## Overview

CloudGuard WAF can be deployed using Docker Images in one of two main configurations:

- **Single Docker** \- a single docker image containing a managed reverse proxy server and the CloudGuard WAF Security agent.

- **Dual Dockers** \- **NGINX Reverse Proxy** **Docker** or **Kong API Gateway Docker** \+ **CloudGuard WAF Security Agent Docker**

The following table compares the two options:

| Feature                      | Single Docker                                                     | Dual Docker                                   |
|------------------------------|-----------------------------------------------------------------|-----------------------------------------------|
| CloudGuard WAF               | Full                                                            | Full                                          |
| NGINX                        | Managed Centrally via WebUI/API or Locally                      | Managed Locally                              |
| Kong                         | Not Available                                                   | Managed Locally                              |
| Upgrade                      | Standard                                                       | Each Docker can be upgraded separately        |
| Docker Compose protecting a specific Application | Supported                                      | Not Supported                                |
| Run in PaaS platforms such as Azure App Services | Supported                                  | Not Supported                                |

## Deployment Instructions

[Single Docker](https://waf-doc.inext.checkpoint.com/getting-started/deploy-enforcement-point/docker/single-docker) [Dual Docker: NGINX / Kong / Envoy + Security Agent](https://waf-doc.inext.checkpoint.com/getting-started/deploy-enforcement-point/docker/dual-docker-nginx-kong-envoy-+-security-agent)

[PreviousEnvoy Application Security (Injector)](https://waf-doc.inext.checkpoint.com/getting-started/deploy-enforcement-point/kubernetes/envoy-application-security-injector) [NextSingle Docker](https://waf-doc.inext.checkpoint.com/getting-started/deploy-enforcement-point/docker/single-docker)

Last updated 1 year ago