feat: update nginx plus image builds to use nginx plus base images #449

dekobon · 2025-09-04T20:23:35Z

This change migrates to using the official NGINX Plus Docker images as base images.

Proposed changes

This pull request refactors the Dockerfiles and entrypoint scripts for both the OSS and Plus NGINX S3 Gateway images. The main goals are to modernize the build process, improve maintainability, and enhance compatibility with best practices for multi-stage Docker builds. The changes include switching to official NGINX Plus base images, restructuring build steps, simplifying environment variable handling, and improving script robustness.

Dockerfile and Build Process Refactoring:

Switched the OSS (Dockerfile.oss) and Plus (Dockerfile.plus) images to use official NGINX and NGINX Plus base images, removing custom build logic and simplifying module installation. The Plus image now uses a multi-stage build to avoid embedding sensitive license files in the final image. [1] [2] [3]
Removed the now-obsolete Dockerfile.buildkit.plus as its logic is replaced by the new multi-stage approach.
Updated the NJS module installation and related environment variables to match the new base images and simplify version management. [1] [2]

Entrypoint Script Improvements:

Switched to using the inherited container's main entrypoint script: docker-entrypoint.sh
Improved logic for setting and exporting environment variables, especially for DNS resolvers and CORS-related settings, making the script more robust and predictable. [1] [2] [3]

Other Notable Changes:

Removed verbose S3 backend environment logging from the entrypoint for cleaner container startup output.
Improved file permissions and copying logic for configuration and entrypoint scripts, ensuring proper initialization and execution in the container. [1] [2]

These changes collectively modernize the build and runtime environment for the NGINX S3 Gateway images, making them easier to maintain and more secure.

Base Image and Versioning Updates:

Dockerfile.plus now uses the official NGINX Plus base image from the private registry instead of the public Debian image, ensuring compliance and improved support. [1] [2]
Environment variables for NGINX and module versions have been updated to use explicit Plus and OSS versions, and package release variables have been clarified for njs and xslt modules. [1] [2]
The installation logic for NGINX Plus modules now uses the correct version variables, ensuring that the built images contain the intended module versions. [1] [2]

Entrypoint and Startup Script Cleanup:

Legacy entrypoint scripts 10-listen-on-ipv6-by-default.sh and 20-envsubst-on-templates.sh have been removed from plus/docker-entrypoint.d, simplifying container startup and reducing maintenance overhead. [1] [2]
Dockerfile instructions for copying entrypoint scripts have been adjusted, removing redundant or unnecessary script copies to the image. [1] [2]

Documentation Improvements:

The build instructions in docs/getting_started.md have been updated to clarify the process for building the NGINX Plus image, including the need to set up access to the official Plus Docker image repository and the steps for handling repository keys.

Checklist

Before creating a pull request (PR), run through this checklist and mark each as complete:

I have read the contributing guidelines.
I have signed the F5 Contributor License Agreement (CLA).
The PR title follows the Conventional Commits specification.
If applicable, I have added tests that prove my fix is effective or that my feature works.
If applicable, I have checked that any relevant tests pass after adding my changes.
I have updated any relevant documentation (e.g. README.md).

Copilot

Pull Request Overview

This PR migrates NGINX Plus container builds from using a public Debian base image to the official NGINX Plus Docker base image, improving compliance and support. It also removes legacy entrypoint scripts that are now redundant with the official base image.

Updates both Dockerfiles to use the official NGINX Plus base image from the private registry
Removes legacy entrypoint scripts (10-listen-on-ipv6-by-default.sh and 20-envsubst-on-templates.sh)
Updates environment variables and module installation logic to use explicit Plus and OSS versions

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
Dockerfile.plus	Updates base image to official NGINX Plus and removes redundant user creation and container configuration
Dockerfile.buildkit.plus	Same base image and configuration updates as standard Dockerfile
plus/docker-entrypoint.d/10-listen-on-ipv6-by-default.sh	Removes legacy IPv6 configuration script
plus/docker-entrypoint.d/20-envsubst-on-templates.sh	Removes legacy template substitution script
docs/getting_started.md	Updates build instructions to clarify NGINX Plus image repository setup requirements

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Dockerfile.plus

Dockerfile.buildkit.plus

4141done

Changes look good to me - the copilot suggestion around chmod commands on directories that are not explicitly copied in any long are worth looking at but perhaps we are not just dealing with those directories as they are inherited from the new base image?

oxpa · 2025-09-05T19:35:37Z

nginx plus has entrypoint scripts copied from docker-nginx of OSS images. Are we sure we want to do any changes to entrypoint.sh?
Is it important to have specific njs version? nginx-plus has /modules from where you can copy files into your image.

dekobon · 2025-09-09T00:56:41Z

@oxpa I've incorporated your suggestions and redone this PR. Thank you for them. It helped me clarify what was needed.

dekobon · 2025-09-09T00:57:12Z

Dockerfile.oss

@@ -1,9 +1,5 @@
 FROM nginx:1.29.0@sha256:f5c017fb33c6db484545793ffb67db51cdd7daebee472104612f73a85063f889

-# NJS env vars


We no longer hard-code NJS versions.

dekobon · 2025-09-09T00:58:49Z

Dockerfile.oss

 COPY common/etc /etc
-COPY common/docker-entrypoint.sh /docker-entrypoint.sh


We no longer need a custom entry point script.

dekobon · 2025-09-09T00:59:35Z

Dockerfile.oss

 COPY common/docker-entrypoint.d /docker-entrypoint.d/

 RUN set -x \
    && mkdir -p /var/cache/nginx/s3_proxy \
    && chown nginx:nginx /var/cache/nginx/s3_proxy \
-    && chmod -R -v +x /docker-entrypoint.sh /docker-entrypoint.d/*.sh;
+    && find /docker-entrypoint.d -type f \( -name '*.sh' -or -name '*.envsh' \) -exec chmod -v +x {} \;


This find command ensures all the files in the entry point directory are executable.

dekobon · 2025-09-09T01:01:20Z

Dockerfile.plus


-ENTRYPOINT ["/docker-entrypoint.sh"]
+RUN set -eux \


We now append the commented out default E+V blocks into the nginx.conf, so that the entry point substitution script can replace values from it.

dekobon · 2025-09-09T16:12:38Z

Dockerfile.plus

 # Copy files from the OSS NGINX Docker container such that the container
 # startup is the same.
+COPY --from=build /etc/nginx/modules/ngx_http_xslt_filter_module*.so /etc/nginx/modules/
+COPY --from=build /etc/nginx/modules/ngx_http_js_module*.s /etc/nginx/modules/
+COPY --from=build /lib/aarch64-linux-gnu/libxslt.so.1 /lib/aarch64-linux-gnu/


It looks like I hard coded architecture here, so this will need to be fixed.

This change does the following: * Migrates to using the official NGINX Plus Docker images as base images * Removes the distinction between BuildKit and non-BuildKit builds for Plus images (OSS never had this) * Adds support for license validation for Plus images * Introduces a multi-stage build for Plus images Signed-off-by: Elijah Zupancic <[email protected]>

Signed-off-by: Elijah Zupancic <[email protected]>

By using the version reported by NGINX rather than the environment variable it allows for a more reliable setting and less complexity. Signed-off-by: Elijah Zupancic <[email protected]>

dekobon requested review from 4141done and Copilot September 4, 2025 20:23

dekobon requested a review from a team as a code owner September 4, 2025 20:23

Copilot AI reviewed Sep 4, 2025

View reviewed changes

Dockerfile.plus Outdated Show resolved Hide resolved

Dockerfile.plus Outdated Show resolved Hide resolved

Dockerfile.buildkit.plus Outdated Show resolved Hide resolved

Dockerfile.buildkit.plus Outdated Show resolved Hide resolved

4141done previously approved these changes Sep 4, 2025

View reviewed changes

dekobon dismissed 4141done’s stale review via 3fb3c55 September 4, 2025 22:48

dekobon force-pushed the nginx-plus-base-image branch from 3fb3c55 to 62504e6 Compare September 5, 2025 16:21

dekobon force-pushed the nginx-plus-base-image branch from e928452 to 8c80096 Compare September 9, 2025 00:55

dekobon requested a review from oxpa September 9, 2025 00:55

dekobon commented Sep 9, 2025

View reviewed changes

dekobon added 3 commits September 9, 2025 15:35

chore: remove deprecated version parameter from docker-compose.yaml

765bbd1

Signed-off-by: Elijah Zupancic <[email protected]>

fix: use nginx version reported by binary instead of env var

ce18e42

By using the version reported by NGINX rather than the environment variable it allows for a more reliable setting and less complexity. Signed-off-by: Elijah Zupancic <[email protected]>

dekobon force-pushed the nginx-plus-base-image branch from 8c80096 to ce18e42 Compare September 9, 2025 22:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: update nginx plus image builds to use nginx plus base images #449

feat: update nginx plus image builds to use nginx plus base images #449

Uh oh!

dekobon commented Sep 4, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

4141done left a comment

Uh oh!

oxpa commented Sep 5, 2025

Uh oh!

dekobon commented Sep 9, 2025

Uh oh!

dekobon Sep 9, 2025

Uh oh!

dekobon Sep 9, 2025

Uh oh!

dekobon Sep 9, 2025

Uh oh!

dekobon Sep 9, 2025

Uh oh!

dekobon Sep 9, 2025

Uh oh!

Uh oh!

		@@ -1,9 +1,5 @@
		FROM nginx:1.29.0@sha256:f5c017fb33c6db484545793ffb67db51cdd7daebee472104612f73a85063f889

		# NJS env vars

		COPY common/etc /etc
		COPY common/docker-entrypoint.sh /docker-entrypoint.sh

feat: update nginx plus image builds to use nginx plus base images #449

Are you sure you want to change the base?

feat: update nginx plus image builds to use nginx plus base images #449

Uh oh!

Conversation

dekobon commented Sep 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

4141done left a comment

Choose a reason for hiding this comment

Uh oh!

oxpa commented Sep 5, 2025

Uh oh!

dekobon commented Sep 9, 2025

Uh oh!

dekobon Sep 9, 2025

Choose a reason for hiding this comment

Uh oh!

dekobon Sep 9, 2025

Choose a reason for hiding this comment

Uh oh!

dekobon Sep 9, 2025

Choose a reason for hiding this comment

Uh oh!

dekobon Sep 9, 2025

Choose a reason for hiding this comment

Uh oh!

dekobon Sep 9, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

dekobon commented Sep 4, 2025 •

edited

Loading