Skip to content

Commit 8bceb49

Browse files
dekobondekobon
committed
refactor: simplify docker build process
This change does the following: * Migrates to using the official NGINX Plus Docker images as base images * Removes the distinction between BuildKit and non-BuildKit builds for Plus images (OSS never had this) * Adds support for license validation for Plus images * Introduces a multi-stage build for Plus images Signed-off-by: Elijah Zupancic <e.zupancic@f5.com>
1 parent a9847e5 commit 8bceb49

File tree

11 files changed

+172
-392
lines changed

11 files changed

+172
-392
lines changed

‎Dockerfile.buildkit.plus‎

Lines changed: 0 additions & 104 deletions
This file was deleted.

‎Dockerfile.oss‎

Lines changed: 9 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,4 @@
1-
FROM nginx:1.29.0@sha256:f5c017fb33c6db484545793ffb67db51cdd7daebee472104612f73a85063f889
2-
3-
# NJS env vars
4-
ENV NJS_VERSION=0.9.0
5-
ENV NJS_RELEASE=1~bookworm
1+
FROM nginx:1.29.1@sha256:d5f28ef21aabddd098f3dbc21fe5b7a7d7a184720bc07da0b6c9b9820e97f25e
62

73
# Proxy cache env vars
84
ENV PROXY_CACHE_MAX_SIZE=10g
@@ -27,20 +23,20 @@ ENV PREFIX_LEADING_DIRECTORY_PATH=""
2723
# 3. Adding a directory for proxied objects to be stored.
2824
# 4. Replacing the entrypoint script with a modified version that explicitly sets resolvers.
2925

26+
# Note: the PKG_RELEASE environment variable is inherited
27+
3028
RUN set -x \
31-
&& echo "deb [signed-by=/etc/apt/keyrings/nginx-archive-keyring.gpg] https://nginx.org/packages/mainline/debian/ $(echo $PKG_RELEASE | cut -f2 -d~) nginx" >> /etc/apt/sources.list.d/nginx.list; \
32-
apt-get update \
29+
&& echo "deb [signed-by=/etc/apt/keyrings/nginx-archive-keyring.gpg] https://nginx.org/packages/mainline/debian/ $(echo $PKG_RELEASE | cut -f2 -d~) nginx" >> /etc/apt/sources.list.d/nginx.list \
30+
&& apt-get update \
3331
&& apt-get install --no-install-recommends --no-install-suggests -y \
34-
libedit2 \
35-
nginx-module-njs=${NGINX_VERSION}+${NJS_VERSION}-${NJS_RELEASE} \
36-
&& apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx.list
32+
libedit2 nginx-module-njs nginx-module-xslt \
33+
&& apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/*
3734

38-
COPY oss/etc /etc
35+
COPY oss/etc/nginx /etc/nginx
3936
COPY common/etc /etc
40-
COPY common/docker-entrypoint.sh /docker-entrypoint.sh
4137
COPY common/docker-entrypoint.d /docker-entrypoint.d/
4238

4339
RUN set -x \
4440
&& mkdir -p /var/cache/nginx/s3_proxy \
4541
&& chown nginx:nginx /var/cache/nginx/s3_proxy \
46-
&& chmod -R -v +x /docker-entrypoint.sh /docker-entrypoint.d/*.sh;
42+
&& find /docker-entrypoint.d -type f \( -name '*.sh' -or -name '*.envsh' \) -exec chmod -v +x {} \;

‎Dockerfile.plus‎

Lines changed: 73 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,59 @@
1-
FROM debian:bookworm-slim@sha256:b1211f6d19afd012477bd34fdcabb6b663d680e0f4b0537da6e6b0fd057a3ec3
1+
FROM nginx:1.29.1@sha256:d5f28ef21aabddd098f3dbc21fe5b7a7d7a184720bc07da0b6c9b9820e97f25e AS oss
22

3-
# Create RELEASE argument
4-
ARG RELEASE=bookworm
3+
FROM private-registry.nginx.com/nginx-plus/base:r35-debian-bookworm@sha256:9a82ad3f96d58be861257efd621f215d599e226ebedd24d9f3211bdd743c3c27 AS build
54

6-
# NJS env vars
7-
ENV NGINX_VERSION=34
8-
ENV NGINX_PKG_RELEASE=1~${RELEASE}
9-
ENV NJS_VERSION=0.9.0
10-
ENV NJS_PKG_RELEASE=1~${RELEASE}
5+
# We create an NGINX Plus image based on the official NGINX Plus Dockerfiles (https://gist.github.com/nginx-gists/36e97fc87efb5cf0039978c8e41a34b5) and modify it by:
6+
# This requires us to have the NGINX Plus license certificate and key from the F5 customer portal,
7+
# so we do not want to embed these certificates and keys in the base image. As such, we use
8+
# in intermediate build image, then throw it away, leaving the modules required.
9+
10+
COPY --from=oss /etc/apt/keyrings/nginx-archive-keyring.gpg /etc/apt/keyrings/
11+
12+
# Download your NGINX license certificate and key from the F5 customer portal (https://account.f5.com) and copy it to the build context
13+
RUN <<EOF
14+
set -eux
15+
NGINX_GPGKEY_PATH="/etc/apt/keyrings/nginx-archive-keyring.gpg"
16+
VERSION_CODENAME="$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2)"
17+
echo "Acquire::https::pkgs.nginx.com::Verify-Peer \"true\";" > /etc/apt/apt.conf.d/90nginx
18+
echo "Acquire::https::pkgs.nginx.com::Verify-Host \"true\";" >> /etc/apt/apt.conf.d/90nginx
19+
echo "Acquire::https::pkgs.nginx.com::SslCert \"/etc/ssl/nginx/nginx-repo.crt\";" >> /etc/apt/apt.conf.d/90nginx
20+
echo "Acquire::https::pkgs.nginx.com::SslKey \"/etc/ssl/nginx/nginx-repo.key\";" >> /etc/apt/apt.conf.d/90nginx
21+
echo "deb [signed-by=$NGINX_GPGKEY_PATH] https://pkgs.nginx.com/plus/debian ${VERSION_CODENAME} nginx-plus\n" > /etc/apt/sources.list.d/nginx-plus.list
22+
EOF
23+
24+
# Setup NGINX Plus apt repository
25+
RUN --mount=type=secret,id=nginx-crt,dst=nginx-repo.crt \
26+
--mount=type=secret,id=nginx-key,dst=nginx-repo.key \
27+
set -eux; \
28+
mkdir --parents /etc/ssl/nginx; \
29+
cat nginx-repo.crt > /etc/ssl/nginx/nginx-repo.crt; \
30+
cat nginx-repo.key > /etc/ssl/nginx/nginx-repo.key
31+
32+
# Only update the NGINX Plus repository
33+
RUN apt-get update
34+
35+
# Download the latest release of the XSLT module and its dependencies
36+
RUN <<EOF
37+
set -eux
38+
mkdir --parents /var/cache/apt/downloads
39+
cd /var/cache/apt/downloads/
40+
apt-get download nginx-plus-module-xslt
41+
EOF
42+
43+
# Install only envsubst from the gettext-base package
44+
RUN <<EOF
45+
set -eux
46+
cd /tmp
47+
apt-get download gettext-base
48+
dpkg-deb --extract "$(find . -type f -name 'gettext-base*.deb')" .
49+
cp usr/bin/envsubst /usr/local/bin/
50+
rm -rf /tmp/*
51+
EOF
52+
53+
FROM private-registry.nginx.com/nginx-plus/base:r35-debian-bookworm@sha256:9a82ad3f96d58be861257efd621f215d599e226ebedd24d9f3211bdd743c3c27
54+
55+
# OSS equivalent version
56+
ENV NGINX_VERSION=1.29.0
1157

1258
# Proxy cache env vars
1359
ENV PROXY_CACHE_MAX_SIZE=10g
@@ -26,76 +72,29 @@ ENV DIRECTORY_LISTING_PATH_PREFIX=""
2672
ENV STRIP_LEADING_DIRECTORY_PATH=""
2773
ENV PREFIX_LEADING_DIRECTORY_PATH=""
2874

29-
# We create an NGINX Plus image based on the official NGINX Plus Dockerfiles (https://gist.github.com/nginx-gists/36e97fc87efb5cf0039978c8e41a34b5) and modify it by:
30-
# 1. Explicitly installing the version of njs coded in the environment variable above.
31-
# 2. Adding configuration files needed for proxying private S3 buckets.
32-
# 3. Adding a directory for proxied objects to be stored.
33-
# 4. Adding the entrypoint scripts found in the base NGINX OSS Docker image with a modified version that explicitly sets resolvers.
34-
35-
# Download your NGINX license certificate and key from the F5 customer portal (https://account.f5.com) and copy it to the build context
36-
COPY plus/etc/ssl /etc/ssl
37-
38-
RUN set -x \
39-
# Create nginx user/group first, to be consistent throughout Docker variants
40-
&& groupadd --system --gid 101 nginx \
41-
&& useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \
42-
&& apt-get update \
43-
&& apt-get install --no-install-recommends --no-install-suggests -y ca-certificates gnupg1 lsb-release \
44-
&& \
45-
NGINX_GPGKEYS="573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62 8540A6F18833A80E9C1653A42FD21310B49F6B46 9E9BE90EACBCDE69FE9B204CBCDCD8A38D88A2B3"; \
46-
NGINX_GPGKEY_PATH=/etc/apt/keyrings/nginx-archive-keyring.gpg; \
47-
export GNUPGHOME="$(mktemp -d)"; \
48-
found=''; \
49-
for NGINX_GPGKEY in $NGINX_GPGKEYS; do \
50-
for server in \
51-
hkp://keyserver.ubuntu.com:80 \
52-
pgp.mit.edu \
53-
; do \
54-
echo "Fetching GPG key $NGINX_GPGKEY from $server"; \
55-
gpg1 --keyserver "$server" --keyserver-options timeout=10 --recv-keys "$NGINX_GPGKEY" && found=yes && break; \
56-
done; \
57-
test -z "$found" && echo >&2 "error: failed to fetch GPG key $NGINX_GPGKEY" && exit 1; \
58-
done; \
59-
gpg1 --export $NGINX_GPGKEYS > "$NGINX_GPGKEY_PATH" ; \
60-
rm -rf "$GNUPGHOME"; \
61-
apt-get remove --purge --auto-remove -y gnupg1 && rm -rf /var/lib/apt/lists/* \
62-
# Install the latest release of NGINX Plus and/or NGINX Plus modules (written and maintained by F5)
63-
&& nginxPackages=" \
64-
nginx-plus=${NGINX_VERSION}-${NGINX_PKG_RELEASE} \
65-
nginx-plus-module-njs=${NGINX_VERSION}+${NJS_VERSION}-${NJS_PKG_RELEASE} \
66-
nginx-plus-module-xslt=${NGINX_VERSION}-${NGINX_PKG_RELEASE} \
67-
" \
68-
&& echo "Acquire::https::pkgs.nginx.com::Verify-Peer \"true\";" > /etc/apt/apt.conf.d/90nginx \
69-
&& echo "Acquire::https::pkgs.nginx.com::Verify-Host \"true\";" >> /etc/apt/apt.conf.d/90nginx \
70-
&& echo "Acquire::https::pkgs.nginx.com::SslCert \"/etc/ssl/nginx/nginx-repo.crt\";" >> /etc/apt/apt.conf.d/90nginx \
71-
&& echo "Acquire::https::pkgs.nginx.com::SslKey \"/etc/ssl/nginx/nginx-repo.key\";" >> /etc/apt/apt.conf.d/90nginx \
72-
&& echo "deb [signed-by=$NGINX_GPGKEY_PATH] https://pkgs.nginx.com/plus/debian `lsb_release -cs` nginx-plus\n" > /etc/apt/sources.list.d/nginx-plus.list \
73-
&& apt-get update \
74-
&& apt-get install --no-install-recommends --no-install-suggests -y $nginxPackages curl gettext-base \
75-
&& apt-get remove --purge -y lsb-release \
76-
&& apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx-plus.list \
77-
&& rm -rf /etc/apt/apt.conf.d/90nginx /etc/ssl/nginx \
78-
# Forward request logs to Docker log collector
79-
&& ln -sf /dev/stdout /var/log/nginx/access.log \
80-
&& ln -sf /dev/stderr /var/log/nginx/error.log
81-
82-
EXPOSE 80
83-
84-
STOPSIGNAL SIGTERM
85-
86-
CMD ["nginx", "-g", "daemon off;"]
87-
8875
# Copy files from the OSS NGINX Docker container such that the container
8976
# startup is the same.
77+
COPY --from=build /var/cache/apt/downloads/* /var/cache/apt/downloads/
78+
COPY --from=build /usr/local/bin/envsubst /usr/local/bin/
79+
9080
COPY plus/etc/nginx /etc/nginx
9181
COPY common/etc /etc
92-
COPY common/docker-entrypoint.sh /docker-entrypoint.sh
9382
COPY common/docker-entrypoint.d /docker-entrypoint.d/
94-
COPY plus/docker-entrypoint.d /docker-entrypoint.d/
9583

96-
RUN set -x \
97-
&& mkdir -p /var/cache/nginx/s3_proxy \
98-
&& chown nginx:nginx /var/cache/nginx/s3_proxy \
99-
&& chmod -R -v +x /docker-entrypoint.sh /docker-entrypoint.d/*.sh;
84+
# 1. Install the XLST filter module.
85+
# 2. Adding configuration files needed for proxying private S3 buckets.
86+
# 3. Adding a directory for proxied objects to be stored.
87+
# 4. Adding the entrypoint scripts found in the base NGINX OSS Docker image with a modified version that explicitly sets resolvers.
88+
RUN <<EOF
89+
set -eux
90+
apt-get update -qq
91+
apt-get install --no-install-recommends --no-install-suggests -y "$(find /var/cache/apt/downloads -type f -name 'nginx-plus-module-xslt*.deb')"
92+
apt-get remove --purge --auto-remove -y
93+
rm -rf /var/cache/apt/downloads /usr/share/doc/ /usr/share/lintian rm -rf /var/lib/apt/lists/*
10094

101-
ENTRYPOINT ["/docker-entrypoint.sh"]
95+
cat /etc/nginx/nginx-license.conf >> /etc/nginx/nginx.conf; \
96+
rm /etc/nginx/nginx-license.conf; \
97+
mkdir -p /var/cache/nginx/s3_proxy; \
98+
chown nginx:nginx /var/cache/nginx/s3_proxy; \
99+
find /docker-entrypoint.d -type f \( -name '*.sh' -or -name '*.envsh' \) -exec chmod -v +x {} \;
100+
EOF

‎common/docker-entrypoint.d/00-check-for-required-env.sh‎

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -130,21 +130,3 @@ fi
130130
if [ $failed -gt 0 ]; then
131131
exit 1
132132
fi
133-
134-
echo "S3 Backend Environment"
135-
echo "Service: ${S3_SERVICE:-s3}"
136-
echo "Access Key ID: ${AWS_ACCESS_KEY_ID}"
137-
echo "Origin: ${S3_SERVER_PROTO}://${S3_BUCKET_NAME}.${S3_SERVER}:${S3_SERVER_PORT}"
138-
echo "Region: ${S3_REGION}"
139-
echo "Addressing Style: ${S3_STYLE}"
140-
echo "AWS Signatures Version: v${AWS_SIGS_VERSION}"
141-
echo "DNS Resolvers: ${DNS_RESOLVERS}"
142-
echo "Directory Listing Enabled: ${ALLOW_DIRECTORY_LIST}"
143-
echo "Directory Listing Path Prefix: ${DIRECTORY_LISTING_PATH_PREFIX}"
144-
echo "Provide Index Pages Enabled: ${PROVIDE_INDEX_PAGE}"
145-
echo "Append slash for directory enabled: ${APPEND_SLASH_FOR_POSSIBLE_DIRECTORY}"
146-
echo "Stripping the following headers from responses: x-amz-;${HEADER_PREFIXES_TO_STRIP}"
147-
echo "Allow the following headers from responses (these take precedence over the above): ${HEADER_PREFIXES_ALLOWED}"
148-
echo "CORS Enabled: ${CORS_ENABLED}"
149-
echo "CORS Allow Private Network Access: ${CORS_ALLOW_PRIVATE_NETWORK_ACCESS}"
150-
echo "Proxy cache using stale setting: ${PROXY_CACHE_USE_STALE}"

0 commit comments

Comments
 (0)