behance/docker-nginx repository overview

⁠docker-nginx

https://hub.docker.com/r/behance/docker-nginx/tags/⁠

Provides base OS, patches and stable nginx for quick and easy spinup.

• Ubuntu used by default
• Alpine builds available tagged as -alpine
• Centos builds available tagged as -centos

S6⁠ process supervisor is used for only for zombie reaping (as PID 1), boot coordination, and termination signal translation

Goss⁠ is used for build-time testing.

See parent(s) docker-base⁠ for additional configuration

⁠Expectations

• Applications must copy their html/app into the /var/www/html folder
• Any new script/file that needs to be added must be given proper permissions/ownership to the non root user through container/root/scripts/set_permissions.sh. This is to ensure that the image can be run under a non root user.
• NOTE: Nginx is exposed and bound to an unprivileged port, 8080

⁠Container Security

See parent configuration⁠

⁠HTTPS usage

To enable this container to serve HTTPS over its primary exposed port:

• SERVER_ENABLE_HTTPS environment variable must be true
• Certificates must be present in /etc/nginx/certs under the following names:
  • ca.crt
  • ca.key
• Additionally, they must be marked read-only (0600)

⁠Local development usage

To generate a self-signed certificate (won't work in most browsers):

openssl genrsa -out ca.key 2048
openssl req -new -key ca.key -out ca.csr -subj '/CN=localhost'
openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt

Run the image in background, bind external port (443), flag HTTPS enabled, mount certificate:

docker run \
  -d
  -p 443:8080 \
  -e SERVER_ENABLE_HTTPS=true \
  -v {directory-containing-ca.crt-and-ca.key}:/etc/nginx/certs:ro
  behance/docker-nginx

Test

curl -k -vvv https://{your-docker-machine-ip}

⁠Environment Variables

⁠Startup/Runtime Modification

• Environment variables are used to drive nginx configuration at runtime
• See here⁠ for more advanced options

⁠Shutdown Behavior

Graceful shutdown is handled as part of the existing⁠ S6 termination process, using a /etc/cont-finish.d script. Nginx will attempt to drain active workers, while rejecting new connections. The drain timeout is controlled by S6_KILL_FINISH_MAXTIME, which corresponds to the length of time the supervisor will wait for the script to run during shutdown. This value defaults to 55s, which deliberately less than an downstream load balancers default max connection length (60s). Each upstream's timeout must be less than the downstream, for sanity and lack of timing precision.

⁠Long-running processes (workers + crons)

• See parent configuration⁠ on reusing container for other purposes.

⁠Container Organization

Besides the instructions contained in the Dockerfile, the majority of this container's use is in configuration and process. The ./container/root repo directory is overlayed into a container during build. Adding additional files to the folders in there will be present in the final image.

Nginx is currently set up as an S6 service in /etc/services-available/nginx, during default environment conditions, it will symlink itself to be supervised under /etc/services.d/nginx. When running under worker entrypoint (worker.sh), it will not be S6's service.d folder to be supervised.