From 7116fff88810ee70a165ddf678352541f177b1d6 Mon Sep 17 00:00:00 2001 From: Vincent Mrose Date: Sat, 1 Aug 2026 14:26:55 +0200 Subject: [PATCH] Adding release notes and weekly build support (to pull latest nginx release) --- .drone.yml | 14 ++++++++-- README.md | 32 +++++++++++++++++++++- RELEASE_NOTES.md | 70 ++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 113 insertions(+), 3 deletions(-) create mode 100644 RELEASE_NOTES.md diff --git a/.drone.yml b/.drone.yml index 39f8b73..5d5f5e0 100644 --- a/.drone.yml +++ b/.drone.yml @@ -10,7 +10,8 @@ steps: path: /var/run/docker.sock commands: - echo "Building redirect image on host Docker daemon..." - - docker build -t redirect:latest . + # --pull ensures base image vulnerabilities/patches are pulled on weekly cron builds + - docker build --pull -t redirect:latest . - | if [ -n "$DRONE_COMMIT_SHA" ]; then SHORT_SHA=$(echo $DRONE_COMMIT_SHA | cut -c1-7) @@ -22,6 +23,15 @@ steps: docker tag redirect:latest redirect:$DRONE_TAG echo "Tagged redirect:$DRONE_TAG" fi + - | + # Fetch latest git tag to update the latest release tag (e.g., on weekly cron builds) + apk add --no-cache git 2>/dev/null || true + git fetch --tags 2>/dev/null || true + LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || true) + if [ -n "$LATEST_TAG" ]; then + docker tag redirect:latest redirect:$LATEST_TAG + echo "Tagged latest release tag: redirect:$LATEST_TAG" + fi - echo "Build complete. Images registered on host Docker engine:" - docker images | grep redirect || true @@ -34,4 +44,4 @@ trigger: event: - push - tag - + - cron diff --git a/README.md b/README.md index a127fa1..dc4cb1e 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,7 @@ # Unprivileged Nginx Redirect Docker Image +[![Build Status](https://ci.mrose.cloud/api/badges/vincent/redirect/status.svg?ref=refs/heads/main)](https://ci.mrose.cloud/vincent/redirect) + A lightweight, secure, and reusable Docker image based on `nginxinc/nginx-unprivileged:alpine-slim` designed to redirect HTTP requests to any configurable target domain/path with customizable HTTP status codes. It is designed to be built via **Drone CI** directly onto the host server's Docker daemon, allowing multiple containers to run on the host system using the single tagged image. @@ -42,16 +44,34 @@ steps: - name: dockersock path: /var/run/docker.sock commands: - - docker build -t redirect:latest . + - docker build --pull -t redirect:latest . - | if [ -n "$DRONE_COMMIT_SHA" ]; then SHORT_SHA=$(echo $DRONE_COMMIT_SHA | cut -c1-7) docker tag redirect:latest redirect:$SHORT_SHA fi + - | + if [ -n "$DRONE_TAG" ]; then + docker tag redirect:latest redirect:$DRONE_TAG + fi + - | + apk add --no-cache git 2>/dev/null || true + git fetch --tags 2>/dev/null || true + LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || true) + if [ -n "$LATEST_TAG" ]; then + docker tag redirect:latest redirect:$LATEST_TAG + fi + volumes: - name: dockersock host: path: /var/run/docker.sock + +trigger: + event: + - push + - tag + - cron ``` > **Note**: Ensure your Drone runner environment allows mounting the host socket volume. @@ -72,6 +92,16 @@ git push origin v1.0.0 2. Drone automatically populates `$DRONE_TAG` with the tag value (e.g. `v1.0.0`) and triggers the pipeline. 3. The pipeline builds and tags the host image as `redirect:v1.0.0` (as well as `redirect:latest` and `redirect:`). +### Weekly Scheduled Rebuilds (`weekly-build`) + +To keep your Docker images updated with upstream OS/Nginx security patches: + +1. In the **Drone CI UI** (or via Drone CLI), navigate to **Repository Settings** -> **Cron Jobs**. +2. Add a new Cron job named `weekly-build` set to trigger weekly (e.g., `@weekly` or `0 0 * * 0`). +3. When the `cron` event triggers: + - The pipeline executes `docker build --pull -t redirect:latest .` to fetch updated base layers from Alpine/Nginx. + - It fetches the latest Git release tag (`git describe --tags --abbrev=0`) and automatically updates `redirect:` (e.g., `redirect:v1.0.0`) on the host daemon. + --- ## Quick Start & Usage diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md new file mode 100644 index 0000000..e2e9bbf --- /dev/null +++ b/RELEASE_NOTES.md @@ -0,0 +1,70 @@ +# Release v1.0.0 - Initial Release: Reusable Unprivileged Nginx Redirect + +We are pleased to announce **v1.0.0** of the Reusable Unprivileged Nginx Redirect container image! This release provides an ultra-lightweight, secure, non-root Docker solution for redirecting web traffic dynamically using environment variables. + +--- + +## 🚀 Key Features + +* **Non-Root & Secure Base**: Built on `nginxinc/nginx-unprivileged:alpine-slim` (~12 MB footprint, runs as UID 101). +* **Zero Overhead Template Engine**: Leverages native Nginx Docker template substitution (`envsubst`) on startup. +* **Drone CI Host Integration**: Pipeline builds directly onto the host server's Docker daemon via `/var/run/docker.sock`, making tagged images immediately available locally for `docker run` or `docker compose`. +* **Path & Query String Preservation**: Support for preserving request paths via `$request_uri` (e.g., `REDIRECT_TARGET="https://destination.com$request_uri"`). +* **Health Check Bypass Endpoint**: Built-in `/healthz` location returns `200 OK` for orchestrator probes without triggering redirects. + +--- + +## ⚙️ Environment Variables + +| Variable | Default Value | Description | +| :--- | :--- | :--- | +| `REDIRECT_TARGET` | `https://example.com` | Target URL/domain for redirection. Append `$request_uri` to preserve path & query parameters. | +| `REDIRECT_CODE` | `301` | HTTP status code for redirection (e.g., `301`, `302`, `307`, `308`). | +| `LISTEN_PORT` | `8080` | Internal listening port (unprivileged non-root standard). | + +--- + +## 📦 Drone CI Pipeline + +Builds are triggered automatically on `push` and `tag` events. The host image is tagged as: +- `redirect:latest` +- `redirect:` +- `redirect:` (e.g., `redirect:v1.0.0`) + +--- + +## 🛠️ Quick Usage Examples + +### Single Container (Docker Run) + +```bash +docker run -d \ + --name redirect-domain \ + -p 8080:8080 \ + -e REDIRECT_TARGET="https://example.com\$request_uri" \ + -e REDIRECT_CODE="301" \ + redirect:v1.0.0 +``` + +### Multi-Container Deployment (Docker Compose) + +```yaml +services: + site-a-redirect: + image: redirect:v1.0.0 + container_name: site-a-redirect + ports: + - "8081:8080" + environment: + - REDIRECT_TARGET=https://site-a.com + - REDIRECT_CODE=301 + + site-b-redirect: + image: redirect:v1.0.0 + container_name: site-b-redirect + ports: + - "8082:8080" + environment: + - REDIRECT_TARGET=https://site-b.com$request_uri + - REDIRECT_CODE=302 +```