Merge pull request #2530 from terrestris/chore/unpriviledged-nginx

chore(docker): use unpriviledged nginx image and add OCI metadata

Author: ahennr

.github/workflows/release_docker.yml

@@ -42,6 +42,9 @@ jobs:
           tags: |
             ${{ env.DOCKER_REGISTRY }}/shogun-gis-client:latest
           load: true
+          build-args: |
+            APP_VERSION=latest
+            GIT_COMMIT=${{ github.sha }}
 
       - name: Build docker image (version)
         if: ${{ inputs.release_is_published }} == 'true'
@@ -51,6 +54,9 @@ jobs:
           tags: |
             ${{ env.DOCKER_REGISTRY }}/shogun-gis-client:${{ inputs.release_version }}
           load: true
+          build-args: |
+            APP_VERSION=${{ inputs.release_version }}
+            GIT_COMMIT=${{ github.sha }}
 
       - name: Push docker image to Nexus (latest)
         run: |

Dockerfile

@@ -13,13 +13,26 @@ COPY . ./
 
 RUN npm run build
 
-FROM nginx:1.29.2-alpine-slim
+FROM ghcr.io/nginx/nginx-unprivileged:1.29-alpine-perl AS app
 
-RUN apk update && apk upgrade --no-cache
-
-COPY --from=build /app/build /usr/share/nginx/html
-COPY default.conf /etc/nginx/conf.d/default.conf
+ENV SHOGUN_GIS_CLIENT_HOST=shogun-gis-client
 
-EXPOSE 80
+ARG GIT_COMMIT
+ARG APP_VERSION
 
-CMD ["nginx", "-g", "daemon off;"]
+COPY --from=build /app/build /usr/share/nginx/html
+COPY default.conf /etc/nginx/templates/default.conf.template
+
+# Metadata according to OCI Image Spec
+LABEL org.opencontainers.image.authors="info@terrestris.de"
+LABEL org.opencontainers.image.created="$(date -u +%Y-%m-%dT%H:%M:%S%z)"
+LABEL org.opencontainers.image.source="https://github.com/terrestris/shogun-gis-client"
+LABEL org.opencontainers.image.title="The SHOGun WebGIS client"
+LABEL org.opencontainers.image.description="Docker image for SHOGun WebGIS client"
+LABEL org.opencontainers.image.url=docker-public.terrestris.de/terrestris/shogun-gis-client
+LABEL org.opencontainers.image.vendor="terrestris GmbH & Co. KG"
+LABEL org.opencontainers.image.licenses="BSD-2-Clause"
+LABEL org.opencontainers.image.revision=$GIT_COMMIT
+LABEL org.opencontainers.image.version=$APP_VERSION
+
+HEALTHCHECK --timeout=5s --start-period=5s --retries=3 CMD curl -f http://localhost:8080/health || exit 1

default.conf

@@ -1,7 +1,17 @@
 server {
-  listen       80;
-  listen  [::]:80;
-  server_name  localhost;
+  listen 8080 default_server;
+  listen [::]:8080 default_server;
+
+  server_name ${SHOGUN_GIS_CLIENT_HOST};
+
+  # Hide nginx version
+  server_tokens off;
+
+  location /health {
+    access_log off;
+    add_header Content-Type text/plain;
+    return 200 "healthy\n";
+  }
 
   location / {
     root   /usr/share/nginx/html;