Dockerfile.template

# Build arguments for version pinning and reproducibility
ARG BASE_VERSION=3.24.1
ARG BASE_HASH=bec4ccd3817e7c824eb0388971a0b83fab111d586285511ba0266b77e8dc65a9
FROM alpine:${BASE_VERSION}@sha256:${BASE_HASH} AS builder
ARG OPENSSL_VERSION
ARG APP_VERSION

WORKDIR /tmp
# System setup and dependency installation
RUN set -eu \
    # Create non-root user for security (nginx:nginx)
    && addgroup --system --gid "10001" nginx && adduser --disabled-password --shell /bin/false --ingroup nginx --uid "10001" --no-create-home nginx \
    # Update system and install build dependencies
    && apk -U -q upgrade && apk add -q --no-cache \
        clang22=22.1.3-r2 \
        lld22=22.1.3-r0 \
        llvm=22-r0 \
        make=4.4.1-r4 \
        git=2.54.0-r0 \
        mimalloc2-dev=2.2.7-r0 \
        build-base=0.5-r4 \
        ca-certificates=20260611-r0 \
        linux-headers=7.0.0-r1 \
        tzdata=2026c-r0 \
        upx=5.2.0-r0 \
        perl=5.42.2-r0 \
        cmake=4.2.3-r0 \
        zstd-dev=1.5.7-r2 \
        zstd-static=1.5.7-r2 \
        brotli-dev=1.2.0-r1  \
        brotli-static=1.2.0-r1 \
        curl=8.22.0-r0 \
        bash=5.3.9-r1 \
    # Update CA certificates for SSL verification
    && update-ca-certificates

SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
RUN git config --global advice.detachedHead false \
    && PCRE_VERSION=$(curl -sSfL "https://api.github.com/repos/PCRE2Project/pcre2/releases/latest" | grep '"tag_name":' | sed -E 's/.*"pcre2\-([^"]+)".*/\1/') \
    && ZLIB_VERSION=$(curl -sSfL "https://api.github.com/repos/zlib-ng/zlib-ng/releases/latest" | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/') \
    && ZSTD_VERSION=$(curl -sSfL "https://api.github.com/repos/tokers/zstd-nginx-module/releases/latest" | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/') \
    # Clone NGINX webserver and remove documentation
    && git clone -q --depth 1 --recursive -j8 --single-branch -b "release-${APP_VERSION}" https://github.com/nginx/nginx && rm -rf /tmp/nginx/docs/html/* \
    # Clone OpenSSL with HTTP/3 and QUIC support
    && git clone -q --depth 1 --recursive -j8 --single-branch -b "openssl-${OPENSSL_VERSION}" https://github.com/openssl/openssl \
    # Clone PCRE2 for regex with JIT support
    && git clone -q --depth 1 --recursive -j8 --single-branch -b "pcre2-${PCRE_VERSION}" https://github.com/PCRE2Project/pcre2 \
    # Clone zlib-ng for modern compression performance
    && git clone -q --depth 1 --recursive -j8 --single-branch -b "${ZLIB_VERSION}" https://github.com/zlib-ng/zlib-ng \
    # Clone Brotli compression module
    && git clone -q --depth 1 --recurse-submodules -j8 https://github.com/google/ngx_brotli \
    # Clone ZSTD compression module
    && git clone -q --depth 1 --recursive -j8 --single-branch -b "${ZSTD_VERSION}" https://github.com/tokers/zstd-nginx-module \
    # Remove Server header from HTTP responses (HTTP/1.1, HTTP/2, HTTP/3)
    && sed -ie 's@r->headers_out.server == NULL@0@g' \
        /tmp/nginx/src/http/ngx_http_header_filter_module.c \
        /tmp/nginx/src/http/v2/ngx_http_v2_filter_module.c \
        /tmp/nginx/src/http/v3/ngx_http_v3_filter_module.c \
    # Remove default footer from error pages
    && sed -ie 's@<hr><center>nginx</center>@@g' /tmp/nginx/src/http/ngx_http_special_response.c

# Build zlib-ng and Brotli compression libraries with optimizations
WORKDIR /tmp/zlib-ng
RUN mkdir -p /tmp/ngx_brotli/deps/brotli/out \
    && cmake -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=OFF \
        -DCMAKE_C_FLAGS="-m64 -march=x86-64 -mtune=generic -funroll-loops -ffunction-sections -fdata-sections" \
        -DCMAKE_CXX_FLAGS="-m64 -march=x86-64 -mtune=generic -funroll-loops -ffunction-sections -fdata-sections" \
        -DCMAKE_INSTALL_PREFIX=./installed -B /tmp/ngx_brotli/deps/brotli/out -S /tmp/ngx_brotli/deps/brotli \
    # Build Brotli encoder
    && cmake --build /tmp/ngx_brotli/deps/brotli/out --config Release --target brotlienc \
    # Configure zlib-ng for compatibility mode
    && sed -i "s/compat=0/compat=1/" /tmp/zlib-ng/configure && ./configure --zlib-compat \
    # Build and install zlib-ng
    && make -s -j "$(nproc)" && make -s install && make -s clean

ENV CC=clang \
    CXX=clang++ \
    LD=lld \
    AR=llvm-ar \
    NM=llvm-nm \
    RANLIB=llvm-ranlib \
    STRIP=llvm-strip

# Configure and build NGINX with security hardening and optimizations
WORKDIR /tmp/nginx
RUN CC=clang CXX=clang++ LD=lld AR=llvm-ar NM=llvm-nm RANLIB=llvm-ranlib STRIP=llvm-strip \
    && ./auto/configure \
        --with-debug \
        # Installation paths
        --prefix="/etc/nginx" \
        --sbin-path="/usr/sbin/nginx" \
        --user="nginx" \
        --group="nginx" \
        --http-log-path="/dev/stdout" \
        --error-log-path="/dev/stderr" \
        --conf-path="/etc/nginx/nginx.conf" \
        --pid-path="/tmp/nginx.pid" \
        --lock-path="/tmp/nginx.lock" \
        --http-client-body-temp-path="/tmp/client_temp" \
        --http-proxy-temp-path="/tmp/proxy_temp" \
        --http-fastcgi-temp-path="/tmp/fastcgi_temp" \
        # SSL/TLS configuration with modern protocols
        --with-openssl="/tmp/openssl" \
        --with-openssl-opt="enable-ec_nistp_64_gcc_128 no-tls1 no-tls1_1 \
            no-shared no-weak-ssl-ciphers enable-quic enable-ktls zlib" \
        # External libraries
        --with-pcre="/tmp/pcre2" \
        --with-zlib="/tmp/zlib-ng" \
        # Compilation flags
        --with-cc-opt="-fPIE -O2 -march=x86-64 \
            -Wall -Wextra -Wformat=2 -Wimplicit-fallthrough \
            -Werror=format-security -Werror=return-type -Wno-deprecated-declarations \
            -Wno-error=implicit-fallthrough -Wno-error=unused-parameter \
            -Wno-error=sign-compare \
            -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 -D_GLIBCXX_ASSERTIONS \
            -fstrict-flex-arrays=3 -fstack-clash-protection -fstack-protector-strong \
            -fcf-protection=full -ftrivial-auto-var-init=pattern \
            -fno-delete-null-pointer-checks -fno-strict-overflow \
            -fasynchronous-unwind-tables -fomit-frame-pointer \
            -DTCP_FASTOPEN=23" \
        --with-ld-opt="-L/usr/local/lib -lz -static-pie \
            -Wl,-z,nodlopen -Wl,-z,noexecstack -Wl,-z,relro -Wl,-z,now \
            -Wl,-z,separate-code -Wl,-z,shstk -Wl,-z,ibt \
            -Wl,--as-needed -Wl,--no-copy-dt-needed-entries" \
        # Core features
        --with-compat \
        --with-pcre-jit \
        --with-threads \
        # HTTP modules
        --with-http_realip_module \
        --with-http_stub_status_module \
        --with-http_ssl_module \
        --with-http_v2_module \
        --with-http_v3_module \
        --with-http_gzip_static_module \
        # Stream modules
        --with-stream \
        --with-stream_realip_module \
        --with-stream_ssl_module \
        --with-stream_ssl_preread_module \
        # Remove unnecessary modules to reduce attack surface
        --without-stream_split_clients_module \
        --without-stream_set_module \
        --without-http_geo_module \
        --without-http_scgi_module \
        --without-http_uwsgi_module \
        --without-http_autoindex_module \
        --without-http_split_clients_module \
        --without-http_memcached_module \
        --without-http_ssi_module \
        --without-http_empty_gif_module \
        --without-http_browser_module \
        --without-http_userid_module \
        --without-http_mirror_module \
        --without-http_referer_module \
        --without-mail_pop3_module \
        --without-mail_imap_module \
        --without-mail_smtp_module \
        # Third-party modules
        --add-module="/tmp/ngx_brotli" \
        --add-module="/tmp/zstd-nginx-module" \
    # Build and install NGINX
    && make -s -j "$(nproc)" && make -s install && make -s clean \
    # Security hardening: strip debug symbols and compress binary
    && llvm-strip --strip-all /usr/sbin/nginx \
    && upx -qq --best --lzma /usr/sbin/nginx \
    # Set proper permissions
    && chown -R "10001:10001" /etc/nginx && rm -rf /tmp/* \
    && grep -E "(root|nginx)" /etc/passwd > /tmp/passwd \
    && grep -E "(root|nginx)" /etc/group > /tmp/group \
    && grep -E "(root|nginx)" /etc/shadow > /tmp/shadow \
    && find /etc/nginx -type d -exec chmod 550 {} \; \
    && find /etc/nginx -type f -name "*.conf" -exec chmod 440 {} \; \
    && find /etc/nginx -type f -name "*.types" -exec chmod 440 {} \; \
    && chmod 644 /tmp/passwd /tmp/group && chmod 640 /tmp/shadow

# Final distroless image
FROM scratch
ARG APP_VERSION
ARG BUILD_DATE
ARG VCS_REF

# Copy minimal runtime dependencies from builder
WORKDIR /tmp
COPY --from=builder --chown="0:0" /tmp/passwd /tmp/group /tmp/shadow /etc/
COPY --from=builder --chown="10001:10001" --chmod="550" /usr/sbin/nginx /usr/sbin/nginx
COPY --from=builder --chown="10001:10001" /etc/nginx /etc/nginx
# Copy configuration files
COPY --chown="10001:10001" ./nginx.conf /etc/nginx/nginx.conf
COPY --chown="10001:10001" ./default.conf /etc/nginx/conf.d/default.conf

# Expose HTTP, HTTPS, and QUIC ports
EXPOSE 8080/tcp 8443/tcp 8443/udp

# OCI labels for image metadata
LABEL description="Distroless NGINX with HTTP/3, QUIC, ECH and PQC support🚀" \
      maintainer="ammnt" \
      org.opencontainers.image.description="Distroless NGINX with HTTP/3, QUIC, ECH and PQC support🚀" \
      org.opencontainers.image.authors="ammnt" \
      org.opencontainers.image.title="Distroless NGINX with HTTP/3, QUIC, ECH and PQC support🚀" \
      org.opencontainers.image.source="https://github.com/ammnt/nginx/" \
      org.opencontainers.image.created=${BUILD_DATE} \
      org.opencontainers.image.documentation="https://github.com/ammnt/nginx/blob/main/README.md" \
      org.opencontainers.image.licenses="BSD-2-Clause License" \
      org.opencontainers.image.url="https://ammnt.fun" \
      org.opencontainers.image.version=${APP_VERSION} \
      org.opencontainers.image.revision=${VCS_REF}

# Health check for container orchestration
HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
  CMD ["/usr/sbin/nginx", "-qt"]

# Use SIGQUIT for graceful shutdown with connection draining
STOPSIGNAL SIGQUIT

# Run as non-root user for security
USER 10001:10001

# Start NGINX in foreground mode
ENTRYPOINT ["/usr/sbin/nginx", "-g", "daemon off;"]