The rootless development image is running.
+ + diff --git a/container/nginx.conf b/container/nginx.conf new file mode 100644 index 0000000..0aeefd8 --- /dev/null +++ b/container/nginx.conf @@ -0,0 +1,29 @@ +worker_processes auto; +pid /tmp/nginx.pid; +error_log /dev/stderr notice; + +events { + worker_connections 1024; +} + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + access_log /dev/stdout main; + + client_body_temp_path /tmp/nginx-client-body; + proxy_temp_path /tmp/nginx-proxy; + fastcgi_temp_path /tmp/nginx-fastcgi; + uwsgi_temp_path /tmp/nginx-uwsgi; + scgi_temp_path /tmp/nginx-scgi; + + sendfile on; + keepalive_timeout 65; + server_tokens off; + + include /etc/nginx/conf.d/*.conf; +} diff --git a/docs/CI.md b/docs/CI.md index 9e0efdc..8102ffc 100644 --- a/docs/CI.md +++ b/docs/CI.md @@ -1,15 +1,14 @@ # Continuous integration -The initial automation protects repository and workflow development before the -container implementation lands. Image build, runtime, SBOM, vulnerability, and -SCAP jobs will be added with the corresponding implementations so a green job -never represents a test that could not actually run. +The automation protects repository, workflow, and container development. A +green job represents only checks that have an implemented target and an +inspectable result; planned controls are not represented as passing jobs. ## Current workflows | Workflow | Triggers | Current purpose | | --- | --- | --- | -| `CI` | Pull requests, `main`, weekly, manual | Run pinned pre-commit checks, audit Actions with Zizmor, and scan repository configuration with Trivy. | +| `CI` | Pull requests, `main`, weekly, manual | Run pinned repository checks, audit Actions, scan configuration, and build, test, inventory, and scan native AMD64 and ARM64 images. | | `CodeQL` | Workflow changes, `main`, weekly, manual | Analyze GitHub Actions with the security-extended query suite. | | `OpenSSF Scorecard` | `main`, branch-protection changes, weekly, manual | Publish repository supply-chain findings and SARIF. | @@ -53,26 +52,27 @@ non-root UID while its Linux VM engine itself operates rootfully. That proves the image's non-root process behavior but does not qualify rootless-host user namespace behavior. Release evidence will distinguish these cases. -After the `Containerfile` and smoke suite are implemented, the README will -publish their exercised Podman commands. Native AMD64 and ARM64 CI remains -required before an image receives supported multi-architecture status. +The README contains the exercised Podman build and smoke commands. The local +PowerShell suite is suitable for Podman Desktop on Windows; the Bash suite is +used on Linux CI. Native AMD64 and ARM64 CI remains required before an image +receives supported multi-architecture status. -## Planned image assurance +## Image assurance -The stable protected check names will be `lint` and `image`. The aggregate -`image` check will require both native architecture jobs after they exist. The -image pipeline will add, in dependency order: +The stable protected check names are `lint`, `configuration security`, and +`image`. The aggregate `image` check requires both native architecture jobs. +The implemented image pipeline performs: 1. Trivy build-configuration scanning. 2. Native architecture builds and restricted-runtime smoke tests. -3. Tailored OpenSCAP evaluation against an ownership-preserving filesystem - export. -4. Trivy image vulnerability scanning. -5. SPDX inventory generation with Syft. -6. Independent fixed High/Critical vulnerability gating with Grype and a +3. Trivy image vulnerability scanning. +4. SPDX inventory generation with Syft. +5. Independent fixed High/Critical vulnerability gating with Grype and a retained full finding inventory. -7. Architecture-specific artifacts and non-pull-request SARIF publication. +6. Architecture-specific artifacts and non-pull-request SARIF publication. -Branch protection must not require `image` until that aggregate check exists -on the default branch. Once present and proven, both `lint` and `image` become -strict, required, up-to-date checks. +Tailored OpenSCAP evaluation against an ownership-preserving filesystem export +will be inserted after the runtime tests when its profile and result semantics +are reviewed. Branch protection must not require `image` until its aggregate +check exists on the default branch. Once present and proven, `image` becomes a +strict, required, up-to-date check alongside the current repository checks. diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md index 0810bee..e688b13 100644 --- a/docs/ROADMAP.md +++ b/docs/ROADMAP.md @@ -65,18 +65,9 @@ are separately approved. They must not delay the core first release. pin every base image and downloaded artifact by digest or checksum. - [ ] Record source, redistribution, licensing, support lifecycle, and update ownership for every runtime component. -- [ ] Build a package-manager-free UBI 9 Micro final stage. -- [ ] Run NGINX directly as a fixed non-root identity compatible with an - arbitrary UID in group `0`; do not include a root entrypoint phase. -- [ ] Listen on `8080` and `8443`; make PID, cache, temporary, and state paths - explicit and compatible with a read-only root filesystem. -- [ ] Send access and error logs to stdout/stderr without symlink mutation at - startup. -- [ ] Add a health check that does not require a shell when practical. -- [ ] Add smoke tests for image identity, process identity, static serving, - reverse proxying, graceful shutdown, read-only root, dropped capabilities, - `no-new-privileges`, arbitrary UID, writable-path failures, and absence of a - package manager. +- [ ] Add negative tests for invalid configuration and unavailable writable + runtime paths with actionable failure diagnostics. +- [ ] Add graceful reload and shutdown assertions to the runtime suite. **Fast-release checkpoint:** after Package 2, a development image is usable for local evaluation but is not yet a supported release. @@ -99,14 +90,6 @@ local evaluation but is not yet a supported release. ## Package 4: CI and supply-chain controls -- [ ] Build and smoke-test on native AMD64 and ARM64 GitHub-hosted runners. -- [ ] Run Trivy configuration and image scanning with fixed High/Critical - findings blocking. -- [ ] Generate architecture-specific SPDX SBOMs with Syft and scan them with - Grype as an independent fixed High/Critical gate; retain the complete - non-blocking finding inventory for review. -- [ ] Retain evidence even when a blocking scan fails, without leaking secrets - into artifacts. - [ ] After the native image jobs exist on `main`, require the stable `lint` and aggregate `image` checks in the default-branch ruleset. diff --git a/tests/smoke.ps1 b/tests/smoke.ps1 new file mode 100644 index 0000000..813f96a --- /dev/null +++ b/tests/smoke.ps1 @@ -0,0 +1,97 @@ +param( + [string]$ContainerRuntime = "podman", + [string]$Image = "localhost/nginx-ubi9:development" +) + +$ErrorActionPreference = "Stop" +$prefix = "nginx-ubi9-smoke-$PID" +$fixedName = "$prefix-fixed" +$arbitraryName = "$prefix-arbitrary" + +function Invoke-ContainerRuntime { + param([Parameter(ValueFromRemainingArguments)] [string[]]$Arguments) + + & $ContainerRuntime @Arguments + if ($LASTEXITCODE -ne 0) { + throw "$ContainerRuntime command failed: $($Arguments -join ' ')" + } +} + +function Wait-Nginx { + param([string]$Name) + + foreach ($attempt in 1..30) { + & $ContainerRuntime exec $Name nginx -t -q 2>$null + if ($LASTEXITCODE -eq 0) { + return + } + Start-Sleep -Seconds 1 + } + + & $ContainerRuntime logs $Name + throw "NGINX did not become ready in $Name" +} + +try { + $configuredUser = & $ContainerRuntime image inspect --format "{{.Config.User}}" $Image + if ($LASTEXITCODE -ne 0 -or $configuredUser -ne "999:0") { + throw "Expected image user 999:0; received $configuredUser" + } + + Invoke-ContainerRuntime run --detach --name $fixedName ` + --read-only ` + --tmpfs "/tmp:size=64m,mode=1777" ` + --cap-drop ALL ` + --security-opt "no-new-privileges:true" ` + --publish "127.0.0.1::8080" ` + $Image | Out-Null + Wait-Nginx $fixedName + + $fixedUid = & $ContainerRuntime exec $fixedName id -u + $fixedGid = & $ContainerRuntime exec $fixedName id -g + if ($fixedUid -ne "999" -or $fixedGid -ne "0") { + throw "Expected fixed identity 999:0; received ${fixedUid}:${fixedGid}" + } + + Invoke-ContainerRuntime exec $fixedName nginx -t -q + Invoke-ContainerRuntime exec $fixedName sh -c "test ! -w /etc/nginx/nginx.conf" + Invoke-ContainerRuntime exec $fixedName sh -c ` + "! command -v dnf && ! command -v microdnf && ! command -v yum" + + $binding = & $ContainerRuntime port $fixedName "8080/tcp" + if ($LASTEXITCODE -ne 0) { + throw "Unable to determine the published health port" + } + $hostPort = ($binding -split ":")[-1] + $health = & curl.exe --fail --silent --show-error ` + "http://127.0.0.1:$hostPort/healthz" + if ($LASTEXITCODE -ne 0 -or $health -ne "ok") { + throw "Unexpected health response: $health" + } + $index = & curl.exe --fail --silent --show-error ` + "http://127.0.0.1:$hostPort/" + $indexText = $index -join "`n" + if ($LASTEXITCODE -ne 0 -or $indexText -notmatch "NGINX on UBI 9") { + throw "The static landing page was not served" + } + + Invoke-ContainerRuntime run --detach --name $arbitraryName ` + --read-only ` + --tmpfs "/tmp:size=64m,mode=1777" ` + --cap-drop ALL ` + --security-opt "no-new-privileges:true" ` + --user "10001:0" ` + $Image | Out-Null + Wait-Nginx $arbitraryName + + $arbitraryUid = & $ContainerRuntime exec $arbitraryName id -u + $arbitraryGid = & $ContainerRuntime exec $arbitraryName id -g + if ($arbitraryUid -ne "10001" -or $arbitraryGid -ne "0") { + throw "Expected arbitrary identity 10001:0; received ${arbitraryUid}:${arbitraryGid}" + } + + Write-Output "Restricted-runtime smoke tests passed for $Image" +} +finally { + & $ContainerRuntime rm --force $fixedName $arbitraryName 2>$null | Out-Null +} diff --git a/tests/smoke.sh b/tests/smoke.sh new file mode 100644 index 0000000..6f37ab9 --- /dev/null +++ b/tests/smoke.sh @@ -0,0 +1,60 @@ +#!/usr/bin/env bash +set -Eeuo pipefail + +runtime="${CONTAINER_RUNTIME:-podman}" +image="${IMAGE:-localhost/nginx-ubi9:development}" +prefix="nginx-ubi9-smoke-${RANDOM}-$$" +primary="${prefix}-primary" +arbitrary="${prefix}-arbitrary" + +cleanup() { + "${runtime}" rm --force "${primary}" "${arbitrary}" >/dev/null 2>&1 || true +} +trap cleanup EXIT + +run_restricted() { + local name="$1" + shift + "${runtime}" run --detach --name "${name}" \ + --read-only \ + --tmpfs /tmp:size=64m,mode=1777 \ + --cap-drop ALL \ + --security-opt no-new-privileges:true \ + "$@" \ + "${image}" >/dev/null +} + +wait_for_nginx() { + local name="$1" + local _ + for _ in {1..30}; do + if "${runtime}" exec "${name}" nginx -t -q >/dev/null 2>&1; then + return 0 + fi + sleep 1 + done + "${runtime}" logs "${name}" >&2 + return 1 +} + +test "$("${runtime}" image inspect --format '{{.Config.User}}' "${image}")" = "999:0" + +run_restricted "${primary}" --publish 127.0.0.1::8080 +wait_for_nginx "${primary}" +test "$("${runtime}" exec "${primary}" id -u)" = "999" +test "$("${runtime}" exec "${primary}" id -g)" = "0" +"${runtime}" exec "${primary}" nginx -t -q +"${runtime}" exec "${primary}" test ! -w /etc/nginx/nginx.conf +"${runtime}" exec "${primary}" sh -c '! command -v dnf && ! command -v microdnf && ! command -v yum' + +binding="$("${runtime}" port "${primary}" 8080/tcp)" +host_port="${binding##*:}" +test "$(curl --fail --silent --show-error "http://127.0.0.1:${host_port}/healthz")" = "ok" +curl --fail --silent --show-error "http://127.0.0.1:${host_port}/" | grep -Fq 'NGINX on UBI 9' + +run_restricted "${arbitrary}" --user 10001:0 +wait_for_nginx "${arbitrary}" +test "$("${runtime}" exec "${arbitrary}" id -u)" = "10001" +test "$("${runtime}" exec "${arbitrary}" id -g)" = "0" + +echo "Rootless restricted-runtime smoke tests passed for ${image}" From 7d86f3feb9052c210c958d4ec7cbd7e4fae64379 Mon Sep 17 00:00:00 2001 From: joey-huckabee <138994589+joey-huckabee@users.noreply.github.com> Date: Tue, 8 Sep 2026 19:51:02 -0500 Subject: [PATCH 2/2] fix: use patched nginx module stream --- Containerfile | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/Containerfile b/Containerfile index 34956f7..2c3848a 100644 --- a/Containerfile +++ b/Containerfile @@ -5,7 +5,8 @@ ARG UBI_MICRO_IMAGE="registry.access.redhat.com/ubi9/ubi-micro:9.8@sha256:f332c9 FROM ${UBI_MINIMAL_IMAGE} AS builder -ARG NGINX_RPM_VERSION="2:1.20.1-28.el9_8.5" +ARG NGINX_MODULE_STREAM="1.26" +ARG NGINX_RPM_VERSION="2:1.26.3-9.module+el9.8.0+24599+8fde0ff7.3" # Install the exact Red Hat NGINX build and its runtime dependency closure into # a separate root. The UBI Micro final stage receives no package-management @@ -13,6 +14,10 @@ ARG NGINX_RPM_VERSION="2:1.20.1-28.el9_8.5" # hadolint ignore=DL3041 RUN microdnf install -y dnf \ && mkdir -p /runtime \ + && dnf module enable -y \ + --installroot=/runtime \ + --releasever=9 \ + "nginx:${NGINX_MODULE_STREAM}" \ && dnf install -y \ --installroot=/runtime \ --releasever=9 \ @@ -37,8 +42,8 @@ RUN microdnf install -y dnf \ FROM ${UBI_MICRO_IMAGE} -ARG NGINX_VERSION="1.20.1" -ARG NGINX_RPM_VERSION="2:1.20.1-28.el9_8.5" +ARG NGINX_VERSION="1.26.3" +ARG NGINX_RPM_VERSION="2:1.26.3-9.module+el9.8.0+24599+8fde0ff7.3" LABEL org.opencontainers.image.title="NGINX on Red Hat UBI 9" \ org.opencontainers.image.description="A security-oriented, rootless NGINX image built on Red Hat UBI 9 Micro" \