fix: update NGINX Plus Dockerfile #274
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,83 +1,105 @@ | ||
| ARG RELEASE=bookworm | ||
| FROM debian:${RELEASE}-slim@sha256:f528891ab1aa484bf7233dbcc84f3c806c3e427571d75510a9d74bb5ec535b33 | ||
|
|
||
| # Persist RELEASE argument | ||
| ARG RELEASE | ||
|
|
||
| # NJS env vars | ||
| ENV NGINX_VERSION=32 | ||
| ENV NGINX_PKG_RELEASE=1~${RELEASE} | ||
| ENV NJS_VERSION=0.8.4 | ||
| ENV NJS_PKG_RELEASE=1~${RELEASE} | ||
|
|
||
| # Proxy cache env vars | ||
| ENV PROXY_CACHE_MAX_SIZE=10g | ||
| ENV PROXY_CACHE_INACTIVE=60m | ||
| ENV PROXY_CACHE_SLICE_SIZE=1m | ||
| ENV PROXY_CACHE_VALID_OK=1h | ||
| ENV PROXY_CACHE_VALID_NOTFOUND=1m | ||
| ENV PROXY_CACHE_VALID_FORBIDDEN=30s | ||
|
|
||
| # CORS env vars | ||
| ENV CORS_ENABLED=0 | ||
| ENV CORS_ALLOW_PRIVATE_NETWORK_ACCESS="" | ||
|
|
||
| # S3 proxy env vars | ||
| ENV DIRECTORY_LISTING_PATH_PREFIX="" | ||
| ENV STRIP_LEADING_DIRECTORY_PATH="" | ||
| ENV PREFIX_LEADING_DIRECTORY_PATH="" | ||
|
|
||
| # We create an NGINX Plus image based on the official NGINX Plus Dockerfiles (https://gist.github.com/nginx-gists/36e97fc87efb5cf0039978c8e41a34b5) and modify it by: | ||
| # 1. Explicitly installing the version of njs coded in the environment variable above. | ||
| # 2. Adding configuration files needed for proxying private S3 buckets. | ||
| # 3. Adding a directory for proxied objects to be stored. | ||
| # 4. Adding the entrypoint scripts found in the base NGINX OSS Docker image with a modified version that explicitly sets resolvers. | ||
|
|
||
| # Download your NGINX license certificate and key from the F5 customer portal (https://account.f5.com) and copy it to the build context | ||
| RUN --mount=type=secret,id=nginx-crt,dst=nginx-repo.crt \ | ||
| --mount=type=secret,id=nginx-key,dst=nginx-repo.key \ | ||
| set -x \ | ||
| # Create nginx user/group first, to be consistent throughout Docker variants | ||
| && groupadd --system --gid 101 nginx \ | ||
| && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ | ||
| && apt-get update \ | ||
| && apt-get install --no-install-recommends --no-install-suggests -y ca-certificates gnupg1 lsb-release \ | ||
| && \ | ||
| NGINX_GPGKEYS="573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62 8540A6F18833A80E9C1653A42FD21310B49F6B46 9E9BE90EACBCDE69FE9B204CBCDCD8A38D88A2B3"; \ | ||
| NGINX_GPGKEY_PATH=/etc/apt/keyrings/nginx-archive-keyring.gpg; \ | ||
| export GNUPGHOME="$(mktemp -d)"; \ | ||
| found=''; \ | ||
| for NGINX_GPGKEY in $NGINX_GPGKEYS; do \ | ||
| for server in \ | ||
| hkp://keyserver.ubuntu.com:80 \ | ||
| pgp.mit.edu \ | ||
| ; do \ | ||
| echo "Fetching GPG key $NGINX_GPGKEY from $server"; \ | ||
| gpg1 --keyserver "$server" --keyserver-options timeout=10 --recv-keys "$NGINX_GPGKEY" && found=yes && break; \ | ||
| done; \ | ||
| test -z "$found" && echo >&2 "error: failed to fetch GPG key $NGINX_GPGKEY" && exit 1; \ | ||
| done; \ | ||
| gpg1 --export "$NGINX_GPGKEYS" > "$NGINX_GPGKEY_PATH" ; \ | ||
| rm -rf "$GNUPGHOME"; \ | ||
| apt-get remove --purge --auto-remove -y gnupg1 && rm -rf /var/lib/apt/lists/* \ | ||
| # Install the latest release of NGINX Plus and/or NGINX Plus modules (written and maintained by F5) | ||
| && nginxPackages=" \ | ||
| nginx-plus=${NGINX_VERSION}-${NGINX_PKG_RELEASE} \ | ||
| nginx-plus-module-njs=${NGINX_VERSION}+${NJS_VERSION}-${NJS_PKG_RELEASE} \ | ||
| nginx-plus-module-xslt=${NGINX_VERSION}-${NGINX_PKG_RELEASE} \ | ||
| " \ | ||
| && echo "Acquire::https::pkgs.nginx.com::Verify-Peer \"true\";" > /etc/apt/apt.conf.d/90nginx \ | ||
| && echo "Acquire::https::pkgs.nginx.com::Verify-Host \"true\";" >> /etc/apt/apt.conf.d/90nginx \ | ||
| && echo "Acquire::https::pkgs.nginx.com::SslCert \"/etc/ssl/nginx/nginx-repo.crt\";" >> /etc/apt/apt.conf.d/90nginx \ | ||
| && echo "Acquire::https::pkgs.nginx.com::SslKey \"/etc/ssl/nginx/nginx-repo.key\";" >> /etc/apt/apt.conf.d/90nginx \ | ||
| && echo "deb [signed-by=$NGINX_GPGKEY_PATH] https://pkgs.nginx.com/plus/debian `lsb_release -cs` nginx-plus\n" > /etc/apt/sources.list.d/nginx-plus.list \ | ||
| && mkdir -p /etc/ssl/nginx \ | ||
| && cat nginx-repo.crt > /etc/ssl/nginx/nginx-repo.crt \ | ||
| && cat nginx-repo.key > /etc/ssl/nginx/nginx-repo.key \ | ||
| && apt-get update \ | ||
| && apt-get install --no-install-recommends --no-install-suggests -y $nginxPackages curl gettext-base \ | ||
| && apt-get remove --purge -y lsb-release \ | ||
| && apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx-plus.list \ | ||
| && rm -rf /etc/apt/apt.conf.d/90nginx /etc/ssl/nginx \ | ||
| # Forward request logs to Docker log collector | ||
| && ln -sf /dev/stdout /var/log/nginx/access.log \ | ||
| && ln -sf /dev/stderr /var/log/nginx/error.log | ||
|
|
||
| EXPOSE 80 | ||
|
|
||
| STOPSIGNAL SIGTERM | ||
|
|
||
| CMD ["nginx", "-g", "daemon off;"] | ||
|
|
||
| # Copy files from the OSS NGINX Docker container such that the container | ||
| # startup is the same. | ||
| COPY plus/etc/nginx /etc/nginx | ||
| COPY common/etc /etc | ||
| COPY common/docker-entrypoint.sh /docker-entrypoint.sh | ||
| COPY common/docker-entrypoint.d /docker-entrypoint.d/ | ||
| COPY plus/docker-entrypoint.d /docker-entrypoint.d/ | ||
|
|
||
| RUN set -x \ | ||
| && mkdir -p /var/cache/nginx/s3_proxy \ | ||
| && chown nginx:nginx /var/cache/nginx/s3_proxy \ | ||
| && chmod -R -v +x /docker-entrypoint.sh /docker-entrypoint.d/*.sh; | ||
|
|
||
| ENTRYPOINT ["/docker-entrypoint.sh"] | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,63 +1,46 @@ | ||
| FROM nginx:1.27.0@sha256:67682bda769fae1ccf5183192b8daf37b64cae99c6c3302650f6f8bf5f0f95df | ||
|
|
||
| # NJS env vars | ||
| ENV NJS_VERSION=0.8.4 | ||
| ENV NJS_RELEASE=2~bookworm | ||
|
|
||
| # Proxy cache env vars | ||
| ENV PROXY_CACHE_MAX_SIZE=10g | ||
| ENV PROXY_CACHE_INACTIVE=60m | ||
| ENV PROXY_CACHE_SLICE_SIZE=1m | ||
| ENV PROXY_CACHE_VALID_OK=1h | ||
| ENV PROXY_CACHE_VALID_NOTFOUND=1m | ||
| ENV PROXY_CACHE_VALID_FORBIDDEN=30s | ||
|
|
||
| # CORS env vars | ||
| ENV CORS_ENABLED=0 | ||
| ENV CORS_ALLOW_PRIVATE_NETWORK_ACCESS="" | ||
|
|
||
| # S3 proxy env vars | ||
| ENV DIRECTORY_LISTING_PATH_PREFIX="" | ||
| ENV STRIP_LEADING_DIRECTORY_PATH="" | ||
| ENV PREFIX_LEADING_DIRECTORY_PATH="" | ||
|
|
||
| # We modify the NGINX base image by: | ||
| # 1. Explicitly installing the version of njs coded in the environment variable above. | ||
| # 2. Adding configuration files needed for proxying private S3 buckets. | ||
| # 3. Adding a directory for proxied objects to be stored. | ||
| # 4. Replacing the entrypoint script with a modified version that explicitly sets resolvers. | ||
|
|
||
| RUN set -x \ | ||
|
There was a problem hiding this comment. Any particular reason we're removing this? Did the official nginx image GPG keys get updated? There was a problem hiding this comment. They did! All three keys (including the new two ones) are now part of the official image and the two new keys do not expire (in theory). |
||
| && echo "deb [signed-by=/etc/apt/keyrings/nginx-archive-keyring.gpg] https://nginx.org/packages/mainline/debian/ $(echo $PKG_RELEASE | cut -f2 -d~) nginx" >> /etc/apt/sources.list.d/nginx.list; \ | ||
| apt-get update \ | ||
| && apt-get install --no-install-recommends --no-install-suggests -y \ | ||
| libedit2 \ | ||
| nginx-module-njs=${NGINX_VERSION}+${NJS_VERSION}-${NJS_RELEASE} \ | ||
| && apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx.list | ||
|
|
||
| COPY oss/etc /etc | ||
| COPY common/etc /etc | ||
| COPY common/docker-entrypoint.sh /docker-entrypoint.sh | ||
| COPY common/docker-entrypoint.d /docker-entrypoint.d/ | ||
|
|
||
| RUN set -x \ | ||
| && mkdir -p /var/cache/nginx/s3_proxy \ | ||
| && chown nginx:nginx /var/cache/nginx/s3_proxy \ | ||
| && chmod -R -v +x /docker-entrypoint.sh /docker-entrypoint.d/*.sh; | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I wouldn't be sure what where I need to put my files based on this comment. I know we supply build context as the last argument to
docker buildso does that mean that if I supply.then this file expects my license files to be in the current dir?Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You would pass the location via the
srcparameter in--secret id=nginx-crt,src=plus/etc/ssl/nginx/nginx-repo.crt.