[Bug]: [F5-WAF] The Docker Compose file is missing a mapping line for JWT

[ohad-perets]

Describe the bug you have identified

https://docs.nginx.com/nginx-app-protect-waf/v5/admin-guide/deploy-on-docker/
The Docker Compose file is missing a mapping line for JWT, NGINX plus docker needs that to run

services:
nginx:
container_name: nginx
image: nginx-app-protect-5
volumes:
- app_protect_bd_config:/opt/app_protect/bd_config
- app_protect_config:/opt/app_protect/config
- app_protect_etc_config:/etc/app_protect/conf
- /conf/nginx.conf:/etc/nginx/nginx.conf # based on the provided example
- /conf/default.conf:/etc/nginx/conf.d/default.conf # based on the provided example
- #JWT mapping should happen here if running NGINX Plus, good to leave a comment for user here
networks:
- waf_network
ports:
- "80:80"

Which product or products does this request relate to?

F5 WAF for NGINX

Steps to reproduce the bug

https://docs.nginx.com/nginx-app-protect-waf/v5/admin-guide/deploy-on-docker/
guess that also in the new doc

What is the expected or desired behaviour?

mention/link/add JWT mapping

What environments or versions does this bug affect?

all

Any additional information

No response

[ADubhlaoich]

Working on this in my current branch: I'm going to review other Dockerfiles as part of my work to see if this is a design problem that's persisted through multiple iterations.

There's a few identified issues (such as NGINX configuration problems) that look like they were a case of a single file being copied and edited, retaining issues through every successive version of the file.

[ADubhlaoich]

I don't actually know what the mapping is meant to be, so I'm leaving this till next week.

I am pushing my existing branch so my other fixes can go out sooner.

[ohad-perets]

TBH, need to check how they handle it in nginx.
@mouraddmeiri / @liadlevif5 any idea what we need to put here in the JWT? map? file? reference? The JWT?

[liadlevif5]

The missing part is the nginx container in the docker-compose file in the multi-container configuration, like it was here - https://github.com/nginx/documentation/blob/main/content/nap-waf/v5/admin-guide/deploy-on-docker.md#docker-compose-file
Also, the docker-compose should contain a mapping of the jwt license for nginx (IIRC it's only for nginx plus).
First, the user should create the file named 'license.jwt'
And then, the mapping will be

• ./license.jwt:/etc/nginx/license.jwt

So at the end, the nginx service in the docker-compose should be like this:
services:
nginx:
container_name: nginx
image: nginx-app-protect-5
volumes:
- app_protect_bd_config:/opt/app_protect/bd_config
- app_protect_config:/opt/app_protect/config
- app_protect_etc_config:/etc/app_protect/conf
- /conf/nginx.conf:/etc/nginx/nginx.conf # based on the provided example
- /conf/default.conf:/etc/nginx/conf.d/default.conf # based on the provided example
- ./license.jwt:/etc/nginx/license.jwt
networks:
- waf_network
ports:
- "80:80"

[ADubhlaoich]

Thanks @liadlevif5! I'll handle this as part of a PR tomorrow.

[ohad-perets]

[like] Ohad Perets reacted to your message:

…

________________________________ From: Alan Dooley ***@***.***> Sent: Tuesday, October 21, 2025 4:00:07 PM To: nginx/documentation ***@***.***> Cc: Ohad Perets ***@***.***>; Author ***@***.***> Subject: Re: [nginx/documentation] [Bug]: [F5-WAF] The Docker Compose file is missing a mapping line for JWT (Issue #1317) CAUTION: This email has been sent from an external source. Do not click links, open attachments, or provide sensitive business information unless you can verify the sender’s legitimacy. [https://avatars.githubusercontent.com/u/3230334?s=20&v=4]ADubhlaoich left a comment (nginx/documentation#1317)<#1317 (comment)> Thanks @liadlevif5<https://github.com/liadlevif5>! I'll handle this as part of a PR tomorrow. — Reply to this email directly, view it on GitHub<#1317 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/A6B6BVSZ35RXJXM37JGQZAD3YZKAPAVCNFSM6AAAAACJLMKVU6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTIMRXGQYDSNRTG4>. You are receiving this because you authored the thread.Message ID: ***@***.***>