added musl-based image

README.md

@@ -5,18 +5,27 @@
 Available at [`ricardbejarano/nginx`](https://hub.docker.com/r/ricardbejarano/nginx).
 
 
+[`1.15.8-glibc`, `1.15.8`, `glibc`, `latest` *(glibc/Dockerfile)*](https://github.com/ricardbejarano/nginx/blob/master/glibc/Dockerfile)
+[`1.15.8-musl`, `musl` *(glibc/Dockerfile)*](https://github.com/ricardbejarano/nginx/blob/master/musl/Dockerfile)
+
+
 ## Features
 
-* Super tiny (only `13.7MB`)
+* Super tiny (`:glibc` is `16.4MB` and `:musl` is `15.6MB`)
 * Built from source, including libraries
 * Based on `scratch`, see the [Filesystem](#Filesystem) section below for an exhaustive list of the image's contents
 * Included [TLS1.3](https://tools.ietf.org/html/rfc8446) protocol support (with [OpenSSL](https://www.openssl.org/))
 * Included [brotli](https://github.com/google/brotli) compression support (with [ngx_brotli](https://github.com/google/ngx_brotli))
+* Reduced attack surface (no `bash`, no UNIX tools, no package manager...)
 
 
 ## Filesystem
 
-The image's contents are:
+The images' contents are:
+
+### `glibc`
+
+Based on the [glibc](https://www.gnu.org/software/libc/) implementation of `libc`.
 
 ```
 /
@@ -40,6 +49,30 @@ The image's contents are:
 └── tmp/
 ```
 
+### `musl`
+
+Based on the [musl](https://www.musl-libc.org/) implementation of `libc`.
+
+```
+/
+├── etc/
+│   ├── group
+│   ├── nginx/
+│   │   ├── html/
+│   │   │   ├── 50x.html
+│   │   │   └── index.html
+│   │   ├── mime.types
+│   │   └── nginx.conf
+│   └── passwd
+├── lib/
+│   ├── ld-musl-x86_64.so.1
+│   └── libssl.so.1.1
+├── nginx
+└── tmp/
+    └── .keep
+```
+
+
 ## License
 
 See [LICENSE](https://github.com/ricardbejarano/nginx/blob/master/LICENSE).

musl/Dockerfile

@@ -0,0 +1,70 @@
+FROM alpine:3.9 AS build
+
+ARG PCRE_VERSION="8.42"
+ARG PCRE_CHECKSUM="69acbc2fbdefb955d42a4c606dfde800c2885711d2979e356c0636efde9ec3b5"
+
+ARG ZLIB_VERSION="1.2.11"
+ARG ZLIB_CHECKSUM="c3e5e9fdd5004dcb542feda5ee4f0ff0744628baf8ed2dd5d66f8ca1197cb1a1"
+
+ARG OPENSSL_VERSION="1.1.1a"
+ARG OPENSSL_CHECKSUM="fc20130f8b7cbd2fb918b2f14e2f429e109c31ddd0fb38fc5d71d9ffed3f9f41"
+
+ARG NGINX_VERSION="1.15.8"
+ARG NGINX_CHECKSUM="a8bdafbca87eb99813ae4fcac1ad0875bf725ce19eb265d28268c309b2b40787"
+ARG NGINX_CONFIG="\
+    --sbin-path=/nginx \
+    --conf-path=/etc/nginx/nginx.conf \
+    --pid-path=/tmp/nginx.pid \
+    --http-log-path=/dev/stdout \
+    --error-log-path=/dev/stdout \
+    --http-client-body-temp-path=/tmp/client_temp \
+    --http-proxy-temp-path=/tmp/proxy_temp \
+    --http-fastcgi-temp-path=/tmp/fastcgi_temp \
+    --http-uwsgi-temp-path=/tmp/uwsgi_temp \
+    --http-scgi-temp-path=/tmp/scgi_temp \
+    --with-pcre=/tmp/pcre-$PCRE_VERSION \
+    --with-openssl=/tmp/openssl-$OPENSSL_VERSION \
+    --with-zlib=/tmp/zlib-$ZLIB_VERSION \
+    --with-file-aio \
+    --with-http_ssl_module \
+    --with-http_v2_module \
+    --with-stream \
+    --with-stream_ssl_module \
+    --with-threads \
+    --add-module=/tmp/ngx_brotli"
+
+ADD https://ftp.pcre.org/pub/pcre/pcre-$PCRE_VERSION.tar.gz /tmp/pcre.tar.gz
+ADD https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz /tmp/openssl.tar.gz
+ADD https://zlib.net/zlib-$ZLIB_VERSION.tar.gz /tmp/zlib.tar.gz
+ADD https://nginx.org/download/nginx-$NGINX_VERSION.tar.gz /tmp/nginx.tar.gz
+
+WORKDIR /tmp
+RUN if [ "$PCRE_CHECKSUM" != "$(sha256sum /tmp/pcre.tar.gz | awk '{print $1}')" ]; then exit 1; fi && \
+    tar xf /tmp/pcre.tar.gz && \
+    if [ "$ZLIB_CHECKSUM" != "$(sha256sum /tmp/zlib.tar.gz | awk '{print $1}')" ]; then exit 1; fi && \
+    tar xf /tmp/zlib.tar.gz && \
+    if [ "$OPENSSL_CHECKSUM" != "$(sha256sum /tmp/openssl.tar.gz | awk '{print $1}')" ]; then exit 1; fi && \
+    tar xf /tmp/openssl.tar.gz && \
+    if [ "$NGINX_CHECKSUM" != "$(sha256sum /tmp/nginx.tar.gz | awk '{print $1}')" ]; then exit 1; fi && \
+    tar xf /tmp/nginx.tar.gz && \
+    mv /tmp/nginx-$NGINX_VERSION /tmp/nginx
+
+WORKDIR /tmp/nginx
+RUN apk add git gcc g++ perl make linux-headers && \
+    git clone --recurse-submodules https://github.com/google/ngx_brotli.git /tmp/ngx_brotli && \
+    ./configure $NGINX_CONFIG && \
+    make
+
+
+FROM scratch
+
+COPY rootfs /
+
+COPY --from=build /lib/ld-musl-x86_64.so.1 \
+                  /lib/libssl.so.1.1 \
+                  /lib/
+COPY --from=build /tmp/nginx/objs/nginx /nginx
+
+STOPSIGNAL SIGTERM
+
+ENTRYPOINT ["/nginx", "-g", "daemon off;"]