[WIP] Merge unprivileged images to this repo

.github/workflows/ci.yml

@@ -10,6 +10,10 @@ defaults:
   run:
     shell: 'bash -Eeuo pipefail -x {0}'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
 
   generate-jobs:
@@ -19,14 +23,21 @@ jobs:
       strategy: ${{ steps.generate-jobs.outputs.strategy }}
     steps:
       - uses: actions/checkout@v3
-      - uses: docker-library/bashbrew@v0.1.12
+      - uses: docker-library/bashbrew@v0.1.13
       - id: generate-jobs
         name: Generate Jobs
         run: |
           strategy="$(GITHUB_REPOSITORY=nginx "$BASHBREW_SCRIPTS/github-actions/generate.sh")"
           strategy="$(GITHUB_REPOSITORY=nginx "$BASHBREW_SCRIPTS/github-actions/munge-i386.sh" -c <<<"$strategy")"
-          echo "strategy=$strategy" >> "$GITHUB_OUTPUT"
-          jq . <<<"$strategy" # sanity check / debugging aid
+          strategyu="$(jq 'walk(if type == "string" then gsub("nginx:"; "nginxinc/nginx-unprivileged:") else . end)' <<<"$strategy")"
+          strategyu="$(jq 'walk(if type == "string" then gsub("^library/"; "unprivileged/") else . end)' <<<"$strategyu")"
+          strategyu="$(jq 'walk(if type == "string" then gsub("'\''library/"; "'\''unprivileged/") else . end)' <<<"$strategyu")"
+          strategyu="$(jq '.matrix.include[].name |= "unpriv " + .' <<<"$strategyu")"
+
+          EOF="EOF-$RANDOM-$RANDOM-$RANDOM"
+          echo "strategy<<$EOF" >> "$GITHUB_OUTPUT"
+          jq --argjson unpriv "$strategyu" '.matrix.include += $unpriv.matrix.include' <<< "$strategy" | tee -a "$GITHUB_OUTPUT"
+          echo "$EOF" >> "$GITHUB_OUTPUT"
 
   test:
     needs: generate-jobs

.test/config.sh

@@ -8,4 +8,11 @@ imageTests+=(
         workers
         modules
 	'
+    [nginxinc/nginx-unprivileged]='
+        static
+        templates
+        templates-resolver
+        templates-resolver-ipv6
+        workers
+    '
 )

.test/tests/static/run.sh

@@ -8,6 +8,9 @@ dir="$(dirname "$(readlink -f "$BASH_SOURCE")")"
 
 image="$1"
 
+port=80
+if echo "$image" | grep -q "unprivileged"; then port=8080; fi
+
 clientImage='buildpack-deps:buster-curl'
 # ensure the clientImage is ready and available
 if ! docker image inspect "$clientImage" &> /dev/null; then
@@ -37,7 +40,7 @@ _request() {
 	docker run --rm \
 		--link "$cid":nginx \
 		"$clientImage" \
-		curl -fsSL -X"$method" --connect-to '::nginx:' "$@" "$proto://example.com/$url"
+		curl -fsSL -X"$method" --connect-to "::nginx:$port" "$@" "$proto://example.com/$url"
 }
 
 . "$HOME/oi/test/retry.sh" '[ "$(_request GET / --output /dev/null || echo $?)" != 7 ]'

entrypoint/unprivileged/10-listen-on-ipv6-by-default.sh

@@ -0,0 +1,67 @@
+#!/bin/sh
+# vim:sw=4:ts=4:et
+
+set -e
+
+entrypoint_log() {
+    if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then
+        echo "$@"
+    fi
+}
+
+ME=$(basename "$0")
+DEFAULT_CONF_FILE="etc/nginx/conf.d/default.conf"
+
+# check if we have ipv6 available
+if [ ! -f "/proc/net/if_inet6" ]; then
+    entrypoint_log "$ME: info: ipv6 not available"
+    exit 0
+fi
+
+if [ ! -f "/$DEFAULT_CONF_FILE" ]; then
+    entrypoint_log "$ME: info: /$DEFAULT_CONF_FILE is not a file or does not exist"
+    exit 0
+fi
+
+# check if the file can be modified, e.g. not on a r/o filesystem
+touch /$DEFAULT_CONF_FILE 2>/dev/null || { entrypoint_log "$ME: info: can not modify /$DEFAULT_CONF_FILE (read-only file system?)"; exit 0; }
+
+# check if the file is already modified, e.g. on a container restart
+grep -q "listen  \[::\]:8080;" /$DEFAULT_CONF_FILE && { entrypoint_log "$ME: info: IPv6 listen already enabled"; exit 0; }
+
+if [ -f "/etc/os-release" ]; then
+    . /etc/os-release
+else
+    entrypoint_log "$ME: info: can not guess the operating system"
+    exit 0
+fi
+
+entrypoint_log "$ME: info: Getting the checksum of /$DEFAULT_CONF_FILE"
+
+case "$ID" in
+    "debian")
+        CHECKSUM=$(dpkg-query --show --showformat='${Conffiles}\n' nginx | grep $DEFAULT_CONF_FILE | cut -d' ' -f 3)
+        echo "$CHECKSUM  /$DEFAULT_CONF_FILE" | md5sum -c - >/dev/null 2>&1 || {
+            entrypoint_log "$ME: info: /$DEFAULT_CONF_FILE differs from the packaged version"
+            exit 0
+        }
+        ;;
+    "alpine")
+        CHECKSUM=$(apk manifest nginx 2>/dev/null| grep $DEFAULT_CONF_FILE | cut -d' ' -f 1 | cut -d ':' -f 2)
+        echo "$CHECKSUM  /$DEFAULT_CONF_FILE" | sha1sum -c - >/dev/null 2>&1 || {
+            entrypoint_log "$ME: info: /$DEFAULT_CONF_FILE differs from the packaged version"
+            exit 0
+        }
+        ;;
+    *)
+        entrypoint_log "$ME: info: Unsupported distribution"
+        exit 0
+        ;;
+esac
+
+# enable ipv6 on default.conf listen sockets
+sed -i -E 's,listen       8080;,listen       8080;\n    listen  [::]:8080;,' /$DEFAULT_CONF_FILE
+
+entrypoint_log "$ME: info: Enabled listen on IPv6 in /$DEFAULT_CONF_FILE"
+
+exit 0

entrypoint/unprivileged/20-envsubst-on-templates.sh

@@ -0,0 +1,78 @@
+#!/bin/sh
+
+set -e
+
+ME=$(basename "$0")
+
+entrypoint_log() {
+  if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then
+    echo "$@"
+  fi
+}
+
+add_stream_block() {
+  local conffile="/etc/nginx/nginx.conf"
+
+  if grep -q -E "\s*stream\s*\{" "$conffile"; then
+    entrypoint_log "$ME: $conffile contains a stream block; include $stream_output_dir/*.conf to enable stream templates"
+  else
+    # check if the file can be modified, e.g. not on a r/o filesystem
+    touch "$conffile" 2>/dev/null || { entrypoint_log "$ME: info: can not modify $conffile (read-only file system?)"; exit 0; }
+    entrypoint_log "$ME: Appending stream block to $conffile to include $stream_output_dir/*.conf"
+    cat << END >> "$conffile"
+# added by "$ME" on "$(date)"
+stream {
+  include $stream_output_dir/*.conf;
+}
+END
+  fi
+}
+
+auto_envsubst() {
+  local template_dir="${NGINX_ENVSUBST_TEMPLATE_DIR:-/etc/nginx/templates}"
+  local suffix="${NGINX_ENVSUBST_TEMPLATE_SUFFIX:-.template}"
+  local output_dir="${NGINX_ENVSUBST_OUTPUT_DIR:-/etc/nginx/conf.d}"
+  local stream_suffix="${NGINX_ENVSUBST_STREAM_TEMPLATE_SUFFIX:-.stream-template}"
+  local stream_output_dir="${NGINX_ENVSUBST_STREAM_OUTPUT_DIR:-/etc/nginx/stream-conf.d}"
+  local filter="${NGINX_ENVSUBST_FILTER:-}"
+
+  local template defined_envs relative_path output_path subdir
+  defined_envs=$(printf '${%s} ' $(awk "END { for (name in ENVIRON) { print ( name ~ /${filter}/ ) ? name : \"\" } }" < /dev/null ))
+  [ -d "$template_dir" ] || return 0
+  if [ ! -w "$output_dir" ]; then
+    entrypoint_log "$ME: ERROR: $template_dir exists, but $output_dir is not writable"
+    return 0
+  fi
+  find "$template_dir" -follow -type f -name "*$suffix" -print | while read -r template; do
+    relative_path="${template#"$template_dir/"}"
+    output_path="$output_dir/${relative_path%"$suffix"}"
+    subdir=$(dirname "$relative_path")
+    # create a subdirectory where the template file exists
+    mkdir -p "$output_dir/$subdir"
+    entrypoint_log "$ME: Running envsubst on $template to $output_path"
+    envsubst "$defined_envs" < "$template" > "$output_path"
+  done
+
+  # Print the first file with the stream suffix, this will be false if there are none
+  if test -n "$(find "$template_dir" -name "*$stream_suffix" -print -quit)"; then
+    mkdir -p "$stream_output_dir"
+    if [ ! -w "$stream_output_dir" ]; then
+      entrypoint_log "$ME: ERROR: $template_dir exists, but $stream_output_dir is not writable"
+      return 0
+    fi
+    add_stream_block
+    find "$template_dir" -follow -type f -name "*$stream_suffix" -print | while read -r template; do
+      relative_path="${template#"$template_dir/"}"
+      output_path="$stream_output_dir/${relative_path%"$stream_suffix"}"
+      subdir=$(dirname "$relative_path")
+      # create a subdirectory where the template file exists
+      mkdir -p "$stream_output_dir/$subdir"
+      entrypoint_log "$ME: Running envsubst on $template to $output_path"
+      envsubst "$defined_envs" < "$template" > "$output_path"
+    done
+  fi
+}
+
+auto_envsubst
+
+exit 0

generate-stackbrew-library.sh

@@ -1,6 +1,8 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -eu
 
+[ -z "${GENERATE_STACKBREW_LIBRARY_TARGET:-}" ] && target="library" || target="$GENERATE_STACKBREW_LIBRARY_TARGET"
+
 declare -A aliases
 aliases=(
 	[mainline]='1 1.29 latest'
@@ -58,17 +60,17 @@ join() {
 for version in "${versions[@]}"; do
     debian_otel="debian-otel"
     alpine_otel="alpine-otel"
-	commit="$(dirCommit "$version/$base")"
+	commit="$(dirCommit "$target/$version/$base")"
 
-	fullVersion="$(git show "$commit":"$version/$base/Dockerfile" | awk '$1 == "ENV" && $2 == "NGINX_VERSION" { print $3; exit }')"
+	fullVersion="$(git show "$commit":"$target/$version/$base/Dockerfile" | awk -F' |=| +' '$1 == "ENV" && $2 == "NGINX_VERSION" { print $3; exit }')"
 
 	versionAliases=( $fullVersion )
 	if [ "$version" != "$fullVersion" ]; then
 		versionAliases+=( $version )
 	fi
 	versionAliases+=( ${aliases[$version]:-} )
 
-	debianVersion="$(git show "$commit":"$version/$base/Dockerfile" | awk -F"[-:]" '$1 == "FROM debian" { print $2; exit }')"
+	debianVersion="$(git show "$commit":"$target/$version/$base/Dockerfile" | awk -F"[-:]" '$1 ~ /^FROM debian|^ARG IMAGE=debian/ { print $2; exit }')"
 	debianAliases=( ${versionAliases[@]/%/-$debianVersion} )
 	debianAliases=( "${debianAliases[@]//latest-/}" )
 
@@ -77,11 +79,11 @@ for version in "${versions[@]}"; do
 		Tags: $(join ', ' "${versionAliases[@]}"), $(join ', ' "${debianAliases[@]}")
 		Architectures: ${debian_architectures[$version]}
 		GitCommit: $commit
-		Directory: $version/$base
+		Directory: $target/$version/$base
 	EOE
 
 	for variant in debian-perl; do
-		commit="$(dirCommit "$version/$variant")"
+		commit="$(dirCommit "$target/$version/$variant")"
 
 		variantAliases=( "${versionAliases[@]/%/-perl}" )
 		variantAliases+=( "${versionAliases[@]/%/-${variant/debian/$debianVersion}}" )
@@ -92,12 +94,12 @@ for version in "${versions[@]}"; do
 			Tags: $(join ', ' "${variantAliases[@]}")
 			Architectures: ${debian_architectures[$version]}
 			GitCommit: $commit
-			Directory: $version/$variant
+			Directory: $target/$version/$variant
 		EOE
 	done
 
 	for variant in $debian_otel; do
-		commit="$(dirCommit "$version/$variant")"
+		commit="$(dirCommit "$target/$version/$variant")"
 
 		variantAliases=( "${versionAliases[@]/%/-otel}" )
 		variantAliases+=( "${versionAliases[@]/%/-${variant/debian/$debianVersion}}" )
@@ -108,16 +110,16 @@ for version in "${versions[@]}"; do
 			Tags: $(join ', ' "${variantAliases[@]}")
 			Architectures: amd64, arm64v8
 			GitCommit: $commit
-			Directory: $version/$variant
+			Directory: $target/$version/$variant
 		EOE
 	done
 
 
-	commit="$(dirCommit "$version/alpine-slim")"
-	alpineVersion="$(git show "$commit":"$version/alpine-slim/Dockerfile" | awk -F: '$1 == "FROM alpine" { print $2; exit }')"
+	commit="$(dirCommit "$target/$version/alpine-slim")"
+	alpineVersion="$(git show "$commit":"$target/$version/alpine-slim/Dockerfile" | awk -F: '$1 ~ /^FROM alpine|^ARG IMAGE=alpine/ { print $2; exit }')"
 
 	for variant in alpine alpine-perl alpine-slim; do
-		commit="$(dirCommit "$version/$variant")"
+		commit="$(dirCommit "$target/$version/$variant")"
 
 		variantAliases=( "${versionAliases[@]/%/-$variant}" )
 		variantAliases+=( "${versionAliases[@]/%/-${variant/alpine/alpine$alpineVersion}}" )
@@ -128,12 +130,12 @@ for version in "${versions[@]}"; do
 			Tags: $(join ', ' "${variantAliases[@]}")
 			Architectures: arm64v8, arm32v6, arm32v7, ppc64le, s390x, i386, amd64, riscv64
 			GitCommit: $commit
-			Directory: $version/$variant
+			Directory: $target/$version/$variant
 		EOE
 	done
 
 	for variant in $alpine_otel; do
-		commit="$(dirCommit "$version/$variant")"
+		commit="$(dirCommit "$target/$version/$variant")"
 
 		variantAliases=( "${versionAliases[@]/%/-$variant}" )
 		variantAliases+=( "${versionAliases[@]/%/-${variant/alpine/alpine$alpineVersion}}" )
@@ -144,7 +146,7 @@ for version in "${versions[@]}"; do
 			Tags: $(join ', ' "${variantAliases[@]}")
 			Architectures: amd64, arm64v8
 			GitCommit: $commit
-			Directory: $version/$variant
+			Directory: $target/$version/$variant
 		EOE
 	done
 

library/stable/debian/15-local-resolvers.envsh

@@ -0,0 +1,15 @@
+#!/bin/sh
+# vim:sw=2:ts=2:sts=2:et
+
+set -eu
+
+LC_ALL=C
+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+[ "${NGINX_ENTRYPOINT_LOCAL_RESOLVERS:-}" ] || return 0
+
+NGINX_LOCAL_RESOLVERS=$(awk 'BEGIN{ORS=" "} $1=="nameserver" {if ($2 ~ ":") {print "["$2"]"} else {print $2}}' /etc/resolv.conf)
+
+NGINX_LOCAL_RESOLVERS="${NGINX_LOCAL_RESOLVERS% }"
+
+export NGINX_LOCAL_RESOLVERS