removed rootfs directory, updated readme
This commit is contained in:
Ricard Bejarano
parent
8af3ab7454
commit
e514540087
10 changed files with 63 additions and 206 deletions
|
|
@ -54,24 +54,35 @@ RUN cd /tmp/nginx && \
|
|||
apt update && \
|
||||
apt install -y gcc g++ perl make && \
|
||||
./configure $NGINX_CONFIG && \
|
||||
make
|
||||
make && \
|
||||
echo "nogroup:*:100:nobody" > /tmp/group && \
|
||||
echo "nobody:*:100:100:::" > /tmp/passwd && \
|
||||
mkdir -p /tmp/tmp && \
|
||||
sed -i -e 's/listen 80;/listen 8080;/g' /tmp/nginx/conf/nginx.conf
|
||||
|
||||
|
||||
FROM scratch
|
||||
|
||||
COPY --from=build /lib/x86_64-linux-gnu/libc.so.6 \
|
||||
/lib/x86_64-linux-gnu/libcrypt.so.1 \
|
||||
/lib/x86_64-linux-gnu/libdl.so.2 \
|
||||
/lib/x86_64-linux-gnu/libnss_files.so.2 \
|
||||
/lib/x86_64-linux-gnu/libnss_dns.so.2 \
|
||||
/lib/x86_64-linux-gnu/libpthread.so.0 \
|
||||
/lib/x86_64-linux-gnu/libresolv.so.2 \
|
||||
/lib/x86_64-linux-gnu/
|
||||
COPY --from=build /lib64/ld-linux-x86-64.so.2 /lib64/
|
||||
COPY --from=build /tmp/nginx/objs/nginx /
|
||||
COPY --from=build --chown=100:100 /tmp/nginx/objs/nginx /
|
||||
COPY --from=build --chown=100:100 /tmp/nginx/conf/nginx.conf \
|
||||
/tmp/nginx/conf/mime.types \
|
||||
/etc/nginx/
|
||||
COPY --from=build --chown=100:100 /tmp/nginx/html /usr/local/nginx/html
|
||||
COPY --from=build --chown=100:100 /tmp/tmp /tmp
|
||||
COPY --from=build --chown=100:100 /lib/x86_64-linux-gnu/libc.so.6 \
|
||||
/lib/x86_64-linux-gnu/libcrypt.so.1 \
|
||||
/lib/x86_64-linux-gnu/libdl.so.2 \
|
||||
/lib/x86_64-linux-gnu/libnss_files.so.2 \
|
||||
/lib/x86_64-linux-gnu/libnss_dns.so.2 \
|
||||
/lib/x86_64-linux-gnu/libpthread.so.0 \
|
||||
/lib/x86_64-linux-gnu/libresolv.so.2 \
|
||||
/lib/x86_64-linux-gnu/
|
||||
COPY --from=build --chown=100:100 /lib64/ld-linux-x86-64.so.2 /lib64/
|
||||
COPY --from=build --chown=100:100 /tmp/group \
|
||||
/tmp/passwd \
|
||||
/etc/
|
||||
|
||||
COPY rootfs /
|
||||
|
||||
EXPOSE 80/tcp
|
||||
USER 100:100
|
||||
EXPOSE 8080/tcp
|
||||
ENTRYPOINT ["/nginx"]
|
||||
CMD ["-g", "daemon off;"]
|
||||
|
|
|
|||
|
|
@ -53,15 +53,26 @@ RUN [ "$PCRE_CHECKSUM" = "$(sha256sum /tmp/pcre.tar.gz | awk '{print $1}')" ] &&
|
|||
RUN cd /tmp/nginx && \
|
||||
apk add gcc g++ perl make linux-headers && \
|
||||
./configure $NGINX_CONFIG && \
|
||||
make
|
||||
make && \
|
||||
echo "nogroup:*:100:nobody" > /tmp/group && \
|
||||
echo "nobody:*:100:100:::" > /tmp/passwd && \
|
||||
mkdir -p /tmp/tmp && \
|
||||
sed -i -e 's/listen 80;/listen 8080;/g' /tmp/nginx/conf/nginx.conf
|
||||
|
||||
|
||||
FROM scratch
|
||||
|
||||
COPY --from=build /tmp/nginx/objs/nginx /
|
||||
COPY --from=build --chown=100:100 /tmp/nginx/objs/nginx /
|
||||
COPY --from=build --chown=100:100 /tmp/nginx/conf/nginx.conf \
|
||||
/tmp/nginx/conf/mime.types \
|
||||
/etc/nginx/
|
||||
COPY --from=build --chown=100:100 /tmp/nginx/html /usr/local/nginx/html
|
||||
COPY --from=build --chown=100:100 /tmp/tmp /tmp
|
||||
COPY --from=build --chown=100:100 /tmp/group \
|
||||
/tmp/passwd \
|
||||
/etc/
|
||||
|
||||
COPY rootfs /
|
||||
|
||||
EXPOSE 80/tcp
|
||||
USER 100:100
|
||||
EXPOSE 8080/tcp
|
||||
ENTRYPOINT ["/nginx"]
|
||||
CMD ["-g", "daemon off;"]
|
||||
|
|
|
|||
42
README.md
42
README.md
|
|
@ -1,6 +1,6 @@
|
|||
<p align=center><img src=https://emojipedia-us.s3.dualstack.us-west-1.amazonaws.com/thumbs/320/apple/155/gear_2699.png width=120px></p>
|
||||
<h1 align=center>nginx (container image)</h1>
|
||||
<p align=center>Built-from-source container image of the <a href=https://nginx.org/>NGINX HTTP server</a></p>
|
||||
<p align="center"><img src="https://emojipedia-us.s3.dualstack.us-west-1.amazonaws.com/thumbs/320/apple/155/gear_2699.png" width="120px"></p>
|
||||
<h1 align="center">nginx (container image)</h1>
|
||||
<p align="center">Built-from-source container image of the <a href="https://nginx.org/">NGINX HTTP server</a></p>
|
||||
|
||||
|
||||
## Tags
|
||||
|
|
@ -22,18 +22,18 @@ Available on [Quay](https://quay.io) as:
|
|||
|
||||
## Features
|
||||
|
||||
* Super tiny (`glibc`-based is `~13.2MB` and `musl`-based is `~12.5MB`)
|
||||
* Compiled from source during build time
|
||||
* Built `FROM scratch`, see [Filesystem](#filesystem) for an exhaustive list of the image's contents
|
||||
* Super tiny (`glibc`-based image is about `14.1MB`, `musl`-based image is about `12.4MB`)
|
||||
* Compiled from source (with binary exploit mitigations) during build time
|
||||
* Built `FROM scratch`, with zero bloat (see [Filesystem](#filesystem))
|
||||
* Reduced attack surface (no shell, no UNIX tools, no package manager...)
|
||||
* Built with binary exploit mitigations enabled
|
||||
* Runs as unprivileged (non-`root`) user
|
||||
|
||||
|
||||
## Configuration
|
||||
|
||||
### Volumes
|
||||
|
||||
- Bind your **configuration** at `/etc/nginx/nginx.conf`.
|
||||
- Mount your **configuration** at `/etc/nginx/nginx.conf`.
|
||||
|
||||
|
||||
## Building
|
||||
|
|
@ -44,8 +44,6 @@ Available on [Quay](https://quay.io) as:
|
|||
|
||||
## Filesystem
|
||||
|
||||
The images' contents are:
|
||||
|
||||
### `glibc`
|
||||
|
||||
Based on the [glibc](https://www.gnu.org/software/libc/) implementation of `libc`. Dynamically linked.
|
||||
|
|
@ -55,9 +53,6 @@ Based on the [glibc](https://www.gnu.org/software/libc/) implementation of `libc
|
|||
├── etc/
|
||||
│ ├── group
|
||||
│ ├── nginx/
|
||||
│ │ ├── html/
|
||||
│ │ │ ├── 50x.html
|
||||
│ │ │ └── index.html
|
||||
│ │ ├── mime.types
|
||||
│ │ └── nginx.conf
|
||||
│ └── passwd
|
||||
|
|
@ -73,8 +68,13 @@ Based on the [glibc](https://www.gnu.org/software/libc/) implementation of `libc
|
|||
├── lib64/
|
||||
│ └── ld-linux-x86-64.so.2
|
||||
├── nginx
|
||||
└── tmp/
|
||||
└── .keep
|
||||
├── tmp/
|
||||
└── usr/
|
||||
└── local/
|
||||
└── nginx/
|
||||
└── html/
|
||||
├── 50x.html
|
||||
└── index.html
|
||||
```
|
||||
|
||||
### `musl`
|
||||
|
|
@ -86,15 +86,17 @@ Based on the [musl](https://www.musl-libc.org/) implementation of `libc`. Static
|
|||
├── etc/
|
||||
│ ├── group
|
||||
│ ├── nginx/
|
||||
│ │ ├── html/
|
||||
│ │ │ ├── 50x.html
|
||||
│ │ │ └── index.html
|
||||
│ │ ├── mime.types
|
||||
│ │ └── nginx.conf
|
||||
│ └── passwd
|
||||
├── nginx
|
||||
└── tmp/
|
||||
└── .keep
|
||||
├── tmp/
|
||||
└── usr/
|
||||
└── local/
|
||||
└── nginx/
|
||||
└── html/
|
||||
├── 50x.html
|
||||
└── index.html
|
||||
```
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1 +0,0 @@
|
|||
nginx:*:100:nginx
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<title>Error</title>
|
||||
<style>
|
||||
body {
|
||||
width: 35em;
|
||||
margin: 0 auto;
|
||||
font-family: Tahoma, Verdana, Arial, sans-serif;
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<h1>An error occurred.</h1>
|
||||
<p>Sorry, the page you are looking for is currently unavailable.<br/>
|
||||
Please try again later.</p>
|
||||
<p>If you are the system administrator of this resource then you should check
|
||||
the error log for details.</p>
|
||||
<p><em>Faithfully yours, nginx.</em></p>
|
||||
</body>
|
||||
</html>
|
||||
|
|
@ -1,25 +0,0 @@
|
|||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<title>Welcome to nginx!</title>
|
||||
<style>
|
||||
body {
|
||||
width: 35em;
|
||||
margin: 0 auto;
|
||||
font-family: Tahoma, Verdana, Arial, sans-serif;
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<h1>Welcome to nginx!</h1>
|
||||
<p>If you see this page, the nginx web server is successfully installed and
|
||||
working. Further configuration is required.</p>
|
||||
|
||||
<p>For online documentation and support please refer to
|
||||
<a href="http://nginx.org/">nginx.org</a>.<br/>
|
||||
Commercial support is available at
|
||||
<a href="http://nginx.com/">nginx.com</a>.</p>
|
||||
|
||||
<p><em>Thank you for using nginx.</em></p>
|
||||
</body>
|
||||
</html>
|
||||
|
|
@ -1,86 +0,0 @@
|
|||
types {
|
||||
text/html html htm shtml;
|
||||
text/css css;
|
||||
text/xml xml;
|
||||
image/gif gif;
|
||||
image/jpeg jpeg jpg;
|
||||
application/javascript js;
|
||||
application/atom+xml atom;
|
||||
application/rss+xml rss;
|
||||
text/mathml mml;
|
||||
text/plain txt;
|
||||
text/vnd.sun.j2me.app-descriptor jad;
|
||||
text/vnd.wap.wml wml;
|
||||
text/x-component htc;
|
||||
image/png png;
|
||||
image/svg+xml svg svgz;
|
||||
image/tiff tif tiff;
|
||||
image/vnd.wap.wbmp wbmp;
|
||||
image/webp webp;
|
||||
image/x-icon ico;
|
||||
image/x-jng jng;
|
||||
image/x-ms-bmp bmp;
|
||||
font/woff woff;
|
||||
font/woff2 woff2;
|
||||
application/java-archive jar war ear;
|
||||
application/json json;
|
||||
application/mac-binhex40 hqx;
|
||||
application/msword doc;
|
||||
application/pdf pdf;
|
||||
application/postscript ps eps ai;
|
||||
application/rtf rtf;
|
||||
application/vnd.apple.mpegurl m3u8;
|
||||
application/vnd.google-earth.kml+xml kml;
|
||||
application/vnd.google-earth.kmz kmz;
|
||||
application/vnd.ms-excel xls;
|
||||
application/vnd.ms-fontobject eot;
|
||||
application/vnd.ms-powerpoint ppt;
|
||||
application/vnd.oasis.opendocument.graphics odg;
|
||||
application/vnd.oasis.opendocument.presentation odp;
|
||||
application/vnd.oasis.opendocument.spreadsheet ods;
|
||||
application/vnd.oasis.opendocument.text odt;
|
||||
application/vnd.openxmlformats-officedocument.presentationml.presentation pptx;
|
||||
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx;
|
||||
application/vnd.openxmlformats-officedocument.wordprocessingml.document docx;
|
||||
application/vnd.wap.wmlc wmlc;
|
||||
application/x-7z-compressed 7z;
|
||||
application/x-cocoa cco;
|
||||
application/x-java-archive-diff jardiff;
|
||||
application/x-java-jnlp-file jnlp;
|
||||
application/x-makeself run;
|
||||
application/x-perl pl pm;
|
||||
application/x-pilot prc pdb;
|
||||
application/x-rar-compressed rar;
|
||||
application/x-redhat-package-manager rpm;
|
||||
application/x-sea sea;
|
||||
application/x-shockwave-flash swf;
|
||||
application/x-stuffit sit;
|
||||
application/x-tcl tcl tk;
|
||||
application/x-x509-ca-cert der pem crt;
|
||||
application/x-xpinstall xpi;
|
||||
application/xhtml+xml xhtml;
|
||||
application/xspf+xml xspf;
|
||||
application/zip zip;
|
||||
application/octet-stream bin exe dll;
|
||||
application/octet-stream deb;
|
||||
application/octet-stream dmg;
|
||||
application/octet-stream iso img;
|
||||
application/octet-stream msi msp msm;
|
||||
audio/midi mid midi kar;
|
||||
audio/mpeg mp3;
|
||||
audio/ogg ogg;
|
||||
audio/x-m4a m4a;
|
||||
audio/x-realaudio ra;
|
||||
video/3gpp 3gpp 3gp;
|
||||
video/mp2t ts;
|
||||
video/mp4 mp4;
|
||||
video/mpeg mpeg mpg;
|
||||
video/quicktime mov;
|
||||
video/webm webm;
|
||||
video/x-flv flv;
|
||||
video/x-m4v m4v;
|
||||
video/x-mng mng;
|
||||
video/x-ms-asf asx asf;
|
||||
video/x-ms-wmv wmv;
|
||||
video/x-msvideo avi;
|
||||
}
|
||||
|
|
@ -1,32 +0,0 @@
|
|||
user nginx;
|
||||
worker_processes 1;
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
http {
|
||||
|
||||
sendfile on;
|
||||
keepalive_timeout 65;
|
||||
|
||||
include mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name localhost;
|
||||
error_page 500 502 503 504 /50x.html;
|
||||
location / {
|
||||
root /etc/nginx/html;
|
||||
index index.html;
|
||||
}
|
||||
location = /stub_status {
|
||||
stub_status;
|
||||
}
|
||||
location = /50x.html {
|
||||
root /etc/nginx/html;
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
|
@ -1 +0,0 @@
|
|||
nginx:*:100:100::/:/nginx
|
||||
|
|
@ -1 +0,0 @@
|
|||
DO NOT DELETE ME! I'M HERE TO KEEP GIT FROM DELETING MY PARENT DIRECTORY
|
||||
Loading…
Add table
Reference in a new issue