Skip to content

Commit 1dca42f

Browse files
thresheekthresheek
committed
Introduced alpine-slim image variant.
1 parent f3d86e9 commit 1dca42f

13 files changed

+1027
-7
lines changed

‎Dockerfile-alpine-slim.template

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
FROM alpine:%%ALPINE_VERSION%%
2+
3+
LABEL maintainer="NGINX Docker Maintainers <[email protected]>"
4+
5+
ENV NGINX_VERSION %%NGINX_VERSION%%
6+
ENV PKG_RELEASE %%PKG_RELEASE%%
7+
8+
RUN set -x \
9+
# create nginx user/group first, to be consistent throughout docker variants
10+
&& addgroup -g 101 -S nginx \
11+
&& adduser -S -D -H -u 101 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx \
12+
&& apkArch="$(cat /etc/apk/arch)" \
13+
&& nginxPackages="%%PACKAGES%%
14+
" \
15+
# install prerequisites for public key and pkg-oss checks
16+
&& apk add --no-cache --virtual .checksum-deps \
17+
openssl \
18+
&& case "$apkArch" in \
19+
x86_64|aarch64) \
20+
# arches officially built by upstream
21+
set -x \
22+
&& KEY_SHA512="e7fa8303923d9b95db37a77ad46c68fd4755ff935d0a534d26eba83de193c76166c68bfe7f65471bf8881004ef4aa6df3e34689c305662750c0172fca5d8552a *stdin" \
23+
&& wget -O /tmp/nginx_signing.rsa.pub https://nginx.org/keys/nginx_signing.rsa.pub \
24+
&& if [ "$(openssl rsa -pubin -in /tmp/nginx_signing.rsa.pub -text -noout | openssl sha512 -r)" = "$KEY_SHA512" ]; then \
25+
echo "key verification succeeded!"; \
26+
mv /tmp/nginx_signing.rsa.pub /etc/apk/keys/; \
27+
else \
28+
echo "key verification failed!"; \
29+
exit 1; \
30+
fi \
31+
&& apk add -X "%%PACKAGEREPO%%v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \
32+
;; \
33+
*) \
34+
# we're on an architecture upstream doesn't officially build for
35+
# let's build binaries from the published packaging sources
36+
set -x \
37+
&& tempDir="$(mktemp -d)" \
38+
&& chown nobody:nobody $tempDir \
39+
&& apk add --no-cache --virtual .build-deps \
40+
gcc \
41+
libc-dev \
42+
make \
43+
openssl-dev \
44+
pcre2-dev \
45+
zlib-dev \
46+
linux-headers \
47+
bash \
48+
alpine-sdk \
49+
findutils \
50+
&& su nobody -s /bin/sh -c " \
51+
export HOME=${tempDir} \
52+
&& cd ${tempDir} \
53+
&& curl -f -O https://hg.nginx.org/pkg-oss/archive/%%REVISION%%.tar.gz \
54+
&& PKGOSSCHECKSUM=\"%%PKGOSSCHECKSUM%% *%%REVISION%%.tar.gz\" \
55+
&& if [ \"\$(openssl sha512 -r %%REVISION%%.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \
56+
echo \"pkg-oss tarball checksum verification succeeded!\"; \
57+
else \
58+
echo \"pkg-oss tarball checksum verification failed!\"; \
59+
exit 1; \
60+
fi \
61+
&& tar xzvf %%REVISION%%.tar.gz \
62+
&& cd pkg-oss-%%REVISION%% \
63+
&& cd alpine \
64+
&& make base \
65+
&& apk index -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \
66+
&& abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \
67+
" \
68+
&& cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \
69+
&& apk del .build-deps \
70+
&& apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \
71+
;; \
72+
esac \
73+
# remove checksum deps
74+
&& apk del .checksum-deps \
75+
# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
76+
&& if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
77+
&& if [ -n "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
78+
&& if [ -n "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
79+
# Bring in gettext so we can get `envsubst`, then throw
80+
# the rest away. To do this, we need to install `gettext`
81+
# then move `envsubst` out of the way so `gettext` can
82+
# be deleted completely, then move `envsubst` back.
83+
&& apk add --no-cache --virtual .gettext gettext \
84+
&& mv /usr/bin/envsubst /tmp/ \
85+
\
86+
&& runDeps="$( \
87+
scanelf --needed --nobanner /tmp/envsubst \
88+
| awk '{ gsub(/,/, "\nso:", $2); print "so:" $2 }' \
89+
| sort -u \
90+
| xargs -r apk info --installed \
91+
| sort -u \
92+
)" \
93+
&& apk add --no-cache $runDeps \
94+
&& apk del .gettext \
95+
&& mv /tmp/envsubst /usr/local/bin/ \
96+
# Bring in tzdata so users could set the timezones through the environment
97+
# variables
98+
&& apk add --no-cache tzdata \
99+
# forward request and error logs to docker log collector
100+
&& ln -sf /dev/stdout /var/log/nginx/access.log \
101+
&& ln -sf /dev/stderr /var/log/nginx/error.log \
102+
# create a docker-entrypoint.d directory
103+
&& mkdir /docker-entrypoint.d
104+
105+
COPY docker-entrypoint.sh /
106+
COPY 10-listen-on-ipv6-by-default.sh /docker-entrypoint.d
107+
COPY 20-envsubst-on-templates.sh /docker-entrypoint.d
108+
COPY 30-tune-worker-processes.sh /docker-entrypoint.d
109+
ENTRYPOINT ["/docker-entrypoint.sh"]
110+
111+
EXPOSE 80
112+
113+
STOPSIGNAL SIGQUIT
114+
115+
CMD ["nginx", "-g", "daemon off;"]

‎generate-stackbrew-library.sh

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,4 +98,19 @@ for version in "${versions[@]}"; do
9898
EOE
9999
done
100100

101+
for variant in alpine-slim; do
102+
commit="$(dirCommit "$version/$variant")"
103+
104+
variantAliases=( "${versionAliases[@]/%/-$variant}" )
105+
variantAliases=( "${variantAliases[@]//latest-/}" )
106+
107+
echo
108+
cat <<-EOE
109+
Tags: $(join ', ' "${variantAliases[@]}")
110+
Architectures: arm64v8, amd64
111+
GitCommit: $commit
112+
Directory: $version/$variant
113+
EOE
114+
done
115+
101116
done

‎mainline/alpine-slim/10-listen-on-ipv6-by-default.sh

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
#!/bin/sh
2+
# vim:sw=4:ts=4:et
3+
4+
set -e
5+
6+
ME=$(basename $0)
7+
DEFAULT_CONF_FILE="etc/nginx/conf.d/default.conf"
8+
9+
# check if we have ipv6 available
10+
if [ ! -f "/proc/net/if_inet6" ]; then
11+
echo >&3 "$ME: info: ipv6 not available"
12+
exit 0
13+
fi
14+
15+
if [ ! -f "/$DEFAULT_CONF_FILE" ]; then
16+
echo >&3 "$ME: info: /$DEFAULT_CONF_FILE is not a file or does not exist"
17+
exit 0
18+
fi
19+
20+
# check if the file can be modified, e.g. not on a r/o filesystem
21+
touch /$DEFAULT_CONF_FILE 2>/dev/null || { echo >&3 "$ME: info: can not modify /$DEFAULT_CONF_FILE (read-only file system?)"; exit 0; }
22+
23+
# check if the file is already modified, e.g. on a container restart
24+
grep -q "listen \[::]\:80;" /$DEFAULT_CONF_FILE && { echo >&3 "$ME: info: IPv6 listen already enabled"; exit 0; }
25+
26+
if [ -f "/etc/os-release" ]; then
27+
. /etc/os-release
28+
else
29+
echo >&3 "$ME: info: can not guess the operating system"
30+
exit 0
31+
fi
32+
33+
echo >&3 "$ME: info: Getting the checksum of /$DEFAULT_CONF_FILE"
34+
35+
case "$ID" in
36+
"debian")
37+
CHECKSUM=$(dpkg-query --show --showformat='${Conffiles}\n' nginx | grep $DEFAULT_CONF_FILE | cut -d' ' -f 3)
38+
echo "$CHECKSUM /$DEFAULT_CONF_FILE" | md5sum -c - >/dev/null 2>&1 || {
39+
echo >&3 "$ME: info: /$DEFAULT_CONF_FILE differs from the packaged version"
40+
exit 0
41+
}
42+
;;
43+
"alpine")
44+
CHECKSUM=$(apk manifest nginx 2>/dev/null| grep $DEFAULT_CONF_FILE | cut -d' ' -f 1 | cut -d ':' -f 2)
45+
echo "$CHECKSUM /$DEFAULT_CONF_FILE" | sha1sum -c - >/dev/null 2>&1 || {
46+
echo >&3 "$ME: info: /$DEFAULT_CONF_FILE differs from the packaged version"
47+
exit 0
48+
}
49+
;;
50+
*)
51+
echo >&3 "$ME: info: Unsupported distribution"
52+
exit 0
53+
;;
54+
esac
55+
56+
# enable ipv6 on default.conf listen sockets
57+
sed -i -E 's,listen 80;,listen 80;\n listen [::]:80;,' /$DEFAULT_CONF_FILE
58+
59+
echo >&3 "$ME: info: Enabled listen on IPv6 in /$DEFAULT_CONF_FILE"
60+
61+
exit 0

‎mainline/alpine-slim/20-envsubst-on-templates.sh

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#!/bin/sh
2+
3+
set -e
4+
5+
ME=$(basename $0)
6+
7+
auto_envsubst() {
8+
local template_dir="${NGINX_ENVSUBST_TEMPLATE_DIR:-/etc/nginx/templates}"
9+
local suffix="${NGINX_ENVSUBST_TEMPLATE_SUFFIX:-.template}"
10+
local output_dir="${NGINX_ENVSUBST_OUTPUT_DIR:-/etc/nginx/conf.d}"
11+
12+
local template defined_envs relative_path output_path subdir
13+
defined_envs=$(printf '${%s} ' $(env | cut -d= -f1))
14+
[ -d "$template_dir" ] || return 0
15+
if [ ! -w "$output_dir" ]; then
16+
echo >&3 "$ME: ERROR: $template_dir exists, but $output_dir is not writable"
17+
return 0
18+
fi
19+
find "$template_dir" -follow -type f -name "*$suffix" -print | while read -r template; do
20+
relative_path="${template#$template_dir/}"
21+
output_path="$output_dir/${relative_path%$suffix}"
22+
subdir=$(dirname "$relative_path")
23+
# create a subdirectory where the template file exists
24+
mkdir -p "$output_dir/$subdir"
25+
echo >&3 "$ME: Running envsubst on $template to $output_path"
26+
envsubst "$defined_envs" < "$template" > "$output_path"
27+
done
28+
}
29+
30+
auto_envsubst
31+
32+
exit 0

0 commit comments

Comments
 (0)