Update nginx image's readme to run as non root

[rcmadhankumar]

No description provided.

[github-actions]

Created a staging project on OBS for Tumbleweed: home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3071
Changes pushed to branch Tumbleweed-3071 as commit 046824c525a10cff4912025e8db04dda08e0cad2
Build succeeded ✅

Build Results

Repository images in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3071 for x86_64: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository images in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3071 for aarch64: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository containerfile in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3071 for x86_64: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3071 for aarch64: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Build succeeded ✅

To run BCI-tests against this PR, use the following command:

OS_VERSION=tumbleweed TARGET=custom BASEURL=registry.opensuse.org/home/pushman/bci/staging/tumbleweed/tumbleweed-3071/ tox -- -n auto

The following images can be pulled from the staging project:

• registry.opensuse.org/home/pushman/bci/staging/tumbleweed/tumbleweed-3071/containerfile/opensuse/nginx:latest

[github-actions]

Created a staging project on OBS for 16.0: home:pushman:BCI:Staging:16.0:16.0-3071
Changes pushed to branch 16.0-3071 as commit 3339adcedf08c9be957cebf65239297f2a5d6fd4
Build succeeded ✅

Build Results

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3071 for x86_64: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3071 for aarch64: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3071 for s390x: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3071 for ppc64le: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3071 for x86_64: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3071 for aarch64: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3071 for s390x: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3071 for ppc64le: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Build succeeded ✅

To run BCI-tests against this PR, use the following command:

OS_VERSION=16.0 TARGET=custom BASEURL=registry.opensuse.org/home/pushman/bci/staging/16.0/16.0-3071/ tox -- -n auto

The following images can be pulled from the staging project:

• registry.opensuse.org/home/pushman/bci/staging/16.0/16.0-3071/containerfile/suse/nginx:1.27

[github-actions]

Created a staging project on OBS for 7: home:pushman:BCI:Staging:SLE-15-SP7:7-3071
Changes pushed to branch 7-3071 as commit bfdf5c3b1f45d88717b190f00e1f918a15ad69a1
Build succeeded ✅

Build Results

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3071 for x86_64: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3071 for aarch64: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3071 for s390x: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3071 for ppc64le: current state: published
Build results:

package name	status	build log
nginx-image	⛔ excluded	live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3071 for x86_64: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3071 for aarch64: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3071 for s390x: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3071 for ppc64le: current state: published
Build results:

package name	status	build log
nginx-image	✅ succeeded	live log

Build succeeded ✅

To run BCI-tests against this PR, use the following command:

OS_VERSION=15.7 TARGET=custom BASEURL=registry.opensuse.org/home/pushman/bci/staging/sle-15-sp7/7-3071/ tox -- -n auto

The following images can be pulled from the staging project:

• registry.opensuse.org/home/pushman/bci/staging/sle-15-sp7/7-3071/containerfile/suse/nginx:latest

[alexandrevicenzi]

I added a few suggestions.

[dirkmueller]

rather than documenting how to fix it, can we just make the image runnable as non-root, e.g. the nginx user?

[rcmadhankumar]

rather than documenting how to fix it, can we just make the image runnable as non-root, e.g. the nginx user?

running as non root requires port changes in the image and we do not want to make port changes in the image.
Also,

Upstream has 2 options now.
1.running standard nginx image as non root user https://hub.docker.com/_/nginx/#running-nginx-as-a-non-root-user

2. they have a separate non previleged image https://github.com/nginx/docker-nginx-unprivileged/blob/main/Dockerfile-debian.template#L129

I felt option 1 is suitable, because the image is already capable of running as non root without making any more changes to it.