Skip to content

Latest commit

 

History

History
22 lines (18 loc) · 828 Bytes

README.md

File metadata and controls

22 lines (18 loc) · 828 Bytes
Raw

ironpeakservices/iron-nginx

Secure base image for running nginx.

docker pull ghcr.io/ironpeakservices/iron-nginx:1.19.3

How is this different?

We build from the official nginx docker image, but additionally:

  • an empty scratch container (no shell, unprivileged user, ...) for a tiny attack vector
  • secure healthcheck binary for embedded container monitoring
  • hardened nginx config
  • hardened Docker Compose file
  • max memory set to 1GB

Example

FROM ghcr.io/ironpeakservices/iron-nginx:1.19.3
COPY --chown=nonroot css/ js/ html/ /assets

Update policy

Updates to the official nginx docker image are automatically created as a pull request and trigger linting & a docker build. When those checks complete without errors, a merge into master will trigger a deploy with the same nginx version to packages.