nginx is not compatible to upstream module package from alpine (nginx-mod-http-headers-more)

[sagiru]

Description

Hi,

we have the requirement to use the module nginx-mod-http-headers-more in our docker images. If we use the nginx-unprivileged:1.22.0-alpine or the nginx-unprivileged:1.23.1-alpine and add the module we got two different error but it does not work with any of them.

If we use 1.22.0 and add the both lines in any dockerfile from below we got the following error:

sascha@marge: $ docker run nginx-sidecar:latest
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf
10-listen-on-ipv6-by-default.sh: info: /etc/nginx/conf.d/default.conf differs from the packaged version
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
/docker-entrypoint.sh: Configuration complete; ready for start up
2022/09/09 13:27:28 [emerg] 1#1: module "/usr/lib/nginx/modules/ngx_http_headers_more_filter_module.so" is not binary compatible in /etc/nginx/nginx.conf:1
nginx: [emerg] module "/usr/lib/nginx/modules/ngx_http_headers_more_filter_module.so" is not binary compatible in /etc/nginx/nginx.conf:1

If we use 1.23.1 and add the both lines in any dockerfile from below we got the following, slightly different error:

sascha@marge: $ docker run nginx-sidecar:latest
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/watcher-launcher.sh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf
10-listen-on-ipv6-by-default.sh: info: /etc/nginx/conf.d/default.conf differs from the packaged version
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
/docker-entrypoint.sh: Configuration complete; ready for start up
2022/09/09 13:08:57 [emerg] 1#1: module "/usr/lib/nginx/modules/ngx_http_headers_more_filter_module.so" version 1022000 instead of 1023001 in /etc/nginx/nginx.conf:1
nginx: [emerg] module "/usr/lib/nginx/modules/ngx_http_headers_more_filter_module.so" version 1022000 instead of 1023001 in /etc/nginx/nginx.conf:1

To reproduce

Use the following dockerfile and do a docker build. After a docker run you will get the errors.

FROM docker-proxy.central.aws.aok-systems.de/nginxinc/nginx-unprivileged:1.23.1-alpine

USER root

RUN apk add --no-cache nginx-mod-http-headers-more
RUN echo "load_module /usr/lib/nginx/modules/ngx_http_headers_more_filter_module.so;" > /etc/nginx/nginx.conf

USER nginx

Your environment

• Version of Docker
• Version of the NGINX Unprivileged Docker image
  • 1.22.0-alpine
  • 1.23.1-alpine
• Target deployment environment/platform
  • Local Docker, Openshift and eks

[alessfg]

This is not a module officially developed by NGINX so I don't know that I can be of much help? I would probably suggest looking through the source repo for the module (https://github.com/openresty/headers-more-nginx-module) to see if anyone is running into similar issues.

[thresheek]

I wanted to add that the reason that alpine packages are incompatible is they're built for a different version. In nginx:alpine, and, subsequently, unprivileged variant we use our own built and tested binaries. Otherwise, we could not have provided an adequate support for those images.

Meanwhile, take a look at the documentation on how to add modules to an upstream image: https://github.com/nginxinc/docker-nginx/tree/master/modules#adding-third-party-modules-to-nginx-official-image

With a patch similar to the one below it's possible to build an unprivileged image too:

--- Dockerfile.alpine	2022-09-12 10:58:04.000000000 +0400
+++ Dockerfile.alpine-unprivileged	2022-09-12 10:56:40.000000000 +0400
@@ -1,4 +1,6 @@
-FROM nginx:mainline-alpine as builder
+FROM nginxinc/nginx-unprivileged:mainline-alpine as builder
+
+USER root

 ARG ENABLED_MODULES

@@ -60,7 +62,9 @@
     done \
     && echo "BUILT_MODULES=\"$BUILT_MODULES\"" > /tmp/packages/modules.env

-FROM nginx:mainline-alpine
+FROM nginxinc/nginx-unprivileged:mainline-alpine
+USER root
+
 COPY --from=builder /tmp/packages /tmp/packages
 RUN set -ex \
     && . /tmp/packages/modules.env \
@@ -69,3 +73,4 @@
        done \
     && rm -rf /tmp/packages

+USER 101

With something like:

docker build --build-arg ENABLED_MODULES=headers-more -t nginx:unpriv-heardersmore -f Dockerfile.alpine-unprivileged .

[alessfg]

See @thresheek's comment for a potential solution to use the ngx_headers_more module 😄

[sagiru]

Thx for the help. That is also a possible solution. At the moment try some different ones. Maybe we could handle it without a rebuild.