Configuration of Owasp Zap on Azure Container Instances

Question

I am trying to create an owasp zap instance using azure container instances using the following code:

$containerGroupName = "EW-owaspzap"
$containerDnsName = "EW-owaspzap"
$imageName = "owasp/zap2docker-stable"
$myIpAddress = (Invoke-WebRequest ifconfig.me/ip).Content.Trim()
$environmentVars = @{"api.key"="myreallysecureapikey";"api.addrs.addr.name"=$myIpAddress}
$containerGroup = Get-AzureRmContainerGroup -ResourceGroupName $resourceGroupName -Name $containerGroupName -ErrorAction SilentlyContinue
if (!$containerGroup) {
    New-AzureRmContainerGroup -ResourceGroupName $resourceGroupName -Name $containerGroupName -Image $imageName -Command zap-webswing.sh -Port 8080,8090 `
         -IpAddressType Public -DnsNameLabel $containerDnsName -RestartPolicy OnFailure -Location WestEurope -AzureFileVolumeShareName $storageShareName `
        -AzureFileVolumeMountPath '/output' -AzureFileVolumeAccountCredential $storageCredentials -EnvironmentVariable $environmentVars
     }

However I get the error:

The environment variable name in container 'EW-owaspzap' of container group 'EW-owaspzap' is invalid. A valid environment variable name must start with alphabetic character or '', followed by a string of alphanumeric characters or '' (e.g. 'my_name', or 'MY_NAME', or 'MyName')

according to this https://github.com/zaproxy/zaproxy/wiki/Docker I have the format of the environment variables correct. Is there anything else I have missed?

Omer Levi Hevroni · Answer 1 · 2018-09-04T17:45:38.183

1

This is ACI limitation - see here for naming limitation for env vars:

| Environment variable | 1-63 |Case insensitive |Alphanumeric, and underscore (_) anywhere except the first or last character

This is not an issue with Zap, but with ACI. This can be solved with a script that gets the env vars in Azure format and converts them to Zap's format (e.g. api_key to api.key). This is a pseudo-code (I did not test it), just to give you an idea:

export set api.key=$API_KEY
./zap

Create a new docker image based on Zap's official image, copy the script and use it to start Zap instead of the regular Zap's command.

edited Sep 04 '18 at 17:45

answered Sep 04 '18 at 16:20

Omer Levi Hevroni

1,935
1
15
33

Is this a script run after the container has started? Could you give an example? – johnstaveley Sep 04 '18 at 17:42
Do you know if I could I just use the Azure Cli to overcome this limitation? – johnstaveley Sep 05 '18 at 07:04
or just use an Arm template to generate the instance? – johnstaveley Sep 05 '18 at 07:12
I don't know... Look on the documentation I've linked to, maybe it will be there – Omer Levi Hevroni Sep 05 '18 at 11:33
Omer is correct, you can work around this env var config constraint by using a startup script or an entrypoint command to set it manually. Another option would be using EXEC to start a live session and setting it yourself if you are looking for one-off interactive tests. – jluk Sep 06 '18 at 23:07

score 0 · Answer 2 · answered Sep 06 '18 at 08:47

0

For your issue, I think there is something you have misunderstood. The command in the link you posted docker run -u zap -p 8080:8080 -i owasp/zap2docker-stable zap-x.sh -daemon -host 0.0.0.0 -port 8080 -config api.addrs.addr.name=.* -config api.addrs.addr.regex=true, you should take a look at docker run, there is no parameter like -config.

So, I think the command from zap-x.sh to the end is a whole bash command with the script zap-x.sh. You can check the parameter definition in the script zap-x.sh.

And the environment in PowerShell command is a Hashtable, you can get more details here. Also, there are some limitations about Naming conventions in Azure Container Instances.

answered Sep 06 '18 at 08:47

Charles Xu

29,862
2
22
39

I'm not sure what you are trying to say. Are you saying my PS example above is missing -config? given the limitations of hashtables I am now looking at arm templates or azure cli as a means of injecting the startup parameters with dots in them. The script is just to start owasp zap with a UI, I don't really want to change this. If there are naming limitations for environment variables in azure, does that mean I can't do what I want to using ACI? – johnstaveley Sep 07 '18 at 07:32
@johnstaveley I mean that the environment you set use a wrong type. You can set the environment as `$environmentVars = @{"api_key"="myreallysecureapikey";"api_addrs_addr_name"=$myIpAddress}` to meet the Hashtable limitation. – Charles Xu Sep 07 '18 at 07:39
Changing the parameters in this way means the container does not pick them up correctly – johnstaveley Sep 07 '18 at 14:14

score 0 · Answer 3 · answered Oct 23 '18 at 23:01

0

Not sure if you got his working, but I used your powershell script & was able to create Zap container by replacing "." with "_" in $environmentVars array.

answered Oct 23 '18 at 23:01

OjasP

29
3

Good point, I didn't check it last night. Looks like with the underscore the scripts goes through without errors, but the values are not being set. Did you get it working any other way? – OjasP Oct 24 '18 at 14:34

Configuration of Owasp Zap on Azure Container Instances

3 Answers3