Add dockerfile for local rootless build #1691
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| pid /tmp/nginx.pid; | ||
| worker_processes 1; | ||
| error_log /var/log/nginx/error.log; | ||
|
|
||
| events { | ||
| worker_connections 1024; | ||
| } | ||
|
|
||
| http { | ||
| proxy_temp_path /var/cache/nginx/proxy_temp; | ||
| client_body_temp_path /var/cache/nginx/client_temp; | ||
| fastcgi_temp_path /var/cache/nginx/fastcgi_temp; | ||
| uwsgi_temp_path /var/cache/nginx/uwsgi_temp; | ||
| scgi_temp_path /var/cache/nginx/scgi_temp; | ||
|
|
||
| include mime.types; | ||
| default_type application/octet-stream; | ||
|
|
||
| log_format main '$remote_addr - $remote_user [$time_local] "$request" ' | ||
| '$status $body_bytes_sent "$http_referer" ' | ||
| '"$http_user_agent" "$http_x_forwarded_for" ' | ||
| '"$bytes_sent" "$request_length" "$request_time" ' | ||
| '"$gzip_ratio" $server_protocol '; | ||
|
|
||
| access_log /var/log/nginx/access.log main; | ||
|
|
||
| sendfile on; | ||
| keepalive_timeout 65; | ||
|
|
||
| server { | ||
| listen 8080; | ||
| server_name localhost; | ||
|
|
||
| location / { | ||
| root /usr/share/nginx/html; | ||
| index index.html index.htm; | ||
| } | ||
|
|
||
| ## | ||
| # Enable Metrics | ||
| ## | ||
| location /api { | ||
| stub_status; | ||
| allow 127.0.0.1; | ||
| deny all; | ||
| } | ||
|
|
||
| # redirect server error pages to the static page /50x.html | ||
| # | ||
| error_page 500 502 503 504 /50x.html; | ||
| location = /50x.html { | ||
| root /usr/share/nginx/html; | ||
| } | ||
| } | ||
| } | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| pid /tmp/nginx.pid; | ||
| worker_processes 1; | ||
| error_log /var/log/nginx/error.log; | ||
|
|
||
| events { | ||
| worker_connections 1024; | ||
| } | ||
|
|
||
| http { | ||
| proxy_temp_path /var/cache/nginx/proxy_temp; | ||
| client_body_temp_path /var/cache/nginx/client_temp; | ||
| fastcgi_temp_path /var/cache/nginx/fastcgi_temp; | ||
| uwsgi_temp_path /var/cache/nginx/uwsgi_temp; | ||
| scgi_temp_path /var/cache/nginx/scgi_temp; | ||
|
|
||
| include mime.types; | ||
| default_type application/octet-stream; | ||
|
|
||
| log_format main '$remote_addr - $remote_user [$time_local] "$request" ' | ||
| '$status $body_bytes_sent "$http_referer" ' | ||
| '"$http_user_agent" "$http_x_forwarded_for" ' | ||
| '"$bytes_sent" "$request_length" "$request_time" ' | ||
| '"$gzip_ratio" $server_protocol '; | ||
|
|
||
| access_log /var/log/nginx/access.log main; | ||
|
|
||
| sendfile on; | ||
| keepalive_timeout 65; | ||
|
|
||
| server { | ||
| listen 8080; | ||
| server_name localhost; | ||
|
|
||
| location / { | ||
| root /usr/share/nginx/html; | ||
| index index.html index.htm; | ||
| } | ||
|
|
||
| ## | ||
| # Enable Metrics | ||
| ## | ||
| location /api/ { | ||
| api write=on; | ||
| allow 127.0.0.1; | ||
| deny all; | ||
| status_zone my_location_zone1; | ||
| } | ||
|
|
||
| # redirect server error pages to the static page /50x.html | ||
| # | ||
| error_page 500 502 503 504 /50x.html; | ||
| location = /50x.html { | ||
| root /usr/share/nginx/html; | ||
| } | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| # Dockerfile for running NGINX Agent with rootless user | ||
| ARG BASE_IMAGE | ||
| FROM ${BASE_IMAGE} as install-nginx-rootless | ||
| LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>" | ||
|
|
||
| ARG DEBIAN_FRONTEND=noninteractive | ||
| ARG ENTRY_POINT | ||
| ARG PACKAGE_NAME | ||
| ARG PACKAGES_REPO | ||
|
|
||
| WORKDIR /agent | ||
| COPY ./build /agent/build | ||
| COPY $ENTRY_POINT /agent/entrypoint.sh | ||
| RUN chmod +x /agent/entrypoint.sh | ||
|
|
||
| # Install system dependencies and create nginx user | ||
| RUN set -x \ | ||
| && groupadd --system --gid 101 nginx \ | ||
| && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ | ||
| && apt-get update \ | ||
| && apt-get install --no-install-recommends --no-install-suggests -y \ | ||
| ca-certificates \ | ||
| gnupg2 \ | ||
| curl \ | ||
| lsb-release \ | ||
| procps \ | ||
| nginx \ | ||
| && apt-get clean \ | ||
| && rm -rf /var/lib/apt/lists/* | ||
|
|
||
| # Create necessary directories and set permissions for nginx user | ||
| RUN mkdir -p /var/log/nginx /var/cache/nginx /var/run/nginx /var/lib/nginx /etc/nginx/conf.d /etc/nginx/ssl \ | ||
| && chown -R nginx:nginx /var/log/nginx /var/cache/nginx /var/run/nginx /var/lib/nginx /etc/nginx /etc/nginx/ssl \ | ||
| && chmod 755 /var/log/nginx /var/cache/nginx /var/run/nginx /var/lib/nginx /etc/nginx /etc/nginx/ssl \ | ||
| && touch /var/lib/nginx/nginx.id || true | ||
|
|
||
| # Copy custom nginx config for rootless setup | ||
| COPY ./test/config/nginx/nginx-rootless-oss.conf /etc/nginx/nginx.conf | ||
| RUN chown nginx:nginx /etc/nginx/nginx.conf \ | ||
| && chmod 644 /etc/nginx/nginx.conf | ||
|
|
||
| # Grant CAP_NET_BIND_SERVICE to allow binding to privileged ports as non-root | ||
| RUN apt-get update && apt-get install -y libcap2-bin \ | ||
| && setcap 'cap_net_bind_service=+ep' /usr/sbin/nginx \ | ||
| && apt-get clean \ | ||
| && rm -rf /var/lib/apt/lists/* | ||
|
|
||
| STOPSIGNAL SIGTERM | ||
|
|
||
| # Expose ports (80 for HTTP with capability, 443 for HTTPS with capability) | ||
| EXPOSE 80 443 | ||
|
|
||
| # Switch to nginx user | ||
| USER nginx | ||
|
|
||
| WORKDIR /etc/nginx-agent | ||
| ENTRYPOINT ["/agent/entrypoint.sh"] | ||
|
|
||
| # Install agent from local package | ||
| FROM install-nginx-rootless as install-agent-local | ||
|
|
||
| ARG PACKAGE_NAME | ||
|
|
||
| USER root | ||
|
|
||
| RUN apt-get update && apt-get install -y /agent/build/$PACKAGE_NAME.deb \ | ||
| && apt-get clean \ | ||
| && rm -rf /var/lib/apt/lists/* | ||
|
|
||
| # Fix permissions for nginx agent config and directories | ||
| RUN if [[ -f /etc/nginx-agent/nginx-agent.conf ]]; then chmod 644 /etc/nginx-agent/nginx-agent.conf; fi \ | ||
|
Contributor
There was a problem hiding this comment. Are we duplicating the permissions from install base image
Author
There was a problem hiding this comment. Good catch @craigell Thanks for pointing that out. I've removed the redundant lines from the install base image and instead fixed the missing directory permissions after the installation, as installation overrides permissions it has to be fixed for both stages (local install and repo install), but I'm open to any suggestions :) |
||
| && chmod 755 /etc/nginx-agent /var/log/nginx-agent \ | ||
| && chown -R nginx:nginx /etc/nginx-agent /var/log/nginx-agent /var/lib/nginx-agent | ||
|
|
||
| USER nginx | ||
|
|
||
| # Install agent from repository | ||
| FROM install-nginx-rootless as install-agent-repo | ||
|
|
||
| USER root | ||
|
|
||
| RUN curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null \ | ||
| && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] http://packages.nginx.org/nginx-agent/ubuntu/ `lsb_release -cs` agent\n" > /etc/apt/sources.list.d/nginx-agent.list | ||
|
|
||
| RUN apt-get update && apt-get install -y nginx-agent \ | ||
| && apt-get clean \ | ||
| && rm -rf /var/lib/apt/lists/* | ||
|
|
||
| # Fix permissions for nginx agent config and directories | ||
| RUN if [[ -f /etc/nginx-agent/nginx-agent.conf ]]; then chmod 644 /etc/nginx-agent/nginx-agent.conf; fi \ | ||
| && chmod 755 /etc/nginx-agent /var/log/nginx-agent \ | ||
| && chown -R nginx:nginx /etc/nginx-agent /var/log/nginx-agent /var/lib/nginx-agent | ||
|
|
||
| USER nginx | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,95 @@ | ||
| # Dockerfile for running NGINX Agent with NGINX Plus and rootless user | ||
| ARG BASE_IMAGE | ||
| FROM ${BASE_IMAGE} as install-nginx-plus-rootless | ||
| LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>" | ||
|
|
||
| ARG DEBIAN_FRONTEND=noninteractive | ||
| ARG ENTRY_POINT | ||
| ARG PACKAGE_NAME | ||
| ARG PACKAGES_REPO | ||
|
|
||
| WORKDIR /agent | ||
| COPY ./build /agent/build | ||
| COPY $ENTRY_POINT /agent/entrypoint.sh | ||
| RUN chmod +x /agent/entrypoint.sh | ||
|
|
||
| ENV PLUS_VERSION=R32 | ||
|
|
||
| RUN --mount=type=secret,id=nginx-crt,dst=nginx-repo.crt \ | ||
| --mount=type=secret,id=nginx-key,dst=nginx-repo.key \ | ||
| set -x \ | ||
| # Create nginx user/group first, to be consistent throughout Docker variants | ||
| && groupadd --system --gid 101 nginx \ | ||
| && useradd --system --gid nginx --no-create-home --home-dir /nonexistent --uid 101 nginx \ | ||
| && apt-get update \ | ||
| && apt-get install --no-install-recommends --no-install-suggests -y \ | ||
| ca-certificates \ | ||
| gpg \ | ||
| lsb-release \ | ||
| git \ | ||
| wget \ | ||
| make \ | ||
| # Install the latest release of NGINX Plus and/or NGINX Plus modules | ||
| # Uncomment individual modules if necessary | ||
| # Use versioned packages over defaults to specify a release | ||
| && nginxPackages=" \ | ||
| nginx-plus \ | ||
| " \ | ||
| && echo "Acquire::https::pkgs.nginx.com::Verify-Peer \"true\";" > /etc/apt/apt.conf.d/90nginx \ | ||
| && echo "Acquire::https::pkgs.nginx.com::Verify-Host \"true\";" >> /etc/apt/apt.conf.d/90nginx \ | ||
| && echo "Acquire::https::pkgs.nginx.com::SslCert \"/etc/ssl/nginx/nginx-repo.crt\";" >> /etc/apt/apt.conf.d/90nginx \ | ||
| && echo "Acquire::https::pkgs.nginx.com::SslKey \"/etc/ssl/nginx/nginx-repo.key\";" >> /etc/apt/apt.conf.d/90nginx \ | ||
| && printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/${PLUS_VERSION}/ubuntu/ `lsb_release -cs` nginx-plus\n" > /etc/apt/sources.list.d/nginx-plus.list \ | ||
| && wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null \ | ||
| && mkdir -p /etc/ssl/nginx \ | ||
| && cat nginx-repo.crt > /etc/ssl/nginx/nginx-repo.crt \ | ||
| && cat nginx-repo.key > /etc/ssl/nginx/nginx-repo.key \ | ||
| && apt-get update \ | ||
| && apt-get install --no-install-recommends --no-install-suggests -y \ | ||
| $nginxPackages \ | ||
| curl \ | ||
| gettext-base \ | ||
| jq \ | ||
| gnupg2 \ | ||
| && apt-get remove --purge -y lsb-release \ | ||
| && apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx-plus.list \ | ||
| && rm -rf /etc/apt/apt.conf.d/90nginx /etc/ssl/nginx | ||
|
|
||
|
|
||
| # Copy custom nginx config for rootless setup | ||
| COPY ./test/config/nginx/nginx-rootless-plus.conf /etc/nginx/nginx.conf | ||
| RUN chown nginx:nginx /etc/nginx/nginx.conf \ | ||
| && chmod 644 /etc/nginx/nginx.conf | ||
|
|
||
| # Create necessary directories and set permissions for nginx user | ||
| RUN mkdir -p /var/log/nginx /var/cache/nginx /var/run/nginx /var/lib/nginx /etc/nginx/conf.d /var/log/nginx-agent /var/log/app_protect /etc/nginx-agent /etc/nginx/ssl \ | ||
| && chown -R nginx:nginx /var/log/nginx /var/cache/nginx /var/run/nginx /var/lib/nginx /etc/nginx /var/log/nginx-agent /var/log/app_protect /etc/nginx-agent /etc/nginx/ssl \ | ||
| && chmod 755 /var/log/nginx /var/cache/nginx /var/run/nginx /var/lib/nginx /etc/nginx /var/log/nginx-agent /etc/nginx-agent /etc/nginx/ssl \ | ||
| && touch /var/lib/nginx/nginx.id || true | ||
|
|
||
| # Grant CAP_NET_BIND_SERVICE so nginx (running non-root) can bind privileged ports | ||
| RUN apt-get update && apt-get install -y --no-install-recommends libcap2-bin \ | ||
| && setcap 'cap_net_bind_service=+ep' /usr/sbin/nginx \ | ||
| && apt-get clean \ | ||
| && rm -rf /var/lib/apt/lists/* | ||
|
|
||
| RUN apt-get update && apt-get install -y /agent/build/$PACKAGE_NAME.deb \ | ||
| && apt-get clean \ | ||
| && rm -rf /var/lib/apt/lists/* | ||
|
|
||
| # Fix permissions for nginx agent config and directories | ||
| RUN if [[ -f /etc/nginx-agent/nginx-agent.conf ]]; then chmod 644 /etc/nginx-agent/nginx-agent.conf; fi \ | ||
| && chmod 755 /etc/nginx-agent \ | ||
| && chown -R nginx:nginx /etc/nginx-agent /var/log/nginx-agent /var/lib/nginx-agent /var/lib/nginx /var/run/nginx | ||
|
|
||
| STOPSIGNAL SIGTERM | ||
|
|
||
| # Expose ports (80 for HTTP with capability, 443 for HTTPS with capability) | ||
| EXPOSE 80 443 | ||
|
|
||
| # Switch to nginx user | ||
| USER nginx | ||
|
|
||
| WORKDIR /etc/nginx-agent | ||
|
|
||
| ENTRYPOINT ["/agent/entrypoint.sh"] |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
typo for oss
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Fixed, thank you :)