Add Dockerfiles to build images from UBI9 minimal #3941
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
File renamed without changes.
File renamed without changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| # syntax=docker/dockerfile:1.18 | ||
| FROM golang:1.25 AS builder | ||
|
|
||
| WORKDIR /go/src/github.com/nginx/nginx-gateway-fabric | ||
|
|
||
| COPY go.mod go.sum /go/src/github.com/nginx/nginx-gateway-fabric/ | ||
| RUN go mod download | ||
|
|
||
| COPY . /go/src/github.com/nginx/nginx-gateway-fabric | ||
| RUN make build | ||
|
|
||
| FROM golang:1.25 AS ca-certs-provider | ||
|
|
||
| FROM redhat/ubi9-minimal:9.6 AS ngf-ubi-minimal | ||
| # CA certs are needed for telemetry report so that NGF can verify the server's certificate. | ||
| COPY --from=ca-certs-provider --link /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ | ||
| USER 101:1001 | ||
| ARG BUILD_AGENT | ||
| ENV BUILD_AGENT=${BUILD_AGENT} | ||
| ENTRYPOINT [ "/usr/bin/gateway" ] | ||
|
|
||
| FROM ngf-ubi-minimal AS container | ||
| COPY --from=builder /go/src/github.com/nginxinc/nginx-gateway-fabric/build/out/gateway /usr/bin/gateway | ||
|
|
||
| FROM ngf-ubi-minimal AS local | ||
| COPY ./build/out/gateway /usr/bin/gateway | ||
|
|
||
| FROM ngf-ubi-minimal AS goreleaser | ||
| ARG TARGETARCH | ||
| COPY dist/gateway_linux_$TARGETARCH*/gateway /usr/bin/gateway |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| # syntax=docker/dockerfile:1.18 | ||
| FROM scratch AS nginx-files | ||
|
|
||
| # Repository and key files for UBI-based builds | ||
| ADD --link --chown=101:1001 https://nginx.org/keys/nginx_signing.key nginx_signing.key | ||
| ADD --link --chown=101:1001 build/ubi/repos/nginx.repo nginx.repo | ||
| ADD --link --chown=101:1001 build/ubi/repos/agent.repo agent.repo | ||
|
|
||
| FROM redhat/ubi9-minimal:9.6 AS ubi-minimal | ||
shaun-nx marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
|
|
||
| FROM ghcr.io/nginx/dependencies/nginx-ubi:ubi9@sha256:01a32246761b9bbe47a6a29bcd8ca6e9b6e331b3bdfa372d8987b622276f7025 AS ubi9-packages | ||
shaun-nx marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| FROM ubi-minimal AS ubi-nginx | ||
|
|
||
| # renovate: datasource=github-tags depName=nginx/agent | ||
| ARG NGINX_AGENT_VERSION=v3.3.1 | ||
| ARG NJS_DIR | ||
| ARG NGINX_CONF_DIR | ||
| ARG BUILD_AGENT | ||
|
|
||
| LABEL name="NGINX Gateway Fabric NGINX" \ | ||
| maintainer="[email protected]" \ | ||
shaun-nx marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| vendor="NGINX Inc" \ | ||
shaun-nx marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
| summary="NGINX for NGINX Gateway Fabric" \ | ||
| description="NGINX data plane for NGINX Gateway Fabric Gateway API implementation" \ | ||
| org.nginx.ngf.image.build.agent="${BUILD_AGENT}" \ | ||
| io.k8s.description="NGINX data plane for NGINX Gateway Fabric Gateway API implementation" \ | ||
| io.openshift.tags="nginx,gateway,kubernetes,openshift" | ||
|
|
||
| COPY --link --chown=101:1001 LICENSE /licenses/ | ||
|
|
||
| # Install NGINX with OTEL support using the same approach as NGINX IC | ||
shaun-nx marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
| RUN --mount=type=bind,from=nginx-files,src=nginx_signing.key,target=/tmp/nginx_signing.key \ | ||
| --mount=type=bind,from=nginx-files,src=nginx.repo,target=/etc/yum.repos.d/nginx.repo \ | ||
| --mount=type=bind,from=nginx-files,src=agent.repo,target=/etc/yum.repos.d/agent.repo \ | ||
| --mount=type=bind,from=ubi9-packages,src=/,target=/ubi-bin/ \ | ||
| # Import NGINX signing key | ||
| rpm --import /tmp/nginx_signing.key \ | ||
| # Install c-ares from the dependencies image (contains required libs) | ||
| && rpm -Uvh /ubi-bin/c-ares-*.rpm \ | ||
| # Create nginx user with consistent UID/GID | ||
| && groupadd -g 1001 nginx \ | ||
| && useradd -r -u 101 -g nginx -s /sbin/nologin -d /var/cache/nginx nginx \ | ||
| # Install NGINX and modules including OTEL | ||
| && microdnf --nodocs install -y nginx nginx-module-njs nginx-module-otel \ | ||
| # Install nginx-agent | ||
| && microdnf --nodocs install -y nginx-agent-${NGINX_AGENT_VERSION#v}* \ | ||
| # Clean up (only remove what we can) | ||
| && microdnf clean all \ | ||
| && rm -rf /var/cache/yum | ||
|
|
||
| # Configure directories and logging | ||
| RUN mkdir -p /usr/lib/nginx/modules /var/run/nginx /usr/lib64/nginx/modules \ | ||
| # Forward request and error logs to docker log collector | ||
| && ln -sf /dev/stdout /var/log/nginx/access.log \ | ||
| && ln -sf /dev/stderr /var/log/nginx/error.log \ | ||
| && cp -r /usr/lib64/nginx/modules/ngx_* /usr/lib/nginx/modules/ \ | ||
| # Set proper permissions for nginx user | ||
| && chown -R 101:1001 /etc/nginx /var/cache/nginx /var/log/nginx /var/run/nginx | ||
shaun-nx marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
|
|
||
| # Copy configuration files and scripts | ||
| COPY build/entrypoint.sh /agent/entrypoint.sh | ||
| COPY ${NJS_DIR}/httpmatches.js /usr/lib/nginx/modules/njs/httpmatches.js | ||
shaun-nx marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
| COPY ${NGINX_CONF_DIR}/nginx.conf /etc/nginx/nginx.conf | ||
| COPY ${NGINX_CONF_DIR}/grpc-error-locations.conf /etc/nginx/grpc-error-locations.conf | ||
| COPY ${NGINX_CONF_DIR}/grpc-error-pages.conf /etc/nginx/grpc-error-pages.conf | ||
|
|
||
| # Set executable permissions | ||
| RUN chmod +x /agent/entrypoint.sh && chown 101:1001 /agent/entrypoint.sh | ||
|
||
|
|
||
| # Switch to non-root user | ||
| USER 101:1001 | ||
shaun-nx marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| ENTRYPOINT ["/agent/entrypoint.sh"] | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,79 @@ | ||
| # syntax=docker/dockerfile:1.18 | ||
| FROM scratch AS nginx-files | ||
|
|
||
| # NGINX Plus repo and key files (must be provided at build time) | ||
| ADD --link --chown=101:1001 https://cs.nginx.com/static/files/plus-9.repo nginx-plus.repo | ||
| ADD --link --chown=101:1001 https://nginx.org/keys/nginx_signing.key nginx_signing.key | ||
| ADD --link --chown=101:1001 build/ubi/repos/agent.repo agent.repo | ||
| ADD --link --chown=101:1001 nginx-repo.crt nginx-repo.crt | ||
| ADD --link --chown=101:1001 nginx-repo.key nginx-repo.key | ||
|
|
||
| FROM redhat/ubi9-minimal:9.6 AS ubi-minimal | ||
shaun-nx marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
|
|
||
| FROM ghcr.io/nginx/dependencies/nginx-ubi:ubi9@sha256:01a32246761b9bbe47a6a29bcd8ca6e9b6e331b3bdfa372d8987b622276f7025 AS ubi9-packages | ||
|
|
||
| FROM ubi-minimal AS ubi-nginxplus | ||
|
|
||
| # renovate: datasource=github-tags depName=nginx/agent | ||
| ARG NGINX_AGENT_VERSION=v3.3.1 | ||
| ARG NJS_DIR | ||
| ARG NGINX_CONF_DIR | ||
| ARG BUILD_AGENT | ||
|
|
||
| LABEL name="NGINX Gateway Fabric NGINX Plus" \ | ||
| maintainer="[email protected]" \ | ||
| vendor="NGINX Inc" \ | ||
| summary="NGINX Plus for NGINX Gateway Fabric" \ | ||
| description="NGINX Plus data plane for NGINX Gateway Fabric Gateway API implementation" \ | ||
| org.nginx.ngf.image.build.agent="${BUILD_AGENT}" \ | ||
| io.k8s.description="NGINX Plus data plane for NGINX Gateway Fabric Gateway API implementation" \ | ||
| io.openshift.tags="nginx-plus,gateway,kubernetes,openshift" | ||
|
|
||
| COPY --link --chown=101:1001 LICENSE /licenses/ | ||
|
|
||
| # Install NGINX Plus and modules | ||
| RUN --mount=type=bind,from=nginx-files,src=nginx-plus.repo,target=/etc/yum.repos.d/nginx-plus.repo \ | ||
| --mount=type=bind,from=nginx-files,src=agent.repo,target=/etc/yum.repos.d/agent.repo \ | ||
| --mount=type=bind,from=nginx-files,src=nginx_signing.key,target=/tmp/nginx_signing.key \ | ||
| --mount=type=bind,from=ubi9-packages,src=/,target=/ubi-bin/ \ | ||
| --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ | ||
| --mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ | ||
| # Install shadow-utils for useradd and subscription-manager for repo access | ||
shaun-nx marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| microdnf --nodocs install -y shadow-utils subscription-manager \ | ||
| && rpm --import /tmp/nginx_signing.key \ | ||
| # Install c-ares from the dependencies image (contains required libs) | ||
| && rpm -Uvh /ubi-bin/c-ares-*.rpm \ | ||
| # Create nginx user with consistent UID/GID | ||
| && groupadd -g 1001 nginx \ | ||
| && useradd -r -u 101 -g nginx -s /sbin/nologin -d /var/cache/nginx nginx \ | ||
| # Install NGINX Plus and modules (njs, otel) | ||
| && microdnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel \ | ||
| # Install nginx-agent | ||
| && microdnf --nodocs install -y nginx-agent-${NGINX_AGENT_VERSION#v}* \ | ||
| # Clean up | ||
| && microdnf clean all \ | ||
| && rm -rf /var/cache/yum | ||
|
|
||
| # Configure directories and logging | ||
| RUN mkdir -p /usr/lib/nginx/modules /var/run/nginx /usr/lib64/nginx/modules \ | ||
| # Forward request and error logs to docker log collector | ||
| && ln -sf /dev/stdout /var/log/nginx/access.log \ | ||
| && ln -sf /dev/stderr /var/log/nginx/error.log \ | ||
| && cp -r /usr/lib64/nginx/modules/ngx_* /usr/lib/nginx/modules/ \ | ||
| # Set proper permissions for nginx user | ||
| && chown -R 101:1001 /etc/nginx /var/cache/nginx /var/log/nginx /var/run/nginx | ||
shaun-nx marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
|
|
||
| # Copy configuration files and scripts | ||
| COPY build/entrypoint.sh /agent/entrypoint.sh | ||
| COPY ${NJS_DIR}/httpmatches.js /usr/lib/nginx/modules/njs/httpmatches.js | ||
| COPY ${NGINX_CONF_DIR}/nginx.conf /etc/nginx/nginx.conf | ||
| COPY ${NGINX_CONF_DIR}/grpc-error-locations.conf /etc/nginx/grpc-error-locations.conf | ||
| COPY ${NGINX_CONF_DIR}/grpc-error-pages.conf /etc/nginx/grpc-error-pages.conf | ||
|
|
||
| # Set executable permissions | ||
| RUN chmod +x /agent/entrypoint.sh && chown 101:1001 /agent/entrypoint.sh | ||
shaun-nx marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
|
|
||
| # Switch to non-root user | ||
| USER 101:1001 | ||
|
|
||
| ENTRYPOINT ["/agent/entrypoint.sh"] | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| [agent] | ||
| name=agent repo | ||
| baseurl=https://packages.nginx.org/nginx-agent/centos/9/$basearch/ | ||
| gpgcheck=1 | ||
| enabled=1 | ||
| module_hotfixes=true |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| [nginx] | ||
| name=nginx repo | ||
| baseurl=https://packages.nginx.org/nginx/mainline/centos/9/$basearch/ | ||
| gpgcheck=1 | ||
| enabled=1 | ||
| module_hotfixes=true |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
|
|
||
| # Binaries for programs and plugins | ||
| *.exe | ||
| *.exe~ | ||
| *.dll | ||
| *.so | ||
| *.dylib | ||
| bin | ||
|
|
||
| # editor and IDE paraphernalia | ||
| .idea | ||
| *.swp | ||
| *.swo | ||
| *~ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| # Build the manager binary | ||
| FROM quay.io/operator-framework/helm-operator:v1.41.1 | ||
|
|
||
| ENV HOME=/opt/helm | ||
| COPY watches.yaml ${HOME}/watches.yaml | ||
| COPY helm-charts ${HOME}/helm-charts | ||
| WORKDIR ${HOME} |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.