Fijxu/nginx-ktls
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

set up Dockerfiles to build single-layer images, added ca-certificates

Browse source
This commit is contained in:
Ricard Bejarano 2020-03-18 17:03:24 +01:00
parent 5430f0e1e3
commit 0fcc34be2b
No known key found for this signature in database
GPG key ID: DD6ACC8CE87FD20A
3 changed files with 49 additions and 48 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

54
Dockerfile.glibc
View file

@ -9,9 +9,9 @@ ARG ZLIB_CHECKSUM="c3e5e9fdd5004dcb542feda5ee4f0ff0744628baf8ed2dd5d66f8ca1197cb
ARG OPENSSL_VERSION="1.1.1d" ARG OPENSSL_VERSION="1.1.1d"
ARG OPENSSL_CHECKSUM="1e3a91bc1f9dfce01af26026f856e064eab4c8ee0a8f457b5ae30b40b8b711f2" ARG OPENSSL_CHECKSUM="1e3a91bc1f9dfce01af26026f856e064eab4c8ee0a8f457b5ae30b40b8b711f2"
ARG NGINX_VERSION="1.17.9" ARG VERSION="1.17.9"
ARG NGINX_CHECKSUM="7dd65d405c753c41b7fdab9415cfb4bdbaf093ec6d9f7432072d52cb7bcbb689" ARG CHECKSUM="7dd65d405c753c41b7fdab9415cfb4bdbaf093ec6d9f7432072d52cb7bcbb689"
ARG NGINX_CONFIG="\ ARG CONFIG="\
--with-cc-opt='-fstack-protector-all' \ --with-cc-opt='-fstack-protector-all' \
--with-ld-opt='-Wl,-z,relro,-z,now' \ --with-ld-opt='-Wl,-z,relro,-z,now' \
--sbin-path=/nginx \ --sbin-path=/nginx \
@ -38,44 +38,42 @@ ARG NGINX_CONFIG="\
ADD https://ftp.pcre.org/pub/pcre/pcre-$PCRE_VERSION.tar.gz /tmp/pcre.tar.gz ADD https://ftp.pcre.org/pub/pcre/pcre-$PCRE_VERSION.tar.gz /tmp/pcre.tar.gz
ADD https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz /tmp/openssl.tar.gz ADD https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz /tmp/openssl.tar.gz
ADD https://zlib.net/zlib-$ZLIB_VERSION.tar.gz /tmp/zlib.tar.gz ADD https://zlib.net/zlib-$ZLIB_VERSION.tar.gz /tmp/zlib.tar.gz
ADD https://nginx.org/download/nginx-$NGINX_VERSION.tar.gz /tmp/nginx.tar.gz ADD https://nginx.org/download/nginx-$VERSION.tar.gz /tmp/nginx.tar.gz
RUN [ "$PCRE_CHECKSUM" = "$(sha256sum /tmp/pcre.tar.gz | awk '{print $1}')" ] && \ RUN [ "$PCRE_CHECKSUM" = "$(sha256sum /tmp/pcre.tar.gz | awk '{print $1}')" ] && \
[ "$ZLIB_CHECKSUM" = "$(sha256sum /tmp/zlib.tar.gz | awk '{print $1}')" ] && \ [ "$ZLIB_CHECKSUM" = "$(sha256sum /tmp/zlib.tar.gz | awk '{print $1}')" ] && \
[ "$OPENSSL_CHECKSUM" = "$(sha256sum /tmp/openssl.tar.gz | awk '{print $1}')" ] && \ [ "$OPENSSL_CHECKSUM" = "$(sha256sum /tmp/openssl.tar.gz | awk '{print $1}')" ] && \
[ "$NGINX_CHECKSUM" = "$(sha256sum /tmp/nginx.tar.gz | awk '{print $1}')" ] && \ [ "$CHECKSUM" = "$(sha256sum /tmp/nginx.tar.gz | awk '{print $1}')" ] && \
tar -C /tmp -xf /tmp/pcre.tar.gz && \ tar -C /tmp -xf /tmp/pcre.tar.gz && \
tar -C /tmp -xf /tmp/zlib.tar.gz && \ tar -C /tmp -xf /tmp/zlib.tar.gz && \
tar -C /tmp -xf /tmp/openssl.tar.gz && \ tar -C /tmp -xf /tmp/openssl.tar.gz && \
tar -C /tmp -xf /tmp/nginx.tar.gz && \ tar -C /tmp -xf /tmp/nginx.tar.gz && \
mv /tmp/nginx-$NGINX_VERSION /tmp/nginx apt update && \
apt install -y gcc g++ perl make ca-certificates && \
cd /tmp/nginx-$VERSION && \
./configure $CONFIG && \
make
RUN cd /tmp/nginx && \ RUN mkdir -p /rootfs/etc/ssl/certs /rootfs/lib/x86_64-linux-gnu/ /rootfs/lib64/ /rootfs/tmp && \
apt update && \ cp /tmp/nginx-$VERSION/objs/nginx /rootfs/ && \
apt install -y gcc g++ perl make && \ cp \
./configure $NGINX_CONFIG && \ /lib/x86_64-linux-gnu/libc.so.6 \
make && \ /lib/x86_64-linux-gnu/libcrypt.so.1 \
echo "nogroup:*:100:nobody" > /tmp/group && \ /lib/x86_64-linux-gnu/libdl.so.2 \
echo "nobody:*:100:100:::" > /tmp/passwd && \ /lib/x86_64-linux-gnu/libnss_files.so.2 \
mkdir -p /tmp/tmp /lib/x86_64-linux-gnu/libnss_dns.so.2 \
/lib/x86_64-linux-gnu/libpthread.so.0 \
/lib/x86_64-linux-gnu/libresolv.so.2 \
/rootfs/lib/x86_64-linux-gnu/ && \
cp /lib64/ld-linux-x86-64.so.2 /rootfs/lib64/ && \
echo "nogroup:*:100:nobody" > /rootfs/etc/group && \
echo "nobody:*:100:100:::" > /rootfs/etc/passwd && \
cp /etc/ssl/certs/ca-certificates.crt /rootfs/etc/ssl/certs/
FROM scratch FROM scratch
COPY --from=build --chown=100:100 /tmp/nginx/objs/nginx / COPY --from=build --chown=100:100 /rootfs /
COPY --from=build --chown=100:100 /tmp/tmp /tmp
COPY --from=build --chown=100:100 /lib/x86_64-linux-gnu/libc.so.6 \
/lib/x86_64-linux-gnu/libcrypt.so.1 \
/lib/x86_64-linux-gnu/libdl.so.2 \
/lib/x86_64-linux-gnu/libnss_files.so.2 \
/lib/x86_64-linux-gnu/libnss_dns.so.2 \
/lib/x86_64-linux-gnu/libpthread.so.0 \
/lib/x86_64-linux-gnu/libresolv.so.2 \
/lib/x86_64-linux-gnu/
COPY --from=build --chown=100:100 /lib64/ld-linux-x86-64.so.2 /lib64/
COPY --from=build --chown=100:100 /tmp/group \
/tmp/passwd \
/etc/
USER 100:100 USER 100:100
ENTRYPOINT ["/nginx"] ENTRYPOINT ["/nginx"]

33
Dockerfile.musl
View file

@ -9,9 +9,9 @@ ARG ZLIB_CHECKSUM="c3e5e9fdd5004dcb542feda5ee4f0ff0744628baf8ed2dd5d66f8ca1197cb
ARG OPENSSL_VERSION="1.1.1d" ARG OPENSSL_VERSION="1.1.1d"
ARG OPENSSL_CHECKSUM="1e3a91bc1f9dfce01af26026f856e064eab4c8ee0a8f457b5ae30b40b8b711f2" ARG OPENSSL_CHECKSUM="1e3a91bc1f9dfce01af26026f856e064eab4c8ee0a8f457b5ae30b40b8b711f2"
ARG NGINX_VERSION="1.17.9" ARG VERSION="1.17.9"
ARG NGINX_CHECKSUM="7dd65d405c753c41b7fdab9415cfb4bdbaf093ec6d9f7432072d52cb7bcbb689" ARG CHECKSUM="7dd65d405c753c41b7fdab9415cfb4bdbaf093ec6d9f7432072d52cb7bcbb689"
ARG NGINX_CONFIG="\ ARG CONFIG="\
--with-cc-opt='-static' \ --with-cc-opt='-static' \
--with-ld-opt='-static' \ --with-ld-opt='-static' \
--sbin-path=/nginx \ --sbin-path=/nginx \
@ -38,34 +38,31 @@ ARG NGINX_CONFIG="\
ADD https://ftp.pcre.org/pub/pcre/pcre-$PCRE_VERSION.tar.gz /tmp/pcre.tar.gz ADD https://ftp.pcre.org/pub/pcre/pcre-$PCRE_VERSION.tar.gz /tmp/pcre.tar.gz
ADD https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz /tmp/openssl.tar.gz ADD https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz /tmp/openssl.tar.gz
ADD https://zlib.net/zlib-$ZLIB_VERSION.tar.gz /tmp/zlib.tar.gz ADD https://zlib.net/zlib-$ZLIB_VERSION.tar.gz /tmp/zlib.tar.gz
ADD https://nginx.org/download/nginx-$NGINX_VERSION.tar.gz /tmp/nginx.tar.gz ADD https://nginx.org/download/nginx-$VERSION.tar.gz /tmp/nginx.tar.gz
RUN [ "$PCRE_CHECKSUM" = "$(sha256sum /tmp/pcre.tar.gz | awk '{print $1}')" ] && \ RUN [ "$PCRE_CHECKSUM" = "$(sha256sum /tmp/pcre.tar.gz | awk '{print $1}')" ] && \
[ "$ZLIB_CHECKSUM" = "$(sha256sum /tmp/zlib.tar.gz | awk '{print $1}')" ] && \ [ "$ZLIB_CHECKSUM" = "$(sha256sum /tmp/zlib.tar.gz | awk '{print $1}')" ] && \
[ "$OPENSSL_CHECKSUM" = "$(sha256sum /tmp/openssl.tar.gz | awk '{print $1}')" ] && \ [ "$OPENSSL_CHECKSUM" = "$(sha256sum /tmp/openssl.tar.gz | awk '{print $1}')" ] && \
[ "$NGINX_CHECKSUM" = "$(sha256sum /tmp/nginx.tar.gz | awk '{print $1}')" ] && \ [ "$CHECKSUM" = "$(sha256sum /tmp/nginx.tar.gz | awk '{print $1}')" ] && \
tar -C /tmp -xf /tmp/pcre.tar.gz && \ tar -C /tmp -xf /tmp/pcre.tar.gz && \
tar -C /tmp -xf /tmp/zlib.tar.gz && \ tar -C /tmp -xf /tmp/zlib.tar.gz && \
tar -C /tmp -xf /tmp/openssl.tar.gz && \ tar -C /tmp -xf /tmp/openssl.tar.gz && \
tar -C /tmp -xf /tmp/nginx.tar.gz && \ tar -C /tmp -xf /tmp/nginx.tar.gz && \
mv /tmp/nginx-$NGINX_VERSION /tmp/nginx apk add gcc g++ perl make linux-headers ca-certificates && \
cd /tmp/nginx-$VERSION && \
./configure $CONFIG && \
make
RUN cd /tmp/nginx && \ RUN mkdir -p /rootfs/etc/ssl/certs /rootfs/tmp && \
apk add gcc g++ perl make linux-headers && \ cp /tmp/nginx-$VERSION/objs/nginx /rootfs/ && \
./configure $NGINX_CONFIG && \ echo "nogroup:*:100:nobody" > /rootfs/etc/group && \
make && \ echo "nobody:*:100:100:::" > /rootfs/etc/passwd && \
echo "nogroup:*:100:nobody" > /tmp/group && \ cp /etc/ssl/certs/ca-certificates.crt /rootfs/etc/ssl/certs/
echo "nobody:*:100:100:::" > /tmp/passwd && \
mkdir -p /tmp/tmp
FROM scratch FROM scratch
COPY --from=build --chown=100:100 /tmp/nginx/objs/nginx / COPY --from=build --chown=100:100 /rootfs /
COPY --from=build --chown=100:100 /tmp/tmp /tmp
COPY --from=build --chown=100:100 /tmp/group \
/tmp/passwd \
/etc/
USER 100:100 USER 100:100
ENTRYPOINT ["/nginx"] ENTRYPOINT ["/nginx"]

10
README.md
View file

@ -52,7 +52,10 @@ Based on the [glibc](https://www.gnu.org/software/libc/) implementation of `libc
/ /
├── etc/ ├── etc/
│ ├── group │ ├── group
│ └── passwd │ ├── passwd
│ └── ssl/
│ └── certs/
│ └── ca-certificates.crt
├── lib/ ├── lib/
│ └── x86_64-linux-gnu/ │ └── x86_64-linux-gnu/
│ ├── libc.so.6 │ ├── libc.so.6
@ -76,7 +79,10 @@ Based on the [musl](https://www.musl-libc.org/) implementation of `libc`. Static
/ /
├── etc/ ├── etc/
│ ├── group │ ├── group
│ └── passwd │ ├── passwd
│ └── ssl/
│ └── certs/
│ └── ca-certificates.crt
├── nginx ├── nginx
└── tmp/ └── tmp/
``` ```