[zacblazic]

Overview

The nginx base image now drops several optional modules and curl that the proxy never uses. Their libraries account for most of the image's vulnerability reports, and are how the recent Brotli CVE got in. This moves the proxy onto that slimmed base, so the sidecars only carry what nginx and the proxy's own modules need.

Changes

• Updates the base image to zappi/nginx:1.31.8-1.
  • Removes the acme, geoip, image-filter, njs and xslt dynamic modules.
  • Removes curl.

Testing

• Builds and passes its compose example: HTTP 200 with X-Trace-ID, headers-more headers applied and the 18081 health check at 200.
• High and critical findings drop from 62 to 46, including the one critical.
• CI fails until zappi/nginx:1.31.8-1 is released.

Risk

• Low. The proxy only loads headers-more and OTel, and no sidecar config uses what's removed.
• Rollback is staying on zappi/nginx-proxy:1.31.8.

Related

• [INFRA-521] Remove unused nginx modules and curl docker-nginx#20

References

• INFRA-521

[itskingori]

Whoops, failing test.