Skip to content

Commit 31efb1a

Browse files
dekobondekobon
authored
feat: update nginx plus image builds to use nginx plus base images (#449)
* refactor: simplify docker build process This change does the following: * Migrates to using the official NGINX Plus Docker images as base images * Removes the distinction between BuildKit and non-BuildKit builds for Plus images (OSS never had this) * Adds support for license validation for Plus images * Introduces a multi-stage build for Plus images Signed-off-by: Elijah Zupancic <[email protected]> * chore: remove deprecated version parameter from docker-compose.yaml Signed-off-by: Elijah Zupancic <[email protected]> * fix: use nginx version reported by binary instead of env var By using the version reported by NGINX rather than the environment variable it allows for a more reliable setting and less complexity. Signed-off-by: Elijah Zupancic <[email protected]> --------- Signed-off-by: Elijah Zupancic <[email protected]>
1 parent a9847e5 commit 31efb1a

13 files changed

+135
-424
lines changed

‎Dockerfile.buildkit.plus‎

Lines changed: 0 additions & 104 deletions
This file was deleted.

‎Dockerfile.latest-njs‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,18 @@
33
# source, and installs it.
44
FROM nginx-s3-gateway
55

6+
# Package names with trailing dashes are intentionally specified in order to
7+
# suppress their install as build dependencies. Those libraries are being
8+
# provided by the inherited container images and we do not want to mess with
9+
# them.
610
RUN set -eux \
7-
export DEBIAN_FRONTEND=noninteractive; \
11+
export DEBIAN_FRONTEND=noninteractive; \
12+
export NGINX_VERSION="$(nginx -V 2>&1 | grep 'nginx version' | awk -F'[/ ]' '{print $4}')"; \
813
apt-get update -qq; \
9-
apt-get install --no-install-recommends --no-install-suggests --yes make gcc libc6-dev curl expect libpcre2-dev libpcre3-dev libedit-dev libreadline-dev libssl-dev libpcre2-posix3 libxml2-dev libxslt1-dev zlib1g-dev; \
14+
apt-get install --no-install-recommends --no-install-suggests --yes --allow-change-held-packages \
15+
make gcc libc6-dev curl expect libpcre2-dev \
16+
libpcre3-dev libedit-dev libreadline-dev libssl-dev libpcre2-posix3 libxml2-dev libxslt1-dev zlib1g-dev \
17+
libgcrypt20 libicu-dev libssl-dev libxslt1-dev- libxml2-dev-; \
1018
mkdir -p /tmp/nginx /tmp/njs-latest; \
1119
curl --retry 6 --location "https://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz" \
1220
| gunzip | tar --extract --strip-components=1 --directory /tmp/nginx; \

‎Dockerfile.oss‎

Lines changed: 9 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,4 @@
1-
FROM nginx:1.29.0@sha256:f5c017fb33c6db484545793ffb67db51cdd7daebee472104612f73a85063f889
2-
3-
# NJS env vars
4-
ENV NJS_VERSION=0.9.0
5-
ENV NJS_RELEASE=1~bookworm
1+
FROM nginx:1.29.1@sha256:d5f28ef21aabddd098f3dbc21fe5b7a7d7a184720bc07da0b6c9b9820e97f25e
62

73
# Proxy cache env vars
84
ENV PROXY_CACHE_MAX_SIZE=10g
@@ -27,20 +23,20 @@ ENV PREFIX_LEADING_DIRECTORY_PATH=""
2723
# 3. Adding a directory for proxied objects to be stored.
2824
# 4. Replacing the entrypoint script with a modified version that explicitly sets resolvers.
2925

26+
# Note: the PKG_RELEASE environment variable is inherited
27+
3028
RUN set -x \
31-
&& echo "deb [signed-by=/etc/apt/keyrings/nginx-archive-keyring.gpg] https://nginx.org/packages/mainline/debian/ $(echo $PKG_RELEASE | cut -f2 -d~) nginx" >> /etc/apt/sources.list.d/nginx.list; \
32-
apt-get update \
29+
&& echo "deb [signed-by=/etc/apt/keyrings/nginx-archive-keyring.gpg] https://nginx.org/packages/mainline/debian/ $(echo $PKG_RELEASE | cut -f2 -d~) nginx" >> /etc/apt/sources.list.d/nginx.list \
30+
&& apt-get update \
3331
&& apt-get install --no-install-recommends --no-install-suggests -y \
34-
libedit2 \
35-
nginx-module-njs=${NGINX_VERSION}+${NJS_VERSION}-${NJS_RELEASE} \
36-
&& apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx.list
32+
libedit2 nginx-module-njs nginx-module-xslt \
33+
&& apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/*
3734

38-
COPY oss/etc /etc
35+
COPY oss/etc/nginx /etc/nginx
3936
COPY common/etc /etc
40-
COPY common/docker-entrypoint.sh /docker-entrypoint.sh
4137
COPY common/docker-entrypoint.d /docker-entrypoint.d/
4238

4339
RUN set -x \
4440
&& mkdir -p /var/cache/nginx/s3_proxy \
4541
&& chown nginx:nginx /var/cache/nginx/s3_proxy \
46-
&& chmod -R -v +x /docker-entrypoint.sh /docker-entrypoint.d/*.sh;
42+
&& find /docker-entrypoint.d -type f \( -name '*.sh' -or -name '*.envsh' \) -exec chmod -v +x {} \;

‎Dockerfile.plus‎

Lines changed: 19 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,7 @@
1-
FROM debian:bookworm-slim@sha256:b1211f6d19afd012477bd34fdcabb6b663d680e0f4b0537da6e6b0fd057a3ec3
1+
# Pull from NGINX image that provides the XSLT module and supporting libraries
2+
FROM private-registry.nginx.com/nginx-plus/modules:r35-xslt-debian@sha256:3eaa85dca47e31b9a6648bcaf6034f076cd59be9b1510b25fd1bbe1144f0bb48 AS xslt
23

3-
# Create RELEASE argument
4-
ARG RELEASE=bookworm
5-
6-
# NJS env vars
7-
ENV NGINX_VERSION=34
8-
ENV NGINX_PKG_RELEASE=1~${RELEASE}
9-
ENV NJS_VERSION=0.9.0
10-
ENV NJS_PKG_RELEASE=1~${RELEASE}
4+
FROM private-registry.nginx.com/nginx-plus/base:r35-debian-bookworm@sha256:9a82ad3f96d58be861257efd621f215d599e226ebedd24d9f3211bdd743c3c27
115

126
# Proxy cache env vars
137
ENV PROXY_CACHE_MAX_SIZE=10g
@@ -26,76 +20,25 @@ ENV DIRECTORY_LISTING_PATH_PREFIX=""
2620
ENV STRIP_LEADING_DIRECTORY_PATH=""
2721
ENV PREFIX_LEADING_DIRECTORY_PATH=""
2822

29-
# We create an NGINX Plus image based on the official NGINX Plus Dockerfiles (https://gist.github.com/nginx-gists/36e97fc87efb5cf0039978c8e41a34b5) and modify it by:
30-
# 1. Explicitly installing the version of njs coded in the environment variable above.
31-
# 2. Adding configuration files needed for proxying private S3 buckets.
32-
# 3. Adding a directory for proxied objects to be stored.
33-
# 4. Adding the entrypoint scripts found in the base NGINX OSS Docker image with a modified version that explicitly sets resolvers.
34-
35-
# Download your NGINX license certificate and key from the F5 customer portal (https://account.f5.com) and copy it to the build context
36-
COPY plus/etc/ssl /etc/ssl
37-
38-
RUN set -x \
39-
# Create nginx user/group first, to be consistent throughout Docker variants
40-
&& groupadd --system --gid 101 nginx \
41-
&& useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \
42-
&& apt-get update \
43-
&& apt-get install --no-install-recommends --no-install-suggests -y ca-certificates gnupg1 lsb-release \
44-
&& \
45-
NGINX_GPGKEYS="573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62 8540A6F18833A80E9C1653A42FD21310B49F6B46 9E9BE90EACBCDE69FE9B204CBCDCD8A38D88A2B3"; \
46-
NGINX_GPGKEY_PATH=/etc/apt/keyrings/nginx-archive-keyring.gpg; \
47-
export GNUPGHOME="$(mktemp -d)"; \
48-
found=''; \
49-
for NGINX_GPGKEY in $NGINX_GPGKEYS; do \
50-
for server in \
51-
hkp://keyserver.ubuntu.com:80 \
52-
pgp.mit.edu \
53-
; do \
54-
echo "Fetching GPG key $NGINX_GPGKEY from $server"; \
55-
gpg1 --keyserver "$server" --keyserver-options timeout=10 --recv-keys "$NGINX_GPGKEY" && found=yes && break; \
56-
done; \
57-
test -z "$found" && echo >&2 "error: failed to fetch GPG key $NGINX_GPGKEY" && exit 1; \
58-
done; \
59-
gpg1 --export $NGINX_GPGKEYS > "$NGINX_GPGKEY_PATH" ; \
60-
rm -rf "$GNUPGHOME"; \
61-
apt-get remove --purge --auto-remove -y gnupg1 && rm -rf /var/lib/apt/lists/* \
62-
# Install the latest release of NGINX Plus and/or NGINX Plus modules (written and maintained by F5)
63-
&& nginxPackages=" \
64-
nginx-plus=${NGINX_VERSION}-${NGINX_PKG_RELEASE} \
65-
nginx-plus-module-njs=${NGINX_VERSION}+${NJS_VERSION}-${NJS_PKG_RELEASE} \
66-
nginx-plus-module-xslt=${NGINX_VERSION}-${NGINX_PKG_RELEASE} \
67-
" \
68-
&& echo "Acquire::https::pkgs.nginx.com::Verify-Peer \"true\";" > /etc/apt/apt.conf.d/90nginx \
69-
&& echo "Acquire::https::pkgs.nginx.com::Verify-Host \"true\";" >> /etc/apt/apt.conf.d/90nginx \
70-
&& echo "Acquire::https::pkgs.nginx.com::SslCert \"/etc/ssl/nginx/nginx-repo.crt\";" >> /etc/apt/apt.conf.d/90nginx \
71-
&& echo "Acquire::https::pkgs.nginx.com::SslKey \"/etc/ssl/nginx/nginx-repo.key\";" >> /etc/apt/apt.conf.d/90nginx \
72-
&& echo "deb [signed-by=$NGINX_GPGKEY_PATH] https://pkgs.nginx.com/plus/debian `lsb_release -cs` nginx-plus\n" > /etc/apt/sources.list.d/nginx-plus.list \
73-
&& apt-get update \
74-
&& apt-get install --no-install-recommends --no-install-suggests -y $nginxPackages curl gettext-base \
75-
&& apt-get remove --purge -y lsb-release \
76-
&& apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx-plus.list \
77-
&& rm -rf /etc/apt/apt.conf.d/90nginx /etc/ssl/nginx \
78-
# Forward request logs to Docker log collector
79-
&& ln -sf /dev/stdout /var/log/nginx/access.log \
80-
&& ln -sf /dev/stderr /var/log/nginx/error.log
81-
82-
EXPOSE 80
83-
84-
STOPSIGNAL SIGTERM
85-
86-
CMD ["nginx", "-g", "daemon off;"]
87-
8823
# Copy files from the OSS NGINX Docker container such that the container
8924
# startup is the same.
25+
COPY --from=xslt / /
26+
9027
COPY plus/etc/nginx /etc/nginx
9128
COPY common/etc /etc
92-
COPY common/docker-entrypoint.sh /docker-entrypoint.sh
9329
COPY common/docker-entrypoint.d /docker-entrypoint.d/
94-
COPY plus/docker-entrypoint.d /docker-entrypoint.d/
95-
96-
RUN set -x \
97-
&& mkdir -p /var/cache/nginx/s3_proxy \
98-
&& chown nginx:nginx /var/cache/nginx/s3_proxy \
99-
&& chmod -R -v +x /docker-entrypoint.sh /docker-entrypoint.d/*.sh;
10030

101-
ENTRYPOINT ["/docker-entrypoint.sh"]
31+
RUN <<EOF
32+
set -eux
33+
apt-get update -qq
34+
apt-get install --no-install-recommends --no-install-suggests -y \
35+
gettext-base libxml2 libxslt1.1
36+
apt-get remove --purge --auto-remove -y
37+
rm -rf /usr/share/doc/ /usr/share/lintian /var/lib/apt/lists
38+
39+
cat /etc/nginx/nginx-license.conf >> /etc/nginx/nginx.conf; \
40+
rm /etc/nginx/nginx-license.conf; \
41+
mkdir -p /var/cache/nginx/s3_proxy; \
42+
chown nginx:nginx /var/cache/nginx/s3_proxy; \
43+
find /docker-entrypoint.d -type f \( -name '*.sh' -or -name '*.envsh' \) -exec chmod -v +x {} \;
44+
EOF

‎common/docker-entrypoint.d/00-check-for-required-env.sh‎

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -130,21 +130,3 @@ fi
130130
if [ $failed -gt 0 ]; then
131131
exit 1
132132
fi
133-
134-
echo "S3 Backend Environment"
135-
echo "Service: ${S3_SERVICE:-s3}"
136-
echo "Access Key ID: ${AWS_ACCESS_KEY_ID}"
137-
echo "Origin: ${S3_SERVER_PROTO}://${S3_BUCKET_NAME}.${S3_SERVER}:${S3_SERVER_PORT}"
138-
echo "Region: ${S3_REGION}"
139-
echo "Addressing Style: ${S3_STYLE}"
140-
echo "AWS Signatures Version: v${AWS_SIGS_VERSION}"
141-
echo "DNS Resolvers: ${DNS_RESOLVERS}"
142-
echo "Directory Listing Enabled: ${ALLOW_DIRECTORY_LIST}"
143-
echo "Directory Listing Path Prefix: ${DIRECTORY_LISTING_PATH_PREFIX}"
144-
echo "Provide Index Pages Enabled: ${PROVIDE_INDEX_PAGE}"
145-
echo "Append slash for directory enabled: ${APPEND_SLASH_FOR_POSSIBLE_DIRECTORY}"
146-
echo "Stripping the following headers from responses: x-amz-;${HEADER_PREFIXES_TO_STRIP}"
147-
echo "Allow the following headers from responses (these take precedence over the above): ${HEADER_PREFIXES_ALLOWED}"
148-
echo "CORS Enabled: ${CORS_ENABLED}"
149-
echo "CORS Allow Private Network Access: ${CORS_ALLOW_PRIVATE_NETWORK_ACCESS}"
150-
echo "Proxy cache using stale setting: ${PROXY_CACHE_USE_STALE}"

0 commit comments

Comments
 (0)