From d2edd18ff48a934e81a7a82cdd40efcb285432d8 Mon Sep 17 00:00:00 2001 From: Zac Blazic Date: Fri, 30 Oct 2026 10:45:58 +0200 Subject: [PATCH 1/4] Remove unused nginx modules and curl The upstream image installs the acme, geoip, image-filter, njs and xslt dynamic modules and curl, but no consumer of this image loads the modules or runs curl at runtime. Their libraries are where most of the image's vulnerability reports come from, including libxml2 via xslt and libbrotli via image-filter and curl. --- Dockerfile | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/Dockerfile b/Dockerfile index 5f06497..3a71870 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,6 +2,16 @@ FROM nginx:1.31.8-trixie ENV NGINX_ENTRYPOINT_QUIET_LOGS=1 +# Remove dynamic modules and tools that upstream installs but we don't use +RUN apt-get purge -y --auto-remove \ + curl \ + nginx-module-acme \ + nginx-module-geoip \ + nginx-module-image-filter \ + nginx-module-njs \ + nginx-module-xslt && \ + rm -rf /var/lib/apt/lists/* + # Override default configuration files COPY ./config/nginx.conf /etc/nginx/nginx.conf COPY ./config/default.conf /etc/nginx/conf.d/default.conf From 31052d405d09e0634d16fbb394fd36da4d08ba3e Mon Sep 17 00:00:00 2001 From: Zac Blazic Date: Fri, 30 Oct 2026 10:45:59 +0200 Subject: [PATCH 2/4] Document differences from upstream --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index e5099fa..3394928 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,8 @@ https://wikipedia.org/wiki/nginx ## How does this differ from upstream? -Currently, the only difference is that we use `SIGQUIT` as the [`STOPSIGNAL`](https://docs.docker.com/engine/reference/builder/#stopsignal) whereas upstream uses the default i.e. `SIGTERM`. Using `SIGQUIT` is better for our use-case as it ensures that nginx will perform a [graceful shutdown](https://docs.nginx.com/nginx/admin-guide/basic-functionality/runtime-control/). +* We use `SIGQUIT` as the [`STOPSIGNAL`](https://docs.docker.com/engine/reference/builder/#stopsignal) whereas upstream uses the default i.e. `SIGTERM`. Using `SIGQUIT` is better for our use-case as it ensures that nginx will perform a [graceful shutdown](https://docs.nginx.com/nginx/admin-guide/basic-functionality/runtime-control/). +* We remove the `acme`, `geoip`, `image-filter`, `njs` and `xslt` dynamic modules and `curl`, which upstream installs but we don't use. This keeps their libraries, and the vulnerabilities reported against them, out of the image. Install them in a derived image if you need them. ## Usage From 9484e3af4dbcff4b8c314fa221596e9f845ab6e6 Mon Sep 17 00:00:00 2001 From: Zac Blazic Date: Fri, 30 Oct 2026 10:45:59 +0200 Subject: [PATCH 3/4] Update changelog --- CHANGELOG.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index b32e1f9..c52a0f1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,10 @@ # Changelog +## 1.31.8-1 + +* Remove the `acme`, `geoip`, `image-filter`, `njs` and `xslt` dynamic + modules and `curl`. + ## 1.31.8 * Upgrade to Nginx 1.31.8. From 175e2d89a40ca70c3f35107e35979379dddc7960 Mon Sep 17 00:00:00 2001 From: Zac Blazic Date: Fri, 30 Oct 2026 10:49:38 +0200 Subject: [PATCH 4/4] Split changelog entry --- CHANGELOG.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c52a0f1..777544c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,7 +3,8 @@ ## 1.31.8-1 * Remove the `acme`, `geoip`, `image-filter`, `njs` and `xslt` dynamic - modules and `curl`. + modules. +* Remove `curl`. ## 1.31.8