bellsoft/hardened-nginx repository overview

⁠Hardened Containers images with Nginx

This repository contains Hardened Containers Stream images with the Nginx web server.

⁠Example

The next code example demonstrates a Dockerfile that creates an image to host simple static content:

FROM bellsoft/hardened-nginx:distroless
COPY static-html-directory /var/lib/nginx/html

Run the following commands in a directory where the static-html-directory directory is located to build and start your container:

$ docker build -t my-nginx .
$ docker run -d -p 8080:8080 my-nginx

After that, you can reach http://localhost:8080.

⁠Tags

Tag name structure:

[Bundle type-][Nginx version][-nonroot|-distroless][libc type]

If Bundle type is omitted, it is treated as the default one. There are the following Bundle type variants:

⁠default

It contains the minimal set of packages needed to run nginx. It does not contain any dynamic nginx modules.

⁠dynamic

This is as the default one, but also contains the following dynamic modules:

• ngx_http_brotli_filter
• ngx_http_brotli_static
• ngx_http_geoip
• ngx_http_image_filter
• ngx_http_js
• ngx_http_xslt_filter
• ngx_stream_geoip
• ngx_stream_js
• ngx_stream

⁠otel

This is as the dynamic one, but also provides an ngx_http_otel dynamic module.

Nginx version is an Nginx version string. It has a X.Y format, e.g. 1.30.

-nonroot|-distroless specifies a hardened image type.

libc type is a libc type (glibc or musl).

⁠License

As with all Docker images, these also contain other software, which may be distributed under other licenses.

The list of installed software components and their licenses can be retrieved by executing the grep -E '^[PVL]:' /var/lib/apk/db/installed command in the image.

As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.