Skip to content

Commit 7c4fb24

Browse files
dekobondekobon
committed
Fixes nginx#73
This commit builds upon the previous commits that add support for running unprivileged nginx instances. In this commit, we normalize spelling, and add CI tooling support for unprivileged nginx instances. Signed-off-by: Elijah Zupancic <e.zupancic@f5.com>
1 parent 8f406d2 commit 7c4fb24

File tree

4 files changed

+103
-26
lines changed

4 files changed

+103
-26
lines changed

‎.github/workflows/main.yml‎

Lines changed: 26 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,13 @@ jobs:
2121
- name: Install dependencies
2222
run: sudo apt-get install -y wait-for-it
2323
- name: Run tests - latest njs version
24-
run: ./test.sh latest-njs-oss
24+
run: ./test.sh --latest-njs --type oss
2525
- name: Run tests - stable njs version
26-
run: ./test.sh oss
26+
run: ./test.sh --type oss
27+
- name: Run tests - stable njs version - unprivileged process
28+
run: ./test.sh --unprivileged --type oss
29+
- name: Run tests - latest njs version - unprivileged process
30+
run: ./test.sh --latest-njs --unprivileged --type oss
2731

2832
build_and_deploy:
2933
runs-on: ubuntu-latest
@@ -41,9 +45,9 @@ jobs:
4145
- name: Install dependencies
4246
run: sudo apt-get install -y wait-for-it
4347
- name: Run tests - latest njs version
44-
run: ./test.sh latest-njs-oss
48+
run: ./test.sh --latest-njs --type oss
4549
- name: Run tests - stable njs version
46-
run: ./test.sh oss
50+
run: ./test.sh --type oss
4751
# latest-njs-oss image push [Github]
4852
- name: Tag container image for Push to github [latest-njs-oss date]
4953
run: docker tag nginx-s3-gateway:latest-njs-oss docker.pkg.github.com/$GITHUB_REPOSITORY/nginx-oss-s3-gateway:latest-njs-oss-${{ steps.date.outputs.date }}
@@ -53,6 +57,15 @@ jobs:
5357
run: docker push docker.pkg.github.com/$GITHUB_REPOSITORY/nginx-oss-s3-gateway:latest-njs-oss-${{ steps.date.outputs.date }}
5458
- name: Push container image to github [latest-njs-oss]
5559
run: docker push docker.pkg.github.com/$GITHUB_REPOSITORY/nginx-oss-s3-gateway:latest-njs-oss
60+
# unprivileged-oss image push [Github]
61+
- name: Tag container image for Push to github [unprivileged-oss date]
62+
run: docker tag nginx-s3-gateway:unprivileged-oss docker.pkg.github.com/$GITHUB_REPOSITORY/nginx-oss-s3-gateway:unprivileged-oss-${{ steps.date.outputs.date }}
63+
- name: Tag container image for Push to github [unprivileged-oss]
64+
run: docker tag nginx-s3-gateway:unprivileged-oss docker.pkg.github.com/$GITHUB_REPOSITORY/nginx-oss-s3-gateway:unprivileged-oss
65+
- name: Push container image to github [unprivileged-oss date]
66+
run: docker push docker.pkg.github.com/$GITHUB_REPOSITORY/nginx-oss-s3-gateway:unprivileged-oss-${{ steps.date.outputs.date }}
67+
- name: Push container image to github [unprivileged-oss]
68+
run: docker push docker.pkg.github.com/$GITHUB_REPOSITORY/nginx-oss-s3-gateway:unprivileged-oss
5669
# oss image push [Github]
5770
- name: Tag container image for Push to github [oss date]
5871
run: docker tag nginx-s3-gateway:latest docker.pkg.github.com/$GITHUB_REPOSITORY/nginx-oss-s3-gateway:latest-${{ steps.date.outputs.date }}
@@ -77,6 +90,15 @@ jobs:
7790
run: docker push nginxinc/nginx-s3-gateway:latest-njs-oss-${{ steps.date.outputs.date }}
7891
- name: Push container image to Docker Hub [latest-njs-oss]
7992
run: docker push nginxinc/nginx-s3-gateway:latest-njs-oss
93+
# unprivileged-oss image push [Docker Hub]
94+
- name: Tag container image for Push to Docker Hub [unprivileged-oss date]
95+
run: docker tag nginx-s3-gateway:unprivileged-oss nginxinc/nginx-s3-gateway:unprivileged-oss-${{ steps.date.outputs.date }}
96+
- name: Tag container image for Push to Docker Hub [unprivileged-oss]
97+
run: docker tag nginx-s3-gateway:unprivileged-oss nginxinc/nginx-s3-gateway:unprivileged-oss
98+
- name: Push container image to Docker Hub [unprivileged-oss date]
99+
run: docker push nginxinc/nginx-s3-gateway:unprivileged-oss-${{ steps.date.outputs.date }}
100+
- name: Push container image to Docker Hub [unprivileged-oss]
101+
run: docker push nginxinc/nginx-s3-gateway:unprivileged-oss
80102
# oss image push [Docker Hub]
81103
- name: Tag container image for Push to Docker Hub [oss date]
82104
run: docker tag nginx-s3-gateway:latest nginxinc/nginx-s3-gateway:latest-${{ steps.date.outputs.date }}

Dockerfile.latest-unpriviledged renamed to Dockerfile.unprivileged

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# This container images makes the necessary modifications in the
22
# inherited image (which could be OSS NGINX or NGINX Plus) in order
33
# to allow running NGINX S3 Gateway as a non root user.
4-
# Steps are based on the official unpriviledged container:
4+
# Steps are based on the official unprivileged container:
55
# https://github.com/nginxinc/docker-nginx-unprivileged/blob/main/Dockerfile-debian.template
66
FROM nginx-s3-gateway
77

@@ -18,4 +18,4 @@ RUN sed -i "/^server {/a \ listen 8080;" /etc/nginx/templates/default.c
1818

1919
EXPOSE 8080
2020

21-
USER nginx
21+
USER nginx

‎test.sh‎

Lines changed: 74 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@
1717
#
1818

1919
set -o errexit # abort on nonzero exit status
20-
set -o nounset # abort on unbound variable
2120
set -o pipefail # don't hide errors within pipes
2221

2322
nginx_server_proto="http"
@@ -41,28 +40,71 @@ e() {
4140
>&2 echo "$1"
4241
}
4342

44-
45-
if [ $# -eq 0 ]; then
43+
usage() { e "Usage: $0 [--latest-njs <default:false>] [--unprivileged <default:false>] [--type <default:oss|plus>" 1>&2; exit 1; }
44+
45+
for arg in "$@"; do
46+
shift
47+
case "$arg" in
48+
'--help') set -- "$@" '-h' ;;
49+
'--latest-njs') set -- "$@" '-j' ;;
50+
'--unprivileged') set -- "$@" '-u' ;;
51+
'--type') set -- "$@" '-t' ;;
52+
*) set -- "$@" "$arg" ;;
53+
esac
54+
done
55+
56+
while getopts "hjut:" arg; do
57+
case "${arg}" in
58+
j)
59+
njs_latest="1"
60+
;;
61+
u)
62+
unprivileged="1"
63+
;;
64+
t)
65+
nginx_type="${OPTARG}"
66+
;;
67+
*)
68+
usage
69+
;;
70+
esac
71+
done
72+
shift $((OPTIND-1))
73+
74+
startup_message=""
75+
76+
if [ -z "${nginx_type}" ]; then
4677
nginx_type="oss"
47-
njs_latest=0
48-
p "No argument specified - defaulting to NGINX OSS. Valid arguments: oss, plus, latest-njs-oss, latest-njs-plus"
78+
startup_message="Starting NGINX ${nginx_type} (default)"
79+
elif ! { [ ${nginx_type} == "oss" ] || [ ${nginx_type} == "plus" ]; }; then
80+
e "Invalid NGINX type: ${nginx_type} - must be either 'oss' or 'plus'"
81+
usage
4982
else
50-
if [[ "${1}" == *plus ]]; then
51-
nginx_type="plus"
52-
p "Testing with NGINX Plus"
53-
else
54-
nginx_type="oss"
55-
p "Testing with NGINX OSS"
56-
fi
83+
startup_message="Starting NGINX ${nginx_type}"
84+
fi
5785

58-
if [[ "${1}" == latest-njs-* ]]; then
59-
p "Testing with latest development version of NJS"
60-
njs_latest=1
61-
else
62-
njs_latest=0
63-
fi
86+
if [ -z "${njs_latest}" ]; then
87+
njs_latest="0"
88+
startup_message="${startup_message} with the release NJS module (default)"
89+
elif [ ${njs_latest} -eq 1 ]; then
90+
startup_message="${startup_message} with the latest NJS module"
91+
else
92+
startup_message="${startup_message} with the release NJS module"
6493
fi
6594

95+
if [ -z "${unprivileged}" ]; then
96+
unprivileged="0"
97+
startup_message="${startup_message} in privileged mode (default)"
98+
elif [ ${unprivileged} -eq 1 ]; then
99+
startup_message="${startup_message} in unprivileged mode"
100+
else
101+
startup_message="${startup_message} in privileged mode"
102+
fi
103+
104+
e "${startup_message}"
105+
106+
set -o nounset # abort on unbound variable
107+
66108
docker_cmd="$(command -v docker)"
67109
if ! [ -x "${docker_cmd}" ]; then
68110
e "required dependency not found: docker not found in the path or not executable"
@@ -102,7 +144,14 @@ if [ "${nginx_type}" = "plus" ]; then
102144
fi
103145

104146
compose() {
105-
"${docker_compose_cmd}" -f "${test_compose_config}" -p "${test_compose_project}" "$@"
147+
# Hint to docker-compose the internal port to map for the container
148+
if [ ${unprivileged} -eq 1 ]; then
149+
export NGINX_INTERNAL_PORT=8080
150+
else
151+
export NGINX_INTERNAL_PORT=80
152+
fi
153+
154+
"${docker_compose_cmd}" -f "${test_compose_config}" -p "${test_compose_project}" "$@"
106155
}
107156

108157
integration_test() {
@@ -208,6 +257,12 @@ if [ ${njs_latest} -eq 1 ]; then
208257
--tag nginx-s3-gateway --tag nginx-s3-gateway:latest-njs-${nginx_type} .
209258
fi
210259

260+
if [ ${unprivileged} -eq 1 ]; then
261+
p "Layering in unprivileged build"
262+
docker build -f Dockerfile.unprivileged \
263+
--tag nginx-s3-gateway --tag nginx-s3-gateway:unprivileged-${nginx_type} .
264+
fi
265+
211266
### UNIT TESTS
212267

213268
p "Running unit tests in Docker image"

‎test/docker-compose.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ services:
99
condition: service_healthy
1010
image: "nginx-s3-gateway"
1111
ports:
12-
- "8989:80/tcp"
12+
- "8989:${NGINX_INTERNAL_PORT-80}/tcp"
1313
links:
1414
- "minio"
1515
restart: "no"

0 commit comments

Comments
 (0)