KEEP_CONFIG_ON_RESTART=yes: the next start renders the temporary configuration instead of serving a mix of two generations. This covers the generator and the configuration push to an instance.
  • [BUGFIX] core: the bunkerweb container exits with an error when its first configuration cannot be generated, instead of starting nginx without one.
  • [BUGFIX] scheduler: a configuration that fails to generate is no longer reported as applied: the previous configuration keeps serving, the failure is shown, and the generation is retried after 30 s, 1 m, 2 m, then every 5 minutes.
  • [BUGFIX] backup: the pre-upgrade backup no longer fails on leftover test_* write-check tables, and a slow but successful dump is no longer reported as a timeout.
  • [BUGFIX] db: SQLAlchemy loggers follow DATABASE_LOG_LEVEL again, so the scheduler, API and UI no longer flood their logs with lazy-loading clauses at INFO.
  • [BUGFIX] misc: the default server certificate and key are saved to the database together, and an instance starting with a missing or mismatched pair replaces it with a temporary one until the scheduler pushes the real pair, instead of crash-looping. (Refs #4031)

Kubernetes & Autoconf

  • [BUGFIX] autoconf: quiet Kubernetes watches reconnect without restarting the controller, while repeated short closures still fail health checks. (Fixes #4064)
  • [BUGFIX] autoconf: Kubernetes API calls time out and use TCP keepalives, and a controller stalled on its internal lock marks itself unhealthy, so a configured liveness probe restarts it instead of leaving it frozen on a dead API connection.
  • [BUGFIX] autoconf: in Gateway API mode, the status of the GatewayClass, Gateways and routes that BunkerWeb owns is written (Accepted, Programmed, listeners, route parents), so kubectl wait and Argo CD health checks complete. This needs get, list and watch on gatewayclasses and patch on the status of the Gateway API kinds; resources of other controllers are left alone. (Fixes #4058)

Redis, Metrics & Cache

  • [BUGFIX] core: the local cache's IPC events expire after 5 minutes, and a worker that falls behind skips the events evicted from a full CACHESTORE_IPC_MEMORY_SIZE zone instead of waiting 0.3 s on each one (could not poll ipc events: timeout), then clears its local cache so it never serves a value whose invalidation it missed.
  • [BUGFIX] metrics: a retried report push scans only the newest reports, so a large Redis list no longer pins Redis at 100% CPU.

Web UI & User Experience

  • [BUGFIX] ui: a before_request plugin hook that raises, or whose plugin hooks fail to load, answers 500 on every page instead of serving the request without its check. Static files stay served.
  • [BUGFIX] ui: the bulk delete and convert of configs works for file-managed configs whose names contain a dot.
  • [BUGFIX] ui: the Reports and Bans filters match values containing &, <, >, quotes, , or ;. (Refs #4013)
  • [BUGFIX] ui: DataTables sort buttons are named after the header text, not its HTML.
  • [BUGFIX] ui: the jobs page finishes loading again, its filter panes broke when the reload and async columns became sortable by value.

DOCUMENTATION

  • [DOCS] Pin llms.txt and llms-full.txt links to their docs version, publish per-plugin settings JSON and register read-only WebMCP tools on docs pages.
  • [DOCS] kubernetes: the quickstart reads the LoadBalancer address from the mybw-bunkerweb-external Service.
  • [DOCS] realip: with REAL_IP_RECURSIVE, the rightmost address not in the trusted list is the client, and the PROXY protocol example sets REAL_IP_HEADER=proxy_protocol.

DEPENDENCIES

MISCELLANEOUS

  • [MISC] templates: the low template sets CROSS_ORIGIN_EMBEDDER_POLICY to unsafe-none.
Check out latest releases or
releases around bunkerity/bunkerweb v1.6.17

Don't miss a new bunkerweb release

NewReleases is sending notifications on new releases.

Get notifications