Docker NGINX v2.0.0

Highlights

• Production-hardened non-root runtime with read-only filesystem support, health checks, and graceful shutdown
• Multi-stage build with pinned and SHA-256-verified NGINX, ModSecurity, connector, and OWASP CRS sources
• Backward-compatible internal port 80 and tested mounted legacy conf.d configurations
• Hardened WAF, real-IP handling, rate limiting, request body limits, and audit log retention
• CI vulnerability scanning, SBOM, provenance, and keyless Cosign signatures
• Runtime image reduced to approximately 79 MB

Compatibility

Existing conf.d files and templates listening on port 80 remain supported. Mounted files must be readable by UID/GID 101. See the README for migration and production configuration details.

Full Changelog: v1.0.1...v2.0.0

v1.0.1 – NGINX security stack update

Security update

• Update NGINX from 1.29.4 to 1.31.3, fixing CVE-2026-42533.
• Pin ModSecurity v3.0.16 and ModSecurity-nginx v1.0.4.
• Pin OWASP Core Rule Set v4.28.0.
• Use HTTPS for the NGINX source download.

Maintenance

• Keep the ModSecurity audit storage root during cleanup.
• Remove the obsolete Docker Compose version declaration.

Validation

• Docker image builds successfully.
• nginx -t passes.
• Normal HTTP request returns 200.
• XSS payload is blocked with 403.

v1.0.0

Initial release