1- FROM debian:bookworm-slim@sha256:b1211f6d19afd012477bd34fdcabb6b663d680e0f4b0537da6e6b0fd057a3ec3
1+ # Pull from NGINX image that provides the XSLT module and supporting libraries
2+ FROM private-registry.nginx.com/nginx-plus/modules:r35-xslt-debian@sha256:3eaa85dca47e31b9a6648bcaf6034f076cd59be9b1510b25fd1bbe1144f0bb48 AS xslt
23
3- # Create RELEASE argument
4- ARG RELEASE=bookworm
5-
6- # NJS env vars
7- ENV NGINX_VERSION=34
8- ENV NGINX_PKG_RELEASE=1~${RELEASE}
9- ENV NJS_VERSION=0.9.0
10- ENV NJS_PKG_RELEASE=1~${RELEASE}
4+ FROM private-registry.nginx.com/nginx-plus/base:r35-debian-bookworm@sha256:9a82ad3f96d58be861257efd621f215d599e226ebedd24d9f3211bdd743c3c27
115
126# Proxy cache env vars
137ENV PROXY_CACHE_MAX_SIZE=10g
@@ -26,76 +20,25 @@ ENV DIRECTORY_LISTING_PATH_PREFIX=""
2620ENV STRIP_LEADING_DIRECTORY_PATH=""
2721ENV PREFIX_LEADING_DIRECTORY_PATH=""
2822
29- # We create an NGINX Plus image based on the official NGINX Plus Dockerfiles (https://gist.github.com/nginx-gists/36e97fc87efb5cf0039978c8e41a34b5) and modify it by:
30- # 1. Explicitly installing the version of njs coded in the environment variable above.
31- # 2. Adding configuration files needed for proxying private S3 buckets.
32- # 3. Adding a directory for proxied objects to be stored.
33- # 4. Adding the entrypoint scripts found in the base NGINX OSS Docker image with a modified version that explicitly sets resolvers.
34-
35- # Download your NGINX license certificate and key from the F5 customer portal (https://account.f5.com) and copy it to the build context
36- COPY plus/etc/ssl /etc/ssl
37-
38- RUN set -x \
39- # Create nginx user/group first, to be consistent throughout Docker variants
40- && groupadd --system --gid 101 nginx \
41- && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \
42- && apt-get update \
43- && apt-get install --no-install-recommends --no-install-suggests -y ca-certificates gnupg1 lsb-release \
44- && \
45- NGINX_GPGKEYS="573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62 8540A6F18833A80E9C1653A42FD21310B49F6B46 9E9BE90EACBCDE69FE9B204CBCDCD8A38D88A2B3"; \
46- NGINX_GPGKEY_PATH=/etc/apt/keyrings/nginx-archive-keyring.gpg; \
47- export GNUPGHOME="$(mktemp -d)"; \
48- found=''; \
49- for NGINX_GPGKEY in $NGINX_GPGKEYS; do \
50- for server in \
51- hkp://keyserver.ubuntu.com:80 \
52- pgp.mit.edu \
53- ; do \
54- echo "Fetching GPG key $NGINX_GPGKEY from $server"; \
55- gpg1 --keyserver "$server" --keyserver-options timeout=10 --recv-keys "$NGINX_GPGKEY" && found=yes && break; \
56- done; \
57- test -z "$found" && echo >&2 "error: failed to fetch GPG key $NGINX_GPGKEY" && exit 1; \
58- done; \
59- gpg1 --export $NGINX_GPGKEYS > "$NGINX_GPGKEY_PATH" ; \
60- rm -rf "$GNUPGHOME"; \
61- apt-get remove --purge --auto-remove -y gnupg1 && rm -rf /var/lib/apt/lists/* \
62- # Install the latest release of NGINX Plus and/or NGINX Plus modules (written and maintained by F5)
63- && nginxPackages=" \
64- nginx-plus=${NGINX_VERSION}-${NGINX_PKG_RELEASE} \
65- nginx-plus-module-njs=${NGINX_VERSION}+${NJS_VERSION}-${NJS_PKG_RELEASE} \
66- nginx-plus-module-xslt=${NGINX_VERSION}-${NGINX_PKG_RELEASE} \
67- " \
68- && echo "Acquire::https::pkgs.nginx.com::Verify-Peer \"true\";" > /etc/apt/apt.conf.d/90nginx \
69- && echo "Acquire::https::pkgs.nginx.com::Verify-Host \"true\";" >> /etc/apt/apt.conf.d/90nginx \
70- && echo "Acquire::https::pkgs.nginx.com::SslCert \"/etc/ssl/nginx/nginx-repo.crt\";" >> /etc/apt/apt.conf.d/90nginx \
71- && echo "Acquire::https::pkgs.nginx.com::SslKey \"/etc/ssl/nginx/nginx-repo.key\";" >> /etc/apt/apt.conf.d/90nginx \
72- && echo "deb [signed-by=$NGINX_GPGKEY_PATH] https://pkgs.nginx.com/plus/debian `lsb_release -cs` nginx-plus\n" > /etc/apt/sources.list.d/nginx-plus.list \
73- && apt-get update \
74- && apt-get install --no-install-recommends --no-install-suggests -y $nginxPackages curl gettext-base \
75- && apt-get remove --purge -y lsb-release \
76- && apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx-plus.list \
77- && rm -rf /etc/apt/apt.conf.d/90nginx /etc/ssl/nginx \
78- # Forward request logs to Docker log collector
79- && ln -sf /dev/stdout /var/log/nginx/access.log \
80- && ln -sf /dev/stderr /var/log/nginx/error.log
81-
82- EXPOSE 80
83-
84- STOPSIGNAL SIGTERM
85-
86- CMD ["nginx", "-g", "daemon off;"]
87-
8823# Copy files from the OSS NGINX Docker container such that the container
8924# startup is the same.
25+ COPY --from=xslt / /
26+
9027COPY plus/etc/nginx /etc/nginx
9128COPY common/etc /etc
92- COPY common/docker-entrypoint.sh /docker-entrypoint.sh
9329COPY common/docker-entrypoint.d /docker-entrypoint.d/
94- COPY plus/docker-entrypoint.d /docker-entrypoint.d/
95-
96- RUN set -x \
97- && mkdir -p /var/cache/nginx/s3_proxy \
98- && chown nginx:nginx /var/cache/nginx/s3_proxy \
99- && chmod -R -v +x /docker-entrypoint.sh /docker-entrypoint.d/*.sh;
10030
101- ENTRYPOINT ["/docker-entrypoint.sh"]
31+ RUN <<EOF
32+ set -eux
33+ apt-get update -qq
34+ apt-get install --no-install-recommends --no-install-suggests -y \
35+ gettext-base libxml2 libxslt1.1
36+ apt-get remove --purge --auto-remove -y
37+ rm -rf /usr/share/doc/ /usr/share/lintian /var/lib/apt/lists
38+
39+ cat /etc/nginx/nginx-license.conf >> /etc/nginx/nginx.conf; \
40+ rm /etc/nginx/nginx-license.conf; \
41+ mkdir -p /var/cache/nginx/s3_proxy; \
42+ chown nginx:nginx /var/cache/nginx/s3_proxy; \
43+ find /docker-entrypoint.d -type f \( -name '*.sh' -or -name '*.envsh' \) -exec chmod -v +x {} \;
44+ EOF
0 commit comments