Skip to content

Update nginx image's readme to run as non root#3071

Closed
rcmadhankumar wants to merge 1 commit intomainfrom
update-nginx_readme
Closed

Update nginx image's readme to run as non root#3071
rcmadhankumar wants to merge 1 commit intomainfrom
update-nginx_readme

Conversation

@rcmadhankumar
Copy link
Copy Markdown
Contributor

@rcmadhankumar rcmadhankumar commented Oct 23, 2025

No description provided.

bci-pushman pushed a commit that referenced this pull request Oct 23, 2025
Test build for #3071
39402a0
bci-pushman pushed a commit that referenced this pull request Oct 23, 2025
Test build for #3071
12968af
bci-pushman pushed a commit that referenced this pull request Oct 23, 2025
Test build for #3071
5c43658
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Oct 23, 2025 •
edited
Loading

Created a staging project on OBS for Tumbleweed: home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3071
Changes pushed to branch Tumbleweed-3071 as commit 046824c525a10cff4912025e8db04dda08e0cad2
Build succeeded ✅

Build Results

Repository images in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3071 for x86_64: current state: published
Build results:

package name status build log
nginx-image ⛔ excluded live log

Repository images in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3071 for aarch64: current state: published
Build results:

package name status build log
nginx-image ⛔ excluded live log

Repository containerfile in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3071 for x86_64: current state: published
Build results:

package name status build log
nginx-image ✅ succeeded live log

Repository containerfile in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3071 for aarch64: current state: published
Build results:

package name status build log
nginx-image ✅ succeeded live log

Build succeeded ✅

To run BCI-tests against this PR, use the following command:

OS_VERSION=tumbleweed TARGET=custom BASEURL=registry.opensuse.org/home/pushman/bci/staging/tumbleweed/tumbleweed-3071/ tox -- -n auto
The following images can be pulled from the staging project:
  • registry.opensuse.org/home/pushman/bci/staging/tumbleweed/tumbleweed-3071/containerfile/opensuse/nginx:latest

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Oct 23, 2025 •
edited
Loading

Created a staging project on OBS for 16.0: home:pushman:BCI:Staging:16.0:16.0-3071
Changes pushed to branch 16.0-3071 as commit 3339adcedf08c9be957cebf65239297f2a5d6fd4
Build succeeded ✅

Build Results

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3071 for x86_64: current state: published
Build results:

package name status build log
nginx-image ⛔ excluded live log

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3071 for aarch64: current state: published
Build results:

package name status build log
nginx-image ⛔ excluded live log

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3071 for s390x: current state: published
Build results:

package name status build log
nginx-image ⛔ excluded live log

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3071 for ppc64le: current state: published
Build results:

package name status build log
nginx-image ⛔ excluded live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3071 for x86_64: current state: published
Build results:

package name status build log
nginx-image ✅ succeeded live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3071 for aarch64: current state: published
Build results:

package name status build log
nginx-image ✅ succeeded live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3071 for s390x: current state: published
Build results:

package name status build log
nginx-image ✅ succeeded live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3071 for ppc64le: current state: published
Build results:

package name status build log
nginx-image ✅ succeeded live log

Build succeeded ✅

To run BCI-tests against this PR, use the following command:

OS_VERSION=16.0 TARGET=custom BASEURL=registry.opensuse.org/home/pushman/bci/staging/16.0/16.0-3071/ tox -- -n auto
The following images can be pulled from the staging project:
  • registry.opensuse.org/home/pushman/bci/staging/16.0/16.0-3071/containerfile/suse/nginx:1.27

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Oct 23, 2025 •
edited
Loading

Created a staging project on OBS for 7: home:pushman:BCI:Staging:SLE-15-SP7:7-3071
Changes pushed to branch 7-3071 as commit bfdf5c3b1f45d88717b190f00e1f918a15ad69a1
Build succeeded ✅

Build Results

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3071 for x86_64: current state: published
Build results:

package name status build log
nginx-image ⛔ excluded live log

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3071 for aarch64: current state: published
Build results:

package name status build log
nginx-image ⛔ excluded live log

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3071 for s390x: current state: published
Build results:

package name status build log
nginx-image ⛔ excluded live log

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3071 for ppc64le: current state: published
Build results:

package name status build log
nginx-image ⛔ excluded live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3071 for x86_64: current state: published
Build results:

package name status build log
nginx-image ✅ succeeded live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3071 for aarch64: current state: published
Build results:

package name status build log
nginx-image ✅ succeeded live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3071 for s390x: current state: published
Build results:

package name status build log
nginx-image ✅ succeeded live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3071 for ppc64le: current state: published
Build results:

package name status build log
nginx-image ✅ succeeded live log

Build succeeded ✅

To run BCI-tests against this PR, use the following command:

OS_VERSION=15.7 TARGET=custom BASEURL=registry.opensuse.org/home/pushman/bci/staging/sle-15-sp7/7-3071/ tox -- -n auto
The following images can be pulled from the staging project:
  • registry.opensuse.org/home/pushman/bci/staging/sle-15-sp7/7-3071/containerfile/suse/nginx:latest

alexandrevicenzi
alexandrevicenzi approved these changes Oct 23, 2025
View reviewed changes
Copy link
Copy Markdown
Member

@alexandrevicenzi alexandrevicenzi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added a few suggestions.

Comment thread src/bci_build/package/nginx/README.md.j2 Outdated
Comment thread src/bci_build/package/nginx/README.md.j2 Outdated
Comment thread src/bci_build/package/nginx/README.md.j2 Outdated
dirkmueller
dirkmueller reviewed Oct 25, 2025
View reviewed changes
Copy link
Copy Markdown
Member

@dirkmueller dirkmueller left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

rather than documenting how to fix it, can we just make the image runnable as non-root, e.g. the nginx user?

@rcmadhankumar
Copy link
Copy Markdown
Contributor Author

rcmadhankumar commented Oct 29, 2025

rather than documenting how to fix it, can we just make the image runnable as non-root, e.g. the nginx user?

running as non root requires port changes in the image and we do not want to make port changes in the image.
Also,

Upstream has 2 options now.
1.running standard nginx image as non root user https://hub.docker.com/_/nginx/#running-nginx-as-a-non-root-user

  1. they have a separate non previleged image https://github.com/nginx/docker-nginx-unprivileged/blob/main/Dockerfile-debian.template#L129

I felt option 1 is suitable, because the image is already capable of running as non root without making any more changes to it.

bci-pushman pushed a commit that referenced this pull request Nov 3, 2025
Test build for #3071
619d14d
bci-pushman pushed a commit that referenced this pull request Nov 3, 2025
Test build for #3071
b7bf911
bci-pushman pushed a commit that referenced this pull request Nov 3, 2025
Test build for #3071
f602463
bci-pushman pushed a commit that referenced this pull request Nov 3, 2025
Test build for #3071
a676a08
bci-pushman pushed a commit that referenced this pull request Nov 3, 2025
Test build for #3071
2442e97
bci-pushman pushed a commit that referenced this pull request Nov 3, 2025
Test build for #3071
9c70697
bci-pushman pushed a commit that referenced this pull request Nov 3, 2025
Test build for #3071
bfdf5c3
bci-pushman pushed a commit that referenced this pull request Nov 3, 2025
Test build for #3071
3339adc
bci-pushman pushed a commit that referenced this pull request Nov 3, 2025
Test build for #3071
046824c
@dirkmueller dirkmueller mentioned this pull request Nov 21, 2025
Open
dirkmueller
dirkmueller reviewed Feb 9, 2026
View reviewed changes
Comment thread src/bci_build/package/nginx/README.md.j2

Define a new path for the process ID in `nginx.conf`:

```ShellSession
Copy link
Copy Markdown
Member

@dirkmueller dirkmueller Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
```ShellSession
```Nginx

dirkmueller
dirkmueller reviewed Feb 9, 2026
View reviewed changes
Comment thread src/bci_build/package/nginx/README.md.j2
```

Adjust the HTTP context paths and ports in `nginx.conf`:
```ShellSession
Copy link
Copy Markdown
Member

@dirkmueller dirkmueller Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
```ShellSession
```Nginx

@dirkmueller
Copy link
Copy Markdown
Member

dirkmueller commented Mar 16, 2026

continued in #3167

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dirkmueller dirkmueller dirkmueller left review comments

@alexandrevicenzi alexandrevicenzi alexandrevicenzi approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@rcmadhankumar @dirkmueller @alexandrevicenzi