WUD Container Update Monitor 9.6.0

Option A: AWS Marketplace console

• Open the SecureAnyCloud Hardened Uptime Kuma, Gatus & Uptime and Status Pages AMIs listing on AWS Marketplace. Choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• When the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace (or Launch from EC2 Console for the full launch wizard). In Version, choose WUD Container Update Monitor 9.6.0 on Ubuntu 24.04, then choose your Region.
• Pick an instance type (m5.large recommended; the software charge is $0.04 per vCPU per hour) and your key pair.
• In the security group, allow SSH (22), HTTP (80) and HTTPS (443). Restrict SSH to your own IP address and ports 80 and 443 to the people who use WUD, because whoever signs in sees this host's containers.
• Choose your VPC and a subnet that gives the instance a public IP. Leave the metadata defaults (the image already requires IMDSv2), then choose Launch.

Option B: AWS CLI

Run these commands on your own workstation. They create a security group that allows SSH and HTTPS from your management address only, then launch the instance. Replace the AMI ID with the one shown for your Region on the Marketplace launch page, and replace the VPC, subnet, key pair and CIDR with your own:

SG=$(aws ec2 create-security-group --group-name wud \
  --description "WUD Container Update Monitor" --vpc-id vpc-0123456789abcdef0 \
  --query GroupId --output text) for p in 22 80 443; do aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port "$p" --cidr <your-mgmt-cidr> done aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids "$SG" \
  --subnet-id subnet-0123456789abcdef0 \
  --associate-public-ip-address \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=wud}]'

You do not need --metadata-options, because the AMI already makes IMDSv2 required.

Connect as ubuntu with the key pair that you chose:

ssh -i ~/.ssh/my-key-pair.pem ubuntu@<public-ip>

First boot finishes within a minute or two of launch. It creates the certificate, the session key and the administrator, starts Docker Engine and the demonstration, and then lets nginx start. Read your credentials from a root-only file:

sudo cat /root/wud-credentials.txt

# WUD Container Update Monitor - generated on first boot by wud-firstboot.service
# These credentials are unique to this instance. Store them somewhere safe.
#
# "Docker" is a trademark of Docker, Inc. sac is not affiliated with, endorsed by, or sponsored by Docker, Inc. WUD_URL=https://ec2-34-239-126-168.compute-1.amazonaws.com/ wud.admin.user=wudadmin wud.admin.pass=<WUD_ADMIN_PASSWORD>
# Open WUD_URL in a browser (self-signed certificate minted on this instance's first boot; port 80 redirects to # https) and sign in with the user and password above. Every page and API call needs them. # ANYONE WHO CAN SIGN IN SEES THIS HOST'S CONTAINER INVENTORY, and WUD reads the container engine as a member of
# the docker group: treat this login as privileged and restrict inbound 443 in your security group.
# Serve it under your own DNS name:
sudo wud-set-hostname <your-dns-name>
# Full deployment guide: https://secureanycloud.com/stacks/wud-container-update-monitor-9-6-0/

wud.admin.pass holds your instance's own password.

Check that the first-boot unit, Docker Engine, the two demonstration services, WUD and nginx are active, that WUD runs as the unprivileged wud user, and that WUD reports healthy on its loopback port:

systemctl is-active wud-firstboot.service docker.service sac-wud-registry.service sac-wud-sink.service wud.service nginx.service ps -o user=,args= -p "$(systemctl show -p MainPID --value wud.service)"
H=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:3000/health); echo "WUD health (loopback): $H" [ "$H" = 200 ] && [ "$(systemctl is-active wud.service nginx.service docker.service | sort -u)" = active ]

active active active active active active wud /opt/node/bin/node /opt/wud/dist/index.js WUD health (loopback): 200

List the TCP ports that the instance listens on:

sudo ss -Hltn | awk '{print $4}' | sort -u

0.0.0.0:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:3000 127.0.0.1:3001 127.0.0.1:5000 127.0.0.1:8081 127.0.0.53%lo:53 127.0.0.54:53 [::]:22 [::]:443 [::]:80

WUD (3000), the demonstration webhook receiver (3001), the demonstration registry (5000) and the demonstration container (8081) listen on loopback only. nginx publishes WUD on port 443. The loopback port 53 entries are Ubuntu's local stub resolver (systemd-resolved). Docker Engine has no TCP port at all.

Show the versions, the six updated dependencies and the build record:

jq -r '"WUD " + .version' /opt/wud/package.json /opt/node/bin/node --version sudo docker version --format 'Docker Engine {{.Server.Version}}' for p in body-parser nodemailer multer undici fast-uri ip-address; do jq -r '" \(.name) \(.version)"' "/opt/wud/node_modules/$p/package.json"; done grep -E '^(source|runtime) ' /usr/share/doc/wud/BUILD-INFO.txt | cut -c1-110 jq -c '.metadata.vulnerabilities' /usr/share/doc/wud/npm-audit-app-prod.json

WUD 9.6.0 v24.22.1 Docker Engine 29.9.2 body-parser 1.20.9 nodemailer 10.2.1 multer 2.5.0 undici 8.12.3 fast-uri 3.1.9 ip-address 10.7.5 source https://github.com/getwud/wud.git tag 9.6.0 = commit ae3c0827c020e62ba15b8df6edd5b04aa05e9e62 runtime Node.js v24.22.1 (https://nodejs.org/dist/v24.22.1/node-v24.22.1-linux-x64.tar.xz, sha256 6c17 {"info":0,"low":0,"moderate":0,"high":0,"critical":0,"total":0}

Browse to the WUD_URL from Step 2, for example https://ec2-34-239-126-168.compute-1.amazonaws.com/. The certificate is self-signed, so your browser warns once. Accept the warning, or install your own certificate (Step 7). Your browser then asks for a user name and password: enter wudadmin and the wud.admin.pass value.

The Containers page lists what WUD watches. On a new instance, that is the demonstration container, already flagged with an update from 1.0.0 to 1.2.0:

You can confirm the sign-in rules from the command line. Port 80 only redirects to HTTPS. A request without credentials, or with a wrong password, is refused with 401. Your credentials are accepted, and the only WUD user is your administrator. The block reads your password from the credentials file into a temporary file that curl reads, so the password never appears on a command line. It stops with an error if any answer is not the expected one:

H=$(sudo sed -n 's/^set $wud_host "\(.*\)";$/\1/p' /etc/nginx/wud-host.conf) R=(--cacert /etc/ssl/wud/wud.crt --resolve "$H:443:127.0.0.1" --resolve "$H:80:127.0.0.1")
K=$(mktemp);
sudo awk -F= '/^wud.admin.user=/{u=$2} /^wud.admin.pass=/{p=$2} END{printf "user = \"%s:%s\"\n", u, p}' /root/wud-credentials.txt > "$K"
P80=$(curl -s "${R[@]}" -o /dev/null -w '%{http_code} %{redirect_url}' "http://$H/")
ANON=$(curl -s "${R[@]}" -o /dev/null -w '%{http_code}' "https://$H/api/containers")
WRONG=$(curl -s "${R[@]}" -u "wudadmin:not-the-password" -o /dev/null -w '%{http_code}' "https://$H/api/containers")
OK=$(curl -s "${R[@]}" -K "$K" -o /dev/null -w '%{http_code}' "https://$H/api/containers")
USERS=$(curl -s "${R[@]}" -K "$K" "https://$H/api/users" | jq -r '.[] | "\(.username) (\(.role))"'); rm -f "$K" echo "port 80 : $P80"; echo "no credentials : $ANON"; echo "wrong password : $WRONG" echo "your credentials : $OK"; echo "WUD users : $USERS" [ "$P80" = "301 https://$H/" ] && [ "$ANON" = 401 ] && [ "$WRONG" = 401 ] && [ "$OK" = 200 ] && [ "$USERS" = "wudadmin (admin)" ]

port 80 : 301 https://ec2-34-239-126-168.compute-1.amazonaws.com/ no credentials : 401 wrong password : 401 your credentials : 200 WUD users : wudadmin (admin)

Scripts and monitoring tools can use the same credentials with HTTP Basic authentication, or a WUD API token that you create under your profile in the web interface.

Inspect the demonstration container. It runs version 1.0.0 of the SecureAnyCloud demonstration image from the local registry, which also holds 1.1.0 and 1.2.0:

sudo docker ps --format '{{.Names}} {{.Image}} {{.Status}}' curl -s http://127.0.0.1:5000/v2/sac/demo-app/tags/list; echo

sac-demo-app 127.0.0.1:5000/sac/demo-app:1.0.0 Up 2 minutes {"name":"sac/demo-app","tags":["1.0.0","1.1.0","1.2.0"]}

WUD checks the registry for every container, reports the newest version and sends a notification through its trigger. On this image, the trigger posts to the local webhook receiver, which writes each delivery to /var/log/sac/sac-wud/trigger.log:

H=$(sudo sed -n 's/^set $wud_host "\(.*\)";$/\1/p' /etc/nginx/wud-host.conf) R=(--cacert /etc/ssl/wud/wud.crt --resolve "$H:443:127.0.0.1")
K=$(mktemp);
sudo awk -F= '/^wud.admin.user=/{u=$2} /^wud.admin.pass=/{p=$2} END{printf "user = \"%s:%s\"\n", u, p}' /root/wud-credentials.txt > "$K"
C=$(curl -s "${R[@]}" -K "$K" "https://$H/api/containers" | jq -r '.[] | "\(.name): running \(.image.tag.value), newest \(.result.tag), updateAvailable=\(.updateAvailable)"'); rm -f "$K" echo "$C"
N=$(sudo grep -c '"updateAvailable":true' /var/log/sac/sac-wud/trigger.log); echo "notifications delivered to the demo webhook sink: $N" [ "$C" = "sac-demo-app: running 1.0.0, newest 1.2.0, updateAvailable=true" ] && [ "$N" -ge 1 ]

sac-demo-app: running 1.0.0, newest 1.2.0, updateAvailable=true notifications delivered to the demo webhook sink: 1

WUD checks every hour (WUD_WATCHER_LOCAL_CRON in /etc/wud/wud.env). To check immediately, choose Watch now on the Containers page.

WUD watches every container on this instance's Docker Engine by default (WUD_WATCHER_LOCAL_WATCHBYDEFAULT=true). Run your containers as usual, and they appear in WUD at the next check. Labels on a container tune what WUD compares. For example, these labels make WUD consider only semantic version tags and show a friendly name:

sudo docker run -d --name web \
  --label 'wud.tag.include=^\d+\.\d+\.\d+$' \
  --label 'wud.display.name=Company website' \
  nginx:1.27.0

Public images on Docker Hub, GitHub Container Registry, Amazon ECR Public, Quay and the other providers listed on the Registries page are checked anonymously out of the box:

For private registries, or to raise Docker Hub's anonymous rate limit, add credentials to /etc/wud/wud.env, then restart WUD. Every local user can read that file, so keep secrets in a root-only file instead (see Maintenance). This example configures a private GitHub Container Registry:

WUD_REGISTRY_GHCR_PRIVATE_USERNAME=my-github-user WUD_REGISTRY_GHCR_PRIVATE_TOKEN=<your-token>

Notifications are triggers. The image has one trigger, the demonstration webhook:

Add your own triggers in the same way, for example email or Slack:

WUD_TRIGGER_SMTP_MAIL_HOST=smtp.example.com WUD_TRIGGER_SMTP_MAIL_PORT=465 WUD_TRIGGER_SMTP_MAIL_FROM=wud@example.com WUD_TRIGGER_SMTP_MAIL_TO=ops@example.com WUD_TRIGGER_SLACK_OPS_TOKEN=<your-token> WUD_TRIGGER_SLACK_OPS_CHANNEL=#containers

WUD can also update containers for you (the docker and dockercompose triggers) or run a command. These triggers are powerful and are deliberately not configured, so read WUD's documentation before you enable one. The Watchers page shows the one watcher, local, reading this instance's Docker Engine:

To watch Docker Engines on other hosts, add a watcher for each in /etc/wud/wud.env. WUD connects to a remote engine over TLS-protected TCP, and you must never expose a Docker API without TLS.

Removing the demonstration. When you watch your own containers, remove the demonstration container, its image, the two demonstration services and their settings:

sudo docker rm -f sac-demo-app
sudo docker rmi 127.0.0.1:5000/sac/demo-app:1.0.0
sudo systemctl disable --now sac-wud-registry.service sac-wud-sink.service
sudo sed -i '/^WUD_REGISTRY_CUSTOM_SACDEMO_/d; /^WUD_TRIGGER_HTTP_SACSINK_/d' /etc/wud/wud.env
sudo sed -i 's/^Wants=network-online.target sac-wud-registry.service sac-wud-sink.service$/Wants=network-online.target/' /etc/systemd/system/wud.service
sudo systemctl daemon-reload && sudo systemctl restart wud.service

The certificate was created on your instance's first boot for the instance's public DNS name, public IP, private IP and localhost. Only their owners can read the key, the credentials file, the session key and WUD's data directory, and only root and the docker group can read the Docker socket:

sudo openssl x509 -in /etc/ssl/wud/wud.crt -noout -subject -ext subjectAltName
sudo stat -c '%a %U:%G %n' /etc/ssl/wud/wud.key /root/wud-credentials.txt /etc/wud/wud-secret.env /var/lib/wud /var/run/docker.sock

subject=CN = ec2-34-239-126-168.compute-1.amazonaws.com, O = sac X509v3 Subject Alternative Name: DNS:ec2-34-239-126-168.compute-1.amazonaws.com, IP Address:34.239.126.168, IP Address:172.31.95.137, IP Address:127.0.0.1, DNS:localhost 600 root:root /etc/ssl/wud/wud.key 600 root:root /root/wud-credentials.txt 600 root:root /etc/wud/wud-secret.env 700 wud:wud /var/lib/wud 660 root:docker /var/run/docker.sock

To serve WUD under your own DNS name (for example wud.example.com, pointed at this instance), run the helper. It records the name, creates a new self-signed certificate for it, updates nginx and WUD's public URL, restarts WUD and rewrites the URL in the credentials file:

sudo wud-set-hostname wud.example.com

Without a recorded name, WUD follows the instance's public address after a stop and start. To use a certificate from your own certificate authority, replace /etc/ssl/wud/wud.key (keep it 0600 root) and /etc/ssl/wud/wud.crt, then run sudo systemctl reload nginx.

WUD and nginx cannot reach the instance metadata service, and the two demonstration services can reach nothing but loopback. The Docker API has no TCP listener, wud is the only member of the docker group, and the configured watcher, registry and trigger are the local ones described above. The firmware-metadata refresh is masked. Confirm each of these points:

for u in wud nginx sac-wud-registry sac-wud-sink; do printf '%-22s %s\n' "$u" "$(systemctl show -p IPAddressDeny --value $u.service)"; done
TCP=$(sudo ss -Hltn | grep -cE ':(2375|2376)( |$)' || true); echo "Docker API TCP listeners: $TCP" getent group docker grep -E '^WUD_(TRIGGER|REGISTRY|WATCHER)_' /etc/wud/wud.env
FW=$(systemctl is-enabled fwupd-refresh.timer fwupd-refresh.service || true); echo "$FW" [ "$TCP" = 0 ] && [ "$(getent group docker | cut -d: -f4)" = wud ] && [ "$(sort -u <<<"$FW")" = masked ] && ! grep -qE '^WUD_TRIGGER_(DOCKER|DOCKERCOMPOSE|COMMAND)_' /etc/wud/wud.env && [ "$(systemctl show -p IPAddressDeny --value wud.service | grep -c 169.254.169.254)" = 1 ]

wud 169.254.169.254/32 fd00:ec2::254/128 168.63.129.16/32 nginx 169.254.169.254/32 fd00:ec2::254/128 168.63.129.16/32 sac-wud-registry ::/0 0.0.0.0/0 sac-wud-sink ::/0 0.0.0.0/0 Docker API TCP listeners: 0 docker:x:987:wud WUD_WATCHER_LOCAL_SOCKET=/var/run/docker.sock WUD_WATCHER_LOCAL_CRON=0 * * * * WUD_WATCHER_LOCAL_WATCHBYDEFAULT=true WUD_REGISTRY_CUSTOM_SACDEMO_URL=http://127.0.0.1:5000 WUD_TRIGGER_HTTP_SACSINK_URL=http://127.0.0.1:3001/sac-wud-trigger WUD_TRIGGER_HTTP_SACSINK_METHOD=POST masked masked

The two demonstration services allow loopback explicitly and deny everything else, which is why their deny list is "all addresses".