Skip to content
This repository was archived by the owner on Jan 11, 2025. It is now read-only.

Commit 8cc747e

Browse files
fabiocicerchiafabiocicerchia
committed
improved readme + added dumb-init + random uid and gid
1 parent 03801d4 commit 8cc747e

File tree

63 files changed

+1394
-340
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

63 files changed

+1394
-340
lines changed

‎.github/workflows/main.yml

-36
Original file line numberDiff line numberDiff line change
@@ -24,12 +24,6 @@ jobs:
2424
- name: Test images
2525
run: ./test/test.sh alpine
2626

27-
- name: Security Check
28-
run: |
29-
npm install -g snyk
30-
snyk auth $SNYK_AUTH_TOKEN
31-
./test/security.sh alpine
32-
3327
- name: Log into registry
3428
run: echo "${{ secrets.DOCKER_HUB_TOKEN }}" | docker login -u ${{ github.actor }} --password-stdin
3529
if: github.ref == 'refs/heads/master'
@@ -49,12 +43,6 @@ jobs:
4943
- name: Test images
5044
run: ./test/test.sh amazonlinux
5145

52-
- name: Security Check
53-
run: |
54-
npm install -g snyk
55-
snyk auth $SNYK_AUTH_TOKEN
56-
./test/security.sh amazonlinux
57-
5846
- name: Log into registry
5947
run: echo "${{ secrets.DOCKER_HUB_TOKEN }}" | docker login -u ${{ github.actor }} --password-stdin
6048
if: github.ref == 'refs/heads/master'
@@ -74,12 +62,6 @@ jobs:
7462
- name: Test images
7563
run: ./test/test.sh centos
7664

77-
- name: Security Check
78-
run: |
79-
npm install -g snyk
80-
snyk auth $SNYK_AUTH_TOKEN
81-
./test/security.sh centos
82-
8365
- name: Log into registry
8466
run: echo "${{ secrets.DOCKER_HUB_TOKEN }}" | docker login -u ${{ github.actor }} --password-stdin
8567
if: github.ref == 'refs/heads/master'
@@ -99,12 +81,6 @@ jobs:
9981
- name: Test images
10082
run: ./test/test.sh debian
10183

102-
- name: Security Check
103-
run: |
104-
npm install -g snyk
105-
snyk auth $SNYK_AUTH_TOKEN
106-
./test/security.sh debian
107-
10884
- name: Log into registry
10985
run: echo "${{ secrets.DOCKER_HUB_TOKEN }}" | docker login -u ${{ github.actor }} --password-stdin
11086
if: github.ref == 'refs/heads/master'
@@ -124,12 +100,6 @@ jobs:
124100
- name: Test images
125101
run: ./test/test.sh fedora
126102

127-
- name: Security Check
128-
run: |
129-
npm install -g snyk
130-
snyk auth $SNYK_AUTH_TOKEN
131-
./test/security.sh fedora
132-
133103
- name: Log into registry
134104
run: echo "${{ secrets.DOCKER_HUB_TOKEN }}" | docker login -u ${{ github.actor }} --password-stdin
135105
if: github.ref == 'refs/heads/master'
@@ -149,12 +119,6 @@ jobs:
149119
- name: Test images
150120
run: ./test/test.sh ubuntu
151121

152-
- name: Security Check
153-
run: |
154-
npm install -g snyk
155-
snyk auth $SNYK_AUTH_TOKEN
156-
./test/security.sh ubuntu
157-
158122
- name: Log into registry
159123
run: echo "${{ secrets.DOCKER_HUB_TOKEN }}" | docker login -u ${{ github.actor }} --password-stdin
160124
if: github.ref == 'refs/heads/master'

‎README.md

+161-54
Large diffs are not rendered by default.

‎docker-build.sh

+2-2
Original file line numberDiff line numberDiff line change
@@ -41,13 +41,13 @@ function build() {
4141
if [ "$OS_TAGS" == "1" ]; then
4242
TAGS="$TAGS -t fabiocicerchia/nginx-lua:$MINOR-$OS"
4343
TAGS="$TAGS -t fabiocicerchia/nginx-lua:$PATCH-$OS"
44-
TAGS="$TAGS -t fabiocicerchia/nginx-lua:$MINOR-$OS$OS_VER"
4544
fi
45+
TAGS="$TAGS -t fabiocicerchia/nginx-lua:$MINOR-$OS$OS_VER"
4646

4747
BUILD_DATE=$(date +%Y%m%d%H%M%S)
4848
BUILD_VERSION=$(date +%s)
4949
VCS_REF=$(git rev-parse --short HEAD)
50-
docker build \
50+
time docker build \
5151
--build-arg BUILD_DATE=$BUILD_DATE \
5252
--build-arg BUILD_VERSION=$BUILD_VERSION \
5353
--build-arg VCS_REF=$VCS_REF \

‎docs/logo-lua.png

15.9 KB
Loading

‎docs/logo-nginx.png

21 KB
Loading

‎nginx/1.17.10/alpine/3.10.5/Dockerfile

+21-5
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
FROM alpine:3.10.5
22

3-
MAINTAINER Fabio Cicerchia <[email protected]>
43
LABEL maintainer="[email protected]"
54

65
ARG BUILD_DATE
@@ -40,6 +39,9 @@ ENV VER_NGINX 1.17.10
4039
# The NDK is now considered to be stable.
4140
ENV VER_NGX_DEVEL_KIT 0.3.1
4241

42+
# https://github.com/Yelp/dumb-init
43+
ENV VER_DUMBINIT 1.2.2
44+
4345
ENV LUAJIT_LIB /usr/local/lib
4446
ENV LUAJIT_INC /usr/local/include/luajit-2.1
4547
ENV LD_LIBRARY_PATH /usr/local/lib/:$LD_LIBRARY_PATH
@@ -49,7 +51,7 @@ RUN set -x \
4951
&& apk add --no-cache \
5052
geoip-dev \
5153
openssl-dev \
52-
pcre3-dev \
54+
pcre-dev \
5355
zlib-dev \
5456
&& apk add --no-cache --virtual .build-deps \
5557
curl \
@@ -92,8 +94,8 @@ RUN set -x \
9294
# NGINX
9395
# ##############################################################################
9496
# create nginx user/group first, to be consistent throughout docker variants
95-
&& addgroup -g 1001 -S nginx \
96-
&& adduser -S -D -H -u 1001 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx \
97+
&& addgroup -g 32548 -S nginx \
98+
&& adduser -S -D -H -u 32548 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx \
9799
# we're on an architecture upstream doesn't officially build for
98100
# let's build binaries from the published packaging sources
99101
&& apk add --no-cache --virtual .nginx-build-deps \
@@ -110,7 +112,7 @@ RUN set -x \
110112
make \
111113
mercurial \
112114
openssl-dev \
113-
pcre3-dev \
115+
pcre-dev \
114116
perl-dev \
115117
zlib-dev \
116118
&& curl -Lo /nginx.tar.gz https://nginx.org/download/nginx-${VER_NGINX}.tar.gz \
@@ -177,6 +179,16 @@ RUN set -x \
177179
# forward request and error logs to docker log collector
178180
&& ln -sf /dev/stdout /var/log/nginx/access.log \
179181
&& ln -sf /dev/stderr /var/log/nginx/error.log \
182+
# UID & GID
183+
# ##############################################################################
184+
&& chown -R 32548:32548 \
185+
/etc/nginx \
186+
/lua-nginx-module-${VER_LUA_NGINX_MODULE} \
187+
/ngx_devel_kit-${VER_NGX_DEVEL_KIT} \
188+
/var/log/nginx \
189+
# dumb-init
190+
# ##############################################################################
191+
&& apk add dumb-init \
180192
# Cleanup
181193
# ##############################################################################
182194
&& rm -rf /lua-nginx-module-${VER_LUA_NGINX_MODULE} \
@@ -189,9 +201,13 @@ RUN set -x \
189201

190202
HEALTHCHECK --interval=30s --timeout=3s CMD curl --fail http://localhost/ || exit 1
191203

204+
USER nginx
205+
192206
EXPOSE 80
193207
EXPOSE 443
194208

195209
STOPSIGNAL SIGTERM
196210

211+
ENTRYPOINT ["dumb-init"]
212+
197213
CMD ["nginx", "-g", "daemon off;"]

‎nginx/1.17.10/alpine/3.11.6/Dockerfile

+21-5
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
FROM alpine:3.11.6
22

3-
MAINTAINER Fabio Cicerchia <[email protected]>
43
LABEL maintainer="[email protected]"
54

65
ARG BUILD_DATE
@@ -40,6 +39,9 @@ ENV VER_NGINX 1.17.10
4039
# The NDK is now considered to be stable.
4140
ENV VER_NGX_DEVEL_KIT 0.3.1
4241

42+
# https://github.com/Yelp/dumb-init
43+
ENV VER_DUMBINIT 1.2.2
44+
4345
ENV LUAJIT_LIB /usr/local/lib
4446
ENV LUAJIT_INC /usr/local/include/luajit-2.1
4547
ENV LD_LIBRARY_PATH /usr/local/lib/:$LD_LIBRARY_PATH
@@ -49,7 +51,7 @@ RUN set -x \
4951
&& apk add --no-cache \
5052
geoip-dev \
5153
openssl-dev \
52-
pcre3-dev \
54+
pcre-dev \
5355
zlib-dev \
5456
&& apk add --no-cache --virtual .build-deps \
5557
curl \
@@ -92,8 +94,8 @@ RUN set -x \
9294
# NGINX
9395
# ##############################################################################
9496
# create nginx user/group first, to be consistent throughout docker variants
95-
&& addgroup -g 1001 -S nginx \
96-
&& adduser -S -D -H -u 1001 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx \
97+
&& addgroup -g 32548 -S nginx \
98+
&& adduser -S -D -H -u 32548 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx \
9799
# we're on an architecture upstream doesn't officially build for
98100
# let's build binaries from the published packaging sources
99101
&& apk add --no-cache --virtual .nginx-build-deps \
@@ -110,7 +112,7 @@ RUN set -x \
110112
make \
111113
mercurial \
112114
openssl-dev \
113-
pcre3-dev \
115+
pcre-dev \
114116
perl-dev \
115117
zlib-dev \
116118
&& curl -Lo /nginx.tar.gz https://nginx.org/download/nginx-${VER_NGINX}.tar.gz \
@@ -177,6 +179,16 @@ RUN set -x \
177179
# forward request and error logs to docker log collector
178180
&& ln -sf /dev/stdout /var/log/nginx/access.log \
179181
&& ln -sf /dev/stderr /var/log/nginx/error.log \
182+
# UID & GID
183+
# ##############################################################################
184+
&& chown -R 32548:32548 \
185+
/etc/nginx \
186+
/lua-nginx-module-${VER_LUA_NGINX_MODULE} \
187+
/ngx_devel_kit-${VER_NGX_DEVEL_KIT} \
188+
/var/log/nginx \
189+
# dumb-init
190+
# ##############################################################################
191+
&& apk add dumb-init \
180192
# Cleanup
181193
# ##############################################################################
182194
&& rm -rf /lua-nginx-module-${VER_LUA_NGINX_MODULE} \
@@ -189,9 +201,13 @@ RUN set -x \
189201

190202
HEALTHCHECK --interval=30s --timeout=3s CMD curl --fail http://localhost/ || exit 1
191203

204+
USER nginx
205+
192206
EXPOSE 80
193207
EXPOSE 443
194208

195209
STOPSIGNAL SIGTERM
196210

211+
ENTRYPOINT ["dumb-init"]
212+
197213
CMD ["nginx", "-g", "daemon off;"]

‎nginx/1.17.10/alpine/3.12.0/Dockerfile

+21-5
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
FROM alpine:3.12.0
22

3-
MAINTAINER Fabio Cicerchia <[email protected]>
43
LABEL maintainer="[email protected]"
54

65
ARG BUILD_DATE
@@ -40,6 +39,9 @@ ENV VER_NGINX 1.17.10
4039
# The NDK is now considered to be stable.
4140
ENV VER_NGX_DEVEL_KIT 0.3.1
4241

42+
# https://github.com/Yelp/dumb-init
43+
ENV VER_DUMBINIT 1.2.2
44+
4345
ENV LUAJIT_LIB /usr/local/lib
4446
ENV LUAJIT_INC /usr/local/include/luajit-2.1
4547
ENV LD_LIBRARY_PATH /usr/local/lib/:$LD_LIBRARY_PATH
@@ -49,7 +51,7 @@ RUN set -x \
4951
&& apk add --no-cache \
5052
geoip-dev \
5153
openssl-dev \
52-
pcre3-dev \
54+
pcre-dev \
5355
zlib-dev \
5456
&& apk add --no-cache --virtual .build-deps \
5557
curl \
@@ -92,8 +94,8 @@ RUN set -x \
9294
# NGINX
9395
# ##############################################################################
9496
# create nginx user/group first, to be consistent throughout docker variants
95-
&& addgroup -g 1001 -S nginx \
96-
&& adduser -S -D -H -u 1001 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx \
97+
&& addgroup -g 32548 -S nginx \
98+
&& adduser -S -D -H -u 32548 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx \
9799
# we're on an architecture upstream doesn't officially build for
98100
# let's build binaries from the published packaging sources
99101
&& apk add --no-cache --virtual .nginx-build-deps \
@@ -110,7 +112,7 @@ RUN set -x \
110112
make \
111113
mercurial \
112114
openssl-dev \
113-
pcre3-dev \
115+
pcre-dev \
114116
perl-dev \
115117
zlib-dev \
116118
&& curl -Lo /nginx.tar.gz https://nginx.org/download/nginx-${VER_NGINX}.tar.gz \
@@ -177,6 +179,16 @@ RUN set -x \
177179
# forward request and error logs to docker log collector
178180
&& ln -sf /dev/stdout /var/log/nginx/access.log \
179181
&& ln -sf /dev/stderr /var/log/nginx/error.log \
182+
# UID & GID
183+
# ##############################################################################
184+
&& chown -R 32548:32548 \
185+
/etc/nginx \
186+
/lua-nginx-module-${VER_LUA_NGINX_MODULE} \
187+
/ngx_devel_kit-${VER_NGX_DEVEL_KIT} \
188+
/var/log/nginx \
189+
# dumb-init
190+
# ##############################################################################
191+
&& apk add dumb-init \
180192
# Cleanup
181193
# ##############################################################################
182194
&& rm -rf /lua-nginx-module-${VER_LUA_NGINX_MODULE} \
@@ -189,9 +201,13 @@ RUN set -x \
189201

190202
HEALTHCHECK --interval=30s --timeout=3s CMD curl --fail http://localhost/ || exit 1
191203

204+
USER nginx
205+
192206
EXPOSE 80
193207
EXPOSE 443
194208

195209
STOPSIGNAL SIGTERM
196210

211+
ENTRYPOINT ["dumb-init"]
212+
197213
CMD ["nginx", "-g", "daemon off;"]

0 commit comments

Comments
 (0)