diff --git a/Dockerfile.glibc b/Dockerfile.glibc index 08d90d6..bc58ee6 100644 --- a/Dockerfile.glibc +++ b/Dockerfile.glibc @@ -54,24 +54,35 @@ RUN cd /tmp/nginx && \ apt update && \ apt install -y gcc g++ perl make && \ ./configure $NGINX_CONFIG && \ - make + make && \ + echo "nogroup:*:100:nobody" > /tmp/group && \ + echo "nobody:*:100:100:::" > /tmp/passwd && \ + mkdir -p /tmp/tmp && \ + sed -i -e 's/listen 80;/listen 8080;/g' /tmp/nginx/conf/nginx.conf FROM scratch -COPY --from=build /lib/x86_64-linux-gnu/libc.so.6 \ - /lib/x86_64-linux-gnu/libcrypt.so.1 \ - /lib/x86_64-linux-gnu/libdl.so.2 \ - /lib/x86_64-linux-gnu/libnss_files.so.2 \ - /lib/x86_64-linux-gnu/libnss_dns.so.2 \ - /lib/x86_64-linux-gnu/libpthread.so.0 \ - /lib/x86_64-linux-gnu/libresolv.so.2 \ - /lib/x86_64-linux-gnu/ -COPY --from=build /lib64/ld-linux-x86-64.so.2 /lib64/ -COPY --from=build /tmp/nginx/objs/nginx / +COPY --from=build --chown=100:100 /tmp/nginx/objs/nginx / +COPY --from=build --chown=100:100 /tmp/nginx/conf/nginx.conf \ + /tmp/nginx/conf/mime.types \ + /etc/nginx/ +COPY --from=build --chown=100:100 /tmp/nginx/html /usr/local/nginx/html +COPY --from=build --chown=100:100 /tmp/tmp /tmp +COPY --from=build --chown=100:100 /lib/x86_64-linux-gnu/libc.so.6 \ + /lib/x86_64-linux-gnu/libcrypt.so.1 \ + /lib/x86_64-linux-gnu/libdl.so.2 \ + /lib/x86_64-linux-gnu/libnss_files.so.2 \ + /lib/x86_64-linux-gnu/libnss_dns.so.2 \ + /lib/x86_64-linux-gnu/libpthread.so.0 \ + /lib/x86_64-linux-gnu/libresolv.so.2 \ + /lib/x86_64-linux-gnu/ +COPY --from=build --chown=100:100 /lib64/ld-linux-x86-64.so.2 /lib64/ +COPY --from=build --chown=100:100 /tmp/group \ + /tmp/passwd \ + /etc/ -COPY rootfs / - -EXPOSE 80/tcp +USER 100:100 +EXPOSE 8080/tcp ENTRYPOINT ["/nginx"] CMD ["-g", "daemon off;"] diff --git a/Dockerfile.musl b/Dockerfile.musl index 0431535..b1fca43 100644 --- a/Dockerfile.musl +++ b/Dockerfile.musl @@ -53,15 +53,26 @@ RUN [ "$PCRE_CHECKSUM" = "$(sha256sum /tmp/pcre.tar.gz | awk '{print $1}')" ] && RUN cd /tmp/nginx && \ apk add gcc g++ perl make linux-headers && \ ./configure $NGINX_CONFIG && \ - make + make && \ + echo "nogroup:*:100:nobody" > /tmp/group && \ + echo "nobody:*:100:100:::" > /tmp/passwd && \ + mkdir -p /tmp/tmp && \ + sed -i -e 's/listen 80;/listen 8080;/g' /tmp/nginx/conf/nginx.conf FROM scratch -COPY --from=build /tmp/nginx/objs/nginx / +COPY --from=build --chown=100:100 /tmp/nginx/objs/nginx / +COPY --from=build --chown=100:100 /tmp/nginx/conf/nginx.conf \ + /tmp/nginx/conf/mime.types \ + /etc/nginx/ +COPY --from=build --chown=100:100 /tmp/nginx/html /usr/local/nginx/html +COPY --from=build --chown=100:100 /tmp/tmp /tmp +COPY --from=build --chown=100:100 /tmp/group \ + /tmp/passwd \ + /etc/ -COPY rootfs / - -EXPOSE 80/tcp +USER 100:100 +EXPOSE 8080/tcp ENTRYPOINT ["/nginx"] CMD ["-g", "daemon off;"] diff --git a/README.md b/README.md index d8c97aa..37fa5a4 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ -

-

nginx (container image)

-

Built-from-source container image of the NGINX HTTP server

+

+

nginx (container image)

+

Built-from-source container image of the NGINX HTTP server

## Tags @@ -22,18 +22,18 @@ Available on [Quay](https://quay.io) as: ## Features -* Super tiny (`glibc`-based is `~13.2MB` and `musl`-based is `~12.5MB`) -* Compiled from source during build time -* Built `FROM scratch`, see [Filesystem](#filesystem) for an exhaustive list of the image's contents +* Super tiny (`glibc`-based image is about `14.1MB`, `musl`-based image is about `12.4MB`) +* Compiled from source (with binary exploit mitigations) during build time +* Built `FROM scratch`, with zero bloat (see [Filesystem](#filesystem)) * Reduced attack surface (no shell, no UNIX tools, no package manager...) -* Built with binary exploit mitigations enabled +* Runs as unprivileged (non-`root`) user ## Configuration ### Volumes -- Bind your **configuration** at `/etc/nginx/nginx.conf`. +- Mount your **configuration** at `/etc/nginx/nginx.conf`. ## Building @@ -44,8 +44,6 @@ Available on [Quay](https://quay.io) as: ## Filesystem -The images' contents are: - ### `glibc` Based on the [glibc](https://www.gnu.org/software/libc/) implementation of `libc`. Dynamically linked. @@ -55,9 +53,6 @@ Based on the [glibc](https://www.gnu.org/software/libc/) implementation of `libc ├── etc/ │ ├── group │ ├── nginx/ -│ │ ├── html/ -│ │ │ ├── 50x.html -│ │ │ └── index.html │ │ ├── mime.types │ │ └── nginx.conf │ └── passwd @@ -73,8 +68,13 @@ Based on the [glibc](https://www.gnu.org/software/libc/) implementation of `libc ├── lib64/ │ └── ld-linux-x86-64.so.2 ├── nginx -└── tmp/ - └── .keep +├── tmp/ +└── usr/ + └── local/ + └── nginx/ + └── html/ + ├── 50x.html + └── index.html ``` ### `musl` @@ -86,15 +86,17 @@ Based on the [musl](https://www.musl-libc.org/) implementation of `libc`. Static ├── etc/ │ ├── group │ ├── nginx/ -│ │ ├── html/ -│ │ │ ├── 50x.html -│ │ │ └── index.html │ │ ├── mime.types │ │ └── nginx.conf │ └── passwd ├── nginx -└── tmp/ - └── .keep +├── tmp/ +└── usr/ + └── local/ + └── nginx/ + └── html/ + ├── 50x.html + └── index.html ``` diff --git a/rootfs/etc/group b/rootfs/etc/group deleted file mode 100755 index ff9c63c..0000000 --- a/rootfs/etc/group +++ /dev/null @@ -1 +0,0 @@ -nginx:*:100:nginx diff --git a/rootfs/etc/nginx/html/50x.html b/rootfs/etc/nginx/html/50x.html deleted file mode 100755 index 9071e0a..0000000 --- a/rootfs/etc/nginx/html/50x.html +++ /dev/null @@ -1,21 +0,0 @@ - - - -Error - - - -

An error occurred.

-

Sorry, the page you are looking for is currently unavailable.
-Please try again later.

-

If you are the system administrator of this resource then you should check -the error log for details.

-

Faithfully yours, nginx.

- - diff --git a/rootfs/etc/nginx/html/index.html b/rootfs/etc/nginx/html/index.html deleted file mode 100755 index 2ca3b95..0000000 --- a/rootfs/etc/nginx/html/index.html +++ /dev/null @@ -1,25 +0,0 @@ - - - -Welcome to nginx! - - - -

Welcome to nginx!

-

If you see this page, the nginx web server is successfully installed and -working. Further configuration is required.

- -

For online documentation and support please refer to -nginx.org.
-Commercial support is available at -nginx.com.

- -

Thank you for using nginx.

- - diff --git a/rootfs/etc/nginx/mime.types b/rootfs/etc/nginx/mime.types deleted file mode 100755 index 1ac0dd5..0000000 --- a/rootfs/etc/nginx/mime.types +++ /dev/null @@ -1,86 +0,0 @@ -types { - text/html html htm shtml; - text/css css; - text/xml xml; - image/gif gif; - image/jpeg jpeg jpg; - application/javascript js; - application/atom+xml atom; - application/rss+xml rss; - text/mathml mml; - text/plain txt; - text/vnd.sun.j2me.app-descriptor jad; - text/vnd.wap.wml wml; - text/x-component htc; - image/png png; - image/svg+xml svg svgz; - image/tiff tif tiff; - image/vnd.wap.wbmp wbmp; - image/webp webp; - image/x-icon ico; - image/x-jng jng; - image/x-ms-bmp bmp; - font/woff woff; - font/woff2 woff2; - application/java-archive jar war ear; - application/json json; - application/mac-binhex40 hqx; - application/msword doc; - application/pdf pdf; - application/postscript ps eps ai; - application/rtf rtf; - application/vnd.apple.mpegurl m3u8; - application/vnd.google-earth.kml+xml kml; - application/vnd.google-earth.kmz kmz; - application/vnd.ms-excel xls; - application/vnd.ms-fontobject eot; - application/vnd.ms-powerpoint ppt; - application/vnd.oasis.opendocument.graphics odg; - application/vnd.oasis.opendocument.presentation odp; - application/vnd.oasis.opendocument.spreadsheet ods; - application/vnd.oasis.opendocument.text odt; - application/vnd.openxmlformats-officedocument.presentationml.presentation pptx; - application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx; - application/vnd.openxmlformats-officedocument.wordprocessingml.document docx; - application/vnd.wap.wmlc wmlc; - application/x-7z-compressed 7z; - application/x-cocoa cco; - application/x-java-archive-diff jardiff; - application/x-java-jnlp-file jnlp; - application/x-makeself run; - application/x-perl pl pm; - application/x-pilot prc pdb; - application/x-rar-compressed rar; - application/x-redhat-package-manager rpm; - application/x-sea sea; - application/x-shockwave-flash swf; - application/x-stuffit sit; - application/x-tcl tcl tk; - application/x-x509-ca-cert der pem crt; - application/x-xpinstall xpi; - application/xhtml+xml xhtml; - application/xspf+xml xspf; - application/zip zip; - application/octet-stream bin exe dll; - application/octet-stream deb; - application/octet-stream dmg; - application/octet-stream iso img; - application/octet-stream msi msp msm; - audio/midi mid midi kar; - audio/mpeg mp3; - audio/ogg ogg; - audio/x-m4a m4a; - audio/x-realaudio ra; - video/3gpp 3gpp 3gp; - video/mp2t ts; - video/mp4 mp4; - video/mpeg mpeg mpg; - video/quicktime mov; - video/webm webm; - video/x-flv flv; - video/x-m4v m4v; - video/x-mng mng; - video/x-ms-asf asx asf; - video/x-ms-wmv wmv; - video/x-msvideo avi; -} diff --git a/rootfs/etc/nginx/nginx.conf b/rootfs/etc/nginx/nginx.conf deleted file mode 100755 index c5070b2..0000000 --- a/rootfs/etc/nginx/nginx.conf +++ /dev/null @@ -1,32 +0,0 @@ -user nginx; -worker_processes 1; - -events { - worker_connections 1024; -} - -http { - - sendfile on; - keepalive_timeout 65; - - include mime.types; - default_type application/octet-stream; - - server { - listen 80; - server_name localhost; - error_page 500 502 503 504 /50x.html; - location / { - root /etc/nginx/html; - index index.html; - } - location = /stub_status { - stub_status; - } - location = /50x.html { - root /etc/nginx/html; - } - } - -} diff --git a/rootfs/etc/passwd b/rootfs/etc/passwd deleted file mode 100755 index fafd80c..0000000 --- a/rootfs/etc/passwd +++ /dev/null @@ -1 +0,0 @@ -nginx:*:100:100::/:/nginx diff --git a/rootfs/tmp/.keep b/rootfs/tmp/.keep deleted file mode 100755 index 63ad7eb..0000000 --- a/rootfs/tmp/.keep +++ /dev/null @@ -1 +0,0 @@ -DO NOT DELETE ME! I'M HERE TO KEEP GIT FROM DELETING MY PARENT DIRECTORY