Nginx

The corresponding FreeBSD14.3p5-amd64 images are available on Github, DockerHub and Quay. CI/CD pipelines will soon add amd64/aarch64 support for 15.0, 14.snap, 15.snap and 16.snap.

• Upstream repo: https://github.com/nginx/docker-nginx
• FreeBSD fork: https://github.com/matias-pizarro/docker-nginx

UsageContainerfileBuildTestPushTagsLicense

Hosting some simple static content

$ podman run --replace --detach --name some-nginx \
-v ./examples/static-html-directory:/usr/local/www/nginx:ro ghcr.io/matias-pizarro/freebsd-oci-containers/nginx:freebsd

Alternatively, a simple Dockerfile can be used to generate a new image that includes the necessary content (which is a much cleaner solution than the bind mount above):

FROM ghcr.io/matias-pizarro/freebsd-oci-containers/nginx:freebsd
COPY static-html-directory /usr/local/www/nginx

Place this file in the same directory as your directory of content ("static-html-directory"), then run these commands to build and start your container:

$ podman build -t some-content-nginx examples
$ podman run --replace --detach --name some-nginx some-content-nginx

Exposing external port

$ podman run --replace --detach --publish \
    --name some-nginx 8080:80 some-content-nginx

Then you can hit http://localhost:8080 or http://host-ip:8080 in your browser.

Customize configuration

You can mount your configuration file, or build a new image with it.

If you wish to adapt the default configuration, use something like the following to get it from a running nginx container:

$ podman run --rm --entrypoint=cat ghcr.io/matias-pizarro/freebsd-oci-containers/nginx:freebsd \
    /usr/local/etc/nginx/nginx.conf > ./examples/custom-nginx-conf/nginx.conf

And then edit examples/custom-nginx-conf/nginx-conf in your host file system.

For information on the syntax of the nginx configuration files, see the official documentation (specifically the Beginner's Guide).

Mount your configuration file

$ podman run --replace --detach --name my-custom-nginx-container \
    -v ./examples/custom-nginx-conf/nginx.conf:/etc/nginx/nginx.conf:ro \
    ghcr.io/matias-pizarro/freebsd-oci-containers/nginx:freebsd

Build a new image with your configuration file

FROM ghcr.io/matias-pizarro/freebsd-oci-containers/nginx:freebsd
COPY nginx.conf /usr/local/etc/nginx/nginx.conf

If you add a custom CMD in the Dockerfile, be sure to include -g daemon off; in the CMD in order for nginx to stay in the foreground, so that podman can track the process properly (otherwise your container will stop immediately after starting)!

Then build the image with docker build -t custom-nginx examples/custom-nginx-conf and run it as follows:

$ podman run --name my-custom-nginx-container --detach custom-nginx

Using environment variables in nginx configuration (new in 1.19)

Out-of-the-box, nginx doesn't support environment variables inside most configuration blocks. But this image has a function, which will extract environment variables before nginx starts.

Here is an example using compose.yaml:

web:
  image: nginx
  volumes:
   - ./templates:/etc/nginx/templates
  ports:
   - "8080:80"
  environment:
   - NGINX_HOST=foobar.com
   - NGINX_PORT=80

By default, this function reads template files in /etc/nginx/templates/*.template and outputs the result of executing envsubst to /etc/nginx/conf.d.

So if you place templates/default.conf.template file, which contains variable references like this:

listen       ${NGINX_PORT};

outputs to /etc/nginx/conf.d/default.conf like this:

listen       80;

This behavior can be changed via the following environment variables:

• NGINX_ENVSUBST_TEMPLATE_DIR
  • A directory which contains template files (default: /etc/nginx/templates)
  • When this directory doesn't exist, this function will do nothing about template processing.
• NGINX_ENVSUBST_TEMPLATE_SUFFIX
  • A suffix of template files (default: .template)
  • This function only processes the files whose name ends with this suffix.
• NGINX_ENVSUBST_OUTPUT_DIR
  • A directory where the result of executing envsubst is output (default: /etc/nginx/conf.d)
  • The output filename is the template filename with the suffix removed.
    • ex.) /etc/nginx/templates/default.conf.template will be output with the filename /etc/nginx/conf.d/default.conf.
  • This directory must be writable by the user running a container.

Running nginx in read-only mode

To run nginx in read-only mode, you will need to mount a podman volume to every location where nginx writes information. The default nginx configuration requires write access to /var/cache/nginx and /var/run. This can be easily accomplished by running nginx as follows:

$ podman run --replace --detach --publish 80:80 --read-only -v $(pwd)/nginx-cache:/var/cache/nginx -v $(pwd)/nginx-pid:/var/run nginx

If you have a more advanced configuration that requires nginx to write to other locations, simply add more volume mounts to those locations.

Running nginx in debug mode

Images since version 1.9.8 come with nginx-debug binary that produces verbose output when using higher log levels. It can be used with simple CMD substitution:

$ podman run --name my-nginx -v /host/path/nginx.conf:/etc/nginx/nginx.conf:ro --detach nginx nginx-debug -g 'daemon off;'

Similar configuration in compose.yaml may look like this:

web:
  image: nginx
  volumes:
    - ./nginx.conf:/etc/nginx/nginx.conf:ro
  command: [nginx-debug, '-g', 'daemon off;']

Entrypoint quiet logs

Since version 1.19.0, a verbose entrypoint was added. It provides information on what's happening during container startup. You can silence this output by setting environment variable NGINX_ENTRYPOINT_QUIET_LOGS:

$ podman run --detach -e NGINX_ENTRYPOINT_QUIET_LOGS=1 nginx

User and group id

Since 1.17.0, both alpine- and debian-based images variants use the same user and group ids to drop the privileges for worker processes:

$ id
uid=101(nginx) gid=101(nginx) groups=101(nginx)

Running nginx as a non-root user

It is possible to run the image as a less privileged arbitrary UID/GID. This, however, requires modification of nginx configuration to use directories writeable by that specific UID/GID pair:

$ podman run --detach -v $PWD/nginx.conf:/etc/nginx/nginx.conf nginx

where nginx.conf in the current directory should have the following directives re-defined:

pid        /tmp/nginx.pid;

And in the http context:

http {
    client_body_temp_path /tmp/client_temp;
    proxy_temp_path       /tmp/proxy_temp_path;
    fastcgi_temp_path     /tmp/fastcgi_temp;
    uwsgi_temp_path       /tmp/uwsgi_temp;
    scgi_temp_path        /tmp/scgi_temp;
...
}

images/14.3/nginx/stable/Containerfile

#
# NOTE: THIS DOCKERFILE IS GENERATED VIA "update.sh"
#
# PLEASE DO NOT EDIT IT DIRECTLY.
#
FROM ghcr.io/matias-pizarro/freebsd-oci-containers/freebsd-zfs:14.3

LABEL maintainer="Matías Pizarro <docker@docbase.net>"

# create nginx user/group first, to be consistent throughout docker variants
RUN echo "nginx:101:::0:0:nginx user:/nonexistent:/usr/bin/false:" | adduser -D -S -f -

ENV NGINX_VERSION   1.28.0
ENV NJS_VERSION     0.9.3

# should provide modules xslt geoip image njs
RUN set -eux; \
    /usr/bin/env pkg install -yr FreeBSD-ports \
        www/nginx-full \
    && rm -f /var/cache/pkg/* \
    && rm -rf /var/db/pkg/* \
    \
# forward request and error logs to docker log collector
    && ln -sf /dev/stdout /var/log/nginx/access.log \
    && ln -sf /dev/stderr /var/log/nginx/error.log \
# create a docker-entrypoint.d directory
    && mkdir /docker-entrypoint.d

COPY docker-entrypoint.sh /
COPY 10-listen-on-ipv6-by-default.sh /docker-entrypoint.d
COPY 15-local-resolvers.envsh /docker-entrypoint.d
COPY 20-envsubst-on-templates.sh /docker-entrypoint.d
COPY 30-tune-worker-processes.sh /docker-entrypoint.d
ENTRYPOINT ["/docker-entrypoint.sh"]

COPY --chown=0:0 --chmod=0644 nginx.conf /usr/local/etc/nginx/nginx.conf
COPY --chown=0:0 --chmod=0644 default.conf /usr/local/etc/nginx/conf.d/default.conf

RUN /usr/local/sbin/nginx -t

EXPOSE 80

STOPSIGNAL SIGQUIT

CMD ["/usr/local/sbin/nginx", "-g", "daemon off;"]

images/14.3/nginx/stable/build.sh

podman build \
    --env IGNORE_OSVERSION=yes \
    --env ABI=FreeBSD:14:$(sysctl -n hw.machine_arch) \
    --env OSVERSION=1403000 \
    --env VERSION_MINOR=3 \
    --no-hosts \
    --tag nginx:freebsd \
    --tag nginx:freebsd14 \
    --tag nginx:freebsd14.3 \
    --tag nginx:stable-freebsd \
    --tag nginx:stable-freebsd14 \
    --tag nginx:stable-freebsd14.3 \
    --file Containerfile

images/14.3/nginx/stable/test.sh

# TBD: smoke test of built images

podman run -it --rm \
    ghcr.io/matias-pizarro/freebsd-oci-containers/nginx:freebsd nginx -v

images/14.3/nginx/stable/push.sh

# Github
echo
echo "################################################################################"
IMAGE_PATH="ghcr.io/matias-pizarro/freebsd-oci-containers"
echo "Pushing nginx-stable to ${IMAGE_PATH}"

echo
echo "nginx:freebsd"
podman tag localhost/nginx:freebsd "${IMAGE_PATH}"/nginx:freebsd
podman push "${IMAGE_PATH}"/nginx:freebsd

echo
echo "nginx:freebsd14"
podman tag localhost/nginx:freebsd14 "${IMAGE_PATH}"/nginx:freebsd14
podman push "${IMAGE_PATH}"/nginx:freebsd14

echo
echo "nginx:freebsd14.3"
podman tag localhost/nginx:freebsd14.3 "${IMAGE_PATH}"/nginx:freebsd14.3
podman push "${IMAGE_PATH}"/nginx:freebsd14.3

echo
echo "nginx:stable-freebsd"
podman tag localhost/nginx:stable-freebsd "${IMAGE_PATH}"/nginx:stable-freebsd
podman push "${IMAGE_PATH}"/nginx:stable-freebsd

echo
echo "nginx:stable-freebsd14"
podman tag localhost/nginx:stable-freebsd14 "${IMAGE_PATH}"/nginx:stable-freebsd14
podman push "${IMAGE_PATH}"/nginx:stable-freebsd14

echo
echo "nginx:stable-freebsd14.3"
podman tag localhost/nginx:stable-freebsd14.3 "${IMAGE_PATH}"/nginx:stable-freebsd14.3
podman push "${IMAGE_PATH}"/nginx:stable-freebsd14.3


# Docker
echo
echo "################################################################################"
IMAGE_PATH="docker.io/matiaspizarro"
echo "Pushing nginx-stable to ${IMAGE_PATH}"

echo
echo "nginx:freebsd"
podman tag localhost/nginx:freebsd "${IMAGE_PATH}"/nginx:freebsd
podman push "${IMAGE_PATH}"/nginx:freebsd

echo
echo "nginx:freebsd14"
podman tag localhost/nginx:freebsd14 "${IMAGE_PATH}"/nginx:freebsd14
podman push "${IMAGE_PATH}"/nginx:freebsd14

echo
echo "nginx:freebsd14.3"
podman tag localhost/nginx:freebsd14.3 "${IMAGE_PATH}"/nginx:freebsd14.3
podman push "${IMAGE_PATH}"/nginx:freebsd14.3

echo
echo "nginx:stable-freebsd"
podman tag localhost/nginx:stable-freebsd "${IMAGE_PATH}"/nginx:stable-freebsd
podman push "${IMAGE_PATH}"/nginx:stable-freebsd

echo
echo "nginx:stable-freebsd14"
podman tag localhost/nginx:stable-freebsd14 "${IMAGE_PATH}"/nginx:stable-freebsd14
podman push "${IMAGE_PATH}"/nginx:stable-freebsd14

echo
echo "nginx:stable-freebsd14.3"
podman tag localhost/nginx:stable-freebsd14.3 "${IMAGE_PATH}"/nginx:stable-freebsd14.3
podman push "${IMAGE_PATH}"/nginx:stable-freebsd14.3


# Quay
echo
echo "################################################################################"
IMAGE_PATH="quay.io/matiaspizarro"
echo "Pushing nginx-stable to ${IMAGE_PATH}"

echo
echo "nginx:freebsd"
podman tag localhost/nginx:freebsd "${IMAGE_PATH}"/nginx:freebsd
podman push "${IMAGE_PATH}"/nginx:freebsd

echo
echo "nginx:freebsd14"
podman tag localhost/nginx:freebsd14 "${IMAGE_PATH}"/nginx:freebsd14
podman push "${IMAGE_PATH}"/nginx:freebsd14

echo
echo "nginx:freebsd14.3"
podman tag localhost/nginx:freebsd14.3 "${IMAGE_PATH}"/nginx:freebsd14.3
podman push "${IMAGE_PATH}"/nginx:freebsd14.3

echo
echo "nginx:stable-freebsd"
podman tag localhost/nginx:stable-freebsd "${IMAGE_PATH}"/nginx:stable-freebsd
podman push "${IMAGE_PATH}"/nginx:stable-freebsd

echo
echo "nginx:stable-freebsd14"
podman tag localhost/nginx:stable-freebsd14 "${IMAGE_PATH}"/nginx:stable-freebsd14
podman push "${IMAGE_PATH}"/nginx:stable-freebsd14

echo
echo "nginx:stable-freebsd14.3"
podman tag localhost/nginx:stable-freebsd14.3 "${IMAGE_PATH}"/nginx:stable-freebsd14.3
podman push "${IMAGE_PATH}"/nginx:stable-freebsd14.3

Supported tags and respective Containerfile links

• freebsd, freebsd14, freebsd14.3, stable-freebsd, stable-freebsd14, stable-freebsd14.3

• mainline-freebsd, mainline-freebsd14, mainline-freebsd14.3

• freebsd14.snapshot, stable-freebsd14.snapshot

• mainline-freebsd14.snapshot

• freebsd15, freebsd15.0, stable-freebsd15, stable-freebsd15.0

• mainline-freebsd15, mainline-freebsd15.0

• freebsd15.snapshot, stable-freebsd15.snapshot

• mainline-freebsd15.snapshot

• freebsd16, freebsd16.snapshot, stable-freebsd16, stable-freebsd16.snapshot

• mainline-freebsd16, mainline-freebsd16.snapshot

images/14.3/nginx/stable/LICENSE

Copyright (C) 2011-2023 F5, Inc.
All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
   notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
   notice, this list of conditions and the following disclaimer in the
   documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.