I'm getting connection reset by peer issue since the :latest-20221216 , using idrive

[Ardakilic]

Hello,

I've been getting issues since :latest-20221216. :latest-20221215 was working nicely.

I'm using Idrive E2 for storage solution.

Here's my docker compose related section:

nginx_s3_gateway:
    image: nginxinc/nginx-s3-gateway:latest-20221215
    ports:
      - "1234:8080"
    restart: "no"
    environment:
      S3_BUCKET_NAME: "mybucketname"
      S3_ACCESS_KEY_ID: "myaccesskey"
      S3_SECRET_KEY: "mysecretkey"
      S3_SERVER: "my.idrivee2.server.url.com"
      S3_SERVER_PORT: "443"
      S3_SERVER_PROTO: "https"
      S3_REGION: ""
      S3_DEBUG: "true"
      S3_STYLE: "virtual" # virtual
      ALLOW_DIRECTORY_LIST: "false"
      PROVIDE_INDEX_PAGE:
      APPEND_SLASH_FOR_POSSIBLE_DIRECTORY:
      AWS_SIGS_VERSION: 4
      STATIC_SITE_HOSTING:
      PROXY_CACHE_VALID_OK: "1h"
      PROXY_CACHE_VALID_NOTFOUND: "1m"
      PROXY_CACHE_VALID_FORBIDDEN: "30s"

This configuration works nicely with :latest-20221215, but I get "connection reset by peer" issue with :latest-20221216

I get the correct information using the yesterday's tag:

➜  docker curl http://192.168.50.3:1234/nah.jpg -I
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 16 Dec 2022 19:10:03 GMT
Content-Type: image/jpeg
Content-Length: 40131
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "yadayadayada"
Last-Modified: Tue, 13 Dec 2022 21:26:25 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Accept-Ranges: bytes

But today's tag gives me this:

➜  docker curl http://192.168.50.3:1234/nah.jpg -I
curl: (56) Recv failure: Connection reset by peer

I cannot see any detailed logs in my logs though:

/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/00-check-for-required-env.sh
S3 Backend Environment
Access Key ID: myaccesskey
Origin: https://my-idrive-host.com:443
�
Region: auto
Addressing Style: virtual
AWS Signatures Version: v4
DNS Resolvers: 127.0.0.11
Directory Listing Enabled: false
Provide Index Pages Enabled: 
Append slash for directory enabled: 
Stripping the following headers from responses: x-amz-;
CORS Enabled: 0
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf
10-listen-on-ipv6-by-default.sh: info: Enabled listen on IPv6 in /etc/nginx/conf.d/default.conf
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
20-envsubst-on-templates.sh: Running envsubst on /etc/nginx/templates/gateway/s3_server.conf.template to /etc/nginx/conf.d/gateway/s3_server.conf
20-envsubst-on-templates.sh: Running envsubst on /etc/nginx/templates/gateway/v2_headers.conf.template to /etc/nginx/conf.d/gateway/v2_headers.conf
20-envsubst-on-templates.sh: Running envsubst on /etc/nginx/templates/gateway/s3_location.conf.template to /etc/nginx/conf.d/gateway/s3_location.conf
20-envsubst-on-templates.sh: Running envsubst on /etc/nginx/templates/gateway/s3listing_location.conf.template to /etc/nginx/conf.d/gateway/s3listing_location.conf
20-envsubst-on-templates.sh: Running envsubst on /etc/nginx/templates/gateway/v4_headers.conf.template to /etc/nginx/conf.d/gateway/v4_headers.conf
20-envsubst-on-templates.sh: Running envsubst on /etc/nginx/templates/gateway/v2_js_vars.conf.template to /etc/nginx/conf.d/gateway/v2_js_vars.conf
20-envsubst-on-templates.sh: Running envsubst on /etc/nginx/templates/gateway/cors.conf.template to /etc/nginx/conf.d/gateway/cors.conf
20-envsubst-on-templates.sh: Running envsubst on /etc/nginx/templates/gateway/v4_js_vars.conf.template to /etc/nginx/conf.d/gateway/v4_js_vars.conf
20-envsubst-on-templates.sh: Running envsubst on /etc/nginx/templates/gateway/js_fetch_trusted_certificate.conf.template to /etc/nginx/conf.d/gateway/js_fetch_trusted_certificate.conf
20-envsubst-on-templates.sh: Running envsubst on /etc/nginx/templates/default.conf.template to /etc/nginx/conf.d/default.conf
20-envsubst-on-templates.sh: Running envsubst on /etc/nginx/templates/upstreams.conf.template to /etc/nginx/conf.d/upstreams.conf
/docker-entrypoint.sh: Launching /docker-entrypoint.d/22-enable_js_fetch_trusted_certificate.sh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
/docker-entrypoint.sh: Configuration complete; ready for start up
2022/12/16 19:26:18 [notice] 1#1: using the "epoll" event method
2022/12/16 19:26:18 [notice] 1#1: nginx/1.23.3
2022/12/16 19:26:18 [notice] 1#1: built by gcc 10.2.1 20210110 (Debian 10.2.1-6) 
2022/12/16 19:26:18 [notice] 1#1: OS: Linux 5.10.0-19-amd64
2022/12/16 19:26:18 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
2022/12/16 19:26:18 [notice] 1#1: start worker processes
2022/12/16 19:26:18 [notice] 1#1: start worker process 75
2022/12/16 19:26:18 [notice] 1#1: start cache manager process 76
2022/12/16 19:26:18 [notice] 1#1: start cache loader process 77
2022/12/16 19:27:22 [notice] 77#77: http file cache: /var/cache/nginx/s3_proxy 0.000M, bsize: 4096
2022/12/16 19:27:22 [notice] 1#1: signal 17 (SIGCHLD) received from 77
2022/12/16 19:27:22 [notice] 1#1: cache loader process 77 exited with code 0
2022/12/16 19:27:22 [notice] 1#1: signal 29 (SIGIO) received

So I was wondering, what has changed since yesterday, that would result breaking it, and how do I resolve it?

Thanks in advance,

[dekobon]

Hi there. Thank you for filing a ticket. Knowing when there are problems with the published images is really helpful.

I made a regression in the latest-20221215 where the unprivileged container image was published as the default latest image. For you that worked because you are mapping port 8080 to 1234. However, when I fixed the regression in latest-20221216, I changed the nginx port back to 80.

Please try to change this part in your configuration to the following:

    ports:
      - "1234:80"

Or alternatively use the unprivileged container image:

    image: ghcr.io/nginxinc/nginx-s3-gateway/nginx-oss-s3-gateway:unprivileged-oss-20221216

Please update the ticket and let me know what happens when you make either of those changes.

[Ardakilic]

Hey @dekobon , thanks for the response! I can confirm, with the latest-20221216 image tag and setting 80 as internal port, it works nicely!