removed rootfs directory, updated readme
This commit is contained in:
Ricard Bejarano
parent
8af3ab7454
commit
e514540087
10 changed files with 63 additions and 206 deletions
|
|
@ -54,24 +54,35 @@ RUN cd /tmp/nginx && \
|
||||||
apt update && \
|
apt update && \
|
||||||
apt install -y gcc g++ perl make && \
|
apt install -y gcc g++ perl make && \
|
||||||
./configure $NGINX_CONFIG && \
|
./configure $NGINX_CONFIG && \
|
||||||
make
|
make && \
|
||||||
|
echo "nogroup:*:100:nobody" > /tmp/group && \
|
||||||
|
echo "nobody:*:100:100:::" > /tmp/passwd && \
|
||||||
|
mkdir -p /tmp/tmp && \
|
||||||
|
sed -i -e 's/listen 80;/listen 8080;/g' /tmp/nginx/conf/nginx.conf
|
||||||
|
|
||||||
|
|
||||||
FROM scratch
|
FROM scratch
|
||||||
|
|
||||||
COPY --from=build /lib/x86_64-linux-gnu/libc.so.6 \
|
COPY --from=build --chown=100:100 /tmp/nginx/objs/nginx /
|
||||||
/lib/x86_64-linux-gnu/libcrypt.so.1 \
|
COPY --from=build --chown=100:100 /tmp/nginx/conf/nginx.conf \
|
||||||
/lib/x86_64-linux-gnu/libdl.so.2 \
|
/tmp/nginx/conf/mime.types \
|
||||||
/lib/x86_64-linux-gnu/libnss_files.so.2 \
|
/etc/nginx/
|
||||||
/lib/x86_64-linux-gnu/libnss_dns.so.2 \
|
COPY --from=build --chown=100:100 /tmp/nginx/html /usr/local/nginx/html
|
||||||
/lib/x86_64-linux-gnu/libpthread.so.0 \
|
COPY --from=build --chown=100:100 /tmp/tmp /tmp
|
||||||
/lib/x86_64-linux-gnu/libresolv.so.2 \
|
COPY --from=build --chown=100:100 /lib/x86_64-linux-gnu/libc.so.6 \
|
||||||
/lib/x86_64-linux-gnu/
|
/lib/x86_64-linux-gnu/libcrypt.so.1 \
|
||||||
COPY --from=build /lib64/ld-linux-x86-64.so.2 /lib64/
|
/lib/x86_64-linux-gnu/libdl.so.2 \
|
||||||
COPY --from=build /tmp/nginx/objs/nginx /
|
/lib/x86_64-linux-gnu/libnss_files.so.2 \
|
||||||
|
/lib/x86_64-linux-gnu/libnss_dns.so.2 \
|
||||||
|
/lib/x86_64-linux-gnu/libpthread.so.0 \
|
||||||
|
/lib/x86_64-linux-gnu/libresolv.so.2 \
|
||||||
|
/lib/x86_64-linux-gnu/
|
||||||
|
COPY --from=build --chown=100:100 /lib64/ld-linux-x86-64.so.2 /lib64/
|
||||||
|
COPY --from=build --chown=100:100 /tmp/group \
|
||||||
|
/tmp/passwd \
|
||||||
|
/etc/
|
||||||
|
|
||||||
COPY rootfs /
|
USER 100:100
|
||||||
|
EXPOSE 8080/tcp
|
||||||
EXPOSE 80/tcp
|
|
||||||
ENTRYPOINT ["/nginx"]
|
ENTRYPOINT ["/nginx"]
|
||||||
CMD ["-g", "daemon off;"]
|
CMD ["-g", "daemon off;"]
|
||||||
|
|
|
||||||
|
|
@ -53,15 +53,26 @@ RUN [ "$PCRE_CHECKSUM" = "$(sha256sum /tmp/pcre.tar.gz | awk '{print $1}')" ] &&
|
||||||
RUN cd /tmp/nginx && \
|
RUN cd /tmp/nginx && \
|
||||||
apk add gcc g++ perl make linux-headers && \
|
apk add gcc g++ perl make linux-headers && \
|
||||||
./configure $NGINX_CONFIG && \
|
./configure $NGINX_CONFIG && \
|
||||||
make
|
make && \
|
||||||
|
echo "nogroup:*:100:nobody" > /tmp/group && \
|
||||||
|
echo "nobody:*:100:100:::" > /tmp/passwd && \
|
||||||
|
mkdir -p /tmp/tmp && \
|
||||||
|
sed -i -e 's/listen 80;/listen 8080;/g' /tmp/nginx/conf/nginx.conf
|
||||||
|
|
||||||
|
|
||||||
FROM scratch
|
FROM scratch
|
||||||
|
|
||||||
COPY --from=build /tmp/nginx/objs/nginx /
|
COPY --from=build --chown=100:100 /tmp/nginx/objs/nginx /
|
||||||
|
COPY --from=build --chown=100:100 /tmp/nginx/conf/nginx.conf \
|
||||||
|
/tmp/nginx/conf/mime.types \
|
||||||
|
/etc/nginx/
|
||||||
|
COPY --from=build --chown=100:100 /tmp/nginx/html /usr/local/nginx/html
|
||||||
|
COPY --from=build --chown=100:100 /tmp/tmp /tmp
|
||||||
|
COPY --from=build --chown=100:100 /tmp/group \
|
||||||
|
/tmp/passwd \
|
||||||
|
/etc/
|
||||||
|
|
||||||
COPY rootfs /
|
USER 100:100
|
||||||
|
EXPOSE 8080/tcp
|
||||||
EXPOSE 80/tcp
|
|
||||||
ENTRYPOINT ["/nginx"]
|
ENTRYPOINT ["/nginx"]
|
||||||
CMD ["-g", "daemon off;"]
|
CMD ["-g", "daemon off;"]
|
||||||
|
|
|
||||||
42
README.md
42
README.md
|
|
@ -1,6 +1,6 @@
|
||||||
<p align=center><img src=https://emojipedia-us.s3.dualstack.us-west-1.amazonaws.com/thumbs/320/apple/155/gear_2699.png width=120px></p>
|
<p align="center"><img src="https://emojipedia-us.s3.dualstack.us-west-1.amazonaws.com/thumbs/320/apple/155/gear_2699.png" width="120px"></p>
|
||||||
<h1 align=center>nginx (container image)</h1>
|
<h1 align="center">nginx (container image)</h1>
|
||||||
<p align=center>Built-from-source container image of the <a href=https://nginx.org/>NGINX HTTP server</a></p>
|
<p align="center">Built-from-source container image of the <a href="https://nginx.org/">NGINX HTTP server</a></p>
|
||||||
|
|
||||||
|
|
||||||
## Tags
|
## Tags
|
||||||
|
|
@ -22,18 +22,18 @@ Available on [Quay](https://quay.io) as:
|
||||||
|
|
||||||
## Features
|
## Features
|
||||||
|
|
||||||
* Super tiny (`glibc`-based is `~13.2MB` and `musl`-based is `~12.5MB`)
|
* Super tiny (`glibc`-based image is about `14.1MB`, `musl`-based image is about `12.4MB`)
|
||||||
* Compiled from source during build time
|
* Compiled from source (with binary exploit mitigations) during build time
|
||||||
* Built `FROM scratch`, see [Filesystem](#filesystem) for an exhaustive list of the image's contents
|
* Built `FROM scratch`, with zero bloat (see [Filesystem](#filesystem))
|
||||||
* Reduced attack surface (no shell, no UNIX tools, no package manager...)
|
* Reduced attack surface (no shell, no UNIX tools, no package manager...)
|
||||||
* Built with binary exploit mitigations enabled
|
* Runs as unprivileged (non-`root`) user
|
||||||
|
|
||||||
|
|
||||||
## Configuration
|
## Configuration
|
||||||
|
|
||||||
### Volumes
|
### Volumes
|
||||||
|
|
||||||
- Bind your **configuration** at `/etc/nginx/nginx.conf`.
|
- Mount your **configuration** at `/etc/nginx/nginx.conf`.
|
||||||
|
|
||||||
|
|
||||||
## Building
|
## Building
|
||||||
|
|
@ -44,8 +44,6 @@ Available on [Quay](https://quay.io) as:
|
||||||
|
|
||||||
## Filesystem
|
## Filesystem
|
||||||
|
|
||||||
The images' contents are:
|
|
||||||
|
|
||||||
### `glibc`
|
### `glibc`
|
||||||
|
|
||||||
Based on the [glibc](https://www.gnu.org/software/libc/) implementation of `libc`. Dynamically linked.
|
Based on the [glibc](https://www.gnu.org/software/libc/) implementation of `libc`. Dynamically linked.
|
||||||
|
|
@ -55,9 +53,6 @@ Based on the [glibc](https://www.gnu.org/software/libc/) implementation of `libc
|
||||||
├── etc/
|
├── etc/
|
||||||
│ ├── group
|
│ ├── group
|
||||||
│ ├── nginx/
|
│ ├── nginx/
|
||||||
│ │ ├── html/
|
|
||||||
│ │ │ ├── 50x.html
|
|
||||||
│ │ │ └── index.html
|
|
||||||
│ │ ├── mime.types
|
│ │ ├── mime.types
|
||||||
│ │ └── nginx.conf
|
│ │ └── nginx.conf
|
||||||
│ └── passwd
|
│ └── passwd
|
||||||
|
|
@ -73,8 +68,13 @@ Based on the [glibc](https://www.gnu.org/software/libc/) implementation of `libc
|
||||||
├── lib64/
|
├── lib64/
|
||||||
│ └── ld-linux-x86-64.so.2
|
│ └── ld-linux-x86-64.so.2
|
||||||
├── nginx
|
├── nginx
|
||||||
└── tmp/
|
├── tmp/
|
||||||
└── .keep
|
└── usr/
|
||||||
|
└── local/
|
||||||
|
└── nginx/
|
||||||
|
└── html/
|
||||||
|
├── 50x.html
|
||||||
|
└── index.html
|
||||||
```
|
```
|
||||||
|
|
||||||
### `musl`
|
### `musl`
|
||||||
|
|
@ -86,15 +86,17 @@ Based on the [musl](https://www.musl-libc.org/) implementation of `libc`. Static
|
||||||
├── etc/
|
├── etc/
|
||||||
│ ├── group
|
│ ├── group
|
||||||
│ ├── nginx/
|
│ ├── nginx/
|
||||||
│ │ ├── html/
|
|
||||||
│ │ │ ├── 50x.html
|
|
||||||
│ │ │ └── index.html
|
|
||||||
│ │ ├── mime.types
|
│ │ ├── mime.types
|
||||||
│ │ └── nginx.conf
|
│ │ └── nginx.conf
|
||||||
│ └── passwd
|
│ └── passwd
|
||||||
├── nginx
|
├── nginx
|
||||||
└── tmp/
|
├── tmp/
|
||||||
└── .keep
|
└── usr/
|
||||||
|
└── local/
|
||||||
|
└── nginx/
|
||||||
|
└── html/
|
||||||
|
├── 50x.html
|
||||||
|
└── index.html
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1 +0,0 @@
|
||||||
nginx:*:100:nginx
|
|
||||||
|
|
@ -1,21 +0,0 @@
|
||||||
<!DOCTYPE html>
|
|
||||||
<html>
|
|
||||||
<head>
|
|
||||||
<title>Error</title>
|
|
||||||
<style>
|
|
||||||
body {
|
|
||||||
width: 35em;
|
|
||||||
margin: 0 auto;
|
|
||||||
font-family: Tahoma, Verdana, Arial, sans-serif;
|
|
||||||
}
|
|
||||||
</style>
|
|
||||||
</head>
|
|
||||||
<body>
|
|
||||||
<h1>An error occurred.</h1>
|
|
||||||
<p>Sorry, the page you are looking for is currently unavailable.<br/>
|
|
||||||
Please try again later.</p>
|
|
||||||
<p>If you are the system administrator of this resource then you should check
|
|
||||||
the error log for details.</p>
|
|
||||||
<p><em>Faithfully yours, nginx.</em></p>
|
|
||||||
</body>
|
|
||||||
</html>
|
|
||||||
|
|
@ -1,25 +0,0 @@
|
||||||
<!DOCTYPE html>
|
|
||||||
<html>
|
|
||||||
<head>
|
|
||||||
<title>Welcome to nginx!</title>
|
|
||||||
<style>
|
|
||||||
body {
|
|
||||||
width: 35em;
|
|
||||||
margin: 0 auto;
|
|
||||||
font-family: Tahoma, Verdana, Arial, sans-serif;
|
|
||||||
}
|
|
||||||
</style>
|
|
||||||
</head>
|
|
||||||
<body>
|
|
||||||
<h1>Welcome to nginx!</h1>
|
|
||||||
<p>If you see this page, the nginx web server is successfully installed and
|
|
||||||
working. Further configuration is required.</p>
|
|
||||||
|
|
||||||
<p>For online documentation and support please refer to
|
|
||||||
<a href="http://nginx.org/">nginx.org</a>.<br/>
|
|
||||||
Commercial support is available at
|
|
||||||
<a href="http://nginx.com/">nginx.com</a>.</p>
|
|
||||||
|
|
||||||
<p><em>Thank you for using nginx.</em></p>
|
|
||||||
</body>
|
|
||||||
</html>
|
|
||||||
|
|
@ -1,86 +0,0 @@
|
||||||
types {
|
|
||||||
text/html html htm shtml;
|
|
||||||
text/css css;
|
|
||||||
text/xml xml;
|
|
||||||
image/gif gif;
|
|
||||||
image/jpeg jpeg jpg;
|
|
||||||
application/javascript js;
|
|
||||||
application/atom+xml atom;
|
|
||||||
application/rss+xml rss;
|
|
||||||
text/mathml mml;
|
|
||||||
text/plain txt;
|
|
||||||
text/vnd.sun.j2me.app-descriptor jad;
|
|
||||||
text/vnd.wap.wml wml;
|
|
||||||
text/x-component htc;
|
|
||||||
image/png png;
|
|
||||||
image/svg+xml svg svgz;
|
|
||||||
image/tiff tif tiff;
|
|
||||||
image/vnd.wap.wbmp wbmp;
|
|
||||||
image/webp webp;
|
|
||||||
image/x-icon ico;
|
|
||||||
image/x-jng jng;
|
|
||||||
image/x-ms-bmp bmp;
|
|
||||||
font/woff woff;
|
|
||||||
font/woff2 woff2;
|
|
||||||
application/java-archive jar war ear;
|
|
||||||
application/json json;
|
|
||||||
application/mac-binhex40 hqx;
|
|
||||||
application/msword doc;
|
|
||||||
application/pdf pdf;
|
|
||||||
application/postscript ps eps ai;
|
|
||||||
application/rtf rtf;
|
|
||||||
application/vnd.apple.mpegurl m3u8;
|
|
||||||
application/vnd.google-earth.kml+xml kml;
|
|
||||||
application/vnd.google-earth.kmz kmz;
|
|
||||||
application/vnd.ms-excel xls;
|
|
||||||
application/vnd.ms-fontobject eot;
|
|
||||||
application/vnd.ms-powerpoint ppt;
|
|
||||||
application/vnd.oasis.opendocument.graphics odg;
|
|
||||||
application/vnd.oasis.opendocument.presentation odp;
|
|
||||||
application/vnd.oasis.opendocument.spreadsheet ods;
|
|
||||||
application/vnd.oasis.opendocument.text odt;
|
|
||||||
application/vnd.openxmlformats-officedocument.presentationml.presentation pptx;
|
|
||||||
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx;
|
|
||||||
application/vnd.openxmlformats-officedocument.wordprocessingml.document docx;
|
|
||||||
application/vnd.wap.wmlc wmlc;
|
|
||||||
application/x-7z-compressed 7z;
|
|
||||||
application/x-cocoa cco;
|
|
||||||
application/x-java-archive-diff jardiff;
|
|
||||||
application/x-java-jnlp-file jnlp;
|
|
||||||
application/x-makeself run;
|
|
||||||
application/x-perl pl pm;
|
|
||||||
application/x-pilot prc pdb;
|
|
||||||
application/x-rar-compressed rar;
|
|
||||||
application/x-redhat-package-manager rpm;
|
|
||||||
application/x-sea sea;
|
|
||||||
application/x-shockwave-flash swf;
|
|
||||||
application/x-stuffit sit;
|
|
||||||
application/x-tcl tcl tk;
|
|
||||||
application/x-x509-ca-cert der pem crt;
|
|
||||||
application/x-xpinstall xpi;
|
|
||||||
application/xhtml+xml xhtml;
|
|
||||||
application/xspf+xml xspf;
|
|
||||||
application/zip zip;
|
|
||||||
application/octet-stream bin exe dll;
|
|
||||||
application/octet-stream deb;
|
|
||||||
application/octet-stream dmg;
|
|
||||||
application/octet-stream iso img;
|
|
||||||
application/octet-stream msi msp msm;
|
|
||||||
audio/midi mid midi kar;
|
|
||||||
audio/mpeg mp3;
|
|
||||||
audio/ogg ogg;
|
|
||||||
audio/x-m4a m4a;
|
|
||||||
audio/x-realaudio ra;
|
|
||||||
video/3gpp 3gpp 3gp;
|
|
||||||
video/mp2t ts;
|
|
||||||
video/mp4 mp4;
|
|
||||||
video/mpeg mpeg mpg;
|
|
||||||
video/quicktime mov;
|
|
||||||
video/webm webm;
|
|
||||||
video/x-flv flv;
|
|
||||||
video/x-m4v m4v;
|
|
||||||
video/x-mng mng;
|
|
||||||
video/x-ms-asf asx asf;
|
|
||||||
video/x-ms-wmv wmv;
|
|
||||||
video/x-msvideo avi;
|
|
||||||
}
|
|
||||||
|
|
@ -1,32 +0,0 @@
|
||||||
user nginx;
|
|
||||||
worker_processes 1;
|
|
||||||
|
|
||||||
events {
|
|
||||||
worker_connections 1024;
|
|
||||||
}
|
|
||||||
|
|
||||||
http {
|
|
||||||
|
|
||||||
sendfile on;
|
|
||||||
keepalive_timeout 65;
|
|
||||||
|
|
||||||
include mime.types;
|
|
||||||
default_type application/octet-stream;
|
|
||||||
|
|
||||||
server {
|
|
||||||
listen 80;
|
|
||||||
server_name localhost;
|
|
||||||
error_page 500 502 503 504 /50x.html;
|
|
||||||
location / {
|
|
||||||
root /etc/nginx/html;
|
|
||||||
index index.html;
|
|
||||||
}
|
|
||||||
location = /stub_status {
|
|
||||||
stub_status;
|
|
||||||
}
|
|
||||||
location = /50x.html {
|
|
||||||
root /etc/nginx/html;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
@ -1 +0,0 @@
|
||||||
nginx:*:100:100::/:/nginx
|
|
||||||
|
|
@ -1 +0,0 @@
|
||||||
DO NOT DELETE ME! I'M HERE TO KEEP GIT FROM DELETING MY PARENT DIRECTORY
|
|
||||||
Loading…
Add table
Reference in a new issue