|
| 1 | +# __ __ |
| 2 | +# .-----.-----.|__|.-----.--.--.______| |.--.--.---.-. |
| 3 | +# | | _ || || |_ _|______| || | | _ | |
| 4 | +# |__|__|___ ||__||__|__|__.__| |__||_____|___._| |
| 5 | +# |_____| |
| 6 | +# |
| 7 | +# Copyright (c) 2020 Fabio Cicerchia. https://fabiocicerchia.it. MIT License |
| 8 | +# Repo: https://github.com/fabiocicerchia/nginx-lua |
| 9 | + |
| 10 | +FROM alpine:3.12.1 AS base |
| 11 | + |
| 12 | +############################# |
| 13 | +# Settings Common Variables # |
| 14 | +############################# |
| 15 | +ARG DOCKER_IMAGE=fabiocicerchia/nginx-lua |
| 16 | +ENV DOCKER_IMAGE=$DOCKER_IMAGE |
| 17 | +ARG DOCKER_IMAGE_OS=alpine |
| 18 | +ENV DOCKER_IMAGE_OS=$DOCKER_IMAGE_OS |
| 19 | +ARG DOCKER_IMAGE_TAG=3.12.1 |
| 20 | +ENV DOCKER_IMAGE_TAG=$DOCKER_IMAGE_TAG |
| 21 | + |
| 22 | +ARG BUILD_DATE |
| 23 | +ENV BUILD_DATE=$BUILD_DATE |
| 24 | +ARG VCS_REF |
| 25 | +ENV VCS_REF=$VCS_REF |
| 26 | + |
| 27 | +ARG EXTENDED_IMAGE=1 |
| 28 | +ENV EXTENDED_IMAGE=$EXTENDED_IMAGE |
| 29 | + |
| 30 | +# ngx_devel_kit |
| 31 | +# https://github.com/vision5/ngx_devel_kit/releases |
| 32 | +# The NDK is now considered to be stable. |
| 33 | +ARG VER_NGX_DEVEL_KIT=0.3.1 |
| 34 | +ENV VER_NGX_DEVEL_KIT=$VER_NGX_DEVEL_KIT |
| 35 | + |
| 36 | +# luajit2 |
| 37 | +# https://github.com/openresty/luajit2/releases |
| 38 | +ARG VER_LUAJIT=2.1-20201012-2 |
| 39 | +ENV VER_LUAJIT=$VER_LUAJIT |
| 40 | +ARG LUAJIT_LIB=/usr/local/lib |
| 41 | +ENV LUAJIT_LIB=$LUAJIT_LIB |
| 42 | +ARG LUAJIT_INC=/usr/local/include/luajit-2.1 |
| 43 | +ENV LUAJIT_INC=$LUAJIT_INC |
| 44 | +ARG LD_LIBRARY_PATH=/usr/local/lib/:$LD_LIBRARY_PATH |
| 45 | +ENV LD_LIBRARY_PATH=$LD_LIBRARY_PATH |
| 46 | + |
| 47 | +# lua-nginx-module |
| 48 | +# https://github.com/openresty/lua-nginx-module/releases |
| 49 | +# Production ready. |
| 50 | +ARG VER_LUA_NGINX_MODULE=0.10.17 |
| 51 | +ENV VER_LUA_NGINX_MODULE=$VER_LUA_NGINX_MODULE |
| 52 | + |
| 53 | +# lua-resty-core |
| 54 | +# https://github.com/openresty/lua-resty-core/releases |
| 55 | +# This library is production ready. |
| 56 | +ARG VER_LUA_RESTY_CORE=0.1.19 |
| 57 | +ENV VER_LUA_RESTY_CORE=$VER_LUA_RESTY_CORE |
| 58 | +ARG LUA_LIB_DIR=/usr/local/share/lua/5.1 |
| 59 | +ENV LUA_LIB_DIR=$LUA_LIB_DIR |
| 60 | + |
| 61 | +# lua-resty-lrucache |
| 62 | +# https://github.com/openresty/lua-resty-lrucache/releases |
| 63 | +# This library is considered production ready. |
| 64 | +ARG VER_LUA_RESTY_LRUCACHE=0.10 |
| 65 | +ENV VER_LUA_RESTY_LRUCACHE=$VER_LUA_RESTY_LRUCACHE |
| 66 | + |
| 67 | +# headers-more-nginx-module |
| 68 | +# https://github.com/openresty/headers-more-nginx-module/commits/master |
| 69 | +ARG VER_OPENRESTY_HEADERS=d6d7ebab3c0c5b32ab421ba186783d3e5d2c6a17 |
| 70 | +ENV VER_OPENRESTY_HEADERS=$VER_OPENRESTY_HEADERS |
| 71 | + |
| 72 | +# lua-resty-cookie |
| 73 | +# https://github.com/cloudflare/lua-resty-cookie/commits/master |
| 74 | +ARG VER_CLOUDFLARE_COOKIE=303e32e512defced053a6484bc0745cf9dc0d39e |
| 75 | +ENV VER_CLOUDFLARE_COOKIE=$VER_CLOUDFLARE_COOKIE |
| 76 | + |
| 77 | +# lua-resty-dns |
| 78 | +# https://github.com/openresty/lua-resty-dns/releases |
| 79 | +ARG VER_OPENRESTY_DNS=0.21 |
| 80 | +ENV VER_OPENRESTY_DNS=$VER_OPENRESTY_DNS |
| 81 | + |
| 82 | +# lua-resty-memcached |
| 83 | +# https://github.com/openresty/lua-resty-memcached/releases |
| 84 | +ARG VER_OPENRESTY_MEMCACHED=0.15 |
| 85 | +ENV VER_OPENRESTY_MEMCACHED=$VER_OPENRESTY_MEMCACHED |
| 86 | + |
| 87 | +# lua-resty-mysql |
| 88 | +# https://github.com/openresty/lua-resty-mysql/releases |
| 89 | +ARG VER_OPENRESTY_MYSQL=0.22 |
| 90 | +ENV VER_OPENRESTY_MYSQL=$VER_OPENRESTY_MYSQL |
| 91 | + |
| 92 | +# lua-resty-redis |
| 93 | +# https://github.com/openresty/lua-resty-redis/releases |
| 94 | +ARG VER_OPENRESTY_REDIS=0.29 |
| 95 | +ENV VER_OPENRESTY_REDIS=$VER_OPENRESTY_REDIS |
| 96 | + |
| 97 | +# lua-resty-shell |
| 98 | +# https://github.com/openresty/lua-resty-shell/releases |
| 99 | +ARG VER_OPENRESTY_SHELL=0.03 |
| 100 | +ENV VER_OPENRESTY_SHELL=$VER_OPENRESTY_SHELL |
| 101 | + |
| 102 | +# lua-resty-upstream-healthcheck |
| 103 | +# https://github.com/openresty/lua-resty-upstream-healthcheck/releases |
| 104 | +ARG VER_OPENRESTY_HEALTHCHECK=0.06 |
| 105 | +ENV VER_OPENRESTY_HEALTHCHECK=$VER_OPENRESTY_HEALTHCHECK |
| 106 | + |
| 107 | +# lua-resty-websocket |
| 108 | +# https://github.com/openresty/lua-resty-websocket/releases |
| 109 | +ARG VER_OPENRESTY_WEBSOCKET=0.07 |
| 110 | +ENV VER_OPENRESTY_WEBSOCKET=$VER_OPENRESTY_WEBSOCKET |
| 111 | + |
| 112 | +# lua-upstream-nginx-module |
| 113 | +# https://github.com/openresty/lua-upstream-nginx-module/releases |
| 114 | +ARG VER_LUA_UPSTREAM=0.07 |
| 115 | +ENV VER_LUA_UPSTREAM=$VER_LUA_UPSTREAM |
| 116 | + |
| 117 | +# nginx-lua-prometheus |
| 118 | +# https://github.com/knyar/nginx-lua-prometheus/releases |
| 119 | +ARG VER_PROMETHEUS=0.20200523 |
| 120 | +ENV VER_PROMETHEUS=$VER_PROMETHEUS |
| 121 | + |
| 122 | +# stream-lua-nginx-module |
| 123 | +# https://github.com/openresty/stream-lua-nginx-module/releases |
| 124 | +ARG VER_OPENRESTY_STREAMLUA=0.0.8 |
| 125 | +ENV VER_OPENRESTY_STREAMLUA=$VER_OPENRESTY_STREAMLUA |
| 126 | + |
| 127 | +# https://github.com/nginx/nginx/releases |
| 128 | +ARG VER_NGINX=1.19.5 |
| 129 | +ENV VER_NGINX=$VER_NGINX |
| 130 | +ARG NGX_CFLAGS="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC" |
| 131 | +ENV NGX_CFLAGS=$NGX_CFLAGS |
| 132 | +ARG NGX_LDOPT="-Wl,-rpath,/usr/local/lib -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie" |
| 133 | +ENV NGX_LDOPT=$NGX_LDOPT |
| 134 | +ARG NGINX_BUILD_CONFIG="\ |
| 135 | + --prefix=/etc/nginx \ |
| 136 | + --sbin-path=/usr/sbin/nginx \ |
| 137 | + --modules-path=/usr/lib/nginx/modules \ |
| 138 | + --conf-path=/etc/nginx/nginx.conf \ |
| 139 | + --error-log-path=/var/log/nginx/error.log \ |
| 140 | + --http-log-path=/var/log/nginx/access.log \ |
| 141 | + --pid-path=/var/run/nginx.pid \ |
| 142 | + --lock-path=/var/run/nginx.lock \ |
| 143 | + --http-client-body-temp-path=/var/cache/nginx/client_temp \ |
| 144 | + --http-proxy-temp-path=/var/cache/nginx/proxy_temp \ |
| 145 | + --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \ |
| 146 | + --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \ |
| 147 | + --http-scgi-temp-path=/var/cache/nginx/scgi_temp \ |
| 148 | + --with-perl_modules_path=/usr/lib/perl5/vendor_perl \ |
| 149 | + --user=nginx \ |
| 150 | + --group=nginx \ |
| 151 | + --with-compat \ |
| 152 | + --with-file-aio \ |
| 153 | + --with-threads \ |
| 154 | + --with-http_addition_module \ |
| 155 | + --with-http_auth_request_module \ |
| 156 | + --with-http_dav_module \ |
| 157 | + --with-http_flv_module \ |
| 158 | + --with-http_gunzip_module \ |
| 159 | + --with-http_gzip_static_module \ |
| 160 | + --with-http_mp4_module \ |
| 161 | + --with-http_random_index_module \ |
| 162 | + --with-http_realip_module \ |
| 163 | + --with-http_secure_link_module \ |
| 164 | + --with-http_slice_module \ |
| 165 | + --with-http_ssl_module \ |
| 166 | + --with-http_stub_status_module \ |
| 167 | + --with-http_sub_module \ |
| 168 | + --with-http_v2_module \ |
| 169 | + --with-mail \ |
| 170 | + --with-mail_ssl_module \ |
| 171 | + --with-stream \ |
| 172 | + --with-stream_realip_module \ |
| 173 | + --with-stream_ssl_module \ |
| 174 | + --with-stream_ssl_preread_module \ |
| 175 | + --add-module=/lua-nginx-module-${VER_LUA_NGINX_MODULE} \ |
| 176 | + --add-module=/ngx_devel_kit-${VER_NGX_DEVEL_KIT} \ |
| 177 | + --add-module=/lua-upstream-nginx-module-${VER_LUA_UPSTREAM} \ |
| 178 | +" |
| 179 | +ENV NGINX_BUILD_CONFIG=$NGINX_BUILD_CONFIG |
| 180 | + |
| 181 | +ARG BUILD_DEPS="\ |
| 182 | + curl \ |
| 183 | + g++ \ |
| 184 | + geoip-dev \ |
| 185 | + gzip \ |
| 186 | + make \ |
| 187 | + openssl-dev \ |
| 188 | + pcre-dev \ |
| 189 | + tar \ |
| 190 | + zlib-dev \ |
| 191 | +" |
| 192 | +ENV BUILD_DEPS=$BUILD_DEPS |
| 193 | + |
| 194 | +ARG NGINX_BUILD_DEPS="\ |
| 195 | +# NGINX |
| 196 | + alpine-sdk \ |
| 197 | + bash \ |
| 198 | + findutils \ |
| 199 | + gcc \ |
| 200 | + gd-dev \ |
| 201 | + geoip-dev \ |
| 202 | + libc-dev \ |
| 203 | + libedit-dev \ |
| 204 | + libxslt-dev \ |
| 205 | + linux-headers \ |
| 206 | + make \ |
| 207 | + openssl-dev \ |
| 208 | + pcre-dev \ |
| 209 | + perl-dev \ |
| 210 | + zlib-dev \ |
| 211 | +" |
| 212 | +ENV NGINX_BUILD_DEPS=$NGINX_BUILD_DEPS |
| 213 | + |
| 214 | +#################################### |
| 215 | +# Build Nginx with support for LUA # |
| 216 | +#################################### |
| 217 | +FROM base AS builder |
| 218 | + |
| 219 | +COPY tpl/Makefile Makefile |
| 220 | + |
| 221 | +# TODO: NGINX_BUILD_CONFIG not updated |
| 222 | +# hadolint ignore=SC2086 |
| 223 | +RUN set -eux \ |
| 224 | + && apk update \ |
| 225 | + && apk add --no-cache \ |
| 226 | + $BUILD_DEPS \ |
| 227 | + $NGINX_BUILD_DEPS \ |
| 228 | + && [ $EXTENDED_IMAGE -eq 1 ] && \ |
| 229 | + NGINX_BUILD_CONFIG="${NGINX_BUILD_CONFIG} \ |
| 230 | + --add-module=/headers-more-nginx-module-${VER_OPENRESTY_HEADERS} \ |
| 231 | + --add-module=/stream-lua-nginx-module-${VER_OPENRESTY_STREAMLUA} \ |
| 232 | + " \ |
| 233 | + && make -j "$(nproc)" deps \ |
| 234 | + && make -j "$(nproc)" core |
| 235 | + |
| 236 | +########################################## |
| 237 | +# Combine everything with minimal layers # |
| 238 | +########################################## |
| 239 | +FROM alpine:3.12.1 |
| 240 | + |
| 241 | +# http://label-schema.org/rc1/ |
| 242 | +LABEL maintainer="Fabio Cicerchia <info@fabiocicerchia.it>" \ |
| 243 | + org.label-schema.build-date=$BUILD_DATE \ |
| 244 | + org.label-schema.description="Nginx $VER_NGINX with Lua support based on $DOCKER_IMAGE_OS $DOCKER_IMAGE_TAG." \ |
| 245 | + org.label-schema.docker.cmd="docker run -p 80:80 -d $DOCKER_IMAGE:$VER_NGINX-$DOCKER_IMAGE_OS$DOCKER_IMAGE_TAG" \ |
| 246 | + org.label-schema.name="$DOCKER_IMAGE" \ |
| 247 | + org.label-schema.schema-version="1.0" \ |
| 248 | + org.label-schema.url="https://github.com/$DOCKER_IMAGE" \ |
| 249 | + org.label-schema.vcs-ref=$VCS_REF \ |
| 250 | + org.label-schema.vcs-url="https://github.com/$DOCKER_IMAGE" \ |
| 251 | + org.label-schema.version="$VER_NGINX-$DOCKER_IMAGE_OS$DOCKER_IMAGE_TAG" \ |
| 252 | + versions.extended=${EXTENDED_IMAGE} \ |
| 253 | + versions.headers-more-nginx-module=${VER_OPENRESTY_HEADERS} \ |
| 254 | + versions.lua-nginx-module=${VER_LUA_NGINX_MODULE} \ |
| 255 | + versions.lua-resty-cookie=${VER_CLOUDFLARE_COOKIE} \ |
| 256 | + versions.lua-resty-core=${VER_LUA_RESTY_CORE} \ |
| 257 | + versions.lua-resty-dns=${VER_OPENRESTY_DNS} \ |
| 258 | + versions.lua-resty-lrucache=${VER_LUA_RESTY_LRUCACHE} \ |
| 259 | + versions.lua-resty-memcached=${VER_OPENRESTY_MEMCACHED} \ |
| 260 | + versions.lua-resty-mysql=${VER_OPENRESTY_MYSQL} \ |
| 261 | + versions.lua-resty-redis=${VER_OPENRESTY_REDIS} \ |
| 262 | + versions.lua-resty-shell=${VER_OPENRESTY_SHELL} \ |
| 263 | + versions.lua-resty-upstream-healthcheck=${VER_OPENRESTY_HEALTHCHECK} \ |
| 264 | + versions.lua-resty-websocket=${VER_OPENRESTY_WEBSOCKET} \ |
| 265 | + versions.lua-upstream=${VER_LUA_UPSTREAM} \ |
| 266 | + versions.luajit2=${VER_LUAJIT} \ |
| 267 | + versions.nginx-lua-prometheus=${VER_PROMETHEUS} \ |
| 268 | + versions.nginx=${VER_NGINX} \ |
| 269 | + versions.ngx_devel_kit=${VER_NGX_DEVEL_KIT} \ |
| 270 | + versions.os=${DOCKER_IMAGE_TAG} \ |
| 271 | + versions.stream-lua-nginx-module=${VER_OPENRESTY_STREAMLUA} |
| 272 | + |
| 273 | +ARG PKG_DEPS="\ |
| 274 | + geoip-dev \ |
| 275 | + openssl-dev \ |
| 276 | + pcre-dev \ |
| 277 | + zlib-dev \ |
| 278 | +" |
| 279 | +ENV PKG_DEPS=$PKG_DEPS |
| 280 | + |
| 281 | +COPY --from=builder /etc/nginx /etc/nginx |
| 282 | +COPY --from=builder /usr/local/lib /usr/local/lib |
| 283 | +COPY --from=builder /usr/local/share/lua /usr/local/share/lua |
| 284 | +COPY --from=builder /usr/sbin/nginx /usr/sbin/nginx |
| 285 | +COPY --from=builder /usr/sbin/nginx-debug /usr/sbin/nginx-debug |
| 286 | +COPY --from=builder /var/cache/nginx /var/cache/nginx |
| 287 | + |
| 288 | +SHELL ["/bin/ash", "-eo", "pipefail", "-c"] |
| 289 | + |
| 290 | +# hadolint ignore=SC2086 |
| 291 | +RUN set -eux \ |
| 292 | + && apk update \ |
| 293 | + && apk add --no-cache --virtual .pkg_deps \ |
| 294 | + $PKG_DEPS \ |
| 295 | +# Bring in gettext so we can get `envsubst`, then throw |
| 296 | +# the rest away. To do this, we need to install `gettext` |
| 297 | +# then move `envsubst` out of the way so `gettext` can |
| 298 | +# be deleted completely, then move `envsubst` back. |
| 299 | + && apk add --no-cache --virtual .gettext gettext \ |
| 300 | + && mv /usr/bin/envsubst /tmp/ \ |
| 301 | + && runDeps="$( \ |
| 302 | + scanelf --needed --nobanner /tmp/envsubst \ |
| 303 | + | awk '{ gsub(/,/, "\nso:", $2); print "so:" $2 }' \ |
| 304 | + | sort -u \ |
| 305 | + | xargs -r apk info --installed \ |
| 306 | + | sort -u \ |
| 307 | + )" \ |
| 308 | + && apk add --no-cache --virtual .run_deps $runDeps \ |
| 309 | + && apk del .gettext \ |
| 310 | + && mv /tmp/envsubst /usr/local/bin/ \ |
| 311 | +# Bring in tzdata so users could set the timezones through the environment |
| 312 | +# variables |
| 313 | + && apk add --no-cache --virtual pkg_tz tzdata \ |
| 314 | +# Bring in curl and ca-certificates to make registering on DNS SD easier |
| 315 | + && apk add --no-cache --virtual pkg_dns curl ca-certificates \ |
| 316 | +# forward request and error logs to docker log collector |
| 317 | + && mkdir -p /var/log/nginx \ |
| 318 | + && ln -sf /dev/stdout /var/log/nginx/access.log \ |
| 319 | + && ln -sf /dev/stderr /var/log/nginx/error.log \ |
| 320 | +# create nginx user/group first, to be consistent throughout docker variants |
| 321 | + && addgroup -g 101 -S nginx \ |
| 322 | + && adduser -S -D -H -u 101 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx \ |
| 323 | + && mkdir /docker-entrypoint.d |
| 324 | + |
| 325 | +COPY tpl/docker-entrypoint.sh / |
| 326 | +COPY tpl/10-listen-on-ipv6-by-default.sh /docker-entrypoint.d/ |
| 327 | +COPY tpl/20-envsubst-on-templates.sh /docker-entrypoint.d/ |
| 328 | + |
| 329 | +# smoke test |
| 330 | +# ############################################################################## |
| 331 | +RUN envsubst -V \ |
| 332 | + && nginx -V \ |
| 333 | + && nginx -t |
| 334 | + |
| 335 | +EXPOSE 80 443 |
| 336 | + |
| 337 | +HEALTHCHECK --interval=30s --timeout=3s CMD curl --fail http://localhost/ || exit 1 |
| 338 | + |
| 339 | +# Override stop signal to stop process gracefully |
| 340 | +STOPSIGNAL SIGQUIT |
| 341 | + |
| 342 | +ENTRYPOINT ["/docker-entrypoint.sh"] |
| 343 | + |
| 344 | +CMD ["nginx", "-g", "daemon off;"] |
0 commit comments