CORS_ALLOW_PRIVATE_NETWORK_ACCESS is not supported in DockerHub images

[vinzee]

Bug Overview

I'm trying to use the nginx s3 gateway to serve static assets (images, etc). I want to be able to render these images on grafana and so I want to enable private network access so that chrome can show them.

When I create a new container with the image nginxinc/nginx-s3-gateway/nginx-oss-s3-gateway:latest with CORS_ENABLED=true & CORS_ALLOW_PRIVATE_NETWORK_ACCESS=true, the env var and thus the corresponding header is not set.

References:

• https://hub.docker.com/r/nginxinc/nginx-s3-gateway
• https://github.com/orgs/nginxinc/packages/container/package/nginx-s3-gateway%2Fnginx-oss-s3-gateway

Expected Behavior

CORS_ALLOW_PRIVATE_NETWORK_ACCESS should be set correctly.

logs should show the following:

CORS Allow Private Network Access: true

Options response should have Access-Control-Allow-Private-Network: true:

curl -X OPTIONS -i http://localhost:8080/screenshot.png
HTTP/1.1 204 No Content
Server: nginx
Date: Wed, 12 Nov 2025 19:08:02 GMT
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Access-Control-Max-Age: 1728000
Access-Control-Allow-Private-Network: true
Content-Type: text/plain; charset=utf-8
Content-Length: 0

Steps to Reproduce the Bug

Doesnt work with images from DockerHub

docker run --env-file ./settings --publish 80:80 --name nginx-s3-gateway \
  nginxinc/nginx-s3-gateway/nginx-oss-s3-gateway:latest

logs: (the env variable is not parsed correctly, notice the missing value)

CORS Allow Private Network Access: 

Options response should have Access-Control-Allow-Private-Network: true:

curl -X OPTIONS -i http://localhost:8080/screenshot.png
HTTP/1.1 204 No Content
Server: nginx
Date: Wed, 12 Nov 2025 19:08:02 GMT
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Access-Control-Max-Age: 1728000
Content-Type: text/plain; charset=utf-8
Content-Length: 0

#### Settings:

```sh
S3_BUCKET_NAME=<>
AWS_ACCESS_KEY_ID=<>
AWS_SECRET_ACCESS_KEY=<>
AWS_SESSION_TOKEN=<>
S3_SERVER=s3.<>.amazonaws.com
S3_SERVER_PORT=443
S3_SERVER_PROTO=https
S3_REGION=<>
S3_STYLE=virtual
S3_SERVICE=s3
DEBUG=true
AWS_SIGS_VERSION=4
ALLOW_DIRECTORY_LIST=true
PROVIDE_INDEX_PAGE=true
APPEND_SLASH_FOR_POSSIBLE_DIRECTORY=false
CORS_ENABLED=true
CORS_ALLOW_PRIVATE_NETWORK_ACCESS=true

Environment Details

• Version of the S3 container used: nginxinc/nginx-s3-gateway/nginx-oss-s3-gateway:latest
• Commit/Tag (if building the NGINX S3 gateway from source): n/a
• Version of NGINX Open Source or NGINX Plus: oss
• Version of NGINX JavaScript: n/a
• Target deployment platforms : local
• S3 backend implementation: AWS
• Authentication method: IAM

Additional Context

No response