Docker 与 Compose
Run the control plane and the data plane in containers with Docker Compose, on Linux or a Mac: start, first-login credentials, upgrade and uninstall.
您安装的是哪个版本
目前公开的是名为 0.3.0-dev 的开发版。名称保持不变：每次发布都会替换上一次，并用构建编号区分两个构建。尚无稳定版：只有在每个系统和每个软件包都完成端到端测试之后，才会发布稳定版。因此本页的命令从 dev 通道安装。开发版可能存在缺陷：在依赖它之前，请先在测试站点上试用。
At a glance
- One image runs the control plane (console and API) or the data plane, selected with TOUTWAF_ROLE; the compose file starts one of each.
- The files (the deploy folder) come with your ToutWAF distribution: they are not in the public repository, which holds binaries and installers only.
- On the very first start, the toutwaf-cp logs show once the secret console address and the generated username and password: copy them, they are written nowhere else.
- The console is published on 127.0.0.1 only: to reach it remotely, use an SSH tunnel, a VPN or a TLS reverse proxy with an allow-list. Never publish 9443 on a public interface.
The commands, step by step
Mac 或 Linux 上的 Docker Compose
在 Linux 或 Mac（Docker Desktop、OrbStack、Colima）上使用 Docker Compose 和一体化镜像（控制平面与数据平面）。相关文件随您的 ToutWAF 发行包提供（deploy 文件夹；公开仓库里没有它，公开仓库只有程序文件和安装程序）。镜像打包了每种架构的预编译二进制文件（bin/amd64 或 bin/arm64），目前尚未向镜像仓库发布镜像。只在 Linux amd64 上测试过；未在真实 Mac 上测试，在 Docker Desktop 之后看到的客户端 IP 是 Docker 网关地址。一次性凭据只会在控制平面日志中出现一次。
bash
cd deploy/docker
# bin/amd64/{toutwaf-cp,toutwaf-dp,toutwafctl} (Intel Mac, Linux x86-64)
# bin/arm64/{toutwaf-cp,toutwaf-dp,toutwafctl} (Apple Silicon, Linux ARM)
cp .env.example .env
docker compose up -d --build
docker compose logs toutwaf-cp升级（容器）
请先做备份。控制台里的更新按钮在容器中无法工作：请替换 bin 文件夹中的二进制文件（待发布镜像后则替换镜像）并重新构建；数据卷即您的数据会被保留。
bash
docker compose up -d --build卸载
第一段命令移除服务、二进制文件以及 ToutWAF 添加的防火墙规则，并保留您的数据。第二段还会删除配置、数据和日志。
bash
docker compose downpurge
docker compose down -vWhat is not verified
We prefer to say it plainly.
- Tested end to end on Linux x86-64 only. An Intel Mac, an Apple Silicon Mac (linux/arm64) and Windows with Docker Desktop are not tested on real hardware.
- No image is published to a registry: building needs the prebuilt release binaries. Native macOS is not provided.
- The in-console update and the firewall helper do not work in a container: you update by replacing the image. A single control-plane instance, with SQLite.