Skip to content

Commit

Permalink
Update security.md
Browse files Browse the repository at this point in the history
Fixing a broken link to WAFv5 docs.
Making the incompatible link more specific to v4 to avoid confusion.

Signed-off-by: nginx-aoife <[email protected]>
  • Loading branch information
nginx-aoife authored Dec 17, 2024
1 parent 6103b0a commit dd68097
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion site/content/configuration/security.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ By default, the ServiceAccount has access to all Secret resources in the cluster
### Configure root filesystem as read-only

{{< caution >}}
This feature is compatible with [NGINX App Protect WAFv5](https://docs.nginx.com/nginx-app-protect-waf-v5/). It is not compatible with [NGINX App Protect WAF](https://docs.nginx.com/nginx-app-protect-waf/) or [NGINX App Protect DoS](https://docs.nginx.com/nginx-app-protect-dos/).
This feature is compatible with [NGINX App Protect WAFv5](https://docs.nginx.com/nginx-app-protect-waf/v5/). It is not compatible with [NGINX App Protect WAFv4](https://docs.nginx.com/nginx-app-protect-waf/v4/) or [NGINX App Protect DoS](https://docs.nginx.com/nginx-app-protect-dos/).
{{< /caution >}}

NGINX Ingress Controller is designed to be resilient against attacks in various ways, such as running the service as non-root to avoid changes to files. We recommend setting filesystems on all containers to read-only, this includes `nginx-ingress-controller`, though also includes `waf-enforcer` and `waf-config-mgr` when NGINX App Protect WAFv5 is in use. This is so that the attack surface is further reduced by limiting changes to binaries and libraries.
Expand Down

0 comments on commit dd68097

Please sign in to comment.