Skip to content
Snippets Groups Projects
Select Git revision
  • d3ac5b0b9dd316db5797e13789b5b8c3e8fa9ff6
  • master default protected
  • dwmcallister-patch-1
  • 520-fix-wsl
  • tune-worker-processes
  • alpine-nginxorg
  • 1.29.0
  • 1.28.0
  • 1.27.5
  • 1.27.3
  • 1.27.2
  • 1.27.0
  • 1.26.1
  • 1.26.0
  • 1.25.5
  • 1.25.4
  • 1.25.3
  • 1.25.2
  • 1.25.1
  • 1.25.0
  • 1.24.0
  • 1.23.3
  • 1.23.4
  • 1.23.2
  • 1.22.1
  • 1.23.1
26 results

Dockerfile-alpine-slim.template

Blame
  • user avatar
    Konstantin Pavlov authored and Konstantin Pavlov committed
    d8e91763
    History
    user avatar d8e91763
    Dockerfile-alpine-slim.template 4.99 KiB
    FROM alpine:%%ALPINE_VERSION%%
    
    LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
    
    ENV NGINX_VERSION  %%NGINX_VERSION%%
    ENV PKG_RELEASE    %%PKG_RELEASE%%
    ENV DYNPKG_RELEASE %%DYNPKG_RELEASE%%
    
    RUN set -x \
    # create nginx user/group first, to be consistent throughout docker variants
        && addgroup -g 101 -S nginx \
        && adduser -S -D -H -u 101 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx \
        && apkArch="$(cat /etc/apk/arch)" \
        && nginxPackages="%%PACKAGES%%
        " \
    # install prerequisites for public key and pkg-oss checks
        && apk add --no-cache --virtual .checksum-deps \
            openssl \
        && case "$apkArch" in \
            x86_64|aarch64) \
    # arches officially built by upstream
                set -x \
                && KEY_SHA512="e09fa32f0a0eab2b879ccbbc4d0e4fb9751486eedda75e35fac65802cc9faa266425edf83e261137a2f4d16281ce2c1a5f4502930fe75154723da014214f0655" \
                && wget -O /tmp/nginx_signing.rsa.pub https://nginx.org/keys/nginx_signing.rsa.pub \
                && if echo "$KEY_SHA512 */tmp/nginx_signing.rsa.pub" | sha512sum -c -; then \
                    echo "key verification succeeded!"; \
                    mv /tmp/nginx_signing.rsa.pub /etc/apk/keys/; \
                else \
                    echo "key verification failed!"; \
                    exit 1; \
                fi \
                && apk add -X "%%PACKAGEREPO%%v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \
                ;; \
            *) \
    # we're on an architecture upstream doesn't officially build for
    # let's build binaries from the published packaging sources
                set -x \
                && tempDir="$(mktemp -d)" \
                && chown nobody:nobody $tempDir \
                && apk add --no-cache --virtual .build-deps \
                    gcc \
                    libc-dev \
                    make \
                    openssl-dev \
                    pcre2-dev \
                    zlib-dev \
                    linux-headers \
                    bash \
                    alpine-sdk \
                    findutils \
                    curl \
                && su nobody -s /bin/sh -c " \
                    export HOME=${tempDir} \
                    && cd ${tempDir} \
                    && curl -f -L -O https://github.com/nginx/pkg-oss/archive/%%REVISION%%.tar.gz \
                    && PKGOSSCHECKSUM=\"%%PKGOSSCHECKSUM%% *%%REVISION%%.tar.gz\" \
                    && if [ \"\$(openssl sha512 -r %%REVISION%%.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \
                        echo \"pkg-oss tarball checksum verification succeeded!\"; \
                    else \
                        echo \"pkg-oss tarball checksum verification failed!\"; \
                        exit 1; \
                    fi \
                    && tar xzvf %%REVISION%%.tar.gz \
                    && cd pkg-oss-%%REVISION%% \
                    && cd alpine \
                    && make %%BUILDTARGET%% \
                    && apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \
                    && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \
                    " \
                && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \
                && apk del --no-network .build-deps \
                && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \
                ;; \
        esac \
    # remove checksum deps
        && apk del --no-network .checksum-deps \
    # if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
        && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
        && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
    # Bring in gettext so we can get `envsubst`, then throw
    # the rest away. To do this, we need to install `gettext`
    # then move `envsubst` out of the way so `gettext` can
    # be deleted completely, then move `envsubst` back.
        && apk add --no-cache --virtual .gettext gettext \
        && mv /usr/bin/envsubst /tmp/ \
        \
        && runDeps="$( \
            scanelf --needed --nobanner /tmp/envsubst \
                | awk '{ gsub(/,/, "\nso:", $2); print "so:" $2 }' \
                | sort -u \
                | xargs -r apk info --installed \
                | sort -u \
        )" \
        && apk add --no-cache $runDeps \
        && apk del --no-network .gettext \
        && mv /tmp/envsubst /usr/local/bin/ \
    # Bring in tzdata so users could set the timezones through the environment
    # variables
        && apk add --no-cache tzdata \
    # forward request and error logs to docker log collector
        && ln -sf /dev/stdout /var/log/nginx/access.log \
        && ln -sf /dev/stderr /var/log/nginx/error.log \
    # create a docker-entrypoint.d directory
        && mkdir /docker-entrypoint.d
    
    COPY docker-entrypoint.sh /
    COPY 10-listen-on-ipv6-by-default.sh /docker-entrypoint.d
    COPY 15-local-resolvers.envsh /docker-entrypoint.d
    COPY 20-envsubst-on-templates.sh /docker-entrypoint.d
    COPY 30-tune-worker-processes.sh /docker-entrypoint.d
    ENTRYPOINT ["/docker-entrypoint.sh"]
    
    EXPOSE 80
    
    STOPSIGNAL SIGQUIT
    
    CMD ["nginx", "-g", "daemon off;"]