Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package nginx-image for openSUSE:Factory checked in at 2026-10-21 20:56:43 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/nginx-image (Old) and /work/SRC/openSUSE:Factory/.nginx-image.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "nginx-image" Wed Oct 21 20:56:43 2026 rev:54 rq:1386613 version:unknown Changes: -------- --- /work/SRC/openSUSE:Factory/nginx-image/nginx-image.changes 2026-10-08 11:59:13.881591180 +0200 +++ /work/SRC/openSUSE:Factory/.nginx-image.new.2252680/nginx-image.changes 2026-10-21 20:58:05.551504956 +0200 @@ -1,0 +2,5 @@ +Tue Oct 20 17:32:35 UTC 2026 - SUSE Update Bot <[email protected]> + +- Allow execution under arbitrary user IDs. + +------------------------------------------------------------------- Old: ---- docker-entrypoint.sh New: ---- docker-entrypoint.sles.sh ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ 40-unprivileged-mode.sh ++++++ --- /var/tmp/diff_new_pack.EWQcxK/_old 2026-10-21 20:58:06.559547216 +0200 +++ /var/tmp/diff_new_pack.EWQcxK/_new 2026-10-21 20:58:06.564547425 +0200 @@ -1,36 +1,10 @@ #!/bin/sh -set -e +echo "$0: Creating temporary folder at /tmp/nginx" -CURRENT_UID=$(id -u) -if [ "$CURRENT_UID" -gt "0" ]; then - echo "$0: Running as unprivileged user (UID: $CURRENT_UID). Configuring for unprivileged mode (Port 8080)." - - CONF_FILES="/etc/nginx/conf.d/default.conf /etc/nginx/nginx.conf" - - for FILE in $CONF_FILES; do - if [ -w "$FILE" ]; then - if grep -q "listen .*80;" "$FILE"; then - echo "Changing port 80 to 8080 in $FILE" - sed 's/listen\s*80;/listen 8080;/g' "$FILE" > /tmp/client_temp/nginx_swap.conf && \ - cat /tmp/client_temp/nginx_swap.conf > "$FILE" && \ - rm -f /tmp/client_temp/nginx_swap.conf - fi - - if [ "$FILE" = "/etc/nginx/nginx.conf" ]; then - echo "Redirecting NGINX temp paths and setting PID to /tmp in $FILE" - sed -e '/^user/d' \ - -e 's,^#\?\s*pid\s\+.*;$,pid /var/run/nginx/nginx.pid;,' \ - -e '/http {/a \ client_body_temp_path /tmp/client_temp;\n proxy_temp_path /tmp/proxy_temp;\n fastcgi_temp_path /tmp/fastcgi_temp;\n uwsgi_temp_path /tmp/uwsgi_temp;\n scgi_temp_path /tmp/scgi_temp;' \ - "$FILE" > /tmp/client_temp/nginx_ultra.conf && \ - cat /tmp/client_temp/nginx_ultra.conf > "$FILE" && \ - rm -f /tmp/client_temp/nginx_ultra.conf - echo "$0: Removed 'user' directive and updated PID path." - fi - fi - done - - echo "$0: Listening on port 8080." -fi -(No newline at EOF) +install -d /tmp/nginx/client_temp \ + /tmp/nginx/proxy_temp \ + /tmp/nginx/fastcgi_temp \ + /tmp/nginx/uwsgi_temp \ + /tmp/nginx/scgi_temp ++++++ Dockerfile ++++++ --- /var/tmp/diff_new_pack.EWQcxK/_old 2026-10-21 20:58:06.598548851 +0200 +++ /var/tmp/diff_new_pack.EWQcxK/_new 2026-10-21 20:58:06.602549018 +0200 @@ -37,6 +37,23 @@ RUN set -euo pipefail; \ [ "$(rpm --root /target -q --qf '%{version}' nginx | \ cut -d '.' -f -2)" = "1.31" ] +RUN set -euo pipefail; mkdir /target/docker-entrypoint.d +COPY [1-4]0-*.sh /target/docker-entrypoint.d/ +COPY docker-entrypoint.sles.sh /target/usr/local/bin/docker-entrypoint.sh +COPY index.html /target/srv/www/htdocs/ +RUN set -euo pipefail; \ + chmod +x /target/docker-entrypoint.d/*.sh \ + /target/usr/local/bin/docker-entrypoint.sh +RUN set -euo pipefail; cp /target/etc/nginx/nginx.conf.default /target/etc/nginx/nginx.conf.non-root +RUN set -euo pipefail; \ + sed -i 's/listen\s*80;/listen 8080;/g' /target/etc/nginx/nginx.conf.non-root; \ + sed -i -e 's,^#\?\s*pid\s\+.*;$,pid /tmp/nginx.pid;,' /target/etc/nginx/nginx.conf.non-root; \ + sed -i "/http {/a\ client_body_temp_path /tmp/client_temp;" /target/etc/nginx/nginx.conf.non-root; \ + sed -i "/http {/a\ proxy_temp_path /tmp/proxy_temp;" /target/etc/nginx/nginx.conf.non-root; \ + sed -i "/http {/a\ fastcgi_temp_path /tmp/fastcgi_temp;" /target/etc/nginx/nginx.conf.non-root; \ + sed -i "/http {/a\ uwsgi_temp_path /tmp/uwsgi_temp;" /target/etc/nginx/nginx.conf.non-root; \ + sed -i "/http {/a\ scgi_temp_path /tmp/scgi_temp;" /target/etc/nginx/nginx.conf.non-root +RUN set -euo pipefail; chmod o+rx /target/var/log/nginx # cleanup logs and temporary files RUN set -euo pipefail; zypper -n --installroot /target clean -a; \ @@ -74,11 +91,8 @@ CMD ["nginx", "-g", "daemon off;"] EXPOSE 80/tcp -RUN set -euo pipefail; mkdir /docker-entrypoint.d -COPY [1-4]0-*.sh /docker-entrypoint.d/ -COPY docker-entrypoint.sh /usr/local/bin -COPY index.html /srv/www/htdocs/ -RUN set -euo pipefail; chmod +x /docker-entrypoint.d/*.sh /usr/local/bin/docker-entrypoint.sh -RUN set -euo pipefail; set -euo pipefail; mkdir -p /var/cache/nginx /var/run/nginx /tmp/client_temp /tmp/proxy_temp /tmp/fastcgi_temp /tmp/uwsgi_temp /tmp/scgi_temp; ln -sf /dev/stdout /var/log/nginx/access.log; ln -sf /dev/stderr /var/log/nginx/error.log; chown -R nginx:nginx /var/cache/nginx /etc/nginx /var/run/nginx /var/log/nginx /tmp/client_temp /tmp/proxy_temp /tmp/fastcgi_temp /tmp/uwsgi_temp /tmp/scgi_temp; +RUN set -euo pipefail; \ + ln -sf /dev/stdout /var/log/nginx/access.log; \ + ln -sf /dev/stderr /var/log/nginx/error.log STOPSIGNAL SIGQUIT ++++++ README.md ++++++ --- /var/tmp/diff_new_pack.EWQcxK/_old 2026-10-21 20:58:06.638550528 +0200 +++ /var/tmp/diff_new_pack.EWQcxK/_new 2026-10-21 20:58:06.642550695 +0200 @@ -44,16 +44,17 @@ ## Running nginx as a non-root user -To run the image as a less-privileged `nginx` user, run the following command: +To run the image as a less-privileged user, run the following command: ```ShellSession $ podman run -it --user nginx --rm -p 8080:8080 -v /path/to/html/:/srv/www/htdocs/:Z registry.opensuse.org/opensuse/nginx:1.31 ``` -The included script `40-unprivileged-mode.sh` changes the default listening port from 80 to 8080, removes the `user` directive from `/etc/nginx/nginx.conf`, - and configures temporary paths and the PID file to use writable locations under `/tmp` and `/var/run/nginx`, respectively. +If no custom configuration is mounted to `/etc/nginx/nginx.conf`, the container falls back to `/etc/nginx/nginx.conf.non-root`. +This non-root configuration changes the default options by changing the port from 80 to 8080, +removes the user directive, and re-routes the PID file and temporary directory paths to /tmp to support unprivileged execution. -**Note:** When running as the `nginx` user, the default port is 8080. +**Note:** The container also supports execution under arbitrary user IDs. ## Environment variables @@ -97,7 +98,7 @@ - `20-envsubst-on-templates.sh` - Enables the use of environment variables in templates. - `30-tune-worker-processes.sh` - Enables autotuning the number of nginx worker processes. -- `40-unprivileged-mode.sh` - Enables running in unprivileged mode if the container is started as a non-root user (UID > 0). +- `40-unprivileged-mode.sh` - Create temporary folders to be used in unprivileged execution. **Warning:** The container startup is aborted if any script exits with an error. ++++++ docker-entrypoint.sles.sh ++++++ #!/bin/sh # vim:sw=4:ts=4:et set -e entrypoint_log() { if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then echo "$@" fi } if [ "$1" = "nginx" ] || [ "$1" = "nginx-debug" ]; then if /usr/bin/find "/docker-entrypoint.d/" -mindepth 1 -maxdepth 1 -type f -print -quit 2>/dev/null | read v; then entrypoint_log "$0: /docker-entrypoint.d/ is not empty, will attempt to perform configuration" entrypoint_log "$0: Looking for shell scripts in /docker-entrypoint.d/" find "/docker-entrypoint.d/" -follow -type f -print | sort -V | while read -r f; do case "$f" in *.envsh) if [ -x "$f" ]; then entrypoint_log "$0: Sourcing $f"; . "$f" else # warn on shell scripts without exec bit entrypoint_log "$0: Ignoring $f, not executable"; fi ;; *.sh) if [ -x "$f" ]; then entrypoint_log "$0: Launching $f"; "$f" else # warn on shell scripts without exec bit entrypoint_log "$0: Ignoring $f, not executable"; fi ;; *) entrypoint_log "$0: Ignoring $f";; esac done entrypoint_log "$0: Configuration complete; ready for start up" else entrypoint_log "$0: No files found in /docker-entrypoint.d/, skipping configuration" fi fi # apply non-root config override only if -c is not already passed if [ "$1" = "nginx" ] || [ "$1" = "nginx-debug" ]; then HAS_CUSTOM_CONFIG=0 for arg in "$@"; do if [ "$arg" = "-c" ]; then HAS_CUSTOM_CONFIG=1 break fi done if [ "$HAS_CUSTOM_CONFIG" -eq 0 ]; then if ! grep -q " /etc/nginx/nginx.conf " /proc/self/mountinfo && [ "$(id -u)" -gt 0 ]; then set -- "$@" -c /etc/nginx/nginx.conf.non-root fi fi fi exec "$@"
