Skip to content

Commit b3c7433

Browse files
alessfgalessfg
committed
fix: update NGINX Plus Dockerfile
1 parent e6ce3f2 commit b3c7433

File tree

9 files changed

+147
-282
lines changed

9 files changed

+147
-282
lines changed

‎Dockerfile.buildkit.plus

Lines changed: 0 additions & 83 deletions
This file was deleted.

‎Dockerfile.oss

Lines changed: 23 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1,63 +1,46 @@
1-
FROM nginx:1.27.0@sha256:56b388b0d79c738f4cf51bbaf184a14fab19337f4819ceb2cae7d94100262de8
1+
FROM nginx:1.27.0@sha256:9c367186df9a6b18c6735357b8eb7f407347e84aea09beb184961cb83543d46e
22

33
# NJS env vars
4-
ENV NJS_VERSION 0.8.4
5-
ENV NJS_RELEASE 2~bookworm
4+
ENV NJS_VERSION=0.8.4
5+
ENV NJS_RELEASE=2~bookworm
66

77
# Proxy cache env vars
8-
ENV PROXY_CACHE_MAX_SIZE "10g"
9-
ENV PROXY_CACHE_INACTIVE "60m"
10-
ENV PROXY_CACHE_SLICE_SIZE "1m"
11-
ENV PROXY_CACHE_VALID_OK "1h"
12-
ENV PROXY_CACHE_VALID_NOTFOUND "1m"
13-
ENV PROXY_CACHE_VALID_FORBIDDEN "30s"
8+
ENV PROXY_CACHE_MAX_SIZE=10g
9+
ENV PROXY_CACHE_INACTIVE=60m
10+
ENV PROXY_CACHE_SLICE_SIZE=1m
11+
ENV PROXY_CACHE_VALID_OK=1h
12+
ENV PROXY_CACHE_VALID_NOTFOUND=1m
13+
ENV PROXY_CACHE_VALID_FORBIDDEN=30s
1414

1515
# CORS env vars
16-
ENV CORS_ENABLED 0
17-
ENV CORS_ALLOW_PRIVATE_NETWORK_ACCESS ""
16+
ENV CORS_ENABLED=0
17+
ENV CORS_ALLOW_PRIVATE_NETWORK_ACCESS=""
1818

1919
# S3 proxy env vars
20-
ENV DIRECTORY_LISTING_PATH_PREFIX ""
21-
ENV STRIP_LEADING_DIRECTORY_PATH ""
22-
ENV PREFIX_LEADING_DIRECTORY_PATH ""
23-
24-
# We modify the nginx base image by:
25-
# 1. Explicitly install the version of njs coded in the environment variable above.
26-
# 2. Adding configuration files needed for proxying private S3 buckets
27-
# 3. Adding a directory for proxied objects to be stored
20+
ENV DIRECTORY_LISTING_PATH_PREFIX=""
21+
ENV STRIP_LEADING_DIRECTORY_PATH=""
22+
ENV PREFIX_LEADING_DIRECTORY_PATH=""
23+
24+
# We modify the NGINX OSS base image by:
25+
# 1. Explicitly installing the version of njs coded in the environment variable above.
26+
# 2. Adding configuration files needed for proxying private S3 buckets.
27+
# 3. Adding a directory for proxied objects to be stored.
2828
# 4. Replacing the entrypoint script with a modified version that explicitly sets resolvers.
2929

3030
RUN set -x \
31-
&& apt-get update \
32-
&& apt-get install --no-install-recommends --no-install-suggests -y gnupg1 ca-certificates \
33-
&& \
34-
NGINX_GPGKEY=573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62; \
35-
NGINX_GPGKEY_PATH=/etc/apt/keyrings/nginx-archive-keyring.gpg; \
36-
export GNUPGHOME="$(mktemp -d)"; \
37-
found=''; \
38-
for server in \
39-
hkp://keyserver.ubuntu.com:80 \
40-
pgp.mit.edu \
41-
; do \
42-
echo "Fetching GPG key $NGINX_GPGKEY from $server"; \
43-
gpg1 --keyserver "$server" --keyserver-options timeout=10 --recv-keys "$NGINX_GPGKEY" && found=yes && break; \
44-
done; \
45-
test -z "$found" && echo >&2 "error: failed to fetch GPG key $NGINX_GPGKEY" && exit 1; \
46-
gpg1 --export "$NGINX_GPGKEY" > "$NGINX_GPGKEY_PATH" ; \
47-
rm -rf "$GNUPGHOME"; \
48-
apt-get remove --purge --auto-remove -y gnupg1 && rm -rf /var/lib/apt/lists/*; \
49-
echo "deb [signed-by=/etc/apt/keyrings/nginx-archive-keyring.gpg] https://nginx.org/packages/mainline/debian/ $(echo $PKG_RELEASE | cut -f2 -d~) nginx" >> /etc/apt/sources.list.d/nginx.list; \
31+
&& echo "deb [signed-by=/etc/apt/keyrings/nginx-archive-keyring.gpg] https://nginx.org/packages/mainline/debian/ $(echo $PKG_RELEASE | cut -f2 -d~) nginx" >> /etc/apt/sources.list.d/nginx.list; \
5032
apt-get update \
5133
&& apt-get install --no-install-recommends --no-install-suggests -y \
5234
libedit2 \
5335
nginx-module-njs=${NGINX_VERSION}+${NJS_VERSION}-${NJS_RELEASE} \
5436
&& apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx.list
5537

56-
COPY common/etc /etc
5738
COPY oss/etc /etc
39+
COPY common/etc /etc
5840
COPY common/docker-entrypoint.sh /docker-entrypoint.sh
5941
COPY common/docker-entrypoint.d /docker-entrypoint.d/
6042

61-
RUN mkdir -p /var/cache/nginx/s3_proxy \
43+
RUN set -x \
44+
&& mkdir -p /var/cache/nginx/s3_proxy \
6245
&& chown nginx:nginx /var/cache/nginx/s3_proxy \
6346
&& chmod -R -v +x /docker-entrypoint.sh /docker-entrypoint.d/*.sh;

‎Dockerfile.plus

Lines changed: 86 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -1,77 +1,102 @@
1-
FROM debian:bookworm-slim@sha256:67f3931ad8cb1967beec602d8c0506af1e37e8d73c2a0b38b181ec5d8560d395
1+
ARG RELEASE=bookworm
2+
FROM debian:${RELEASE}-slim@sha256:67f3931ad8cb1967beec602d8c0506af1e37e8d73c2a0b38b181ec5d8560d395
23

3-
ENV NGINX_PLUS_VERSION 30-2
4-
ENV NGINX_VERSION 1.25.1
5-
ENV NJS_VERSION 30+0.8.0-1
6-
ENV XSLT_VERSION 30-1
4+
# NJS env vars
5+
ENV NGINX_VERSION=32
6+
ENV NGINX_PKG_RELEASE=1~${RELEASE}
7+
ENV NJS_VERSION=0.8.4
8+
ENV NJS_PKG_RELEASE=1~${RELEASE}
79

8-
ENV PROXY_CACHE_MAX_SIZE "10g"
9-
ENV PROXY_CACHE_INACTIVE "60m"
10-
ENV PROXY_CACHE_SLICE_SIZE "1m"
11-
ENV PROXY_CACHE_VALID_OK "1h"
12-
ENV PROXY_CACHE_VALID_NOTFOUND "1m"
13-
ENV PROXY_CACHE_VALID_FORBIDDEN "30s"
14-
ENV CORS_ENABLED 0
15-
ENV CORS_ALLOW_PRIVATE_NETWORK_ACCESS ""
16-
ENV DIRECTORY_LISTING_PATH_PREFIX ""
17-
ENV STRIP_LEADING_DIRECTORY_PATH ""
18-
ENV PREFIX_LEADING_DIRECTORY_PATH ""
10+
# Proxy cache env vars
11+
ENV PROXY_CACHE_MAX_SIZE=10g
12+
ENV PROXY_CACHE_INACTIVE=60m
13+
ENV PROXY_CACHE_SLICE_SIZE=1m
14+
ENV PROXY_CACHE_VALID_OK=1h
15+
ENV PROXY_CACHE_VALID_NOTFOUND=1m
16+
ENV PROXY_CACHE_VALID_FORBIDDEN=30s
1917

20-
COPY plus/etc/ssl /etc/ssl
21-
COPY plus/usr /usr
18+
# CORS env vars
19+
ENV CORS_ENABLED=0
20+
ENV CORS_ALLOW_PRIVATE_NETWORK_ACCESS=""
2221

23-
# Copy files from the OSS NGINX Docker container such that the container
24-
# startup is the same.
25-
COPY common/docker-entrypoint.sh /docker-entrypoint.sh
26-
COPY common/docker-entrypoint.d /docker-entrypoint.d/
27-
COPY plus/docker-entrypoint.d /docker-entrypoint.d/
28-
# Add NGINX Plus package repository keyring
29-
COPY plus/usr/share/keyrings/nginx-archive-keyring.gpg /usr/share/keyrings/nginx-archive-keyring.gpg
22+
# S3 proxy env vars
23+
ENV DIRECTORY_LISTING_PATH_PREFIX=""
24+
ENV STRIP_LEADING_DIRECTORY_PATH=""
25+
ENV PREFIX_LEADING_DIRECTORY_PATH=""
3026

31-
RUN set -eux \
32-
export DEBIAN_FRONTEND=noninteractive; \
33-
# create nginx user/group first, to be consistent throughout docker variants
34-
addgroup --system --gid 101 nginx; \
35-
adduser --system --disabled-login --ingroup nginx --no-create-home --home /nonexistent --gecos "nginx user" --shell /bin/false --uid 101 nginx; \
36-
apt-get -qq update; \
37-
apt-get -qq upgrade --yes; \
38-
apt-get -qq install --yes \
39-
ca-certificates \
40-
curl \
41-
libedit2; \
42-
sh -a /usr/local/bin/add_nginx_plus_repo.sh; \
43-
rm /usr/local/bin/add_nginx_plus_repo.sh; \
44-
apt-get -qq update; \
45-
export DISTRO_VERSION="$(grep '^VERSION_CODENAME=' /etc/os-release | awk -v FS='=' '{print $2}')" && \
46-
apt-get -qq install --yes --no-install-recommends --no-install-suggests \
47-
nginx-plus=${NGINX_PLUS_VERSION}~${DISTRO_VERSION} \
48-
nginx-plus-module-njs=${NJS_VERSION}~${DISTRO_VERSION} \
49-
nginx-plus-module-xslt=${XSLT_VERSION}~${DISTRO_VERSION} \
50-
gettext-base; \
51-
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
52-
rm -rf /etc/apt/sources.list.d/nginx-plus.list /var/lib/apt/lists/* /var/tmp/* /tmp/*; \
53-
# forward request and error logs to docker log collector
54-
ln -sf /dev/stdout /var/log/nginx/access.log; \
55-
ln -sf /dev/stderr /var/log/nginx/error.log; \
56-
chmod -R -v +x /docker-entrypoint.sh /docker-entrypoint.d/*.sh
27+
# We create an NGINX Plus image based on the official NGINX Plus Dockerfiles (https://gist.github.com/nginx-gists/36e97fc87efb5cf0039978c8e41a34b5) and modify it by:
28+
# 1. Explicitly installing the version of njs coded in the environment variable above.
29+
# 2. Adding configuration files needed for proxying private S3 buckets.
30+
# 3. Adding a directory for proxied objects to be stored.
31+
# 4. Adding the entrypoint scripts found in the base NGINX OSS Docker image with a modified version that explicitly sets resolvers.
5732

58-
ENTRYPOINT ["/docker-entrypoint.sh"]
33+
# Download your NGINX license certificate and key from the F5 customer portal (https://account.f5.com) and copy them to the build context
34+
RUN --mount=type=secret,id=nginx-crt,dst=nginx-repo.crt \
35+
--mount=type=secret,id=nginx-key,dst=nginx-repo.key \
36+
set -x \
37+
# Create nginx user/group first, to be consistent throughout Docker variants
38+
&& groupadd --system --gid 101 nginx \
39+
&& useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \
40+
&& apt-get update \
41+
&& apt-get install --no-install-recommends --no-install-suggests -y ca-certificates gnupg2 lsb-release \
42+
&& \
43+
NGINX_GPGKEYS="573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62 8540A6F18833A80E9C1653A42FD21310B49F6B46 9E9BE90EACBCDE69FE9B204CBCDCD8A38D88A2B3"; \
44+
NGINX_GPGKEY_PATH=/usr/share/keyrings/nginx-archive-keyring.gpg; \
45+
export GNUPGHOME="$(mktemp -d)"; \
46+
found=''; \
47+
for NGINX_GPGKEY in $NGINX_GPGKEYS; do \
48+
for server in \
49+
hkp://keyserver.ubuntu.com:80 \
50+
pgp.mit.edu \
51+
; do \
52+
echo "Fetching GPG key $NGINX_GPGKEY from $server"; \
53+
gpg --keyserver "$server" --keyserver-options timeout=10 --recv-keys "$NGINX_GPGKEY" && found=yes && break; \
54+
done; \
55+
test -z "$found" && echo >&2 "error: failed to fetch GPG key $NGINX_GPGKEY" && exit 1; \
56+
done; \
57+
gpg1 --export "$NGINX_GPGKEYS" > "$NGINX_GPGKEY_PATH" ; \
58+
rm -rf "$GNUPGHOME"; \
59+
apt-get remove --purge --auto-remove -y gnupg2 && rm -rf /var/lib/apt/lists/* \
60+
# Install the latest release of NGINX Plus and/or NGINX Plus modules (written and maintained by F5)
61+
&& nginxPackages=" \
62+
nginx-plus=${NGINX_VERSION}-${NGINX_PKG_RELEASE} \
63+
nginx-plus-module-njs=${NGINX_VERSION}+${NJS_VERSION}-${NJS_PKG_RELEASE} \
64+
nginx-plus-module-xslt=${NGINX_VERSION}-${NGINX_PKG_RELEASE} \
65+
" \
66+
&& echo "Acquire::https::pkgs.nginx.com::Verify-Peer \"true\";" > /etc/apt/apt.conf.d/90nginx \
67+
&& echo "Acquire::https::pkgs.nginx.com::Verify-Host \"true\";" >> /etc/apt/apt.conf.d/90nginx \
68+
&& echo "Acquire::https::pkgs.nginx.com::SslCert \"/etc/ssl/nginx/nginx-repo.crt\";" >> /etc/apt/apt.conf.d/90nginx \
69+
&& echo "Acquire::https::pkgs.nginx.com::SslKey \"/etc/ssl/nginx/nginx-repo.key\";" >> /etc/apt/apt.conf.d/90nginx \
70+
&& echo "deb [signed-by=$NGINX_GPGKEY_PATH] https://pkgs.nginx.com/plus/debian `lsb_release -cs` nginx-plus\n" > /etc/apt/sources.list.d/nginx-plus.list \
71+
&& mkdir -p /etc/ssl/nginx \
72+
&& cat nginx-repo.crt > /etc/ssl/nginx/nginx-repo.crt \
73+
&& cat nginx-repo.key > /etc/ssl/nginx/nginx-repo.key \
74+
&& apt-get update \
75+
&& apt-get install --no-install-recommends --no-install-suggests -y $nginxPackages curl gettext-base \
76+
&& apt-get remove --purge -y lsb-release \
77+
&& apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx-plus.list \
78+
&& rm -rf /etc/apt/apt.conf.d/90nginx /etc/ssl/nginx \
79+
# Forward request logs to Docker log collector
80+
&& ln -sf /dev/stdout /var/log/nginx/access.log \
81+
&& ln -sf /dev/stderr /var/log/nginx/error.log
5982

6083
EXPOSE 80
6184

6285
STOPSIGNAL SIGTERM
6386

6487
CMD ["nginx", "-g", "daemon off;"]
6588

66-
# NGINX Docker image setup complete, everything below is specific for
67-
# the S3 Gateway use case.
68-
89+
# Copy files from the OSS NGINX Docker container such that the container
90+
# startup is the same.
6991
COPY plus/etc/nginx /etc/nginx
7092
COPY common/etc /etc
71-
COPY common/docker-entrypoint.d/00-check-for-required-env.sh /docker-entrypoint.d/00-check-for-required-env.sh
93+
COPY common/docker-entrypoint.sh /docker-entrypoint.sh
94+
COPY common/docker-entrypoint.d /docker-entrypoint.d/
95+
COPY plus/docker-entrypoint.d /docker-entrypoint.d/
96+
97+
RUN set -x \
98+
&& mkdir -p /var/cache/nginx/s3_proxy \
99+
&& chown nginx:nginx /var/cache/nginx/s3_proxy \
100+
&& chmod -R -v +x /docker-entrypoint.sh /docker-entrypoint.d/*.sh;
72101

73-
RUN set -eux \
74-
export DEBIAN_FRONTEND=noninteractive; \
75-
mkdir -p /var/cache/nginx/s3_proxy; \
76-
chown nginx:nginx /var/cache/nginx/s3_proxy; \
77-
chmod -R +x /docker-entrypoint.d/*
102+
ENTRYPOINT ["/docker-entrypoint.sh"]

‎README.md

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -76,9 +76,7 @@ test/ contains automated tests for validang that the
7676
Dockerfile.oss Dockerfile that configures NGINX OSS to act as a S3 gateway
7777
Dockerfile.plus Dockerfile that builds a NGINX Plus instance that is configured
7878
equivelently to NGINX OSS - instance is configured to act as a
79-
S3 gateway with NGINX Plus additional features enabled
80-
Dockerfile.buildkit.plus Dockerfile with the same configuration as Dockerfile.plus, but
81-
with support for hiding secrets using Docker's Buildkit
79+
S3 gateway with NGINX Plus additional features enabled. The NGINX Plus license is parsed via Docker's Buildkit built-in support for secrets
8280
Dockerfile.latest-njs Dockerfile that inherits from the last build of the gateway and
8381
then builds and installs the latest version of njs from source
8482
Dockerfile.unprivileged Dockerfiles that inherits from the last build of the gateway and

0 commit comments

Comments
 (0)