Skip to content

Commit c10595e

Browse files
denjidenji
committed
nginx: mainline=1.29.5, stable=1.28.2, libressl=4.2.1
- replace hg.nginx.org clone with github mirror for njs - use proper GPG key verification for LibreSSL - optimize workflow with matrix strategy and conditional QEMU - add native arm64 runner (ubuntu-24.04-arm) for amd64/arm64 builds - add arm/v6, s390x, riscv64, loong64, mips64le targets - run arm/v7 and arm/v6 QEMU on arm64 runner (same ISA, faster) - pin x86 QEMU jobs to ubuntu-22.04 (segfault regression in 24.04) - bump binfmt to tonistiigi/binfmt:qemu-v10.1.3-60 (loong64 requires v9.2.0+) - add fail-fast: false to keep matrix running on partial failures
1 parent fd45500 commit c10595e

14 files changed

Lines changed: 1737 additions & 583 deletions

‎.github/workflows/docker-image.yml‎

Lines changed: 117 additions & 177 deletions
Original file line numberDiff line numberDiff line change
@@ -1,207 +1,147 @@
1-
name: Docker Image CI
1+
name: Docker Image CI (LibreSSL)
22

33
on:
44
push:
55
branches: [ main ]
66
paths-ignore:
77
- 'README.md'
88

9+
env:
10+
GHCR_IMAGE: ghcr.io/${{ github.repository_owner }}/nginx-libressl
11+
DHUB_IMAGE: docker.io/denji/nginx-libressl
12+
913
jobs:
10-
build-host-amd64v4:
11-
runs-on: ubuntu-latest
12-
steps:
13-
- name: Check Out Repo
14-
uses: actions/checkout@v4
15-
- name: Login to DockerHub
16-
uses: docker/login-action@v3
17-
with:
18-
username: ${{ secrets.DOCKERHUB_USERNAME }}
19-
password: ${{ secrets.DOCKERHUB_TOKEN }}
20-
- name: Build and push mainline/alpine (Linux x86_64-v4)
21-
uses: docker/build-push-action@v5
22-
with:
23-
context: ./
24-
file: mainline-alpine.Dockerfile
25-
push: true
26-
tags: docker.io/denji/nginx-libressl:mainline-alpine
27-
cache-from: type=registry,ref=docker.io/denji/nginx-libressl:mainline-alpine
28-
cache-to: type=inline
29-
- name: Build and push stable/alpine (Linux x86_64-v4)
30-
uses: docker/build-push-action@v5
31-
with:
32-
context: ./
33-
file: stable-alpine.Dockerfile
34-
push: true
35-
tags: docker.io/denji/nginx-libressl:stable-alpine
36-
cache-from: type=registry,ref=docker.io/denji/nginx-libressl:stable-alpine
37-
cache-to: type=inline
38-
build-qemu-arm64:
39-
runs-on: ubuntu-latest
14+
build:
15+
runs-on: ${{ matrix.runner }}
16+
strategy:
17+
fail-fast: false
18+
matrix:
19+
include:
20+
# --- native runners (no QEMU) ---
21+
- { platforms: linux/amd64, build_dir: mainline, dockerfile: Dockerfile, tag: mainline-amd64-alpine, runner: ubuntu-latest }
22+
- { platforms: linux/arm64, build_dir: mainline, dockerfile: Dockerfile, tag: mainline-aarch64-alpine, runner: ubuntu-24.04-arm }
23+
- { platforms: linux/amd64, build_dir: stable, dockerfile: Dockerfile, tag: stable-amd64-alpine, runner: ubuntu-latest }
24+
- { platforms: linux/arm64, build_dir: stable, dockerfile: Dockerfile, tag: stable-aarch64-alpine, runner: ubuntu-24.04-arm }
25+
26+
# --- QEMU on arm64 runner ---
27+
# arm/v7 and arm/v6: kernel compat layer (no TCG at all)
28+
- { platforms: linux/arm/v7, build_dir: mainline, dockerfile: Dockerfile, tag: mainline-armv7-alpine, runner: ubuntu-24.04-arm }
29+
- { platforms: linux/arm/v6, build_dir: mainline, dockerfile: Dockerfile, tag: mainline-armv6-alpine, runner: ubuntu-24.04-arm }
30+
- { platforms: linux/ppc64le, build_dir: mainline, dockerfile: Dockerfile, tag: mainline-ppc64le-alpine, runner: ubuntu-24.04-arm }
31+
- { platforms: linux/riscv64, build_dir: mainline, dockerfile: Dockerfile, tag: mainline-riscv64-alpine, runner: ubuntu-24.04-arm }
32+
- { platforms: linux/loong64, build_dir: mainline, dockerfile: Dockerfile.loongarch64, tag: mainline-loong64-alpine, runner: ubuntu-24.04-arm }
33+
#- { platforms: linux/mips64le, build_dir: mainline, dockerfile: Dockerfile.mips64le, tag: mainline-mips64le-alpine, runner: ubuntu-24.04-arm }
34+
- { platforms: linux/arm/v7, build_dir: stable, dockerfile: Dockerfile, tag: stable-armv7-alpine, runner: ubuntu-24.04-arm }
35+
- { platforms: linux/arm/v6, build_dir: stable, dockerfile: Dockerfile, tag: stable-armv6-alpine, runner: ubuntu-24.04-arm }
36+
- { platforms: linux/ppc64le, build_dir: stable, dockerfile: Dockerfile, tag: stable-ppc64le-alpine, runner: ubuntu-24.04-arm }
37+
- { platforms: linux/riscv64, build_dir: stable, dockerfile: Dockerfile, tag: stable-riscv64-alpine, runner: ubuntu-24.04-arm }
38+
- { platforms: linux/loong64, build_dir: stable, dockerfile: Dockerfile.loongarch64, tag: stable-loong64-alpine, runner: ubuntu-24.04-arm }
39+
#- { platforms: linux/mips64le, build_dir: stable, dockerfile: Dockerfile.mips64le, tag: stable-mips64le-alpine, runner: ubuntu-24.04-arm }
40+
41+
# --- QEMU on x86 runner ---
42+
# s390x: strong memory model (TSO-like) → needs x86 host for MTTCG
43+
# Pinned to ubuntu-22.04: QEMU segfault regression in ubuntu-24.04 >= 20250202.1.0
44+
# Track: https://github.com/actions/runner-images/issues/11662
45+
#- { platforms: linux/s390x, build_dir: mainline, dockerfile: Dockerfile, tag: mainline-s390x-alpine, runner: ubuntu-22.04 }
46+
#- { platforms: linux/s390x, build_dir: stable, dockerfile: Dockerfile, tag: stable-s390x-alpine, runner: ubuntu-22.04 }
47+
48+
permissions:
49+
contents: read
50+
packages: write
51+
4052
steps:
4153
- name: Check Out Repo
42-
uses: actions/checkout@v4
54+
uses: actions/checkout@v6
55+
4356
- name: Set up QEMU
57+
if: matrix.platforms != 'linux/amd64' && matrix.platforms != 'linux/arm64'
4458
uses: docker/setup-qemu-action@v3
59+
with:
60+
# qemu-v9.2.0-51+ required for loong64 support
61+
image: tonistiigi/binfmt:qemu-v10.1.3-60
62+
4563
- name: Set up Docker Buildx
4664
uses: docker/setup-buildx-action@v3
47-
- name: Login to DockerHub
65+
66+
- name: Login to GHCR
4867
uses: docker/login-action@v3
4968
with:
50-
username: ${{ secrets.DOCKERHUB_USERNAME }}
51-
password: ${{ secrets.DOCKERHUB_TOKEN }}
52-
- name: Build and push mainline/alpine (Linux AArch64 - ARMv8)
53-
uses: docker/build-push-action@v5
54-
with:
55-
context: ./
56-
file: mainline-alpine.Dockerfile
57-
platforms: linux/arm64
58-
push: true
59-
tags: docker.io/denji/nginx-libressl:mainline-aarch64-alpine
60-
cache-from: type=registry,ref=docker.io/denji/nginx-libressl:mainline-aarch64-alpine
61-
cache-to: type=inline
62-
- name: Build and push stable/alpine (Linux AArch64 - ARMv8)
63-
uses: docker/build-push-action@v5
64-
with:
65-
context: ./
66-
file: stable-alpine.Dockerfile
67-
platforms: linux/arm64
68-
push: true
69-
tags: docker.io/denji/nginx-libressl:stable-aarch64-alpine
70-
cache-from: type=registry,ref=docker.io/denji/nginx-libressl:stable-aarch64-alpine
71-
cache-to: type=inline
72-
build-qemu-armv7:
73-
runs-on: ubuntu-latest
74-
steps:
75-
- name: Check Out Repo
76-
uses: actions/checkout@v4
77-
- name: Set up QEMU
78-
uses: docker/setup-qemu-action@v3
79-
- name: Set up Docker Buildx
80-
uses: docker/setup-buildx-action@v3
69+
registry: ghcr.io
70+
username: ${{ github.actor }}
71+
password: ${{ secrets.GITHUB_TOKEN }}
72+
8173
- name: Login to DockerHub
8274
uses: docker/login-action@v3
8375
with:
8476
username: ${{ secrets.DOCKERHUB_USERNAME }}
8577
password: ${{ secrets.DOCKERHUB_TOKEN }}
86-
- name: Build and push mainline/alpine (Linux ARMv7 - 32-bit)
87-
uses: docker/build-push-action@v5
88-
with:
89-
context: ./
90-
file: mainline-alpine.Dockerfile
91-
platforms: linux/arm/v7
92-
push: true
93-
tags: docker.io/denji/nginx-libressl:mainline-armv7-alpine
94-
cache-from: type=registry,ref=docker.io/denji/nginx-libressl:mainline-armv7-alpine
95-
cache-to: type=inline
96-
- name: Build and push stable/alpine (Linux ARMv7 - 32-bit)
97-
uses: docker/build-push-action@v5
78+
79+
- name: Build and push ${{ matrix.tag }}
80+
uses: docker/build-push-action@v6
9881
with:
99-
context: ./
100-
file: stable-alpine.Dockerfile
101-
platforms: linux/arm/v7
82+
context: ${{ matrix.build_dir }}
83+
file: ${{ matrix.build_dir }}/${{ matrix.dockerfile }}
84+
platforms: ${{ matrix.platforms }}
10285
push: true
103-
tags: docker.io/denji/nginx-libressl:stable-armv7-alpine
104-
cache-from: type=registry,ref=docker.io/denji/nginx-libressl:stable-armv7-alpine
105-
cache-to: type=inline
106-
#build-qemu-armhf:
107-
# runs-on: ubuntu-latest
108-
# steps:
109-
# - name: Check Out Repo
110-
# uses: actions/checkout@v4
111-
# - name: Set up QEMU
112-
# uses: docker/setup-qemu-action@v3
113-
# - name: Set up Docker Buildx
114-
# uses: docker/setup-buildx-action@v3
115-
# - name: Login to DockerHub
116-
# uses: docker/login-action@v3
117-
# with:
118-
# username: ${{ secrets.DOCKERHUB_USERNAME }}
119-
# password: ${{ secrets.DOCKERHUB_TOKEN }}
120-
# - name: Build and push mainline/alpine (Linux armhf - 32-bit hard-float ABI ARMv6)
121-
# uses: docker/build-push-action@v5
122-
# with:
123-
# context: ./
124-
# file: mainline-alpine.Dockerfile
125-
# platforms: linux/arm/v6
126-
# push: true
127-
# tags: docker.io/denji/nginx-libressl:mainline-armhf-alpine
128-
# cache-from: type=registry,ref=docker.io/denji/nginx-libressl:mainline-armhf-alpine
129-
# cache-to: type=inline
130-
# - name: Build and push stable/alpine (Linux armhf - 32-bit hard-float ABI ARMv6)
131-
# uses: docker/build-push-action@v5
132-
# with:
133-
# context: ./
134-
# file: stable-alpine.Dockerfile
135-
# platforms: linux/arm/v6
136-
# push: true
137-
# tags: docker.io/denji/nginx-libressl:stable-armhf-alpine
138-
# cache-from: type=registry,ref=docker.io/denji/nginx-libressl:stable-armhf-alpine
139-
# cache-to: type=inline
140-
#build-qemu-s390x:
141-
# runs-on: ubuntu-latest
142-
# steps:
143-
# - name: Check Out Repo
144-
# uses: actions/checkout@v4
145-
# - name: Set up QEMU
146-
# uses: docker/setup-qemu-action@v3
147-
# - name: Set up Docker Buildx
148-
# uses: docker/setup-buildx-action@v3
149-
# - name: Login to DockerHub
150-
# uses: docker/login-action@v3
151-
# with:
152-
# username: ${{ secrets.DOCKERHUB_USERNAME }}
153-
# password: ${{ secrets.DOCKERHUB_TOKEN }}
154-
# - name: Build and push mainline/alpine (Linux s390x - IBM System Z Based)
155-
# uses: docker/build-push-action@v5
156-
# with:
157-
# context: ./
158-
# file: mainline-alpine.Dockerfile
159-
# platforms: linux/s390x
160-
# push: true
161-
# tags: docker.io/denji/nginx-libressl:mainline-s390x-alpine
162-
# cache-from: type=registry,ref=docker.io/denji/nginx-libressl:mainline-s390x-alpine
163-
# cache-to: type=inline
164-
# - name: Build and push stable/alpine (Linux s390x - IBM System Z Based)
165-
# uses: docker/build-push-action@v5
166-
# with:
167-
# context: ./
168-
# file: stable-alpine.Dockerfile
169-
# platforms: linux/s390x
170-
# push: true
171-
# tags: docker.io/denji/nginx-libressl:stable-s390x-alpine
172-
# cache-from: type=registry,ref=docker.io/denji/nginx-libressl:stable-s390x-alpine
173-
# cache-to: type=inline
174-
build-qemu-ppc64le:
86+
tags: |
87+
${{ env.GHCR_IMAGE }}:${{ matrix.tag }}
88+
${{ env.DHUB_IMAGE }}:${{ matrix.tag }}
89+
#cache-from: type=registry,ref=${{ env.GHCR_IMAGE }}:cache-${{ matrix.tag }}
90+
#cache-to: type=registry,ref=${{ env.GHCR_IMAGE }}:cache-${{ matrix.tag }},mode=max
91+
cache-from: type=gha,scope=${{ matrix.tag }}
92+
cache-to: type=gha,mode=max,scope=${{ matrix.tag }}
93+
94+
merge:
17595
runs-on: ubuntu-latest
96+
needs: build
97+
permissions:
98+
contents: read
99+
packages: write
176100
steps:
177-
- name: Check Out Repo
178-
uses: actions/checkout@v4
179-
- name: Set up QEMU
180-
uses: docker/setup-qemu-action@v3
181-
- name: Set up Docker Buildx
182-
uses: docker/setup-buildx-action@v3
101+
- name: Login to GHCR
102+
uses: docker/login-action@v3
103+
with:
104+
registry: ghcr.io
105+
username: ${{ github.actor }}
106+
password: ${{ secrets.GITHUB_TOKEN }}
107+
183108
- name: Login to DockerHub
184109
uses: docker/login-action@v3
185110
with:
186111
username: ${{ secrets.DOCKERHUB_USERNAME }}
187112
password: ${{ secrets.DOCKERHUB_TOKEN }}
188-
- name: Build and push mainline/alpine (Linux ppc64le - 64-bit PowerPC little-endian)
189-
uses: docker/build-push-action@v5
190-
with:
191-
context: ./
192-
file: mainline-alpine.Dockerfile
193-
platforms: linux/ppc64le
194-
push: true
195-
tags: docker.io/denji/nginx-libressl:mainline-ppc64le-alpine
196-
cache-from: type=registry,ref=docker.io/denji/nginx-libressl:mainline-ppc64le-alpine
197-
cache-to: type=inline
198-
- name: Build and push stable/alpine (Linux ppc64le - 64-bit PowerPC little-endian)
199-
uses: docker/build-push-action@v5
200-
with:
201-
context: ./
202-
file: stable-alpine.Dockerfile
203-
platforms: linux/ppc64le
204-
push: true
205-
tags: docker.io/denji/nginx-libressl:stable-ppc64le-alpine
206-
cache-from: type=registry,ref=docker.io/denji/nginx-libressl:stable-ppc64le-alpine
207-
cache-to: type=inline
113+
114+
- name: Set up Docker Buildx
115+
uses: docker/setup-buildx-action@v3
116+
117+
- name: Merge and push mainline-alpine manifest
118+
run: |
119+
docker buildx imagetools create -t ${{ env.GHCR_IMAGE }}:mainline-alpine \
120+
${{ env.GHCR_IMAGE }}:mainline-amd64-alpine \
121+
${{ env.GHCR_IMAGE }}:mainline-aarch64-alpine \
122+
${{ env.GHCR_IMAGE }}:mainline-armv7-alpine \
123+
${{ env.GHCR_IMAGE }}:mainline-armv6-alpine \
124+
${{ env.GHCR_IMAGE }}:mainline-ppc64le-alpine \
125+
${{ env.GHCR_IMAGE }}:mainline-riscv64-alpine \
126+
${{ env.GHCR_IMAGE }}:mainline-loong64-alpine
127+
# ${{ env.GHCR_IMAGE }}:mainline-s390x-alpine
128+
# ${{ env.GHCR_IMAGE }}:mainline-mips64le-alpine
129+
130+
docker buildx imagetools create -t ${{ env.DHUB_IMAGE }}:mainline-alpine \
131+
${{ env.GHCR_IMAGE }}:mainline-alpine
132+
133+
- name: Merge and push stable-alpine manifest
134+
run: |
135+
docker buildx imagetools create -t ${{ env.GHCR_IMAGE }}:stable-alpine \
136+
${{ env.GHCR_IMAGE }}:stable-amd64-alpine \
137+
${{ env.GHCR_IMAGE }}:stable-aarch64-alpine \
138+
${{ env.GHCR_IMAGE }}:stable-armv7-alpine \
139+
${{ env.GHCR_IMAGE }}:stable-armv6-alpine \
140+
${{ env.GHCR_IMAGE }}:stable-ppc64le-alpine \
141+
${{ env.GHCR_IMAGE }}:stable-riscv64-alpine \
142+
${{ env.GHCR_IMAGE }}:stable-loong64-alpine
143+
# ${{ env.GHCR_IMAGE }}:stable-s390x-alpine
144+
# ${{ env.GHCR_IMAGE }}:stable-mips64le-alpine
145+
146+
docker buildx imagetools create -t ${{ env.DHUB_IMAGE }}:stable-alpine \
147+
${{ env.GHCR_IMAGE }}:stable-alpine

‎README.md‎

Lines changed: 36 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,46 @@
1-
# **NGINX** built with **LibreSSL**
1+
# NGINX with LibreSSL
22

3-
### Docker image
3+
[**NGINX built with LibreSSL**](https://github.com/nginx-modules/docker-nginx-libressl)
44

5-
[![](https://img.shields.io/docker/automated/denji/nginx-libressl.svg)](https://hub.docker.com/r/denji/nginx-libressl/builds/) [![](https://img.shields.io/docker/pulls/denji/nginx-libressl.svg)](https://hub.docker.com/r/denji/nginx-libressl/) [![](https://img.shields.io/docker/stars/denji/nginx-libressl.svg)](https://hub.docker.com/r/denji/nginx-libressl/)
5+
---
6+
7+
[![Pulls](https://img.shields.io/docker/pulls/denji/nginx-libressl.svg)](https://hub.docker.com/r/denji/nginx-libressl/)
8+
[![Stars](https://img.shields.io/docker/stars/denji/nginx-libressl.svg)](https://hub.docker.com/r/denji/nginx-libressl/)
69

710
[![Docker Image CI](https://github.com/nginx-modules/docker-nginx-libressl/actions/workflows/docker-image.yml/badge.svg)](https://github.com/nginx-modules/docker-nginx-libressl/actions/workflows/docker-image.yml)
811

9-
### Supported tags and respective `Dockerfile` links
12+
## Docker Image
13+
14+
Images are published to both registries:
15+
- `docker.io/denji/nginx-libressl`
16+
- `ghcr.io/nginx-modules/nginx-libressl`
17+
18+
---
19+
20+
## Supported tags and architectures (compact)
1021

11-
* Stable Release
12-
- `docker.io/denji/nginx-libressl:stable-alpine` - (Linux x86_64-v4)
13-
- `docker.io/denji/nginx-libressl:stable-aarch64-alpine` - (Linux AArch64 - ARMv8)
14-
- `docker.io/denji/nginx-libressl:stable-armv7-alpine` - (Linux ARMv7 - 32-bit)
15-
- `docker.io/denji/nginx-libressl:stable-ppc64le-alpine` - (Linux ppc64le - 64-bit PowerPC little-endian)
22+
| Tag pattern | Architectures |
23+
|-------------|---------------|
24+
| `stable-alpine`, `mainline-alpine` | x86_64, ARMv6/7 (32-bit), AArch64 (ARMv8), RISC-V64, LoongArch64, PPC64LE |
25+
| `stable-aarch64-alpine`, `mainline-aarch64-alpine` | AArch64 (ARMv8) |
26+
| `stable-armv6-alpine`, `mainline-armv6-alpine` | ARMv6 (32-bit) |
27+
| `stable-armv7-alpine`, `mainline-armv7-alpine` | ARMv7 (32-bit) |
28+
| `stable-riscv64-alpine`, `mainline-riscv64-alpine` | RISC-V 64 |
29+
| `stable-loong64-alpine`, `mainline-loong64-alpine` | LoongArch 64-bit |
30+
| `stable-ppc64le-alpine`, `mainline-ppc64le-alpine` | PPC64LE (64-bit PowerPC little-endian) |
1631

17-
* Mainline Release
18-
- `docker.io/denji/nginx-libressl:mainline-alpine` - (Linux x86_64-v4)
19-
- `docker.io/denji/nginx-libressl:mainline-aarch64-alpine` - (Linux AArch64 - ARMv8)
20-
- `docker.io/denji/nginx-libressl:mainline-armv7-alpine` - (Linux ARMv7 - 32-bit)
21-
- `docker.io/denji/nginx-libressl:mainline-ppc64le-alpine` - (Linux ppc64le - 64-bit PowerPC little-endian)
32+
---
2233

23-
#### Features
34+
## Features
2435

25-
- Images are used Alpine Linux.
26-
- PCRE with JIT enabled.
27-
- HTTP/2.0 (+NPN) support.
28-
- Async I/O using threads support.
29-
- Dynamic TLS records patch CloudFlare support (and configured).
30-
- Gzip static `.gz` files support enabled
31-
- Brotli static `.br` files support (and configured).
32-
- Brotli on-the-fly disabled (dynamic compression unstable)
36+
- Based on **Alpine Linux**.
37+
- **PCRE** with JIT enabled.
38+
- **HTTP/2** (+NPN) support.
39+
- **Async I/O** using threads supported.
40+
- **Dynamic TLS record patch** for Cloudflare (enabled).
41+
- **Gzip static `.gz` files** support enabled.
42+
- **Brotli static `.br` files** support enabled.
43+
- On-the-fly Brotli compression is **disabled** (unstable).
44+
- Based on **Official NGINX Dockerfile** and [`Wonderfall/boring-nginx`](https://github.com/Wonderfall/boring-nginx).
3345

34-
#### Based on the Official NGINX Dockerfile & `Wonderfall/boring-nginx`
46+
---

0 commit comments

Comments
 (0)