Use nginx-unprivileged base image for improved security

.docker/nginx.conf

@@ -1,11 +1,8 @@
 # Run nginx in foreground.
 # daemon off;
 
-# This is run inside Docker.
-user nginx;
-
 # Pid storage location.
-pid /run/nginx.pid;
+pid /tmp/nginx.pid;
 
 # Set number of worker processes.
 worker_processes 1;
@@ -41,8 +38,8 @@ http {
     resolver 127.0.0.11 ipv6=off;
 
     server {
-        listen       80;
-        listen  [::]:80;
+        listen       ${NGINX_PORT};
+        listen  [::]:${NGINX_PORT};
         server_name  localhost;
 
         location / {
@@ -90,4 +87,4 @@ http {
             proxy_set_header X-Real-IP $remote_addr;
         }
     }
-}
+}

.docker/scripts/100-envsubst-on-app-envs.sh

@@ -5,6 +5,6 @@ set -ex
 # find the file with the template envs
 envs=$(ls -t /usr/share/nginx/html/assets/envs*.js | head -n1)
 
-envsubst < "$envs" > ./envs_temp
-cp ./envs_temp "$envs"
-rm ./envs_temp
+tmpfile=$(mktemp)
+envsubst < "$envs" > "$tmpfile"
+mv "$tmpfile" "$envs"

.docker/scripts/90-envsubst-on-nginx-conf.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env sh
+
+set -ex
+
+config_file="/etc/nginx/nginx.conf"
+
+tmpfile=$(mktemp)
+envsubst '${NGINX_PORT}' < "$config_file" > "$tmpfile"
+mv "$tmpfile" "$config_file"

Dockerfile

@@ -1,10 +1,9 @@
-FROM nginx:alpine-slim AS prod
+FROM nginxinc/nginx-unprivileged:alpine-slim AS prod
 
-EXPOSE 80
-
-COPY .docker/scripts/ /docker-entrypoint.d/
-COPY .docker/nginx.conf /etc/nginx/
+ENV NGINX_PORT=80
 
-RUN chmod +x /docker-entrypoint.d/100-envsubst-on-app-envs.sh
+EXPOSE 80
 
-COPY dist/ /usr/share/nginx/html/
+COPY --chmod=755 .docker/scripts/ /docker-entrypoint.d/
+COPY --chown=nginx:root .docker/nginx.conf /etc/nginx/
+COPY --chown=nginx:root dist/ /usr/share/nginx/html/