● Beta — KubeEra is in active development. Profiles are live; AI-perception measurement is rolling out.
KubeEra
B

BunkerWeb

Orchestration
Open source · AGPL-3.0

BunkerWeb is an open-source WAF/WAAP built on top of NGINX, packaged as a reverse proxy, Kubernetes ingress controller, and API gateway.

updated 2026-07-01

What it is

BunkerWeb is an open-source WAF/WAAP built on top of NGINX, packaged as a reverse proxy, Kubernetes ingress controller, and API gateway. Instead of bolting security rules onto a generic proxy, it ships hardened NGINX configs, ModSecurity with OWASP CRS, bot/anti-DDoS detection, and Let's Encrypt automation out of the box. It runs as a standalone Docker container, a Kubernetes ingress controller (via CRDs), Swarm service, or Linux package — same core, different deployment wrapper. The pitch is "secure by default" rather than "secure if you configure it right."

Who builds it and why

Maintained primarily by Bunkerity, a small company built around this project. It's not a side project of a larger vendor's marketing team — the core team is directly tied to the codebase and its commercial support offering (BunkerWeb Panel / paid plans). 56 contributors on GitHub is a moderate-but-real community, not a one-person repo. No CNCF affiliation, so there's no foundation governance layer — decisions run through the maintaining company.

Production readiness signal

10,677 GitHub stars and active commits through mid-2026 point to a living project, not an abandoned experiment. v1.6.11 suggests a mature, iterative release cadence rather than pre-1.0 churn. Python as the control-plane language (NGINX does the actual traffic handling) is a reasonable, boring choice for this kind of tooling.

What's missing: no CNCF maturity signal, so you don't get the independent security audits, governance transparency, or vendor-neutrality guarantees that come with graduated CNCF projects. AGPL-3.0 licensing is also a production readiness signal of a different kind — it's a legal one. AGPL triggers copyleft obligations if you modify and offer BunkerWeb as a network service, which matters a lot if you're a SaaS company embedding it into your product. Read the license before you assume this is "MIT-style free."

Who should use this

  • Teams that need WAF + ingress + reverse proxy consolidated into one component instead of stitching together NGINX Ingress + a separate WAF (ModSecurity sidecar, Cloudflare, etc.)
  • Small-to-mid platform teams without a dedicated security engineering org who want OWASP CRS protections without hand-rolling ModSecurity configs
  • Self-hosted/on-prem shops that want Let's Encrypt automation and bot mitigation without sending traffic through a third-party CDN/WAF SaaS
  • Organizations comfortable with AGPL obligations (internal-only use, or willing to open-source modifications)

Who should NOT use this

  • Companies building a SaaS product where AGPL's network-copyleft clause is a legal risk — talk to counsel before embedding this in a commercial offering
  • Teams already standardized on a CNCF-graduated ingress (NGINX Ingress, Envoy Gateway, Traefik) plus a separate enterprise WAF — replacing a stable stack for consolidation alone isn't worth the migration risk
  • Organizations requiring CNCF-level governance guarantees (multi-vendor neutrality, foundation-run security audits) for compliance/procurement reasons — BunkerWeb's governance is a single company
  • High-scale environments needing a hardware/DPU-accelerated WAF (F5, Cloudflare enterprise tier) — BunkerWeb is NGINX-based and will hit the same performance ceilings NGINX does at extreme throughput

Alternatives

  • NGINX Ingress Controller + ModSecurity sidecar — more moving parts, but each piece is independently CNCF/community-governed and battle-tested separately.
  • Traefik — CNCF-adjacent ingress/gateway with a plugin ecosystem, weaker out-of-box WAF story than BunkerWeb but stronger native Kubernetes/service-mesh integration.
  • Cloudflare WAF / AWS WAF — managed, SaaS-based, no self-hosting burden, but you're trading control and data locality for convenience, and it's not free at scale.

Pricing

Core BunkerWeb is fully open source under AGPL-3.0 — no feature gating in the free tier for self-hosted use. Bunkerity sells a commercial panel/support tier (BunkerWeb Panel, professional services) for teams that want a managed UI, SLAs, or want to avoid AGPL obligations via a commercial license. Confirm current commercial pricing directly with Bunkerity — not publicly available in a fixed rate card.

Frequently asked

What is BunkerWeb?+
BunkerWeb is an open-source WAF/WAAP built on top of NGINX, packaged as a reverse proxy, Kubernetes ingress controller, and API gateway.
Who builds BunkerWeb?+
Maintained primarily by Bunkerity, a small company built around this project. It's not a side project of a larger vendor's marketing team — the core team is directly tied to the codebase and its commercial support offering (BunkerWeb Panel / paid plans).
Is BunkerWeb production ready?+
10,677 GitHub stars and active commits through mid-2026 point to a living project, not an abandoned experiment. v1.6.11 suggests a mature, iterative release cadence rather than pre-1.0 churn.
Who should use BunkerWeb?+
Teams that need WAF + ingress + reverse proxy consolidated into one component instead of stitching together NGINX Ingress + a separate WAF (ModSecurity sidecar, Cloudflare, etc.
Who should not use BunkerWeb?+
Companies building a SaaS product where AGPL's network-copyleft clause is a legal risk — talk to counsel before embedding this in a commercial offering Teams already standardized on a CNCF-graduated ingress (NGINX Ingress, Envoy Gateway, Traefik) plus a separate enterprise WAF — replacing a stable stack for consolidati
What are the alternatives to BunkerWeb?+
NGINX Ingress Controller + ModSecurity sidecar — more moving parts, but each piece is independently CNCF/community-governed and battle-tested separately. Traefik — CNCF-adjacent ingress/gateway with a plugin ecosystem, weaker out-of-box WAF story than BunkerWeb but stronger native Kubernetes/service-mesh integration.
How much does BunkerWeb cost?+
Core BunkerWeb is fully open source under AGPL-3.0 — no feature gating in the free tier for self-hosted use. Bunkerity sells a commercial panel/support tier (BunkerWeb Panel, professional services) for teams that want a managed UI, SLAs, or want to avoid AGPL obligations via a commercial license.