Run nginx as unprevileged user #3167

rcmadhankumar · 2025-11-17T09:55:31Z

Made necessary changes to the nginx image so that it can be simply run as non root by passing --user=nginx flag.

github-actions · 2025-11-17T09:56:19Z

Created a staging project on OBS for Tumbleweed: home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3167
Changes pushed to branch Tumbleweed-3167 as commit a989594add9a723babcea6d0897e044df9124a2d
Build succeeded ✅

Build Results

Repository images in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3167 for x86_64: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository images in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3167 for aarch64: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository containerfile in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3167 for x86_64: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3167 for aarch64: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Build succeeded ✅

To run BCI-tests against this PR, use the following command:

OS_VERSION=tumbleweed TARGET=custom BASEURL=registry.opensuse.org/home/pushman/bci/staging/tumbleweed/tumbleweed-3167/ tox -- -n auto

The following images can be pulled from the staging project:

registry.opensuse.org/home/pushman/bci/staging/tumbleweed/tumbleweed-3167/containerfile/opensuse/nginx:latest

github-actions · 2025-11-17T09:56:26Z

Created a staging project on OBS for 7: home:pushman:BCI:Staging:SLE-15-SP7:7-3167
Changes pushed to branch 7-3167 as commit 44f4d53c178aa3dfbd19824f84fe15c5443ec821
Build succeeded ✅

Build Results

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3167 for x86_64: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3167 for aarch64: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3167 for s390x: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3167 for ppc64le: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3167 for x86_64: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3167 for aarch64: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3167 for s390x: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3167 for ppc64le: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Build succeeded ✅

To run BCI-tests against this PR, use the following command:

OS_VERSION=15.7 TARGET=custom BASEURL=registry.opensuse.org/home/pushman/bci/staging/sle-15-sp7/7-3167/ tox -- -n auto

The following images can be pulled from the staging project:

registry.opensuse.org/home/pushman/bci/staging/sle-15-sp7/7-3167/containerfile/suse/nginx:latest

github-actions · 2025-11-17T09:56:28Z

Created a staging project on OBS for 16.0: home:pushman:BCI:Staging:16.0:16.0-3167
Changes pushed to branch 16.0-3167 as commit 9ff50151d9f4e6c4d1ff08095e4284321e2e4fa4
Build succeeded ✅

Build Results

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3167 for x86_64: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3167 for aarch64: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3167 for s390x: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3167 for ppc64le: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3167 for x86_64: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3167 for aarch64: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3167 for s390x: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3167 for ppc64le: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Build succeeded ✅

To run BCI-tests against this PR, use the following command:

OS_VERSION=16.0 TARGET=custom BASEURL=registry.opensuse.org/home/pushman/bci/staging/16.0/16.0-3167/ tox -- -n auto

The following images can be pulled from the staging project:

registry.opensuse.org/home/pushman/bci/staging/16.0/16.0-3167/containerfile/suse/nginx:1.27

dirkmueller · 2025-11-20T08:49:05Z

src/bci_build/package/nginx/docker-entrypoint.sh

+    entrypoint_log "$0: Removed 'user' directive for unprivileged worker."
+
+    # Ensure PID path is set to /tmp/nginx.pid
+    sed -i 's,^#\?\s*pid\s\+.*;$,pid /tmp/nginx.pid;,' /etc/nginx/nginx.conf


why are we setting it to /tmp rather than a safe location like /run/nginx or /run ?

We are starting the nginx container as unprevileged user.
/run directory and /var/run directory is owned by root.

But nothing prevents you from having /run/nginx/nginx.pid , you can create the folder with the nginx user, which it seems you already do with chown -R nginx:nginx /var/run/.

I would also move this to be a default location, not just in case it is a non-root user. Since it would not make any difference if it is owned by nginx anyway.

pid path is set to /var/run/nginx/nginx.pid

dirkmueller · 2025-11-21T10:08:37Z

@rcmadhankumar can you please also include the (adjusted) readme update from #3071 ?

rcmadhankumar · 2025-12-16T12:24:07Z

@rcmadhankumar can you please also include the (adjusted) readme update from #3071 ?

Added relevant readme update.

alexandrevicenzi

Are we seding the user provided file as well (volume mount)? It does not make sense to change is such cases, only if it is the default config we ship, otherwise, we could potentially break the user config.

alexandrevicenzi · 2025-12-16T15:10:36Z

src/bci_build/package/nginx/docker-entrypoint.sh

+    entrypoint_log "$0: Removed 'user' directive for unprivileged worker."
+
+    # Ensure PID path is set to /tmp/nginx.pid
+    sed -i 's,^#\?\s*pid\s\+.*;$,pid /tmp/nginx.pid;,' /etc/nginx/nginx.conf


But nothing prevents you from having /run/nginx/nginx.pid , you can create the folder with the nginx user, which it seems you already do with chown -R nginx:nginx /var/run/.

I would also move this to be a default location, not just in case it is a non-root user. Since it would not make any difference if it is owned by nginx anyway.

src/bci_build/package/appcontainers.py

src/bci_build/package/nginx/README.md.j2

src/bci_build/package/nginx/docker-entrypoint.sh

src/bci_build/package/nginx/README.md.j2

github-actions · 2026-01-23T09:51:36Z

Created a staging project on OBS for 16.1: home:pushman:BCI:Staging:16.1:16.1-3167
Changes pushed to branch 16.1-3167 as commit 3854473f232ed96d72ec8298cef0c86ed7da4c3c

alexandrevicenzi · 2026-01-23T13:58:10Z

src/bci_build/package/nginx/docker-entrypoint.sh

+    entrypoint_log "$0: Running as unprivileged user (UID: $CURRENT_UID). Configuring for unprivileged mode (Port 8080)."
+
+    # Remove the 'user' directive
+    sed -i '/^user/d' /etc/nginx/nginx.conf


This should replace only if the user is root I think, otherwise it can override a user provided in the custom config. However we could also use NGINX_USER and the build-in template engine.

As an unprevileged user i can't use the command user. so, the line is removed from the config file.
Updated the #comment accordingly.

alexandrevicenzi · 2026-01-23T13:58:27Z

src/bci_build/package/nginx/docker-entrypoint.sh

+fi
+
+# modify temp paths
+sed -i "/^http {/a \        proxy_temp_path /tmp/proxy_temp;\n        client_body_temp_path /tmp/client_temp;\n        fastcgi_temp_path /tmp/fastcgi_temp;\n        uwsgi_temp_path /tmp/uwsgi_temp;\n        scgi_temp_path /tmp/scgi_temp;\n" /etc/nginx/nginx.conf


We could use /tmp for all users, including root.

this line is applicable to both non root and root users.
Just updated the comment and moved the code above if blocks.

alexandrevicenzi · 2026-01-23T13:58:49Z

src/bci_build/package/nginx/docker-entrypoint.sh

+    entrypoint_log "$0: Removed 'user' directive for unprivileged worker."
+
+    # Ensure PID path is set to /var/run/nginx.pid
+    sed -i 's,^#\?\s*pid\s\+.*;$,pid /var/run/nginx/nginx.pid;,' /etc/nginx/nginx.conf


We could use /var for all users, including root.

alexandrevicenzi · 2026-01-23T14:01:40Z

src/bci_build/package/nginx/docker-entrypoint.sh

+
+    # Ensure PID path is set to /var/run/nginx.pid
+    sed -i 's,^#\?\s*pid\s\+.*;$,pid /var/run/nginx/nginx.pid;,' /etc/nginx/nginx.conf
+    sed -i 's/listen \(.*\)80;/listen \18080;/' /etc/nginx/conf.d/default.conf 2>/dev/null || \


We should probably use the built-in template functions to override the port. However the user would be required to set NGINX_PORT in case a non-root user is used.

I think, for a smoother user experience we can keep it as it is! wdyt?
(user can always forward the port 8080 to the port no they wish anyways)

bci-pushman pushed a commit that referenced this pull request Nov 17, 2025

Test build for #3167

a53fd58

bci-pushman pushed a commit that referenced this pull request Nov 17, 2025

Test build for #3167

7d878b7

bci-pushman pushed a commit that referenced this pull request Nov 17, 2025

Test build for #3167

04254ff

rcmadhankumar force-pushed the unprevileged-nginx branch from 871cffd to e43e062 Compare November 18, 2025 05:36

bci-pushman pushed a commit that referenced this pull request Nov 18, 2025

Test build for #3167

22ba676

bci-pushman pushed a commit that referenced this pull request Nov 18, 2025

Test build for #3167

f5eb766

bci-pushman pushed a commit that referenced this pull request Nov 18, 2025

Test build for #3167

3f5ac58

bci-pushman pushed a commit that referenced this pull request Nov 18, 2025

Test build for #3167

d19a64a

bci-pushman pushed a commit that referenced this pull request Nov 18, 2025

Test build for #3167

dcb241f

bci-pushman pushed a commit that referenced this pull request Nov 18, 2025

Test build for #3167

4598a05

rcmadhankumar force-pushed the unprevileged-nginx branch from e43e062 to ca2996d Compare November 20, 2025 08:31

bci-pushman pushed a commit that referenced this pull request Nov 20, 2025

Test build for #3167

6997215

bci-pushman pushed a commit that referenced this pull request Nov 20, 2025

Test build for #3167

44898a1

bci-pushman pushed a commit that referenced this pull request Nov 20, 2025

Test build for #3167

02baf4a

dirkmueller reviewed Nov 20, 2025

View reviewed changes

rcmadhankumar force-pushed the unprevileged-nginx branch from ca2996d to 77e787a Compare December 16, 2025 12:23

bci-pushman pushed a commit that referenced this pull request Dec 16, 2025

Test build for #3167

3a58415

bci-pushman pushed a commit that referenced this pull request Dec 16, 2025

Test build for #3167

dd2186b

bci-pushman pushed a commit that referenced this pull request Dec 16, 2025

Test build for #3167

47a5153

rcmadhankumar force-pushed the unprevileged-nginx branch from 77e787a to 74167bd Compare December 16, 2025 12:26

bci-pushman pushed a commit that referenced this pull request Dec 16, 2025

Test build for #3167

b8cf5ef

bci-pushman pushed a commit that referenced this pull request Dec 16, 2025

Test build for #3167

23a0991

bci-pushman pushed a commit that referenced this pull request Dec 16, 2025

Test build for #3167

c07163c

alexandrevicenzi reviewed Dec 16, 2025

View reviewed changes

dirkmueller mentioned this pull request Jan 12, 2026

Run nginx as a non root user #2934

Closed

rcmadhankumar force-pushed the unprevileged-nginx branch 2 times, most recently from 7d44601 to 5c92bea Compare January 23, 2026 09:51

bci-pushman pushed a commit that referenced this pull request Jan 23, 2026

Test build for #3167

50a195f

bci-pushman pushed a commit that referenced this pull request Jan 23, 2026

Test build for #3167

5911226

bci-pushman pushed a commit that referenced this pull request Jan 23, 2026

Test build for #3167

2ad7622

bci-pushman pushed a commit that referenced this pull request Jan 23, 2026

Test build for #3167

af445eb

bci-pushman pushed a commit that referenced this pull request Jan 23, 2026

Test build for #3167

896a084

bci-pushman pushed a commit that referenced this pull request Jan 23, 2026

Test build for #3167

4a37df2

bci-pushman pushed a commit that referenced this pull request Jan 23, 2026

Test build for #3167

6c645f1

alexandrevicenzi reviewed Jan 23, 2026

View reviewed changes

Run nginx as unprevileged user

c6f69b9

rcmadhankumar force-pushed the unprevileged-nginx branch from 5c92bea to c6f69b9 Compare January 28, 2026 00:47

bci-pushman pushed a commit that referenced this pull request Jan 28, 2026

Test build for #3167

a989594

bci-pushman pushed a commit that referenced this pull request Jan 28, 2026

Test build for #3167

9ff5015

bci-pushman pushed a commit that referenced this pull request Jan 28, 2026

Test build for #3167

3854473

bci-pushman pushed a commit that referenced this pull request Jan 28, 2026

Test build for #3167

44f4d53

Run nginx as unprevileged user #3167

Are you sure you want to change the base?

Run nginx as unprevileged user #3167

Uh oh!

Conversation

rcmadhankumar commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rcmadhankumar Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dirkmueller commented Nov 21, 2025

Uh oh!

rcmadhankumar commented Dec 16, 2025

Uh oh!

alexandrevicenzi left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rcmadhankumar commented Nov 17, 2025 •

edited

Loading

github-actions bot commented Nov 17, 2025 •

edited

Loading

github-actions bot commented Nov 17, 2025 •

edited

Loading

github-actions bot commented Nov 17, 2025 •

edited

Loading

rcmadhankumar Jan 23, 2026 •

edited

Loading

github-actions bot commented Jan 23, 2026 •

edited

Loading