11# syntax=docker/dockerfile:1.3
22ARG BUILD_OS=debian
33ARG NGINX_PLUS_VERSION=r25
4- ARG UBI_VERSION=8
54ARG DOWNLOAD_TAG=edge
65ARG DEBIAN_VERSION=bullseye-slim
76
87# ############################################ Base image for Debian #############################################
98FROM nginx:1.21.5 AS debian
109
1110RUN apt-get update \
12- && apt-get install --no-install-recommends --no-install-suggests -y libcap2-bin libgmp10 \
11+ && apt-get install --no-install-recommends --no-install-suggests -y libcap2-bin \
1312 # temporary fix for CVE-2021-43618
1413 && apt-get install --no-install-recommends --no-install-suggests -y libgmp10 \
1514 && rm -rf /var/lib/apt/lists/* \
@@ -62,79 +61,40 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
6261 && rm -rf /var/lib/apt/lists/*
6362
6463
65- # ############################################ Base image for Debian with NGINX Plus and App Protect #############################################
64+ # ############################################ Base image for Debian with NGINX Plus and App Protect WAF/DoS #############################################
6665FROM debian-plus as debian-plus-nap
6766ARG NGINX_PLUS_VERSION
67+ ARG NAP_MODULES
6868
6969RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
7070 --mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
7171 apt-get update \
7272 && apt-get install --no-install-recommends --no-install-suggests -y gnupg curl apt-transport-https \
7373 && curl -fsSL https://cs.nginx.com/static/keys/app-protect-security-updates.key | gpg --dearmor > /etc/apt/trusted.gpg.d/nginx_app_signing.gpg \
7474 && DEBIAN_VERSION=$(awk -F '=' '/^VERSION_CODENAME=/ {print $2}' /etc/os-release) \
75- && printf "%s\n " "deb https://pkgs.nginx.com/app-protect/${NGINX_PLUS_VERSION^^}/debian ${DEBIAN_VERSION} nginx-plus" \
75+ && if [ -z "${NAP_MODULES##*waf*}" ]; then \
76+ printf "%s\n " "deb https://pkgs.nginx.com/app-protect/${NGINX_PLUS_VERSION^^}/debian ${DEBIAN_VERSION} nginx-plus" \
7677 "deb https://pkgs.nginx.com/app-protect-security-updates/debian ${DEBIAN_VERSION} nginx-plus" > /etc/apt/sources.list.d/nginx-app-protect.list \
7778 && apt-get update \
78- && apt-get install --no-install-recommends --no-install-suggests -y \
79- nginx-plus-module-appprotect app-protect app-protect-attack-signatures app-protect-threat-campaigns \
80- && apt-get purge --auto-remove -y apt-transport-https gnupg curl \
79+ && apt-get install --no-install-recommends --no-install-suggests -y app-protect app-protect-attack-signatures app-protect-threat-campaigns \
80+ && apt-get purge --auto-remove -y curl; \
81+ fi \
82+ && if [ -z "${NAP_MODULES##*dos*}" ]; then \
83+ printf "%s\n " "deb https://pkgs.nginx.com/app-protect-dos/${NGINX_PLUS_VERSION^^}/debian ${DEBIAN_VERSION} nginx-plus" > /etc/apt/sources.list.d/nginx-app-protect-dos.list \
84+ && apt-get update \
85+ && apt-get install --no-install-recommends --no-install-suggests -y app-protect-dos; \
86+ fi \
87+ && apt-get purge --auto-remove -y apt-transport-https gnupg \
8188 && rm -rf /var/lib/apt/lists/* \
82- && rm /etc/apt/sources.list.d/nginx-app-protect.list
89+ && rm /etc/apt/sources.list.d/nginx-app-protect* .list
8390
8491# Uncomment the lines below if you want to install a custom CA certificate
8592# COPY build/*.crt /usr/local/share/ca-certificates/
8693# RUN update-ca-certificates
8794
88- # ############################################ Base image for Debian with NGINX Plus and App Protect Dos #############################################
89- FROM debian-plus as debian-plus-dos
90- ARG NGINX_PLUS_VERSION
91-
92- RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
93- --mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
94- set -x \
95- && apt-get update \
96- && apt-get -y install ca-certificates \
97- && DEBIAN_VERSION=$(awk -F '=' '/^VERSION_CODENAME=/ {print $2}' /etc/os-release) \
98- && printf "%s\n " "deb https://pkgs.nginx.com/app-protect-dos/${NGINX_PLUS_VERSION^^}/debian ${DEBIAN_VERSION} nginx-plus" > /etc/apt/sources.list.d/nginx-app-protect-dos.list \
99- && apt-get update \
100- && apt-get -y install app-protect-dos \
101- && rm -rf /var/lib/apt/lists/* \
102- && rm /etc/apt/sources.list.d/nginx-app-protect-dos.list
103-
104- # ############################################ Base image for Debian with NGINX, App Protect and App Protect Dos #############################################
105- FROM debian-plus-nap as debian-plus-nap-dos
106- ARG NGINX_PLUS_VERSION
107-
108- RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
109- --mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
110- set -x \
111- && apt-get update \
112- && apt-get -y install ca-certificates \
113- && DEBIAN_VERSION=$(awk -F '=' '/^VERSION_CODENAME=/ {print $2}' /etc/os-release) \
114- && printf "%s\n " "deb https://pkgs.nginx.com/app-protect-dos/${NGINX_PLUS_VERSION^^}/debian ${DEBIAN_VERSION} nginx-plus" > /etc/apt/sources.list.d/nginx-app-protect-dos.list \
115- && apt-get update \
116- && apt-get -y install app-protect-dos \
117- && rm -rf /var/lib/apt/lists/* \
118- && rm /etc/apt/sources.list.d/nginx-app-protect-dos.list
119-
120- # ############################################ Base image for UBI 8 #############################################
121- FROM redhat/ubi8-minimal AS ubi-base-8
122-
123- # temporary fix for CVE-2021-42574
124- RUN microdnf upgrade -y libgcc libstdc++
125-
126-
127- # ############################################ Base image for UBI 7 #############################################
128- FROM registry.access.redhat.com/ubi7/ubi AS ubi-base-7
129-
130- RUN yum install -y microdnf
131-
132- # temporary fix for CVE-2021-42574
133- RUN yum upgrade -y binutils
134-
13595
13696# ############################################ Base image for UBI #############################################
137- FROM ubi-base-${UBI_VERSION} AS ubi-base
97+ FROM redhat/ubi8 AS ubi-base
13898ARG IC_VERSION
13999
140100SHELL ["/bin/bash" , "-o" , "pipefail" , "-c" ]
@@ -148,7 +108,7 @@ LABEL name="NGINX Ingress Controller" \
148108 io.k8s.description="The NGINX Ingress controller is an application that runs in a cluster and configures an HTTP load balancer according to Ingress resources." \
149109 io.openshift.tags="nginx,ingress-controller,ingress,controller,kubernetes,openshift"
150110
151- RUN microdnf --nodocs install -y shadow-utils ca-certificates \
111+ RUN dnf --nodocs install -y shadow-utils ca-certificates \
152112 && groupadd --system --gid 101 nginx \
153113 && useradd --system --gid nginx --no-create-home --home-dir /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx
154114
@@ -165,7 +125,7 @@ RUN --mount=type=bind,from=debian,source=/nginx_version,target=/tmp/nginx_versio
165125 && printf "%s\n " "[nginx]" "name=nginx repo" \
166126 "baseurl=https://nginx.org/packages/mainline/centos/${version}/\$ basearch/" \
167127 "gpgcheck=1" "enabled=1" "module_hotfixes=true" > /etc/yum.repos.d/nginx.repo \
168- && microdnf --nodocs install -y nginx-${NGINX_VERSION} \
128+ && dnf --nodocs install -y nginx-${NGINX_VERSION} \
169129 && rm /etc/yum.repos.d/nginx.repo
170130
171131
@@ -177,69 +137,39 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
177137 --mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
178138 rpm --import https://cs.nginx.com/static/keys/nginx_signing.key \
179139 && curl -fsSL "https://cs.nginx.com/static/files/nginx-plus-$(grep -E -o '[0-9]+\. [0-9]+' /etc/redhat-release | cut -d" ." -f1).repo" | tr 0 1 > /etc/yum.repos.d/nginx-plus.repo \
180- && microdnf --nodocs install -y nginx-plus-${NGINX_PLUS_VERSION} nginx-plus-module-njs-${NGINX_PLUS_VERSION}
140+ && dnf --nodocs install -y nginx-plus-${NGINX_PLUS_VERSION} nginx-plus-module-njs-${NGINX_PLUS_VERSION}
181141
182142
183- # ############################################ Base image for UBI with NGINX Plus and App Protect WAF #############################################
143+ # ############################################ Base image for UBI with NGINX Plus and App Protect WAF/DoS #############################################
184144FROM ubi-plus as ubi-plus-nap
185145ARG NGINX_PLUS_VERSION
146+ ARG NAP_MODULES
186147
187148RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
188149 --mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
189150 --mount=type=secret,id=rhel_license,dst=/tmp/rhel_license,mode=0644 \
190151 source /tmp/rhel_license \
191152 && subscription-manager register --org=${RHEL_ORGANIZATION} --activationkey=${RHEL_ACTIVATION_KEY} || true \
192153 && subscription-manager attach \
193- && subscription-manager repos --enable rhel-7-server-optional-rpms --enable rhel-7-server-extras-rpms \
194- && curl -fsSL https://cs.nginx.com/static/files/app-protect-7.repo > /etc/yum.repos.d/app-protect-7.repo \
195- && yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm \
196- && yum install -y app-protect-${NGINX_PLUS_VERSION#r}* app-protect-attack-signatures app-protect-threat-campaigns \
197- && rm /etc/yum.repos.d/app-protect-7.repo \
154+ && dnf config-manager --set-enabled codeready-builder-for-rhel-8-x86_64-rpms \
155+ && dnf --nodocs install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm \
156+ && if [ -z "${NAP_MODULES##*waf*}" ]; then \
157+ curl -fsSL https://cs.nginx.com/static/files/app-protect-8.repo > /etc/yum.repos.d/app-protect-8.repo; \
158+ dnf --nodocs install -y app-protect-${NGINX_PLUS_VERSION#r}* app-protect-attack-signatures app-protect-threat-campaigns; \
159+ fi \
160+ && if [ -z "${NAP_MODULES##*dos*}" ]; then \
161+ curl -fsSL https://cs.nginx.com/static/files/app-protect-dos-8.repo > /etc/yum.repos.d/app-protect-dos-8.repo; \
162+ dnf --nodocs install -y app-protect-dos-${NGINX_PLUS_VERSION#r}*; \
163+ fi \
164+ && rm /etc/yum.repos.d/app-protect*.repo \
198165 && subscription-manager unregister \
199- && yum clean all && rm -rf /var/cache/yum
166+ && dnf clean all && rm -rf /var/cache/dnf
200167
201168# Uncomment the lines below if you want to install a custom CA certificate
202169# COPY build/*.crt /etc/pki/ca-trust/source/anchors/
203170# RUN update-ca-trust extract
204171
205172
206- # ############################################ Base image for UBI with NGINX Plus and App Protect Dos #############################################
207- FROM ubi-plus as ubi-plus-dos
208- ARG NGINX_PLUS_VERSION
209-
210- RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
211- --mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
212- --mount=type=secret,id=rhel_license,dst=/tmp/rhel_license,mode=0644 \
213- source /tmp/rhel_license \
214- && subscription-manager register --org=${RHEL_ORGANIZATION} --activationkey=${RHEL_ACTIVATION_KEY} || true \
215- && subscription-manager attach \
216- && subscription-manager repos --enable rhel-7-server-optional-rpms --enable rhel-7-server-extras-rpms \
217- && curl -fsSL https://cs.nginx.com/static/files/app-protect-dos-7.repo > /etc/yum.repos.d/app-protect-dos-7.repo \
218- && yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm \
219- && yum install -y app-protect-dos-${NGINX_PLUS_VERSION#r}* \
220- && rm /etc/yum.repos.d/app-protect-dos-7.repo \
221- && subscription-manager unregister \
222- && yum clean all && rm -rf /var/cache/yum
223-
224-
225- # ############################################ Base image for UBI with NGINX Plus, App Protect WAF and App Protect Dos #############################################
226- FROM ubi-plus-nap as ubi-plus-nap-dos
227- ARG NGINX_PLUS_VERSION
228-
229- RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
230- --mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
231- --mount=type=secret,id=rhel_license,dst=/tmp/rhel_license,mode=0644 \
232- source /tmp/rhel_license \
233- && subscription-manager register --org=${RHEL_ORGANIZATION} --activationkey=${RHEL_ACTIVATION_KEY} || true \
234- && subscription-manager attach \
235- && subscription-manager repos --enable rhel-7-server-optional-rpms --enable rhel-7-server-extras-rpms \
236- && curl -fsSL https://cs.nginx.com/static/files/app-protect-dos-7.repo > /etc/yum.repos.d/app-protect-dos-7.repo \
237- && yum install -y app-protect-dos-${NGINX_PLUS_VERSION#r}* \
238- && rm /etc/yum.repos.d/app-protect-dos-7.repo \
239- && subscription-manager unregister \
240- && yum clean all && rm -rf /var/cache/yum
241-
242-
243173# ############################################ Base images containing libs for Opentracing #############################################
244174FROM opentracing/nginx-opentracing:nginx-1.21.5 as opentracing-lib
245175FROM opentracing/nginx-opentracing:nginx-1.21.5-alpine as alpine-opentracing-lib
@@ -282,12 +212,13 @@ ARG IC_VERSION
282212ARG GIT_COMMIT
283213ARG DATE
284214ARG TARGETPLATFORM
215+ ARG NAP_MODULES=none
285216
286217# copy oidc files on plus build
287218RUN --mount=target=/tmp [ -n "${BUILD_OS##*plus*}" ] && exit 0; mkdir -p etc/nginx/oidc/ && cp -a /tmp/internal/configs/oidc/* /etc/nginx/oidc/
288219
289- # run only on nap build
290- RUN --mount=target=/tmp [ -n "${BUILD_OS ##*nap *}" ] && exit 0; mkdir -p /etc/nginx/waf/nac-policies /etc/nginx/waf/nac-logconfs /etc/nginx/waf/nac-usersigs /var/log/app_protect /opt/app_protect \
220+ # run only on nap waf build
221+ RUN --mount=target=/tmp [ -n "${NAP_MODULES ##*waf *}" ] && exit 0; mkdir -p /etc/nginx/waf/nac-policies /etc/nginx/waf/nac-logconfs /etc/nginx/waf/nac-usersigs /var/log/app_protect /opt/app_protect \
291222 && chown -R nginx:0 /etc/app_protect /usr/share/ts /var/log/app_protect/ /opt/app_protect/ /var/log/nginx/ \
292223 && touch /etc/nginx/waf/nac-usersigs/index.conf \
293224 && printf "%s\n " "MODULE = ALL;" "LOG_LEVEL = TS_CRIT;" "FILE = 2;" > /etc/app_protect/bd/logger.cfg \
@@ -302,8 +233,9 @@ RUN --mount=target=/tmp [ -n "${BUILD_OS##*nap*}" ] && exit 0; mkdir -p /etc/ngi
302233 ; done \
303234 && cp -a /tmp/build/log-default.json /etc/nginx
304235
305- # run only on dos build
306- RUN --mount=target=/tmp [ -n "${BUILD_OS##*dos*}" ] && exit 0; mkdir -p /root/app_protect_dos /etc/nginx/dos/policies /etc/nginx/dos/logconfs /shared/cores /var/log/adm /var/run/adm && chmod 777 /shared/cores /var/log/adm /var/run/adm /etc/app_protect_dos
236+ # run only on nap dos build
237+ RUN --mount=target=/tmp [ -n "${NAP_MODULES##*dos*}" ] && exit 0; mkdir -p /root/app_protect_dos /etc/nginx/dos/policies /etc/nginx/dos/logconfs /shared/cores /var/log/adm /var/run/adm \
238+ && chmod 777 /shared/cores /var/log/adm /var/run/adm /etc/app_protect_dos
307239
308240RUN --mount=target=/tmp mkdir -p /var/lib/nginx /etc/nginx/secrets /etc/nginx/stream-conf.d \
309241 && setcap 'cap_net_bind_service=+ep' /usr/sbin/nginx 'cap_net_bind_service=+ep' /usr/sbin/nginx-debug \
0 commit comments