From e537da42513fe8e114bc8e0f31816cfc97d588a9 Mon Sep 17 00:00:00 2001 From: Andrew Ferrazzutti Date: Thu, 27 Mar 2025 16:43:13 -0400 Subject: [PATCH] Docker: Use nginx-unprivileged as base image (#29353) Instead of manually tweaking directory ownership & pidfile config to enable running as non-root, use the official first-party base image for achieving non-root. Co-authored-by: Michael Telatynski <7t3chguy@gmail.com> --- Dockerfile | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/Dockerfile b/Dockerfile index cd1766347a..0258850d89 100644 --- a/Dockerfile +++ b/Dockerfile @@ -19,7 +19,10 @@ RUN /src/scripts/docker-package.sh RUN cp /src/config.sample.json /src/webapp/config.json # App -FROM nginx:alpine-slim +FROM nginxinc/nginx-unprivileged:alpine-slim + +# Need root user to install packages & manipulate the usr directory +USER root # Install jq and moreutils for sponge, both used by our entrypoints RUN apk add jq moreutils @@ -31,13 +34,6 @@ COPY --from=builder /src/webapp /app COPY /docker/nginx-templates/* /etc/nginx/templates/ COPY /docker/docker-entrypoint.d/* /docker-entrypoint.d/ -# Tell nginx to put its pidfile elsewhere, so it can run as non-root -RUN sed -i -e 's,/var/run/nginx.pid,/tmp/nginx.pid,' /etc/nginx/nginx.conf - -# nginx user must own the cache and etc directory to write cache and tweak the nginx config -RUN chown -R nginx:0 /var/cache/nginx /etc/nginx -RUN chmod -R g+w /var/cache/nginx /etc/nginx - RUN rm -rf /usr/share/nginx/html \ && ln -s /app /usr/share/nginx/html