Run nginx as unprevileged user by rcmadhankumar · Pull Request #3167 · SUSE/BCI-dockerfile-generator

rcmadhankumar · 2025-11-17T09:55:31Z

Made necessary changes to the nginx image so that it can be simply run as non root by passing --user=nginx flag.

github-actions · 2025-11-17T09:56:19Z

Created a staging project on OBS for Tumbleweed: home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3167
Changes pushed to branch Tumbleweed-3167 as commit 912f50c694b55abeaf427b79ede3fb98a835996d
Build succeeded ✅

Build Results

Repository images in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3167 for x86_64: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository images in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3167 for aarch64: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository containerfile in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3167 for x86_64: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3167 for aarch64: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Build succeeded ✅

To run BCI-tests against this PR, use the following command:

OS_VERSION=tumbleweed TARGET=custom BASEURL=registry.opensuse.org/home/pushman/bci/staging/tumbleweed/tumbleweed-3167/ tox -- -n auto

The following images can be pulled from the staging project:

registry.opensuse.org/home/pushman/bci/staging/tumbleweed/tumbleweed-3167/containerfile/opensuse/nginx:latest

github-actions · 2025-11-17T09:56:26Z

Created a staging project on OBS for 7: home:pushman:BCI:Staging:SLE-15-SP7:7-3167
Changes pushed to branch 7-3167 as commit 57d9eeee2aa805b5caff87a84e1b66c4d8959f12
Build succeeded ✅

Build Results

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3167 for x86_64: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3167 for aarch64: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3167 for s390x: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3167 for ppc64le: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3167 for x86_64: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3167 for aarch64: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3167 for s390x: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3167 for ppc64le: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Build succeeded ✅

To run BCI-tests against this PR, use the following command:

OS_VERSION=15.7 TARGET=custom BASEURL=registry.opensuse.org/home/pushman/bci/staging/sle-15-sp7/7-3167/ tox -- -n auto

The following images can be pulled from the staging project:

registry.opensuse.org/home/pushman/bci/staging/sle-15-sp7/7-3167/containerfile/suse/nginx:latest

github-actions · 2025-11-17T09:56:28Z

Created a staging project on OBS for 16.0: home:pushman:BCI:Staging:16.0:16.0-3167
Changes pushed to branch 16.0-3167 as commit 1dc98705a10c378fdb276b0baeabd7109abe09aa
Build succeeded ✅

Build Results

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3167 for x86_64: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3167 for aarch64: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3167 for s390x: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3167 for ppc64le: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3167 for x86_64: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3167 for aarch64: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3167 for s390x: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3167 for ppc64le: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Build succeeded ✅

To run BCI-tests against this PR, use the following command:

OS_VERSION=16.0 TARGET=custom BASEURL=registry.opensuse.org/home/pushman/bci/staging/16.0/16.0-3167/ tox -- -n auto

The following images can be pulled from the staging project:

registry.opensuse.org/home/pushman/bci/staging/16.0/16.0-3167/containerfile/suse/nginx:1.27

dirkmueller · 2025-11-20T08:49:05Z

src/bci_build/package/nginx/docker-entrypoint.sh

+    entrypoint_log "$0: Removed 'user' directive for unprivileged worker."
+
+    # Ensure PID path is set to /tmp/nginx.pid
+    sed -i 's,^#\?\s*pid\s\+.*;$,pid /tmp/nginx.pid;,' /etc/nginx/nginx.conf


why are we setting it to /tmp rather than a safe location like /run/nginx or /run ?

We are starting the nginx container as unprevileged user.
/run directory and /var/run directory is owned by root.

But nothing prevents you from having /run/nginx/nginx.pid , you can create the folder with the nginx user, which it seems you already do with chown -R nginx:nginx /var/run/.

I would also move this to be a default location, not just in case it is a non-root user. Since it would not make any difference if it is owned by nginx anyway.

pid path is set to /var/run/nginx/nginx.pid

dirkmueller · 2025-11-21T10:08:37Z

@rcmadhankumar can you please also include the (adjusted) readme update from #3071 ?

rcmadhankumar · 2025-12-16T12:24:07Z

@rcmadhankumar can you please also include the (adjusted) readme update from #3071 ?

Added relevant readme update.

alexandrevicenzi

Are we seding the user provided file as well (volume mount)? It does not make sense to change is such cases, only if it is the default config we ship, otherwise, we could potentially break the user config.

alexandrevicenzi · 2025-12-16T15:10:36Z

src/bci_build/package/nginx/docker-entrypoint.sh

+    entrypoint_log "$0: Removed 'user' directive for unprivileged worker."
+
+    # Ensure PID path is set to /tmp/nginx.pid
+    sed -i 's,^#\?\s*pid\s\+.*;$,pid /tmp/nginx.pid;,' /etc/nginx/nginx.conf


But nothing prevents you from having /run/nginx/nginx.pid , you can create the folder with the nginx user, which it seems you already do with chown -R nginx:nginx /var/run/.

I would also move this to be a default location, not just in case it is a non-root user. Since it would not make any difference if it is owned by nginx anyway.

src/bci_build/package/appcontainers.py

src/bci_build/package/nginx/README.md.j2

src/bci_build/package/nginx/docker-entrypoint.sh

src/bci_build/package/nginx/README.md.j2

dirkmueller · 2026-02-09T08:07:39Z

src/bci_build/package/appcontainers.py

+                chown -R nginx:nginx /etc/nginx; \
+                chown -R nginx:nginx /var/run/nginx; \
+                install -d -o nginx -g nginx /tmp/client_temp /tmp/proxy_temp /tmp/fastcgi_temp /tmp/uwsgi_temp /tmp/scgi_temp; \
+                chown -R nginx:nginx /tmp; \


well, /tmp must be owned by root, it has the sticky bit set though. why are you changing this here?

Sure, Now changing only the permissions of the subdirectories inside /tmp created in the run time to run the image in root less mode.

dirkmueller · 2026-02-09T08:11:13Z

src/bci_build/package/nginx/docker-entrypoint.sh

+    entrypoint_log "$0: Removed 'user' directive for unprivileged worker."
+
+    sed -i 's/listen \(.*\)80;/listen \18080;/' /etc/nginx/conf.d/default.conf 2>/dev/null || \
+    sed -i 's/listen \(.*\)80;/listen \18080;/' /etc/nginx/nginx.conf 2>/dev/null || true


this could be mounted over though by a user to provide a different configuration file? we should at least check before sed'ing whether there is a change necessary?

True that. Sedding config file now only if it uses port 80 in rootless mode. This prevents if user wants to use different port than 8080 in rootless mode.

dirkmueller · 2026-02-09T08:12:17Z

src/bci_build/package/nginx/README.md.j2

+## Running nginx as a non-root user
+To run the image as a less privileged user using the `nginx` user, do the following:
+```ShellSession
+$ podman run -it --user nginx --rm -p 8080:8080 -v /path/to/html/:/srv/www/htdocs/:Z -v $PWD/nginx.conf:/etc/nginx/nginx.conf:Z {{ image.pretty_reference }}


why exactly do we still need nginx.conf to be mounted over from the host here? where is it coming from?

We don't necessarily mount the config file. Updated the readme.

dirkmueller · 2026-02-09T08:13:25Z

src/bci_build/package/appcontainers.py

+                ln -sf /dev/stderr /var/log/nginx/error.log; \
+                chown -R nginx:nginx /var/cache/nginx; \
+                chown -R nginx:nginx /etc/nginx; \
+                chown -R nginx:nginx /var/run/nginx; \


so we're expecting the uid to be the one of nginx? otherwise these changes wouldn't seem to make sense?

Yes it was. Now modified the code so the rootless user ID can be anything.

dirkmueller · 2026-02-09T08:14:33Z

src/bci_build/package/nginx/docker-entrypoint.sh

+# Ensure PID path is set to /var/run/nginx.pid for both privileged and unprivileged users
+sed -i 's,^#\?\s*pid\s\+.*;$,pid /var/run/nginx/nginx.pid;,' /etc/nginx/nginx.conf
+# modify temp paths for both privileged and unprivileged users
+sed -i "/^http {/a \        proxy_temp_path /tmp/proxy_temp;\n        client_body_temp_path /tmp/client_temp;\n        fastcgi_temp_path /tmp/fastcgi_temp;\n        uwsgi_temp_path /tmp/uwsgi_temp;\n        scgi_temp_path /tmp/scgi_temp;\n" /etc/nginx/nginx.conf


that's a backward incompatible change, isn't it? we cannot do it that way unconditionally.

Yes, Updated the code.

dirkmueller

need to preserve compatibility with previous version of the nginx container

rcmadhankumar · 2026-02-17T11:41:11Z

modified the code by keeping following expectations in mind:

Nginx image should be runnable as a rootless user on the host
podman run -it --rm --user $(id -u) -p 8080:8080 localhost/ngnix:latest
Nginx image should be runnable as a nginx user
podman run -it --rm --user nginx -p 8080:8080 localhost/ngnix:latest
Nginx image should be runnable as any random rootless user id
podman run -it --rm --user 1002 -p 8080:8080 localhost/ngnix:latest
Nginx image should be runnable as any random rootless user id and group id
podman run -it --rm --user 486:499 -p 8080:8080 localhost/ngnix:latest
Nginx image should be runnable as a rootless user without externally providing any configuration file
Nginx image should be runnable as a rootless user which doesn't affect rootful mode so it can be backward compatible

alexandrevicenzi · 2026-02-18T09:29:07Z

src/bci_build/package/nginx/docker-entrypoint.sh

    fi
 fi

+CURRENT_UID=$(id -u)


This code is going to vanish as soon as update-files.sh is executed. docker-entrypoint.sh is taken from upstream. I completely missed that before.

This piece of code should be in /docker-entrypoint.d/ and could be called unprivileged-mode.sh.

dirkmueller · 2026-03-16T13:44:54Z

src/bci_build/package/appcontainers.py

+            {DOCKERFILE_RUN} set -euo pipefail; mkdir -p /var/cache/nginx /var/run/nginx /tmp/client_temp /tmp/proxy_temp /tmp/fastcgi_temp /tmp/uwsgi_temp /tmp/scgi_temp;\
+                ln -sf /dev/stdout /var/log/nginx/access.log;\
+                ln -sf /dev/stderr /var/log/nginx/error.log;\
+                chmod -R 777 /var/cache/nginx /etc/nginx /var/run/nginx /var/log/nginx /tmp/client_temp /tmp/proxy_temp /tmp/fastcgi_temp /tmp/uwsgi_temp /tmp/scgi_temp;


a chmod -R 0777 is kinda ugly, can we chown it to the nginx user instead? we should then set that as a stableuid and update the README accordingly.

bci-pushman pushed a commit that referenced this pull request Nov 17, 2025

Test build for #3167

a53fd58

bci-pushman pushed a commit that referenced this pull request Nov 17, 2025

Test build for #3167

7d878b7

bci-pushman pushed a commit that referenced this pull request Nov 17, 2025

Test build for #3167

04254ff

rcmadhankumar force-pushed the unprevileged-nginx branch from 871cffd to e43e062 Compare November 18, 2025 05:36

bci-pushman pushed a commit that referenced this pull request Nov 18, 2025

Test build for #3167

22ba676

bci-pushman pushed a commit that referenced this pull request Nov 18, 2025

Test build for #3167

f5eb766

bci-pushman pushed a commit that referenced this pull request Nov 18, 2025

Test build for #3167

3f5ac58

bci-pushman pushed a commit that referenced this pull request Nov 18, 2025

Test build for #3167

d19a64a

bci-pushman pushed a commit that referenced this pull request Nov 18, 2025

Test build for #3167

dcb241f

bci-pushman pushed a commit that referenced this pull request Nov 18, 2025

Test build for #3167

4598a05

rcmadhankumar force-pushed the unprevileged-nginx branch from e43e062 to ca2996d Compare November 20, 2025 08:31

bci-pushman pushed a commit that referenced this pull request Nov 20, 2025

Test build for #3167

6997215

bci-pushman pushed a commit that referenced this pull request Nov 20, 2025

Test build for #3167

44898a1

bci-pushman pushed a commit that referenced this pull request Nov 20, 2025

Test build for #3167

02baf4a

dirkmueller reviewed Nov 20, 2025

View reviewed changes

rcmadhankumar force-pushed the unprevileged-nginx branch from ca2996d to 77e787a Compare December 16, 2025 12:23

bci-pushman pushed a commit that referenced this pull request Dec 16, 2025

Test build for #3167

3a58415

bci-pushman pushed a commit that referenced this pull request Dec 16, 2025

Test build for #3167

dd2186b

bci-pushman pushed a commit that referenced this pull request Dec 16, 2025

Test build for #3167

47a5153

rcmadhankumar force-pushed the unprevileged-nginx branch from 77e787a to 74167bd Compare December 16, 2025 12:26

bci-pushman pushed a commit that referenced this pull request Dec 16, 2025

Test build for #3167

b8cf5ef

bci-pushman pushed a commit that referenced this pull request Dec 16, 2025

Test build for #3167

23a0991

bci-pushman pushed a commit that referenced this pull request Dec 16, 2025

Test build for #3167

c07163c

alexandrevicenzi reviewed Dec 16, 2025

View reviewed changes

dirkmueller mentioned this pull request Jan 12, 2026

Run nginx as a non root user #2934

Closed

bci-pushman pushed a commit that referenced this pull request Jan 28, 2026

Test build for #3167

44f4d53

dirkmueller self-requested a review February 2, 2026 13:23

dirkmueller reviewed Feb 9, 2026

View reviewed changes

dirkmueller requested changes Feb 9, 2026

View reviewed changes

rcmadhankumar force-pushed the unprevileged-nginx branch from c6f69b9 to 50d77cf Compare February 17, 2026 11:29

bci-pushman pushed a commit that referenced this pull request Feb 17, 2026

Test build for #3167

a9d7d86

bci-pushman pushed a commit that referenced this pull request Feb 17, 2026

Test build for #3167

bef4b25

bci-pushman pushed a commit that referenced this pull request Feb 17, 2026

Test build for #3167

e58e687

bci-pushman pushed a commit that referenced this pull request Feb 17, 2026

Test build for #3167

670a666

rcmadhankumar force-pushed the unprevileged-nginx branch from 50d77cf to 0154f56 Compare February 17, 2026 11:43

bci-pushman pushed a commit that referenced this pull request Feb 17, 2026

Test build for #3167

ff5a072

bci-pushman pushed a commit that referenced this pull request Feb 17, 2026

Test build for #3167

6b0d056

bci-pushman pushed a commit that referenced this pull request Feb 17, 2026

Test build for #3167

a947976

bci-pushman pushed a commit that referenced this pull request Feb 17, 2026

Test build for #3167

1dc9870

rcmadhankumar requested review from alexandrevicenzi and dirkmueller February 17, 2026 12:00

alexandrevicenzi requested changes Feb 18, 2026

View reviewed changes

Run nginx as unprevileged user

99dea49

rcmadhankumar force-pushed the unprevileged-nginx branch from 0154f56 to 99dea49 Compare February 24, 2026 06:25

bci-pushman pushed a commit that referenced this pull request Feb 24, 2026

Test build for #3167

d02a5c2

bci-pushman pushed a commit that referenced this pull request Feb 24, 2026

Test build for #3167

912f50c

bci-pushman pushed a commit that referenced this pull request Feb 24, 2026

Test build for #3167

57d9eee

alexandrevicenzi approved these changes Mar 6, 2026

View reviewed changes

dirkmueller requested changes Mar 16, 2026

View reviewed changes

dirkmueller mentioned this pull request Mar 16, 2026

Update nginx image's readme to run as non root #3071

Closed

Conversation

rcmadhankumar commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rcmadhankumar Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dirkmueller commented Nov 21, 2025

Uh oh!

rcmadhankumar commented Dec 16, 2025

Uh oh!

alexandrevicenzi left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rcmadhankumar Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dirkmueller left a comment

Choose a reason for hiding this comment

Uh oh!

rcmadhankumar commented Feb 17, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

rcmadhankumar commented Nov 17, 2025 •

edited

Loading

github-actions bot commented Nov 17, 2025 •

edited

Loading

github-actions bot commented Nov 17, 2025 •

edited

Loading

github-actions bot commented Nov 17, 2025 •

edited

Loading

rcmadhankumar Jan 23, 2026 •

edited

Loading

rcmadhankumar Feb 17, 2026 •

edited

Loading