Skip to content

Commit 3e85ea0

Browse files
shaun-nxciarams87
shaun-nx
authored and
ciarams87
committed
Add Dockerfiles to build images from UBI9 minimal (#3941)
1 parent 5cb1646 commit 3e85ea0

File tree

7 files changed

+200
-6
lines changed

7 files changed

+200
-6
lines changed

‎Makefile‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ HELM_SCHEMA_VERSION = 0.18.1
4343
PREFIX ?= nginx-gateway-fabric## The name of the NGF image. For example, nginx-gateway-fabric
4444
NGINX_PREFIX ?= $(PREFIX)/nginx## The name of the nginx image. For example: nginx-gateway-fabric/nginx
4545
NGINX_PLUS_PREFIX ?= $(PREFIX)/nginx-plus## The name of the nginx plus image. For example: nginx-gateway-fabric/nginx-plus
46+
BUILD_OS ?= ## The OS of the nginx image. Possible values: ubi and empty string, which defaults to alpine.
4647
NGINX_SERVICE_TYPE ?= NodePort## The type of the nginx service. Possible values: NodePort, LoadBalancer, ClusterIP
4748
PULL_POLICY ?= Never## The pull policy of the images. Possible values: Always, IfNotPresent, Never
4849
TAG ?= $(VERSION:v%=%)## The tag of the image. For example, 1.1.0
@@ -85,21 +86,21 @@ build-prod-ngf-image: build-ngf-image ## Build the NGF docker image for producti
8586

8687
.PHONY: build-ngf-image
8788
build-ngf-image: check-for-docker build ## Build the NGF docker image
88-
docker build --platform linux/$(GOARCH) --build-arg BUILD_AGENT=$(BUILD_AGENT) --target $(strip $(TARGET)) -f $(SELF_DIR)build/Dockerfile -t $(strip $(PREFIX)):$(strip $(TAG)) $(strip $(SELF_DIR))
89+
docker build --platform linux/$(GOARCH) --build-arg BUILD_AGENT=$(BUILD_AGENT) --target $(strip $(TARGET)) -f $(SELF_DIR)build/$(if $(BUILD_OS),$(BUILD_OS)/)Dockerfile -t $(strip $(PREFIX)):$(strip $(TAG)) $(strip $(SELF_DIR))
8990

9091
.PHONY: build-prod-nginx-image
9192
build-prod-nginx-image: build-nginx-image ## Build the custom nginx image for production
9293

9394
.PHONY: build-nginx-image
9495
build-nginx-image: check-for-docker ## Build the custom nginx image
95-
docker build --platform linux/$(GOARCH) $(strip $(NGINX_DOCKER_BUILD_OPTIONS)) -f $(SELF_DIR)build/Dockerfile.nginx -t $(strip $(NGINX_PREFIX)):$(strip $(TAG)) $(strip $(SELF_DIR))
96+
docker build --platform linux/$(GOARCH) $(strip $(NGINX_DOCKER_BUILD_OPTIONS)) -f $(SELF_DIR)build/$(if $(BUILD_OS),$(BUILD_OS)/)Dockerfile.nginx -t $(strip $(NGINX_PREFIX)):$(strip $(TAG)) $(strip $(SELF_DIR))
9697

9798
.PHONY: build-prod-nginx-plus-image
9899
build-prod-nginx-plus-image: build-nginx-plus-image ## Build the custom nginx plus image for production
99100

100101
.PHONY: build-nginx-plus-image
101102
build-nginx-plus-image: check-for-docker ## Build the custom nginx plus image
102-
docker build --platform linux/$(GOARCH) $(strip $(NGINX_DOCKER_BUILD_OPTIONS)) $(strip $(NGINX_DOCKER_BUILD_PLUS_ARGS)) -f $(SELF_DIR)build/Dockerfile.nginxplus -t $(strip $(NGINX_PLUS_PREFIX)):$(strip $(TAG)) $(strip $(SELF_DIR))
103+
docker build --platform linux/$(GOARCH) $(strip $(NGINX_DOCKER_BUILD_OPTIONS)) $(strip $(NGINX_DOCKER_BUILD_PLUS_ARGS)) -f $(SELF_DIR)build/$(if $(BUILD_OS),$(BUILD_OS)/)Dockerfile.nginxplus -t $(strip $(NGINX_PLUS_PREFIX)):$(strip $(TAG)) $(strip $(SELF_DIR))
103104

104105
.PHONY: check-for-docker
105106
check-for-docker: ## Check if Docker is installed

‎build/entrypoint.sh‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,12 +40,12 @@ fi
4040
nginx_pid=$!
4141

4242
SECONDS=0
43-
44-
while ! ps -ef | grep "nginx: master process" | grep -v grep; do
45-
if ((SECONDS > 5)); then
43+
while [[ ! -f /var/run/nginx.pid ]] && [[ ! -f /var/run/nginx/nginx.pid ]]; do
44+
if ((SECONDS > 30)); then
4645
echo "couldn't find nginx master process"
4746
exit 1
4847
fi
48+
sleep 1
4949
done
5050

5151
# start nginx-agent, pass args

‎build/ubi/Dockerfile‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# syntax=docker/dockerfile:1.18
2+
FROM golang:1.25 AS builder
3+
4+
WORKDIR /go/src/github.com/nginx/nginx-gateway-fabric
5+
6+
COPY go.mod go.sum /go/src/github.com/nginx/nginx-gateway-fabric/
7+
RUN go mod download
8+
9+
COPY . /go/src/github.com/nginx/nginx-gateway-fabric
10+
RUN make build
11+
12+
FROM golang:1.25 AS ca-certs-provider
13+
14+
FROM redhat/ubi9-minimal:9.6 AS ngf-ubi-minimal
15+
# CA certs are needed for telemetry report so that NGF can verify the server's certificate.
16+
COPY --from=ca-certs-provider --link /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
17+
USER 101:1001
18+
ARG BUILD_AGENT
19+
ENV BUILD_AGENT=${BUILD_AGENT}
20+
ENTRYPOINT [ "/usr/bin/gateway" ]
21+
22+
FROM ngf-ubi-minimal AS container
23+
COPY --from=builder /go/src/github.com/nginxinc/nginx-gateway-fabric/build/out/gateway /usr/bin/gateway
24+
25+
FROM ngf-ubi-minimal AS local
26+
COPY ./build/out/gateway /usr/bin/gateway
27+
28+
FROM ngf-ubi-minimal AS goreleaser
29+
ARG TARGETARCH
30+
COPY dist/gateway_linux_$TARGETARCH*/gateway /usr/bin/gateway

‎build/ubi/Dockerfile.nginx‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# syntax=docker/dockerfile:1.18
2+
FROM scratch AS nginx-files
3+
4+
# Repository and key files for UBI-based builds
5+
ADD --link --chown=101:1001 https://nginx.org/keys/nginx_signing.key nginx_signing.key
6+
ADD --link --chown=101:1001 build/ubi/repos/nginx.repo nginx.repo
7+
ADD --link --chown=101:1001 build/ubi/repos/agent.repo agent.repo
8+
9+
FROM ghcr.io/nginx/dependencies/nginx-ubi:ubi9@sha256:01a32246761b9bbe47a6a29bcd8ca6e9b6e331b3bdfa372d8987b622276f7025 AS ubi9-packages
10+
11+
FROM redhat/ubi9-minimal:9.6 AS ubi-nginx
12+
13+
# renovate: datasource=github-tags depName=nginx/agent
14+
ARG NGINX_AGENT_VERSION=v3.3.1
15+
ARG NJS_DIR
16+
ARG NGINX_CONF_DIR
17+
ARG BUILD_AGENT
18+
19+
LABEL name="F5 NGINX Gateway Fabric NGINX OSS" \
20+
maintainer="kubernetes@nginx.com" \
21+
vendor="F5 NGINX" \
22+
summary="NGINX Gateway Fabric" \
23+
description="NGINX Gateway Fabric provides an implementation for the Gateway API using NGINX as the data plane." \
24+
org.nginx.ngf.image.build.agent="${BUILD_AGENT}" \
25+
io.k8s.description="NGINX Gateway Fabric provides an implementation for the Gateway API using NGINX as the data plane." \
26+
io.openshift.tags="nginx,gateway,kubernetes,openshift"
27+
28+
COPY --link --chown=101:1001 LICENSE /licenses/
29+
30+
# Install NGINX with packages
31+
RUN --mount=type=bind,from=nginx-files,src=nginx_signing.key,target=/tmp/nginx_signing.key \
32+
--mount=type=bind,from=nginx-files,src=nginx.repo,target=/etc/yum.repos.d/nginx.repo \
33+
--mount=type=bind,from=nginx-files,src=agent.repo,target=/etc/yum.repos.d/agent.repo \
34+
--mount=type=bind,from=ubi9-packages,src=/,target=/ubi-bin/ \
35+
# Import NGINX signing key
36+
rpm --import /tmp/nginx_signing.key \
37+
# Install c-ares from the dependencies image (contains required libs)
38+
&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
39+
# Create nginx user with consistent UID/GID
40+
&& groupadd -g 1001 nginx \
41+
&& useradd -r -u 101 -g nginx -s /sbin/nologin -d /var/cache/nginx nginx \
42+
# Install NGINX and modules including OTEL
43+
&& microdnf --nodocs install -y nginx nginx-module-njs nginx-module-otel \
44+
# Install nginx-agent
45+
&& microdnf --nodocs install -y nginx-agent-${NGINX_AGENT_VERSION#v}* \
46+
# Clean up (only remove what we can)
47+
&& microdnf clean all \
48+
&& rm -rf /var/cache/yum
49+
50+
# Configure directories and logging
51+
RUN mkdir -p /usr/lib/nginx/modules /var/run/nginx /usr/lib64/nginx/modules \
52+
# Forward request and error logs to docker log collector
53+
&& ln -sf /dev/stdout /var/log/nginx/access.log \
54+
&& ln -sf /dev/stderr /var/log/nginx/error.log \
55+
&& mv /usr/lib64/nginx/modules/ngx_* /usr/lib/nginx/modules/
56+
57+
# Set proper permissions for nginx user
58+
RUN chown -R 101:1001 /etc/nginx /var/cache/nginx
59+
60+
# Copy configuration files and scripts
61+
COPY build/entrypoint.sh /agent/entrypoint.sh
62+
COPY ${NJS_DIR}/ /usr/lib/nginx/modules/njs/
63+
COPY ${NGINX_CONF_DIR}/nginx.conf /etc/nginx/nginx.conf
64+
COPY ${NGINX_CONF_DIR}/grpc-error-locations.conf /etc/nginx/grpc-error-locations.conf
65+
COPY ${NGINX_CONF_DIR}/grpc-error-pages.conf /etc/nginx/grpc-error-pages.conf
66+
67+
# Switch to non-root user
68+
USER 101:1001
69+
70+
ENTRYPOINT ["/agent/entrypoint.sh"]

‎build/ubi/Dockerfile.nginxplus‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
# syntax=docker/dockerfile:1.18
2+
FROM scratch AS nginx-files
3+
4+
# NGINX Plus repo and key files (must be provided at build time)
5+
ADD --link --chown=101:1001 https://cs.nginx.com/static/files/plus-9.repo nginx-plus.repo
6+
ADD --link --chown=101:1001 https://nginx.org/keys/nginx_signing.key nginx_signing.key
7+
ADD --link --chown=101:1001 build/ubi/repos/agent.repo agent.repo
8+
9+
FROM ghcr.io/nginx/dependencies/nginx-ubi:ubi9@sha256:01a32246761b9bbe47a6a29bcd8ca6e9b6e331b3bdfa372d8987b622276f7025 AS ubi9-packages
10+
11+
FROM redhat/ubi9-minimal:9.6 AS ubi-nginx-plus
12+
13+
ARG NGINX_PLUS_VERSION=R35
14+
15+
# renovate: datasource=github-tags depName=nginx/agent
16+
ARG NGINX_AGENT_VERSION=v3.3.1
17+
ARG NJS_DIR
18+
ARG NGINX_CONF_DIR
19+
ARG BUILD_AGENT
20+
21+
LABEL name="F5 NGINX Gateway Fabric NGINX Plus" \
22+
maintainer="kubernetes@nginx.com" \
23+
vendor="F5 NGINX" \
24+
summary="NGINX Gateway Fabric" \
25+
description="NGINX Gateway Fabric provides an implementation for the Gateway API using NGINX as the data plane." \
26+
org.nginx.ngf.image.build.agent="${BUILD_AGENT}" \
27+
io.k8s.description="NGINX Gateway Fabric provides an implementation for the Gateway API using NGINX as the data plane." \
28+
io.openshift.tags="nginx,gateway,kubernetes,openshift"
29+
30+
COPY --link --chown=101:1001 LICENSE /licenses/
31+
32+
# Install NGINX Plus and modules
33+
RUN --mount=type=bind,from=nginx-files,src=nginx-plus.repo,target=/etc/yum.repos.d/nginx-plus.repo \
34+
--mount=type=bind,from=nginx-files,src=agent.repo,target=/etc/yum.repos.d/agent.repo \
35+
--mount=type=bind,from=nginx-files,src=nginx_signing.key,target=/tmp/nginx_signing.key \
36+
--mount=type=bind,from=ubi9-packages,src=/,target=/ubi-bin/ \
37+
--mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
38+
--mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
39+
# Install shadow-utils for useradd and subscription-manager for repo access
40+
microdnf --nodocs install -y shadow-utils subscription-manager \
41+
&& rpm --import /tmp/nginx_signing.key \
42+
# Install c-ares from the dependencies image (contains required libs)
43+
&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
44+
# Create nginx user with consistent UID/GID
45+
&& groupadd -g 1001 nginx \
46+
&& useradd -r -u 101 -g nginx -s /sbin/nologin -d /var/cache/nginx nginx \
47+
# Install NGINX Plus and modules (njs, otel)
48+
&& microdnf --nodocs install -y nginx-plus-${NGINX_PLUS_VERSION,,} \
49+
&& microdnf --nodocs install -y nginx-plus-module-njs-${NGINX_PLUS_VERSION,,} nginx-plus-module-otel-${NGINX_PLUS_VERSION,,} \
50+
# Install nginx-agent
51+
&& microdnf --nodocs install -y nginx-agent-${NGINX_AGENT_VERSION#v}* \
52+
# Clean up
53+
&& microdnf remove -y shadow-utils subscription-manager \
54+
&& microdnf clean all \
55+
&& rm -rf /var/cache/yum
56+
57+
# Configure directories and logging
58+
RUN mkdir -p /usr/lib/nginx/modules /var/run/nginx /usr/lib64/nginx/modules \
59+
# Forward request and error logs to docker log collector
60+
&& ln -sf /dev/stdout /var/log/nginx/access.log \
61+
&& ln -sf /dev/stderr /var/log/nginx/error.log \
62+
&& mv /usr/lib64/nginx/modules/ngx_* /usr/lib/nginx/modules/
63+
64+
# Copy default html files to a writable location
65+
RUN mkdir -p /etc/nginx/html \
66+
&& cp /usr/share/nginx/html/* /etc/nginx/html/
67+
68+
# Set proper permissions for nginx user
69+
RUN chown -R 101:1001 /etc/nginx /var/cache/nginx
70+
71+
# Copy configuration files and scripts
72+
COPY build/entrypoint.sh /agent/entrypoint.sh
73+
COPY ${NJS_DIR}/ /usr/lib/nginx/modules/njs/
74+
COPY ${NGINX_CONF_DIR}/nginx.conf /etc/nginx/nginx.conf
75+
COPY ${NGINX_CONF_DIR}/grpc-error-locations.conf /etc/nginx/grpc-error-locations.conf
76+
COPY ${NGINX_CONF_DIR}/grpc-error-pages.conf /etc/nginx/grpc-error-pages.conf
77+
78+
# Switch to non-root user
79+
USER 101:1001
80+
81+
ENTRYPOINT ["/agent/entrypoint.sh"]

‎build/ubi/repos/agent.repo‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
[agent]
2+
name=agent repo
3+
baseurl=https://packages.nginx.org/nginx-agent/centos/9/$basearch/
4+
gpgcheck=1
5+
enabled=1
6+
module_hotfixes=true

‎build/ubi/repos/nginx.repo‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
[nginx]
2+
name=nginx repo
3+
baseurl=https://packages.nginx.org/nginx/mainline/centos/9/$basearch/
4+
gpgcheck=1
5+
enabled=1
6+
module_hotfixes=true

0 commit comments

Comments
 (0)