Giter VIP home page Giter VIP logo

docker-openresty's Introduction

docker-openresty - Docker tooling for OpenResty

Travis Status Appveyor status

docker-openresty is Docker tooling for OpenResty (https://www.openresty.org).

Docker is a container management platform. OpenResty is a full-fledged web application server by bundling the standard nginx core, lots of 3rd-party nginx modules, as well as most of their external dependencies.

OpenResty Image Tags

It is best practice to pin your images to an explicit image tag. The next section below covers the conventions in detail, but here are some common examples:

Image Description
openresty/openresty:1.25.3.1-0-jammy Built-from-source Ubuntu Jammy
openresty/openresty:1.25.3.1-0-focal Built-from-source Ubuntu Focal
openresty/openresty:1.25.3.1-0-bookworm-fat Built-from-upstream Debian Bookworm
openresty/openresty:1.25.3.1-0-alpine Built-from-source Alpine
openresty/openresty:1.25.3.1-0-alpine-apk Built-from-upstream Alpine

These are examples of untagged image names, for reference:

Image Description
openresty/openresty:jammy Latest Ubuntu Jammy
openresty/openresty:focal Latest Ubuntu Focal
openresty/openresty:alpine Latest Alpine

Table of Contents

Usage

If you are happy with the build defaults, then you can use the openresty image from the Docker Hub. The image tags available there are listed at the top of this README.

docker run [options] openresty/openresty:bullseye-fat

[options] would be things like -p to map ports, -v to map volumes, and -d to daemonize.

docker-openresty symlinks /usr/local/openresty/nginx/logs/access.log and error.log to /dev/stdout and /dev/stderr respectively, so that Docker logging works correctly. If you change the log paths in your nginx.conf, you should symlink those paths as well. This is not possible with the windows image.

Temporary directories such as client_body_temp_path are stored in /var/run/openresty/. You may consider mounting that volume, rather than writing to a container-local directory. This is not done for windows.

Supported tags and respective Dockerfile links

The following "flavors" are available and built from upstream OpenResty packages:

The following "flavors" are built from source and are intended for more advanced and custom usage, caveat emptor:

The openresty/openresty:latest tag points to the latest bullseye image.

Since 1.19.3.2-1, all flavors support multi-architecture builds, both amd64 and aarch64. Since 1.21.4.1-1, the s390x architecture is supported for build-from-source Ubuntu flavors (like jammy), however PCRE JIT is disabled.

Starting with 1.13.6.1, releases are tagged with <openresty-version>-<image-version>-<flavor>. The latest image-version will also be tagged <openresty-version>-<flavor>. The HEAD of the master branch is also labeled plainly as <flavor>. The builds are managed by Travis-CI and Appveyor (for Windows images).

There are architecture-specific tags as well, <openresty-version>-<image-version>-<flavor>-<arch>, but one would generally pull from the multi-architecture name above.

OpenResty supports SSE 4.2 optimizations. Starting with the 1.19.3.1 series, the architecture is auto-detected and the optimizations enabled accordingly. Earlier image series 1.15.8.1 and 1.17.8.2 have -nosse42 image flavors for systems which explicitly disable SSE 4.2 support; this is useful for older systems and embedded systems. They are built with -mno-sse4.2 appended to the build arg RESTY_LUAJIT_OPTIONS. It is highly recommended NOT to use these if your system supports SSE 4.2 because the CRC32 instruction dramatically improves large string performance. These are only for built-from-source flavors, e.g. 1.15.8.1-3-bionic-nosse42, 1.15.8.1-3-alpine-nosse42, 1.15.8.1-3-alpine-fat-nosse42.

It is highly recommended that you use the upstream-based images for best support. For best stability, pin your images to the full tag, for example 1.21.4.1-0-bionic.

At this time, the only images that are compatible with aarch64 are alpine and alpine-fat. Once there are binary packages available, they can be released with the upstream packages.

Policies

The Maintainers of this OpenResty Docker Tooling operate under the following policies:

Nginx Config Files

The Docker tooling installs its own nginx.conf file. If you want to directly override it, you can replace it in your own Dockerfile or via volume bind-mounting.

For the Linux images, that nginx.conf has the directive include /etc/nginx/conf.d/*.conf; so all nginx configurations in that directory will be included. The default virtual host configuration has the original OpenResty configuration and is copied to /etc/nginx/conf.d/default.conf.

You can override that default.conf directly or volume bind-mount the /etc/nginx/conf.d directory to your own set of configurations:

docker run -v /my/custom/conf.d:/etc/nginx/conf.d openresty/openresty:alpine

If you are running on an selinux host (e.g. CentOS), you may need to add :Z to your volume bind-mount argument:

docker run -v /my/custom/conf.d:/etc/nginx/conf.d:Z openresty/openresty:alpine

When using the windows image you can change the main configuration directly:

docker run -v C:/my/custom/nginx.conf:C:/openresty/conf/nginx.conf openresty/openresty:windows

OPM

Starting at version 1.11.2.2, OpenResty for Linux includes a package manager called opm, which can be found at /usr/local/openresty/bin/opm.

opm is built in all the images except alpine and buster and bullseye.

To use opm in the alpine image, you must also install the curl and perl packages; they are not included by default because they double the image size. You may install them like so: apk add --no-cache curl perl.

To use opm within the bullseye image, you can either use the bullseye-fat image or install the openresty-opm package in a custom build (which you would need to do to install your own opm packages anyway), as shown in this buster example.

LuaRocks

LuaRocks is included in the alpine-fat, centos, and bionic variants. It is excluded from alpine because it generally requires a build system and we want to keep that variant lean.

It is available at /usr/local/openresty/luajit/bin/luarocks. Packages can be added in your dependent Dockerfiles like so:

RUN /usr/local/openresty/luajit/bin/luarocks install <rock>

Tips & Pitfalls

  • The envsubst utility is included in all images except alpine and windows; this utility is also included in the Nginx docker image and is used to template environment variables into configuration files.

  • By default, OpenResty is built with SSE4.2 optimizations if the build machine supports it. If run on machine without SSE4.2, there will be invalid opcode issues. Thus all the Docker Hub images require SSE4.2. You can build a custom image from source explicitly without SSE4.2 support, using build arguments like so:

docker build -f bionic/Dockerfile --build-arg "RESTY_LUAJIT_OPTIONS=--with-luajit-xcflags='-DLUAJIT_NUMMODE=2 -DLUAJIT_ENABLE_LUA52COMPAT -mno-sse4.2'" .

  • OpenResty's OpenSSL library version must be compatible with your opm and LuaRocks packages' version. At minimum, the numeric portion should be the same (e.g. 1.1.1). The image label resty_openssl_version indicates this value. see Labels.

  • The 1.13.6.2-alpine is built from OpenSSL 1.0.2r because of build issues on Alpine. 1.15.8.1-alpine and later are built from OpenSSL 1.1.1 series.

  • Windows images must be built from the same version as the host system it runs on. See Windows container version compatibility. Our images are currently built from the "Windows Server 2016" series.

  • The SIGQUIT signal will be sent to nginx to stop this container, to give it an opportunity to stop gracefully (i.e, finish processing active connections). The Docker default is SIGTERM, which immediately terminates active connections.

  • Alpine 3.9 added OpenSSL 1.1.1 and we build images against this. OpenSSL 1.1.1 enabled TLS 1.3 by default, which can create unexpected behavior with ssl_session_(store|fetch)_by_lua*. See this patch, which will ship in OpenResty 1.17.x.1, for more information: https://github.com/openresty/lua-nginx-module/commit/d3dbc0c8102a9978d649c99e3261d93aac547378

Image Labels

The image builds are labeled with various information, such as the versions of OpenResty and its dependent libraries. Here's an example of printing the labels using jq:

$ docker pull openresty/openresty:1.17.8.1-0-bionic
$ docker inspect openresty/openresty:1.17.8.1-0-bionic | jq '.[].Config.Labels'
{
  "maintainer": "Evan Wies <evan@*********.net>",
  "resty_add_package_builddeps": "",
  "resty_add_package_rundeps": "",
  "resty_config_deps": "--with-pcre     --with-cc-opt='-DNGX_LUA_ABORT_AT_PANIC -I/usr/local/openresty/pcre/include -I/usr/local/openresty/openssl/include'     --with-ld-opt='-L/usr/local/openresty/pcre/lib -L/usr/local/openresty/openssl/lib -Wl,-rpath,/usr/local/openresty/pcre/lib:/usr/local/openresty/openssl/lib'     ",
  "resty_config_options": "    --with-compat     --with-file-aio     --with-http_addition_module     --with-http_auth_request_module     --with-http_dav_module     --with-http_flv_module     --with-http_geoip_module=dynamic     --with-http_gunzip_module     --with-http_gzip_static_module     --with-http_image_filter_module=dynamic     --with-http_mp4_module     --with-http_random_index_module     --with-http_realip_module     --with-http_secure_link_module     --with-http_slice_module     --with-http_ssl_module     --with-http_stub_status_module     --with-http_sub_module     --with-http_v2_module     --with-http_v3_module     --with-http_xslt_module=dynamic     --with-ipv6     --with-mail     --with-mail_ssl_module     --with-md5-asm     --with-pcre-jit     --with-sha1-asm     --with-stream     --with-stream_ssl_module     --with-threads     ",
  "resty_config_options_more": "",
  "resty_eval_post_make": "",
  "resty_eval_pre_configure": "",
  "resty_eval_post_download_pre_configure": "",
  "resty_image_base": "ubuntu",
  "resty_image_tag": "bionic",
  "resty_luarocks_version": "3.3.1",
  "resty_openssl_patch_version": "1.1.0d",
  "resty_openssl_url_base": "https://www.openssl.org/source/old/1.1.0",
  "resty_openssl_version": "1.1.0l",
  "resty_pcre_version": "8.45",
  "resty_version": "1.17.8.1"
}
Label Name Description
maintainer Maintainer of the image
resty_add_package_builddeps buildarg RESTY_ADD_PACKAGE_BUILDDEPS
resty_add_package_rundeps buildarg RESTY_ADD_PACKAGE_RUNDEPS
resty_apk_key_url buildarg RESTY_APK_KEY_URL
resty_apk_repo_url buildarg RESTY_APK_REPO_URL
resty_apk_version buildarg RESTY_APK_VERSION
resty_apt_pgp buildarg RESTY_APT_PGP
resty_apt_repo buildarg RESTY_APT_REPO
resty_apt_arch buildarg RESTY_APT_ARCH
resty_config_deps buildarg _RESTY_CONFIG_DEPS (internal)
resty_config_options_more buildarg RESTY_CONFIG_OPTIONS_MORE
resty_config_options buildarg RESTY_CONFIG_OPTIONS
resty_deb_flavor buildarg RESTY_DEB_FLAVOR
resty_deb_version buildarg RESTY_DEB_VERSION (available versions)
resty_eval_post_make buildarg RESTY_EVAL_POST_MAKE
resty_eval_pre_configure buildarg RESTY_EVAL_PRE_CONFIGURE
resty_eval_post_download_pre_configure buildarg RESTY_EVAL_POST_DOWNLOAD_PRE_CONFIGURE
resty_fat_deb_flavor buildarg RESTY_FAT_DEB_FLAVOR
resty_fat_deb_version buildarg RESTY_FAT_DEB_VERSION
resty_fat_image_base Name of the base image to build fat images from, buildarg RESTY_FAT_IMAGE_BASE
resty_fat_image_tag Tag of the base image to build fat images from, buildarg RESTY_FAT_IMAGE_TAG
resty_image_base Name of the base image to build from, buildarg RESTY_IMAGE_BASE
resty_image_tag Tag of the base image to build from, buildarg RESTY_IMAGE_TAG
resty_install_base buildarg RESTY_INSTALL_BASE
resty_install_tag buildarg RESTY_INSTALL_TAG
resty_luajit_options buildarg RESTY_LUAJIT_OPTIONS
resty_luarocks_version buildarg RESTY_LUAROCKS_VERSION
resty_openssl_patch_version buildarg RESTY_OPENSSL_PATCH_VERSION
resty_openssl_url_base buildarg RESTY_OPENSSL_URL_BASE
resty_openssl_version buildarg RESTY_OPENSSL_VERSION
resty_pcre_build_options buildarg RESTY_PCRE_BUILD_OPTIONS
resty_pcre_options buildarg RESTY_PCRE_OPTIONS
resty_pcre_sha256 buildarg RESTY_PCRE_SHA256
resty_pcre_version buildarg RESTY_PCRE_VERSION
resty_rpm_arch buildarg RESTY_RPM_ARCH
resty_rpm_dist buildarg RESTY_RPM_DIST
resty_rpm_flavor buildarg RESTY_RPM_FLAVOR
resty_rpm_version buildarg RESTY_RPM_VERSION
resty_version buildarg RESTY_VERSION
resty_yum_repo buildarg RESTY_YUM_REPO

Docker CMD

The -g "daemon off;" directive is used in the Dockerfile CMD to keep the Nginx daemon running after container creation. If this directive is added to the nginx.conf, then the docker run should explicitly invoke openresty (or nginx for windows images):

docker run [options] openresty/openresty:bionic openresty

Invoke another CMD, for example the resty utility, like so:

docker run [options] openresty/openresty:bionic resty [script.lua]

NOTE The alpine images do not include the packages perl and ncurses, which is needed by the resty utility.

Building (from source)

This Docker image can be built and customized by cloning the repo and running docker build with the desired Dockerfile:

git clone https://github.com/openresty/docker-openresty.git
cd docker-openresty
docker build -t myopenresty -f bionic/Dockerfile .
docker run myopenresty

Dockerfiles are provided for the following base systems, selecting the Dockerfile path with -f:

We used to support more build flavors but have trimmed that down. Older Dockerfiles are archived in the archive folder.

The following are the available build-time options. They can be set using the --build-arg CLI argument, like so:

docker build --build-arg RESTY_J=4 -f jammy/Dockerfile .
Key Default Description
RESTY_IMAGE_BASE "ubuntu" / "alpine" The Debian or Alpine Docker image base to build FROM.
RESTY_IMAGE_TAG "jammy" / "3.19" The Debian or Alpine Docker image tag to build FROM.
RESTY_VERSION 1.25.3.1 The version of OpenResty to use.
RESTY_LUAROCKS_VERSION 3.11.0 The version of LuaRocks to use.
RESTY_OPENSSL_VERSION 1.1.1w The version of OpenSSL to use.
RESTY_OPENSSL_PATCH_VERSION 1.1.1f The version of OpenSSL to use when patching.
RESTY_OPENSSL_URL_BASE https://www.openssl.org/source/old/1.1.1 The base of the URL to download OpenSSL from.
RESTY_PCRE_VERSION 8.45 The version of PCRE to use.
RESTY_PCRE_SHA256 4e6ce03e0336e8b4a3d6c2b70b1c5e18590a5673a98186da90d4f33c23defc09 The SHA-256 checksum of the PCRE package to check.
RESTY_PCRE_BUILD_OPTIONS "--enable-jit" Options tweak Resty's PCRE build.
RESTY_PCRE_OPTIONS "--with-pcre-jit" Options to tweak Resty's build args regarding PCRE.
RESTY_J 1 Sets the parallelism level (-jN) for the builds.
RESTY_CONFIG_OPTIONS "--with-compat --with-file-aio --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_geoip_module=dynamic --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_mp4_module --with-http_perl_module=dynamic --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-http_xslt_module=dynamic --with-ipv6 --with-mail --with-mail_ssl_module --with-md5-asm --with-pcre-jit --with-sha1-asm --with-stream --with-stream_ssl_module --with-threads" Options to pass to OpenResty's ./configure script.
RESTY_LUAJIT_OPTIONS "--with-luajit-xcflags='-DLUAJIT_NUMMODE=2 -DLUAJIT_ENABLE_LUA52COMPAT'" Options to tweak LuaJIT.
RESTY_CONFIG_OPTIONS_MORE "" More options to pass to OpenResty's ./configure script.
RESTY_ADD_PACKAGE_BUILDDEPS "" Additional packages to install with package manager required by build only (removed after installation)
RESTY_ADD_PACKAGE_RUNDEPS "" Additional packages to install with package manager required at runtime (not removed after installation)
RESTY_EVAL_PRE_CONFIGURE "" Command(s) to run prior to executing OpenResty's ./configure script. (this can be used to clone a github repo of an extension you want to add to OpenResty, for example. In that case, dont forget to add the appropriate argument to the RESTY_CONFIG_OPTIONS_MORE argument as described above).
RESTY_EVAL_POST_DOWNLOAD_PRE_CONFIGURE "" Command(s) to run after downloading and extracting OpenResty's source tarball, but prior to executing OpenResty's ./configure script. Working directory will be the extracted OpenResty source directory.
RESTY_EVAL_POST_MAKE "" Command(s) to run after running make install.

These built-from-source flavors include the following modules by default, but one can easily increase or decrease that with the custom build options above:

  • file-aio
  • http_addition_module
  • http_auth_request_module
  • http_dav_module
  • http_flv_module
  • http_geoip_module=dynamic
  • http_gunzip_module
  • http_gzip_static_module
  • http_image_filter_module=dynamic
  • http_mp4_module
  • http_random_index_module
  • http_realip_module
  • http_secure_link_module
  • http_slice_module
  • http_ssl_module
  • http_stub_status_module
  • http_sub_module
  • http_v2_module
  • http_xslt_module=dynamic
  • ipv6
  • mail
  • mail_ssl_module
  • md5-asm
  • pcre-jit
  • sha1-asm
  • stream
  • stream_ssl_module
  • threads Back to TOC

Building (RPM based)

OpenResty now now has RPMs available. The centos and fedora images use these RPMs rather than building from source.

This Docker image can be built and customized by cloning the repo and running docker build with the desired Dockerfile:

The following are the available build-time options. They can be set using the --build-arg CLI argument, like so:

docker build --build-arg RESTY_RPM_FLAVOR="-debug" centos7/Dockerfile .
docker build --build-arg RESTY_RPM_FLAVOR="-debug" centos/Dockerfile .
docker build --build-arg RESTY_RPM_FLAVOR="-debug" -f fedora/Dockerfile .
Key Default Description
RESTY_IMAGE_BASE "centos" The Centos Docker image base to build FROM.
RESTY_IMAGE_TAG "8" The CentOS Docker image tag to build FROM.
RESTY_LUAROCKS_VERSION 3.11.0 The version of LuaRocks to use.
RESTY_YUM_REPO "https://openresty.org/package/centos/openresty.repo" URL for the OpenResty YUM Repository.
RESTY_RPM_FLAVOR "" The openresty package flavor to use. Possibly "-debug" or "-valgrind".
RESTY_RPM_VERSION "1.21.4.3-1" The openresty package version to install.
RESTY_RPM_DIST "el8" The openresty package distribution to install.
RESTY_RPM_ARCH "x86_64" The openresty package architecture to install.

Back to TOC

Building (DEB based)

OpenResty now now has Debian Packages (DEBs) available. The bullseye image use these DEBs rather than building from source.

You can derive your own Docker images from this to install your own packages. See buster/Dockerfile.opm_example and buster/Dockerfile.luarocks_example.

This Docker image can be built and customized by cloning the repo and running docker build with the desired Dockerfile:

The following are the available build-time options. They can be set using the --build-arg CLI argument, like so:

docker build --build-arg RESTY_DEB_FLAVOR="-debug" -f bullseye/Dockerfile .
Key Default Description
RESTY_APT_REPO "https://openresty.org/package/debian" Apt repo to load from.
RESTY_APT_PGP "https://openresty.org/package/pubkey.gpg" URL to download APT PGP key from
RESTY_APT_ARCH amd64 Architecture for APT lookups
RESTY_IMAGE_BASE "debian" The Debian Docker image base to build FROM.
RESTY_IMAGE_TAG "bullseye-slim" The Debian Docker image tag to build FROM.
RESTY_DEB_FLAVOR "" The openresty package flavor to use. Possibly "-debug" or "-valgrind".
RESTY_DEB_VERSION "=1.25.3.1-2~bookworm1" The Debian package version to use, with = prepended.
RESTY_FAT_DEB_FLAVOR "" The openresty package flavor to use to install "fat" packages. Possibly "-debug" or "-valgrind".
RESTY_FAT_DEB_VERSION "=1.25.3.1-2~bookworm1" The Debian package version to use to "fat" packages, with = prepended.
  • For amd64 builds, RESTY_APT_REPO="https://openresty.org/package/debian"
  • For arm64 builds, RESTY_APT_REPO="https://openresty.org/package/arm64/debian"

Back to TOC

Building (APK based)

OpenResty now now has Alpine Packagesx-5q (APKs) available. The alpine-apk image use these APKs rather than building from source. You can derive your own Docker images from this to install your own packages.

This Docker image can be built and customized by cloning the repo and running docker build with the desired Dockerfile:

The following are the available build-time options. They can be set using the --build-arg CLI argument, like so:

docker build --build-arg RESTY_IMAGE_TAG="3.12" -f alpine-apk/Dockerfile .
Key Default Description
RESTY_IMAGE_BASE "alpine" The Alpine Docker image base to build FROM.
RESTY_IMAGE_TAG "3.18" The Alpine Docker image tag to build FROM.
RESTY_APK_KEY_URL "https://openresty.org/package/[email protected]" The URL of the signing key of the openresty package.
RESTY_APK_REPO_URL "https://openresty.org/package/alpine/v${RESTY_IMAGE_TAG}/main" The URL of the APK repository for openresty package.
RESTY_APK_VERSION "=1.25.3.1-r0" The suffix to add to the apk install package name: openresty${RESTY_APK_VERSION}.

Back to TOC

Building (Windows based)

This Docker image can be built and customized by cloning the repo and running docker build with the desired Dockerfile:

The following are the available build-time options. They can be set using the --build-arg CLI argument, like so:

docker build --build-arg RESTY_VERSION="1.13.6.2" -f windows/Dockerfile .
Key Default Description
RESTY_INSTALL_BASE "mcr.microsoft.com/dotnet/framework/runtime" The Windows Server Docker image name to download and install OpenResty with.
RESTY_INSTALL_TAG "4.8-windowsservercore-ltsc2019" The Windows Server Docker image name to download and install OpenResty with.
RESTY_IMAGE_BASE "mcr.microsoft.com/windows/nanoserver" The Windows Server Docker image name to build FROM for final image.
RESTY_IMAGE_TAG "1809" The Windows Server Docker image tag to build FROM for final image.
RESTY_VERSION 1.25.3.1 The version of OpenResty to use.

Back to TOC

Feedback & Bug Reports

You're very welcome to report bugs and give feedback as GitHub Issues:

https://github.com/openresty/docker-openresty/issues

Back to TOC

Changelog & Authors

Back to TOC

Copyright & License

docker-openresty is licensed under the 2-clause BSD license.

Copyright (c) 2017-2024, Evan Wies [email protected].

This module is licensed under the terms of the BSD license.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

  • Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  • Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Back to TOC

docker-openresty's People

Contributors

4n70w4 avatar badin017 avatar chrko avatar davidemontanari avatar dndx avatar fengshunli avatar jf avatar jodok avatar joellinn avatar johanneswuerbach avatar josephcsible avatar kshitijmjoshi avatar lippertmarkus avatar mahnkong avatar neomantra avatar number5 avatar onnimonni avatar pgibson1-godaddy avatar radekrdk avatar robinkb avatar roynasser avatar sko00o avatar spacewander avatar tobiasstadler avatar xinroom avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Forkers

zhangwin ahlfors ilayze wiseok cpoole olegabr leeyenmomoko fouriertransformer leihentulong jeromegn timothyliu is00hcw zhangf911 trblockone outstand timmensch howdo-tech landao314 shawnzhu webscaleco jbergstroem princessd8251 evolutionary-networking-designs gogobook kioco mendersoftware mrkz55 songweian akrevenya mahnkong onnimonni nomaster 1275381 weiyanwei412 tingliu9 marrotte ldelossa wall-e alauda hyhy01 guoyu07 matt-hensley atebmt jwest-rms starefossen jebenexer stephenpcg noonly jerry123479 toecuta xingqijiuxueyuan avjpl tspicer ueu2715 denggm2000 ivokoko aayyz aguereca banjoinc alejandropal elefthei automationd yanzhid jalkjaer mobiker rusname ifooth holmser techatdhq lodestreams shancci binaris darep maskshell plambert flyoverit songyingjun luckystarry e7 station19 coozila yushifa lihua8712051 yangmozi yuanshuhan hlee-va vlaurenzano pmcpsantana beijingrb jodok skyformat99 dtulyakov brunopaiuca fushutech gy1005 tui-nordic z0x010 wds948993066 shishir-bg lippertmarkus

docker-openresty's Issues

Installing luasec with luarockt fails

I've attempted to install luasec, as I have some code that does HTTPS requests and requires TLS, therefore I've attempted to install luasec in my docker image by running this:

RUN /usr/local/openresty/luajit/bin/luarocks install luasec

Although I end up getting this error:

Step 7/13 : RUN /usr/local/openresty/luajit/bin/luarocks install luasec
 ---> Running in 054990a68d2a
Warning: falling back to curl - install luasec to get native HTTPS support
Installing https://luarocks.org/luasec-0.6-1.rockspec...

Error: Could not find header file for OPENSSL
  No file openssl/ssl.h in /usr/local/include
  No file openssl/ssl.h in /usr/include
You may have to install OPENSSL in your system and/or pass OPENSSL_DIR or OPENSSL_INCDIR to the luarocks command.
Example: luarocks install luasec OPENSSL_DIR=/usr/local
Using https://luarocks.org/luasec-0.6-1.rockspec... switching to 'build' mode
The command '/bin/sh -c /usr/local/openresty/luajit/bin/luarocks install luasec' returned a non-zero code: 1

I've attempted do download the the openssl-1.0.2f manually, extract it to the /usr/local/openssl dir and run it with luarocks install luasec OPENSSL_DIR=/usr/local although I end up getting other errors saying other files are now missing.

TO give you some context, here is my Dockerfile:

FROM openresty/openresty:alpine-fat

RUN apk add --no-cache git

RUN /usr/local/openresty/luajit/bin/luarocks install md5 
RUN /usr/local/openresty/luajit/bin/luarocks install luasocket

RUN cd /tmp \
        && curl -fSL https://www.openssl.org/source/openssl-1.0.2f.tar.gz -o openssl-1.0.2f.tar.gz \
        && tar xzf openssl-1.0.2f.tar.gz \
        && mkdir -p /usr/include/openssl \
        && cp -R openssl-1.0.2f/ssl/* /usr/include/openssl \
        && cp -R openssl-1.0.2f/crypto/* /usr/include/openssl \
        && cp -R openssl-1.0.2f/*.h /usr/include/openssl \
        && rm -rf openssl-1.0.2f/

RUN /usr/local/openresty/luajit/bin/luarocks install luasec OPENSSL_INCDIR=/usr/include

Any ideas how I can get around this issue?

xenial image not including fastcgi?

I downloaded xenial image but I'm getting errors with all fastcgi directives:

nginx                  | nginx: [emerg] unknown directive "fastcgi_read_timeout" in /usr/local/openresty/nginx/conf/nginx.conf:39

Using the same nginx.conf with official nginx image is ok

Add nginx (or openresty user) to run nginx

Similar to the official nginx docker container it would be ideal to run the openresty nginx server as a non root user. https://github.com/nginxinc/docker-nginx/blob/25a3fc7343c6916fce1fba32caa1e8de8409d79f/stable/alpine/Dockerfile#L52

This would simplify the handling of nginx.conf quite a bit. Because the nginx user is not present in the openresty container the nginx.conf can't contain a line like user nginx;. For a non container deployment it's recommended to use a non root user. For this reason I run openresty under nginx with the nginx.conf directive of user nginx;. I need to maintain two different nginx.conf file for a container runtime and a non container runtime.

make available on Docker Hub

We should make this available on Docker Hub. Then people can do docker pull openresty/docker-openresty

@agentzh said that he would give @neomantra access to the openresty username on Docker Hub. openresty`. That can happen in private -- this ticket just reminds us to do it :)

Unicode not supported in the self-built pcre

Specifically, this happens when I add the "u" option of a regular expression substitution.

-- test.lua
newstr, n, err = ngx.re.gsub("测 试 用 例", "[ \t]", "", "ju")
ngx.say(newstr)

I use docker image tag 1.11.2.1-xenial.

If the image is based on xenial / trusty, would it be better to install pcre and openssl from apt source, just like the openresty official document suggested?

apt-get install libreadline-dev libncurses5-dev libpcre3-dev \
    libssl-dev perl make build-essential

Common Vulnerabilities and Exposures (CVE) on alpine version

We detect, few vulnerabilities critical and major on the alpine docker image,
take a look at the list below ;)
@agentzh, @bakins, @detailyang, @lordnynex, @membphis, @neomantra, @thibaultcha

List

  • musi 1.1.15
  • gdlib 2.2.3-r1
  • pcre
  • freetype
  • libxslt
  • libgcrypt
  • libpng

CVE

CVE-2016-8670
CVE-2016-6912
CVE-2016-10166
CVE-2016-9317
CVE-2016-10168
CVE-2016-9933
CVE-2016-6911
CVE-2016-6906
CVE-2016-10167
CVE-2016-8859
CVE-2017-7245
CVE-2017-7246
CVE-2017-7186
CVE-2017-7244
CVE-2016-10244
CVE-2012-2871
CVE-2016-6313
CVE-2016-10087

should this image do more than build OpenResty

Right now this image just builds OpenResty. People can build on top of this to make more complex deployments and simply use this as a their Dockerfile FROM command. Since OpenResty is so flexible, perhaps this is all it should do.

The nginx docker image includes a default nginx.conf file for serving static content and exposes ports 80 and 443 (which can be remapped at run-time).

We have to be careful of being too tailored to the nginx case because this image can also be used for running resty.

Perhaps we just document the different ways to use it in the README. nginx does that.

luarocks install lua-cjson broke in 1.11.2.3

Hi all,
My Docker build breaks since a few days ago on the luarocks install lua-cjson step. Here's my Dockerfile:

FROM openresty/openresty:trusty

EXPOSE 80

# ... credential passing ... #

RUN mkdir /var/log/nginx

RUN sudo apt-get install -y python

RUN /usr/local/openresty/luajit/bin/luarocks install lua-resty-http
RUN /usr/local/openresty/luajit/bin/luarocks install lua-cjson
...

Here's the build output:

Step 1 : FROM openresty/openresty:trusty
trusty: Pulling from openresty/openresty
8f229c550c2e: Pulling fs layer
8e1fb71e8df6: Pulling fs layer
f75a34586856: Pulling fs layer
8744e322b832: Pulling fs layer
d5165bfce78f: Pulling fs layer
5a2803531d69: Pulling fs layer
8f229c550c2e: Waiting
8e1fb71e8df6: Waiting
f75a34586856: Waiting
8744e322b832: Waiting
d5165bfce78f: Waiting
5a2803531d69: Waiting
8e1fb71e8df6: Verifying Checksum
8e1fb71e8df6: Download complete
f75a34586856: Verifying Checksum
f75a34586856: Download complete
8744e322b832: Verifying Checksum
8744e322b832: Download complete
d5165bfce78f: Verifying Checksum
d5165bfce78f: Download complete
8f229c550c2e: Verifying Checksum
8f229c550c2e: Download complete
5a2803531d69: Verifying Checksum
5a2803531d69: Download complete
8f229c550c2e: Pull complete
8f229c550c2e: Pull complete
8e1fb71e8df6: Pull complete
8e1fb71e8df6: Pull complete
f75a34586856: Pull complete
f75a34586856: Pull complete
8744e322b832: Pull complete
8744e322b832: Pull complete
d5165bfce78f: Pull complete
d5165bfce78f: Pull complete
5a2803531d69: Pull complete
5a2803531d69: Pull complete
Digest: sha256:1b0df410ce4e53b0e516a3b63b3707c9fde1ce86f803e12520495dc121eb0c56
Status: Downloaded newer image for openresty/openresty:trusty
 ---> ad2172685db9
Step 2 : EXPOSE 80
 ---> Running in be2a5aff8132
 ---> 12863bfbb40c
# ... things happening ... #
Step 5 : RUN mkdir /var/log/nginx
 ---> Running in ce443aa719ca
 ---> 4a3553bb1159
Step 6 : RUN sudo apt-get install -y python
 ---> Running in d854312e6d8b
Reading package lists...
Building dependency tree...
Reading state information...
The following extra packages will be installed:
  libpython-stdlib libpython2.7-minimal libpython2.7-stdlib python-minimal
  python2.7 python2.7-minimal
Suggested packages:
  python-doc python-tk python2.7-doc binfmt-support
The following NEW packages will be installed:
  libpython-stdlib libpython2.7-minimal libpython2.7-stdlib python
  python-minimal python2.7 python2.7-minimal
0 upgraded, 7 newly installed, 0 to remove and 0 not upgraded.
Need to get 3731 kB of archives.
After this operation, 16.0 MB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu/ trusty-updates/main libpython2.7-minimal amd64 2.7.6-8ubuntu0.3 [307 kB]
Get:2 http://archive.ubuntu.com/ubuntu/ trusty-updates/main python2.7-minimal amd64 2.7.6-8ubuntu0.3 [1187 kB]
Get:3 http://archive.ubuntu.com/ubuntu/ trusty-updates/main libpython2.7-stdlib amd64 2.7.6-8ubuntu0.3 [1873 kB]
Get:4 http://archive.ubuntu.com/ubuntu/ trusty/main libpython-stdlib amd64 2.7.5-5ubuntu3 [7012 B]
Get:5 http://archive.ubuntu.com/ubuntu/ trusty-updates/main python2.7 amd64 2.7.6-8ubuntu0.3 [197 kB]
Get:6 http://archive.ubuntu.com/ubuntu/ trusty/main python-minimal amd64 2.7.5-5ubuntu3 [27.5 kB]
Get:7 http://archive.ubuntu.com/ubuntu/ trusty/main python amd64 2.7.5-5ubuntu3 [134 kB]
debconf: unable to initialize frontend: Dialog
debconf: (Dialog frontend will not work on a dumb terminal, an emacs shell buffer, or without a controlling terminal.)
debconf: falling back to frontend: Readline
debconf: unable to initialize frontend: Readline
debconf: (This frontend requires a controlling tty.)
debconf: falling back to frontend: Teletype
dpkg-preconfigure: unable to re-open stdin: 
Fetched 3731 kB in 2s (1848 kB/s)
Selecting previously unselected package libpython2.7-minimal:amd64.
(Reading database ... 17182 files and directories currently installed.)
Preparing to unpack .../libpython2.7-minimal_2.7.6-8ubuntu0.3_amd64.deb ...
Unpacking libpython2.7-minimal:amd64 (2.7.6-8ubuntu0.3) ...
Selecting previously unselected package python2.7-minimal.
Preparing to unpack .../python2.7-minimal_2.7.6-8ubuntu0.3_amd64.deb ...
Unpacking python2.7-minimal (2.7.6-8ubuntu0.3) ...
Selecting previously unselected package libpython2.7-stdlib:amd64.
Preparing to unpack .../libpython2.7-stdlib_2.7.6-8ubuntu0.3_amd64.deb ...
Unpacking libpython2.7-stdlib:amd64 (2.7.6-8ubuntu0.3) ...
Selecting previously unselected package libpython-stdlib:amd64.
Preparing to unpack .../libpython-stdlib_2.7.5-5ubuntu3_amd64.deb ...
Unpacking libpython-stdlib:amd64 (2.7.5-5ubuntu3) ...
Selecting previously unselected package python2.7.
Preparing to unpack .../python2.7_2.7.6-8ubuntu0.3_amd64.deb ...
Unpacking python2.7 (2.7.6-8ubuntu0.3) ...
Selecting previously unselected package python-minimal.
Preparing to unpack .../python-minimal_2.7.5-5ubuntu3_amd64.deb ...
Unpacking python-minimal (2.7.5-5ubuntu3) ...
Selecting previously unselected package python.
Preparing to unpack .../python_2.7.5-5ubuntu3_amd64.deb ...
Unpacking python (2.7.5-5ubuntu3) ...
Processing triggers for mime-support (3.54ubuntu1.1) ...
Setting up libpython2.7-minimal:amd64 (2.7.6-8ubuntu0.3) ...
Setting up python2.7-minimal (2.7.6-8ubuntu0.3) ...
Linking and byte-compiling packages for runtime python2.7...
Setting up libpython2.7-stdlib:amd64 (2.7.6-8ubuntu0.3) ...
Setting up libpython-stdlib:amd64 (2.7.5-5ubuntu3) ...
Setting up python2.7 (2.7.6-8ubuntu0.3) ...
Setting up python-minimal (2.7.5-5ubuntu3) ...
Setting up python (2.7.5-5ubuntu3) ...
 ---> fc986cb4c93a
Step 7 : RUN /usr/local/openresty/luajit/bin/luarocks install lua-resty-http
 ---> Running in a1034728ae62
Installing https://luarocks.org/lua-resty-http-0.10-0.src.rock...
Using https://luarocks.org/lua-resty-http-0.10-0.src.rock... switching to 'build' mode
Updating manifest for /usr/local/openresty/luajit/lib/luarocks/rocks
No existing manifest. Attempting to rebuild...
lua-resty-http 0.10-0 is now built and installed in /usr/local/openresty/luajit (license: 2-clause BSD)

 ---> 2e1c5c0b8712
Step 8 : RUN /usr/local/openresty/luajit/bin/luarocks install lua-cjson
 ---> Running in cafdec7414d3
Archive:  lua-cjson-2.1.0.zip
   creating: lua-cjson-2.1.0/
  inflating: lua-cjson-2.1.0/runtests.sh  
  inflating: lua-cjson-2.1.0/fpconv.c  
  inflating: lua-cjson-2.1.0/lua-cjson.spec  
  inflating: lua-cjson-2.1.0/rfc4627.txt  
  inflating: lua-cjson-2.1.0/dtoa.c  
  inflating: lua-cjson-2.1.0/lua-cjson-2.1.0-1.rockspec  
  inflating: lua-cjson-2.1.0/manual.txt  
  inflating: lua-cjson-2.1.0/performance.html  
  inflating: lua-cjson-2.1.0/CMakeLists.txt  
  inflating: lua-cjson-2.1.0/fpconv.h  
  inflating: lua-cjson-2.1.0/strbuf.h  
  inflating: lua-cjson-2.1.0/strbuf.c  
  inflating: lua-cjson-2.1.0/NEWS    
  inflating: lua-cjson-2.1.0/manual.html  
  inflating: lua-cjson-2.1.0/lua_cjson.c  
  inflating: lua-cjson-2.1.0/LICENSE  
  inflating: lua-cjson-2.1.0/dtoa_config.h  
   creating: lua-cjson-2.1.0/tests/
  inflating: lua-cjson-2.1.0/tests/bench.lua  
  inflating: lua-cjson-2.1.0/tests/numbers.json  
  inflating: lua-cjson-2.1.0/tests/example3.json  
  inflating: lua-cjson-2.1.0/tests/octets-escaped.dat  
 extracting: lua-cjson-2.1.0/tests/types.json  
  inflating: lua-cjson-2.1.0/tests/genutf8.pl  
  inflating: lua-cjson-2.1.0/tests/rfc-example1.json  
  inflating: lua-cjson-2.1.0/tests/example4.json  
  inflating: lua-cjson-2.1.0/tests/example2.json  
  inflating: lua-cjson-2.1.0/tests/README  
  inflating: lua-cjson-2.1.0/tests/rfc-example2.json  
  inflating: lua-cjson-2.1.0/tests/test.lua  
  inflating: lua-cjson-2.1.0/tests/example5.json  
  inflating: lua-cjson-2.1.0/tests/example1.json  
  inflating: lua-cjson-2.1.0/g_fmt.c  
  inflating: lua-cjson-2.1.0/Makefile  
   creating: lua-cjson-2.1.0/lua/
  inflating: lua-cjson-2.1.0/lua/lua2json.lua  
  inflating: lua-cjson-2.1.0/lua/json2lua.lua  
   creating: lua-cjson-2.1.0/lua/cjson/
  inflating: lua-cjson-2.1.0/lua/cjson/util.lua  
  inflating: lua-cjson-2.1.0/performance.txt  
  inflating: lua-cjson-2.1.0/THANKS  
lua_cjson.c:1298:13: error: static declaration of 'luaL_setfuncs' follows non-static declaration
 static void luaL_setfuncs (lua_State *l, const luaL_Reg *reg, int nup)
             ^
In file included from lua_cjson.c:44:0:
/usr/local/openresty/luajit/include/luajit-2.1/lauxlib.h:88:18: note: previous declaration of 'luaL_setfuncs' was here
 LUALIB_API void (luaL_setfuncs) (lua_State *L, const luaL_Reg *l, int nup);
                  ^

Error: Build error: Failed compiling object lua_cjson.o
Installing https://luarocks.org/lua-cjson-2.1.0-1.src.rock...
Using https://luarocks.org/lua-cjson-2.1.0-1.src.rock... switching to 'build' mode
gcc -O2 -fPIC -I/usr/local/openresty/luajit/include/luajit-2.1 -c lua_cjson.c -o lua_cjson.o
The command '/bin/sh -c /usr/local/openresty/luajit/bin/luarocks install lua-cjson' returned a non-zero code: 1

Default modules parity with OpenResty distro

The Dockerfile has a default set of bundled nginx modules that is a subset of what the upstream OpenResty distribution includes. The opinion has involved that these sets should be in parity.

So, examine what modules are in OpenResty upstream and make sure they are included in the Dockerfiles.

Alpine image is broken

From a comment from vus520 on Docker Hub:

1.9.7.4-alpine, (alpine/Dockerfile)

Error loading shared library libgcc_s.so.1: No such file or directory (needed by /usr/local/openresty/luajit/lib/libluajit-5.1.so.2)
Error relocating /usr/local/openresty/luajit/lib/libluajit-5.1.so.2: _Unwind_SetIP: symbol not found
Error relocating /usr/local/openresty/luajit/lib/libluajit-5.1.so.2: _Unwind_GetCFA: symbol not found
Error relocating /usr/local/openresty/luajit/lib/libluajit-5.1.so.2: _Unwind_DeleteException: symbol not found
Error relocating /usr/local/openresty/luajit/lib/libluajit-5.1.so.2: _Unwind_SetGR: symbol not found
Error relocating /usr/local/openresty/luajit/lib/libluajit-5.1.so.2: _Unwind_RaiseException: symbol not found

Although he didn't leave much other info, I guess LuaJIT has a dependency on gcc's runtime library. So the cleanup phase of the docker image build process needs to be adjusted.

debian build images...

Greetings!

Let me direct your attention to debian builds I did based on your xenial Dockerfile. Both jessie and wheezy build successfully.

On wheezy I had to only reference libgd2-noxpm-dev instead of libgd-dev, and the build succeeded.

You can see it here: https://github.com/krull/docker-openresty

I have left attribution as-is. I just wanted to have an all debian stack versus having to contaminate my stack with some other deb flavor other than debian itself 👍

Feel free to include them here for others to use.

Hope this helps!

Usage of luarocks in docker container

Hello,
I'm using your xenial image like a parent for my image and install some packages with "/usr/local/openesty/luajit/bin/luarocks install " none of them can't be detected by Lua scripts.
FROM openresty/openresty:latest-xenial

WORKDIR /opt

RUN /usr/local/openresty/luajit/bin/luarocks install lbase64 \
&& /usr/local/openresty/luajit/bin/luarocks install lzlib 0.4.work3-1 \
&& /usr/local/openresty/luajit/bin/luarocks install xml \
&& /usr/local/openresty/luajit/bin/luarocks install lua-resty-http \
&& mkdir /opt/ssl && mkdir /opt/proxy

EXPOSE 5080

should this image contains lua-resty-http?

Hi all,

Our team use openresty with lua-resty-http in the production, and we want to migrate some nginx server from vm to container via this image, but some of useful libraries could not found in it.

Is there any roadmap to support 3rd library in this image?

Thx

automated build issues

Our images now ADD files from this repo into the image (initially to complete #40).

However this broke the automated builds because Docker Hub changes the working directory of its build to where the Dockerfile lives. Thus docker build wasn't seeing the necessary files. [One solution was to copy the relevant files to each sub-directory, but that is long-term hard to manage.]

I have moved the image build to Google Cloud Builder (https://cloud.google.com/container-builder/) and works well. Images from 20171208 and later are currently built with it. They are then pushed by the build system to Docker Hub.

I have not committed the build tooling, but will soon. Some remaining issues:

  • it is currently hosted by a GCP organization other than an "OpenResty one
  • get other OpenResty admins access to it
  • need to get "the public" (you!) access to the build logs for transparency
  • need to sort out some secrets issues

If somebody has a suggestion for another public image building platform than Docker Hub, please let me know. Google Cloud Builder is "almost there" in what it provides; I'll try to work out the remaining issues (notably transparency), but it may be intractable there.

No way to make openresty run as PID1

When running the image with the command given in the readme:
docker run [options] openresty/openresty:latest-trusty /usr/local/openresty/nginx/sbin/nginx
The image immediately exits.

If I start the container in an interactive bash shell and then call nginx my pstree looks as follows:

root@f4dbc6cba0ca:/# pstree -npcUa
bash,1
  ├─nginx,73
  │   └─nginx,74                
  └─pstree,81 -npcUa

This is to be expected, one master and one worker process. What doesn't make sense is why this process can't be run as PID1

I have tested this on docker 1.11 and 1.12 beta and both have the same behavior

Document adding extra modules

It would be nice if there was some documentation on the recommend way to add extra modules(ie HeadersMore).

Is there a way to do it just using FROM openresty/openrest:tag or are we supposed to manually edit a dockerfile to add options under ./config?

flesh out default configure options

Currently the configure options are:

  • --with-ipv6
  • --with-pcre-jit

As the defaults configure options will be used by everyone who pulls the image from Docker Hub, we should include the most common options, perhaps including ones that have security best practices.

help needed

Could someone please post a simple hello world?

Make envsubst available in the images

The official nginx image includes the envsubst command in the final image, and even refers to it in the documentation as a workaround for using environment variables in nginx configuration.

Is there a reason why it's not included in the Openresty images (admittedly I've only checked jessie, which is missing the gettext-base package) and/or is there an alternative for using environment variables for Openresty configuration?

Add `1.11.2.4-stretch` tag

Hi

I see that you've recently added stretch support, congratulations and thank you for your hard work!

However, most docker images based off of the openresty image should be tagged more specifically for compatibility reasons.

I see that openresty doesn't use semver which already makes it difficult to understand which images are non-breaking. All the more reason to use a specific tag.

tag images with package version

As noted in #45, we should add tags for the specific DEB or RPM package version that is used. But that is fancier that the build system we have now, so we'd need a helper script (maybe using Docker Hub's HTTP triggers)

For example:

  • centos-rpm
  • 1.11.2.4-centos-rpm
  • 1.11.2.4-1.el7.centos-rpm (it is this one we don't do now)

rocks installed by luarocks could not be found

I'm trying to build

FROM openresty/openresty:xenial
MAINTAINER Leandro Moreira <[email protected]>

RUN apt-get -y update && apt-get install -y git
RUN /usr/local/openresty/luajit/bin/luarocks install ledge

ENTRYPOINT ["/usr/local/openresty/bin/openresty", "-g", "daemon off;"]

And then when I try to use the ledge library it shows that it couldn't find it at the available paths, should I set LUA_PATH by hand?

Removing intermediate container e71dc5ffb472
Step 4/5 : RUN /usr/local/openresty/luajit/bin/luarocks install ledge
 ---> Running in 485daee4b982

Missing dependencies for ledge:
lua-resty-cookie >= 0.1
lua-resty-redis-connector >= 0.03
lua-resty-http >= 0.10
lua-resty-qless >= 0.08
lua-ffi-zlib >= 0.1

Installing https://luarocks.org/ledge-1.28-1.src.rock...
Using https://luarocks.org/ledge-1.28-1.src.rock... switching to 'build' mode
Using https://luarocks.org/lua-resty-cookie-0.1.0-1.rockspec... switching to 'build' mode
Cloning into 'lua-resty-cookie'...
Note: checking out 'bbd0df6bca3cac22138225d6a36243ce767d5881'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by performing another checkout.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -b with the checkout command again. Example:

  git checkout -b <new-branch-name>

No existing manifest. Attempting to rebuild...
Updating manifest for /usr/local/openresty/luajit/lib/luarocks/rocks
lua-resty-cookie 0.1.0-1 is now built and installed in /usr/local/openresty/luajit (license: BSD)

Using https://luarocks.org/lua-resty-redis-connector-0.06-0.src.rock... switching to 'build' mode
Updating manifest for /usr/local/openresty/luajit/lib/luarocks/rocks
lua-resty-redis-connector 0.06-0 is now built and installed in /usr/local/openresty/luajit (license: 2-clause BSD)

Using https://luarocks.org/lua-resty-http-0.11-0.src.rock... switching to 'build' mode
Updating manifest for /usr/local/openresty/luajit/lib/luarocks/rocks
lua-resty-http 0.11-0 is now built and installed in /usr/local/openresty/luajit (license: 2-clause BSD)

Using https://luarocks.org/lua-resty-qless-0.11-0.src.rock... switching to 'build' mode
Updating manifest for /usr/local/openresty/luajit/lib/luarocks/rocks
lua-resty-qless 0.11-0 is now built and installed in /usr/local/openresty/luajit (license: 2-clause BSD)

Using https://luarocks.org/lua-ffi-zlib-0.3-0.src.rock... switching to 'build' mode
Updating manifest for /usr/local/openresty/luajit/lib/luarocks/rocks
lua-ffi-zlib 0.3-0 is now built and installed in /usr/local/openresty/luajit

Updating manifest for /usr/local/openresty/luajit/lib/luarocks/rocks
ledge 1.28-1 is now built and installed in /usr/local/openresty/luajit (license: 2-clause BSD)

 ---> 6fcb5d1a7dcd
Removing intermediate container 485daee4b982
Step 5/5 : ENTRYPOINT /usr/local/openresty/bin/openresty -g daemon off;
 ---> Running in 42546db846dd
 ---> 21c10cbadb2c
Removing intermediate container 42546db846dd
Successfully built 21c10cbadb2c
Successfully tagged ledgedocker_nginx:latest
Creating network "ledgedocker_default" with the default driver
Creating ledgedocker_redis_1 ...
Creating ledgedocker_redis_1 ... done
2017/08/29 01:27:58 [error] 1#1: init_by_lua error: init_by_lua:2: module 'ledge' not found:
	no field package.preload['ledge']
	no file '/usr/local/openresty/site/lualib/ledge.ljbc'
	no file '/usr/local/openresty/site/lualib/ledge/init.ljbc'
	no file '/usr/local/openresty/lualib/ledge.ljbc'
	no file '/usr/local/openresty/lualib/ledge/init.ljbc'
	no file '/usr/local/openresty/site/lualib/ledge.lua'
	no file '/usr/local/openresty/site/lualib/ledge/init.lua'
	no file '/usr/local/openresty/lualib/ledge.lua'
	no file '/usr/local/openresty/lualib/ledge/init.lua'
	no file './ledge.lua'
	no file '/usr/local/openresty/luajit/share/luajit-2.1.0-beta3/ledge.lua'
	no file '/usr/local/share/lua/5.1/ledge.lua'
	no file '/usr/local/share/lua/5.1/ledge/init.lua'
	no file '/usr/local/openresty/luajit/share/lua/5.1/ledge.lua'
	no file '/usr/local/openresty/luajit/share/lua/5.1/ledge/init.lua'
	no file '/usr/local/openresty/site/lualib/ledge.so'
	no file '/usr/local/openresty/lualib/ledge.so'
	no file './ledge.so'
	no file '/usr/local/lib/lua/5.1/ledge.so'
	no file '/usr/local/openresty/luajit/lib/lua/5.1/ledge.so'
	no file '/usr/local/lib/lua/5.1/loadall.so'
stack traceback:
	[C]: in function 'require'
	init_by_lua:2: in main chunk
nginx: [error] init_by_lua error: init_by_lua:2: module 'ledge' not found:
	no field package.preload['ledge']
	no file '/usr/local/openresty/site/lualib/ledge.ljbc'
	no file '/usr/local/openresty/site/lualib/ledge/init.ljbc'
	no file '/usr/local/openresty/lualib/ledge.ljbc'
	no file '/usr/local/openresty/lualib/ledge/init.ljbc'
	no file '/usr/local/openresty/site/lualib/ledge.lua'
	no file '/usr/local/openresty/site/lualib/ledge/init.lua'
	no file '/usr/local/openresty/lualib/ledge.lua'
	no file '/usr/local/openresty/lualib/ledge/init.lua'
	no file './ledge.lua'
	no file '/usr/local/openresty/luajit/share/luajit-2.1.0-beta3/ledge.lua'
	no file '/usr/local/share/lua/5.1/ledge.lua'
	no file '/usr/local/share/lua/5.1/ledge/init.lua'
	no file '/usr/local/openresty/luajit/share/lua/5.1/ledge.lua'
	no file '/usr/local/openresty/luajit/share/lua/5.1/ledge/init.lua'
	no file '/usr/local/openresty/site/lualib/ledge.so'
	no file '/usr/local/openresty/lualib/ledge.so'
	no file './ledge.so'
	no file '/usr/local/lib/lua/5.1/ledge.so'
	no file '/usr/local/openresty/luajit/lib/lua/5.1/ledge.so'
	no file '/usr/local/lib/lua/5.1/loadall.so'
stack traceback:
	[C]: in function 'require'
	init_by_lua:2: in main chunk
make: *** [start] Error 1

When I ran the show command on the rock:

ledge 1.28-1 - An ESI capable HTTP cache module for OpenResty

License: 	2-clause BSD
Homepage: 	https://github.com/pintsized/ledge
Installed in: 	/usr/local/openresty/luajit

Modules:
	ledge.esi (/usr/local/openresty/luajit/share/lua/5.1/ledge/esi.lua)
	ledge.header_util (/usr/local/openresty/luajit/share/lua/5.1/ledge/header_util.lua)
	ledge.jobs.collect_entity (/usr/local/openresty/luajit/share/lua/5.1/ledge/jobs/collect_entity.lua)
	ledge.jobs.purge (/usr/local/openresty/luajit/share/lua/5.1/ledge/jobs/purge.lua)
	ledge.jobs.revalidate (/usr/local/openresty/luajit/share/lua/5.1/ledge/jobs/revalidate.lua)
	ledge.ledge (/usr/local/openresty/luajit/share/lua/5.1/ledge/ledge.lua)
	ledge.response (/usr/local/openresty/luajit/share/lua/5.1/ledge/response.lua)

Depends on:
	lua-resty-cookie
	lua-resty-redis-connector
	lua-ffi-zlib
	lua-resty-qless
	lua-resty-http

relative paths in a lua block don't seem to work in a docker container

I'm using a short nginx.conf with an init_by_lua_block that opens a file and reads it whole like this:
fh = io.open("./app/allowed_users.json", "r")
however, while the path definitely exists relative to the nginx.conf opening the file always fails. ( fh will be null )

The file itself has 644 permission and is owned by root/root.

However, if I do the same thing on a local openresty on the host (no docker), the exact same nginx.conf and path-layout works fine and the file (w/ relative path) is read successfully.

Only if I change the path to an absolute one does it work in the docker container, but I'm trying to a void this.

Any pointers would be greatly appreciated.

Add image to official repository

This may a slightly more involved process, but have you considered contributing this image to the docker official images repository?

I was personally surprised at having to use openresty/openresty and I'm sure a lot of people are too.

The official builds are tracked at docker-library/official-images and the README file has instructions on how to propose adding the image.

include init script

@agentzh said there should be an init script. Is the idea to control the start/stop of the container? Or of the nginx service inside it. In other words, are you expecting this init script to be run inside or outside the container by the machine host?

expire, ttl not are nill, version is the neweast

when I call expire/ttl on shared memory, it says 'attempt to call method 'ttl' (a nil value)', but I saw the arguments in the compilation params, there is nginx version: openresty/1.13.6.1 built by gcc 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.5) built with OpenSSL 1.0.2k 26 Jan 2017 ... --add-module=../ngx_lua-0.10.11 ....
the instruction from Dockerfile: FROM openresty/openresty:xenial

sorce code:
`local memory = ngx.shared.waf
local restraint = "127.0.0.1"

memory:incr(restraint, 1, 0) -- incr request times: ip, step, initial value
memory:ttl(restraint)
memory:expire(restraint, expire_time)
`

Use OpenResty RPM packages for Centos build

There are now production RPMs for OpenResty. Use them for a Docker image.

I'm thinking of having a specific tag for these, e.g. centos-rpm, as the existing centos tag provides more customizability.

We should also make it easy to use the other flavors of RPMs, e.g. -debug, -valgrind, etc.

OPM on alpine documentation missing curl instructions

The README sais that to get opm working in the alpine image, you need to "apk add perl".
The alpine image doesn't contain curl so opm just gives a server error back

opm search without curl added:

 ~ docker run -ti --rm openresty/openresty:alpine sh -c 'apk add --no-cache perl && opm search lock'
fetch http://dl-cdn.alpinelinux.org/alpine/v3.6/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.6/community/x86_64/APKINDEX.tar.gz
(1/1) Installing perl (5.24.1-r2)
Executing busybox-1.26.2-r5.trigger
OK: 46 MiB in 25 packages
ERROR: failed to search: server error.

With curl added

 ~ docker run -ti --rm openresty/openresty:alpine sh -c 'apk add --no-cache perl curl && opm search lock'
fetch http://dl-cdn.alpinelinux.org/alpine/v3.6/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.6/community/x86_64/APKINDEX.tar.gz
(1/5) Installing ca-certificates (20161130-r2)
(2/5) Installing libssh2 (1.8.0-r1)
(3/5) Installing libcurl (7.55.0-r0)
(4/5) Installing curl (7.55.0-r0)
(5/5) Installing perl (5.24.1-r2)
Executing busybox-1.26.2-r5.trigger
Executing ca-certificates-20161130-r2.trigger
OK: 47 MiB in 29 packages
openresty/lua-resty-lock                          Simple shm-based nonblocking lock API

Illegal instruction (core dumped)

When I run docker run -i -t --rm openresty/openresty:alpine on a virtual machine, it will finish immediately with a 132 return value. This has never happened when I run it on my laptop. So I run docker run -i -t --rm --entrypoint=/bin/sh openresty/openresty:alpine to get a shell and see what happened. I get this:

$ docker run -i -t --rm --entrypoint=/bin/sh openresty/openresty:alpine 
/ # /usr/local/openresty/bin/openresty 
Illegal instruction (core dumped)
/ # /usr/local/openresty/luajit/bin/luajit
Illegal instruction (core dumped)

Because the nginx installed by apk add runs well, I think it maybe caused by luajit. As you can see luajit do failed.

I have tried to build the image from Dockerfile which will compile the source on that virtual machine, but it also failed. I have also tried centos tag, still failed.
Howerver, the openresty/openresty:latest image runs well. It is an old version with alpine:3.4, and not in the tags list of docker hub now.

I am not familiar with the 'illegal instruction' error. I only know that it is related to cpus. So, here is some cpu information of the virtual machine:

$ uname -a
Linux xxx.xxx.xxx.com 3.10.0-514.26.2.el7.x86_64 #1 SMP Tue Jul 4 15:04:05 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
$ cat /proc/cpuinfo 
processor	: 0
vendor_id	: GenuineIntel
cpu family	: 6
model		: 23
model name	: Intel(R) Xeon(R) CPU           X5450  @ 3.00GHz
stepping	: 6
microcode	: 0x60f
cpu MHz		: 2991.330
cache size	: 6144 KB
physical id	: 0
siblings	: 1
core id		: 0
cpu cores	: 1
apicid		: 0
initial apicid	: 0
fpu		: yes
fpu_exception	: yes
cpuid level	: 10
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts mmx fxsr sse sse2 ss syscall nx lm constant_tsc arch_perfmon pebs bts nopl tsc_reliable nonstop_tsc aperfmperf pni ssse3 cx16 sse4_1 tsc_deadline_timer hypervisor lahf_lm dtherm tsc_adjust
bogomips	: 5985.00
clflush size	: 64
cache_alignment	: 64
address sizes	: 43 bits physical, 48 bits virtual
power management:

processor	: 1
vendor_id	: GenuineIntel
cpu family	: 6
model		: 23
model name	: Intel(R) Xeon(R) CPU           X5450  @ 3.00GHz
stepping	: 6
microcode	: 0x60f
cpu MHz		: 2991.330
cache size	: 6144 KB
physical id	: 2
siblings	: 1
core id		: 0
cpu cores	: 1
apicid		: 2
initial apicid	: 2
fpu		: yes
fpu_exception	: yes
cpuid level	: 10
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts mmx fxsr sse sse2 ss syscall nx lm constant_tsc arch_perfmon pebs bts nopl tsc_reliable nonstop_tsc aperfmperf pni ssse3 cx16 sse4_1 tsc_deadline_timer hypervisor lahf_lm dtherm tsc_adjust
bogomips	: 5985.00
clflush size	: 64
cache_alignment	: 64
address sizes	: 43 bits physical, 48 bits virtual
power management:

Could any body help me to solve this problem? Should I change the configuration of the VM, or there are some other ways?

Luarocks Missing in Stretch

Here's what I get when my build tries to install the uuid rock

Step 2/6 : RUN /usr/local/openresty/luajit/bin/luarocks install uuid
 ---> Running in 24a96b5a9f67
/bin/sh: 1: /usr/local/openresty/luajit/bin/luarocks: not found

I don't think Luarocks is included in stretch, even though the documentation says it's only unavailable in alpine:

LuaRocks is included in the alpine-fat, centos, centos-rpm, trusty, and xenial variants. It is excluded from alpine because it generally requires a build system and we want to keep that variant lean.

1.13.6.1 docker images

Hi

Wondering when the latest release (1.13.6.1) pre-built docker images will be put on docker hub?

Thanks!

Problem with default conf

Is the COPY command for nginx.conf working for the docker?

If I docker exec into the container the file /usr/local/openresty/nginx/conf/nginx.conf it's
the default config.

Not sure what's the working directory for the Docker build but the nginx.conf is in ../nginx.conf. Should the COPY command be COPY ../nginx.conf /usr/local/openresty/nginx/conf/nginx.conf?

What else could cause my conf to be the default and not conatining the include state include /etc/nginx/conf.d/*.conf;

docker-openresty/alpine/Dockerfile

Line 96 in 99acf4a

COPY nginx.conf /usr/local/openresty/nginx/conf/nginx.conf

Reorganize Docker tags

Over recent time, OpenResty has introduced upstream packages. First the RPMs. Forthcoming are the DEBs. Given this and other discussions, it seems that the following image tags conventions are worth maintaining:

  • centos - based on upstream RPM, replaces centos-rpm
    • xenial - based on upstream DEB
    • alpine - existing alpine Dockerfile
    • alpine-full - alpine package with additional packages such as LuaRocks support

If upstream ever makes an Alpine package, we can use that. It probably is handy to have at least one package that is built within Docker and can be customized with build-args.

openresty not using mime.types

nginx docker images work correctly...files loaded from fs are mapped via conf/mime.types. however, with openresty i have to add include /usr/local/openresty/nginx/conf/mime.types; to get auto type mapping.

Use CMD instead of ENTRYPOINT

In docker ENTRYPOINT is making it harder to debug by overwriting the entrypoint,
chaining containers together, makes it easier to inherit from this container in other Lua containers.
It's easier to run for example:

docker run -it openresty/openresty sh

resty util requires perl

We were discussing thinning out the Alpine module in #5.

The resty utility script is written in perl. The perl dependency is 40M, almost doubling the size of the image.

Do we exclude perl from the alpine images and require another image on top of it to get resty working?

process exit with code 132

When I try to start a docker container using the command:
docker run -it -p 8888:80 openresty/openresty:alpine
it stops with exit code 132.

dmesg says:

[ 7037.973584] docker0: port 1(vethd17cbc4) entered blocking state
[ 7037.973587] docker0: port 1(vethd17cbc4) entered disabled state
[ 7037.974176] device vethd17cbc4 entered promiscuous mode
[ 7037.977153] IPv6: ADDRCONF(NETDEV_UP): vethd17cbc4: link is not ready
[ 7038.455470] eth0: renamed from veth377baff
[ 7038.470311] IPv6: ADDRCONF(NETDEV_CHANGE): vethd17cbc4: link becomes ready
[ 7038.470384] docker0: port 1(vethd17cbc4) entered blocking state
[ 7038.470386] docker0: port 1(vethd17cbc4) entered forwarding state
[ 7038.848814] traps: openresty[11535] trap invalid opcode ip:7ffa43f3cc08 sp:7ffd03b36190 error:0
[ 7038.848829]  in libluajit-5.1.so.2.1.0[7ffa43f35000+276000]
[ 7039.174984] docker0: port 1(vethd17cbc4) entered disabled state
[ 7039.175110] veth377baff: renamed from eth0
[ 7039.297612] docker0: port 1(vethd17cbc4) entered disabled state
[ 7039.304632] device vethd17cbc4 left promiscuous mode
[ 7039.304647] docker0: port 1(vethd17cbc4) entered disabled state

docker info

Containers: 12
 Running: 0
 Paused: 0
 Stopped: 12
Images: 7
Server Version: 17.05.0-ce
Storage Driver: aufs
 Root Dir: /var/lib/docker/aufs
 Backing Filesystem: extfs
 Dirs: 71
 Dirperm1 Supported: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins: 
 Volume: local
 Network: bridge host macvlan null overlay
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 9048e5e50717ea4497b757314bad98ea3763c145
runc version: 9c2d8d184e5da67c95d601382adf14862e4f2228
init version: 949e6fa
Security Options:
 apparmor
 seccomp
  Profile: default
Kernel Version: 4.10.0-20-generic
Operating System: Ubuntu 17.04
OSType: linux
Architecture: x86_64
CPUs: 2
Total Memory: 3.856GiB
Name: armit-pc
ID: ASVC:P2BR:M7SV:3KOM:66KK:IIU5:5K3L:RYGM:RJAF:FTSD:D2W2:DNMN
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Experimental: false
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false
WARNING: No swap limit support

docker images openresty/openresty:alpine

REPOSITORY            TAG                 IMAGE ID            CREATED             SIZE
openresty/openresty   alpine              1aa892b461b2        3 weeks ago         44.9MB

Any idea what this could be?

Error during the build when using php:fpm-alpine as the base image

If I replace FROM alpine:latest with FROM php:fpm-alpine in alpine/Dockerfile, I get the following error during the build:

DYNLINK   libluajit.so
/usr/lib/gcc/x86_64-alpine-linux-musl/5.3.0/../../../../x86_64-alpine-linux-musl/bin/ld: lj_err_dyn.o: relocation R_X86_64_TPOFF32 against `static_uex' can not be used when making a shared object; recompile with -fPIC
lj_err_dyn.o: error adding symbols: Bad value
collect2: error: ld returned 1 exit status
Makefile:702: recipe for target 'libluajit.so' failed
make[1]: Leaving directory '/tmp/openresty-1.11.2.2/build/LuaJIT-2.1-20161104/src'
make[1]: *** [libluajit.so] Error 1
make: *** [default] Error 2
Makefile:111: recipe for target 'default' failed
ERROR: failed to run command: make -j1 TARGET_STRIP=@: CCDEBUG=-g XCFLAGS='-DLUAJIT_ENABLE_LUA52COMPAT' CC=cc PREFIX=/usr/local/openresty/luajit

Could you help me figure out how to fix it, please?

P. S. I understand that this issue should not be in this repo, because there is nothing wrong with your Dockerfile, I just wanted to get help from the experts.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.