Unable to start image `1.27-alpine-slim` after the most recent push

[ezbercihk]

Bug Overview

We have been using this image for a very long time and up until a little more than half an hour ago, it started to fail with the following error:

2025/04/16 21:12:46 [notice] 1#1: using the "epoll" event method
2025/04/16 21:12:46 [notice] 1#1: nginx/1.27.5
2025/04/16 21:12:46 [notice] 1#1: built by gcc 14.2.0 (Alpine 14.2.0)
2025/04/16 21:12:46 [notice] 1#1: OS: Linux 5.10.234-225.921.amzn2.x86_64
2025/04/16 21:12:46 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
2025/04/16 21:12:46 [emerg] 1#1: open() "/run/nginx.pid" failed (30: Read-only file system)
nginx: [emerg] open() "/run/nginx.pid" failed (30: Read-only file system)

It seems like a new patch (1.27.5) has been released and now this tag points to that so it probably has to do with a change in this patch release that is trying to write to the filesystem. We have our filesystems in our pods in read-only mode as a security precaution and a best practice. So this may or may not be considered a bug from nginx's perspective but it is impacting us. As a workaround we changed the tag to 1.27.4-alpine-slim for the time being.

Expected Behavior

That the container image comes up.

Steps to Reproduce the Bug

Try running the image in a pod with read-only filesystem.

Environment Details

• Version of the Docker NGINX image or specific commit: 1.27-alpine-slim
• Target deployment platform: Kubernetes

Additional Context

No response

[thresheek]

Hi @ezbercihk!

Prior to 1.27.5, nginx packages (as used in this docker image) used /var/run/nginx.pid to store the pid file information. Now, starting with 1.27.5, we rely on /run/nginx.pid to do the same - as /var/run is deprecated (and is a long time symlink to /run on all contemporary OSes).

Now, 1.27.4 should fail the same way if you have a fully read-only filesystem. I believe you have some other configuration that makes /var/run writeable in your deployment?

[ezbercihk]

@thresheek, thank you for the fast response. You are right, we had the following line in our Dockerfile that was overcoming this issue (/tmp is mounted as writable) but since the location has changed now, it was ineffective:

sed -i 's,/var/run/nginx.pid,/tmp/nginx.pid,' /etc/nginx/nginx.conf

We have updated the line to use the new location and that solved our problem. I'll go ahead and close this issue.