Skip to content

Commit 05446b8

Browse files
committed
Update nginx image's readme to run as non root
1 parent 851b480 commit 05446b8

1 file changed

Lines changed: 31 additions & 0 deletions

File tree

src/bci_build/package/nginx/README.md.j2

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,37 @@ The template above is then rendered to `/etc/nginx/conf.d/default.conf` as follo
4242
listen 80;
4343
```
4444

45+
## Running nginx as a non-root user
46+
It is possible to run the image as a less privileged arbitrary UID/GID. This, however, requires modification of nginx configuration to use directories writeable by that specific UID/GID pair:
47+
```ShellSession
48+
$ podman run -it --user nginx --rm -p 8080:8080 -v /path/to/html/:/srv/www/htdocs/:Z -v $PWD/nginx.conf:/etc/nginx/nginx.conf:Z {{ image.pretty_reference }}
49+
```
50+
51+
where nginx.conf in the current directory should have the following directives re-defined:
52+
53+
```ShellSession
54+
pid /tmp/nginx.pid;
55+
```
56+
57+
And in the http context:
58+
```ShellSession
59+
http {
60+
client_body_temp_path /tmp/client_temp;
61+
proxy_temp_path /tmp/proxy_temp_path;
62+
fastcgi_temp_path /tmp/fastcgi_temp;
63+
uwsgi_temp_path /tmp/uwsgi_temp;
64+
scgi_temp_path /tmp/scgi_temp;
65+
...
66+
...
67+
server {
68+
listen 8080;
69+
...
70+
...
71+
}
72+
...
73+
}
74+
```
75+
4576
## Environment variables
4677

4778
### NGINX_ENTRYPOINT_QUIET_LOGS

0 commit comments

Comments
 (0)