Skip to content

v1.2.6 - Container Optimization with nginx:alpine-slim

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Dec 08:49
· 476 commits to master since this release
v1.2.6
936640d

Release Notes - v1.2.6

Release Date: 2025-12-14
Type: Container Optimization Release

Summary

This release optimizes the web application Dockerfile by switching to the smaller nginx:1.29-alpine-slim base image and fixes non-root permission issues specific to the alpine-slim variant. The alpine-slim image provides a reduced attack surface with minimal packages while maintaining full functionality for serving the CyberChef web application.

Changes

nginx Base Image Optimization

The web application Dockerfile now uses nginx:1.29-alpine-slim instead of nginx:stable-alpine:

# Before (v1.2.5)
FROM nginx:stable-alpine AS cyberchef

# After (v1.2.6)
FROM nginx:1.29-alpine-slim AS cyberchef

Benefits:

  • Smaller image size: alpine-slim variant includes only essential packages
  • Reduced attack surface: Fewer packages means fewer potential vulnerabilities
  • Explicit version pinning: 1.29 ensures reproducible builds (no surprise updates)
  • Security hardened: Minimal base image follows container security best practices

Non-Root Permission Fixes

The alpine-slim variant has stricter default permissions than standard alpine, requiring explicit setup for non-root nginx execution:

# Security: Set proper ownership for nginx user and cache directories
# The alpine-slim variant requires explicit cache directory setup for non-root execution
RUN chown -R nginx:nginx /usr/share/nginx/html && \
    chmod -R 755 /usr/share/nginx/html && \
    mkdir -p /var/cache/nginx/client_temp \
             /var/cache/nginx/proxy_temp \
             /var/cache/nginx/fastcgi_temp \
             /var/cache/nginx/uwsgi_temp \
             /var/cache/nginx/scgi_temp && \
    chown -R nginx:nginx /var/cache/nginx && \
    chown -R nginx:nginx /var/run && \
    chown -R nginx:nginx /run

Fixed Issues:

  1. nginx: [emerg] mkdir() "/var/cache/nginx/client_temp" failed (13: Permission denied)
  2. nginx: [emerg] open() "/run/nginx.pid" failed (13: Permission denied)

Root Cause: The nginx:alpine-slim variant does not pre-create nginx cache directories or configure permissions for non-root execution by default.

Technical Details

Cache Directory Structure

nginx requires the following cache directories for operation:

  • /var/cache/nginx/client_temp - Client body buffering
  • /var/cache/nginx/proxy_temp - Proxy response buffering
  • /var/cache/nginx/fastcgi_temp - FastCGI response buffering
  • /var/cache/nginx/uwsgi_temp - uWSGI response buffering
  • /var/cache/nginx/scgi_temp - SCGI response buffering

These directories must be created and owned by the nginx user for non-root execution.

PID File Location

nginx writes its process ID to /run/nginx.pid (symlinked from /var/run/nginx.pid on Alpine). The nginx user must have write access to /run for the PID file.

Changed Files

File Change
Dockerfile Changed base image from nginx:stable-alpine to nginx:1.29-alpine-slim
Dockerfile Added explicit mkdir for nginx cache directories
Dockerfile Added chown for /var/run and /run directories
package.json mcpVersion bumped to 1.2.6
src/node/mcp-server.mjs Version constant updated to 1.2.6
README.md Version references updated to v1.2.6
docs/user_guide.md Download URLs updated to v1.2.6
SECURITY.md Security measures section updated to v1.2.6
docs/ROADMAP.md Added v1.2.6 to release overview
CHANGELOG.md v1.2.6 release notes added

Upgrade Instructions

From v1.2.5

# Pull latest MCP server image
docker pull ghcr.io/doublegate/cyberchef-mcp_v1:v1.2.6

# Or download offline tarball
wget https://github.com/doublegate/CyberChef-MCP/releases/download/v1.2.6/cyberchef-mcp-v1.2.6-docker-image.tar.gz
docker load < cyberchef-mcp-v1.2.6-docker-image.tar.gz

Rebuild Web Application Image

If using the web application Dockerfile:

docker build -t cyberchef-web .
docker run -p 8080:80 cyberchef-web

Verify Non-Root Execution

# Verify nginx user in web app container
docker run --rm cyberchef-web id
# Expected: uid=101(nginx) gid=101(nginx) groups=101(nginx)

# Verify MCP server non-root user
docker run --rm ghcr.io/doublegate/cyberchef-mcp_v1:v1.2.6 id
# Expected: uid=1001(cyberchef) gid=1001(cyberchef)

Breaking Changes

None. This release is fully backward compatible with v1.2.5.

Security Considerations

nginx:alpine-slim vs nginx:alpine

Aspect nginx:alpine nginx:alpine-slim
Image Size ~40MB ~12MB
Packages Full Alpine base Minimal essential only
Attack Surface Standard Reduced
Shell /bin/sh included /bin/sh included
Package Manager apk included apk not included

The slim variant provides security through minimization - fewer packages means fewer potential vulnerabilities and less to patch.

Recommended Security Options

For maximum security, run with all hardening options:

docker run -i --rm \
  --read-only \
  --tmpfs /tmp:size=100M \
  --cap-drop=ALL \
  --security-opt=no-new-privileges \
  ghcr.io/doublegate/cyberchef-mcp_v1:v1.2.6

Links

Full Changelog

Full Changelog: v1.2.5...v1.2.6

Assets 4
Loading