From 283536154d716bb1e93fb6bd027bfc7d1bb339be Mon Sep 17 00:00:00 2001
From: Manuel Alejandro de Brito Fontes <aledbf@gmail.com>
Date: Tue, 24 Dec 2019 14:42:59 -0300
Subject: [PATCH 1/3] Switch to nginx

---
 images/nginx/Makefile          |   4 +-
 images/nginx/rootfs/Dockerfile |  63 +++++++--
 images/nginx/rootfs/build.sh   | 245 +++++++++++++++++++--------------
 3 files changed, 196 insertions(+), 116 deletions(-)

diff --git a/images/nginx/Makefile b/images/nginx/Makefile
index 230576f692..086251fe36 100644
--- a/images/nginx/Makefile
+++ b/images/nginx/Makefile
@@ -13,7 +13,7 @@
 # limitations under the License.
 
 # 0.0.0 shouldn't clobber any released builds
-TAG ?= 0.94
+TAG ?= 0.95
 REGISTRY ?= quay.io/kubernetes-ingress-controller
 ARCH ?= $(shell go env GOARCH)
 DOCKER ?= docker
@@ -26,7 +26,7 @@ ifeq ($(GOHOSTOS),darwin)
   SED_I=sed -i ''
 endif
 
-QEMUVERSION=v4.1.0-1
+QEMUVERSION=v4.1.1-1
 
 IMGNAME = nginx
 IMAGE = $(REGISTRY)/$(IMGNAME)
diff --git a/images/nginx/rootfs/Dockerfile b/images/nginx/rootfs/Dockerfile
index 11a587e64a..b8af478f0e 100644
--- a/images/nginx/rootfs/Dockerfile
+++ b/images/nginx/rootfs/Dockerfile
@@ -13,23 +13,68 @@
 # limitations under the License.
 
 
-FROM BASEIMAGE
+FROM BASEIMAGE as builder
 
 CROSS_BUILD_COPY qemu-ARCH-static /usr/bin/
 
-ENV PATH=$PATH:/usr/local/openresty/luajit/bin:/usr/local/openresty/nginx/sbin:/usr/local/openresty/bin
-
-# Add LuaRocks paths
-# see https://github.com/openresty/docker-openresty/blob/de05cd72594498b83e3a97e2f632da6aa75ec01d/bionic/Dockerfile#L168
-ENV LUA_PATH="/usr/local/openresty/site/lualib/?.ljbc;/usr/local/openresty/site/lualib/?/init.ljbc;/usr/local/openresty/lualib/?.ljbc;/usr/local/openresty/lualib/?/init.ljbc;/usr/local/openresty/site/lualib/?.lua;/usr/local/openresty/site/lualib/?/init.lua;/usr/local/openresty/lualib/?.lua;/usr/local/openresty/lualib/?/init.lua;./?.lua;/usr/local/openresty/luajit/share/luajit-2.1.0-beta3/?.lua;/usr/local/share/lua/5.1/?.lua;/usr/local/share/lua/5.1/?/init.lua;/usr/local/openresty/luajit/share/lua/5.1/?.lua;/usr/local/openresty/luajit/share/lua/5.1/?/init.lua;/usr/local/lib/lua/?.lua"
-ENV LUA_CPATH="/usr/local/openresty/site/lualib/?.so;/usr/local/openresty/lualib/?.so;./?.so;/usr/local/lib/lua/5.1/?.so;/usr/local/openresty/luajit/lib/lua/5.1/?.so;/usr/local/lib/lua/5.1/loadall.so;/usr/local/openresty/luajit/lib/lua/5.1/?.so"
+RUN clean-install bash
 
 COPY . /
 
-RUN clean-install bash
-
 RUN /build.sh
 
+# Use a multi-stage build
+FROM BASEIMAGE
+
+ENV PATH=$PATH:/usr/local/luajit/bin:/usr/local/nginx/sbin:/usr/local/nginx/bin
+
+ENV LUA_PATH="/usr/local/share/luajit-2.1.0-beta3/?.lua;/usr/local/share/lua/5.1/?.lua;/usr/local/lib/lua/?.lua;;"
+ENV LUA_CPATH="/usr/local/lib/lua/?/?.so;/usr/local/lib/lua/?.so;;"
+
+COPY --from=builder /usr/local /usr/local
+COPY --from=builder /opt /opt
+COPY --chown=www-data:www-data --from=builder /etc/nginx /etc/nginx
+
+RUN apt-get update && apt-get dist-upgrade -y \
+  && clean-install \
+    bash \
+    curl ca-certificates \
+    libgeoip1 \
+    patch \
+    libpcre3 \
+    zlib1g \
+    libaio1 \
+    openssl \
+    util-linux \
+    lmdb-utils \
+    libcurl4 \
+    libprotobuf17 \
+    libz3-4 \
+    procps \
+    libxml2 libpcre++0v5 \
+    liblmdb0 \
+    libmaxminddb0 \
+    dumb-init \
+    nano \
+    libyaml-cpp0.6 \
+    libyajl2 \
+  && ln -s /usr/local/nginx/sbin/nginx /sbin/nginx \
+  && ln -s /usr/local/lib/mimalloc-1.2/libmimalloc.so /usr/local/lib/libmimalloc.so \
+  && bash -eu -c ' \
+  writeDirs=( \
+    /var/log/nginx \
+    /var/lib/nginx/body \
+    /var/lib/nginx/fastcgi \
+    /var/lib/nginx/proxy \
+    /var/lib/nginx/scgi \
+    /var/lib/nginx/uwsgi \
+    /var/log/audit \
+  ); \
+  for dir in "${writeDirs[@]}"; do \
+    mkdir -p ${dir}; \
+    chown -R www-data.www-data ${dir}; \
+  done'
+
 EXPOSE 80 443
 
 CMD ["nginx", "-g", "daemon off;"]
diff --git a/images/nginx/rootfs/build.sh b/images/nginx/rootfs/build.sh
index 5fbf1e9e2d..c9248d3325 100755
--- a/images/nginx/rootfs/build.sh
+++ b/images/nginx/rootfs/build.sh
@@ -21,7 +21,10 @@ set -o pipefail
 
 export DEBIAN_FRONTEND=noninteractive
 
-export OPENRESTY_VERSION=7508c1852265bd04fdb2dfd64989d4c490440f1a
+export NGINX_VERSION=1.17.7
+export NDK_VERSION=0.3.1rc1
+export SETMISC_VERSION=0.32
+export MORE_HEADERS_VERSION=0.33
 export NGINX_DIGEST_AUTH=cd8641886c873cf543255aeda20d23e4cd603d05
 export NGINX_SUBSTITUTIONS=bc58cb11844bc42735bbaef7085ea86ace46d05b
 export NGINX_OPENTRACING_VERSION=0.9.0
@@ -31,14 +34,20 @@ export JAEGER_VERSION=741b1af2805388e98dbfea449f40c6d6b19c13be
 export MSGPACK_VERSION=3.2.0
 export DATADOG_CPP_VERSION=1.1.1
 export MODSECURITY_VERSION=1.0.1
-export MODSECURITY_LIB_VERSION=3.0.3
+export MODSECURITY_LIB_VERSION=6624a18a4e7fd9881a7a9b435db3e481e8e986a5
 export OWASP_MODSECURITY_CRS_VERSION=3.2.0
+export LUA_NGX_VERSION=0.10.15
+export LUA_STREAM_NGX_VERSION=0.0.7
+export LUA_UPSTREAM_VERSION=0.07
 export LUA_BRIDGE_TRACER_VERSION=0.1.1
 export NGINX_INFLUXDB_VERSION=5b09391cb7b9a889687c0aa67964c06a2d933e8b
-export GEOIP2_VERSION=3.2
+export GEOIP2_VERSION=3.3
 export NGINX_AJP_VERSION=bf6cd93f2098b59260de8d494f0f4b1f11a84627
-export RESTY_LUAROCKS_VERSION=3.1.3
-export LUA_RESTY_BALANCER_VERSION=0.03
+export RESTY_LUAROCKS_VERSION=3.2.1
+export LUAJIT_VERSION=9d5750d28478abfdcaefdfdc408f87752a21e431
+export LUA_RESTY_BALANCER=0.03
+export LUA_RESTY_CORE=0.1.17
+export LUA_CJSON_VERSION=2.1.0.7
 
 export BUILD_PATH=/tmp/build
 
@@ -84,15 +93,11 @@ clean-install \
   libcurl4-openssl-dev \
   libprotobuf-dev protobuf-compiler \
   libz-dev \
-  procps \
   git g++ pkgconf flex bison doxygen libyajl-dev liblmdb-dev libtool dh-autoreconf libxml2 libpcre++-dev libxml2-dev \
   python \
   libmaxminddb-dev \
-  dumb-init \
   bc \
   unzip \
-  nano \
-  ssdeep \
   dos2unix mercurial \
   libyaml-cpp0.6 \
   || exit 1
@@ -126,8 +131,17 @@ mkdir --verbose -p "$BUILD_PATH"
 cd "$BUILD_PATH"
 
 # download, verify and extract the source files
-get_src 221cfecadd0ed2902738757e7d8fb0bc41882840f07ea87112740b44f173722f \
-        "https://github.com/openresty/openresty/archive/${OPENRESTY_VERSION}.tar.gz"
+get_src b62756842807e5693b794e5d0ae289bd8ae5b098e66538b2a91eb80f25c591ff \
+        "https://nginx.org/download/nginx-$NGINX_VERSION.tar.gz"
+
+get_src 49f50d4cd62b166bc1aaf712febec5e028d9f187cedbc27a610dfd01bdde2d36 \
+        "https://github.com/simpl/ngx_devel_kit/archive/v$NDK_VERSION.tar.gz"
+
+get_src f1ad2459c4ee6a61771aa84f77871f4bfe42943a4aa4c30c62ba3f981f52c201 \
+        "https://github.com/openresty/set-misc-nginx-module/archive/v$SETMISC_VERSION.tar.gz"
+
+get_src a3dcbab117a9c103bc1ea5200fc00a7b7d2af97ff7fd525f16f8ac2632e30fbf \
+        "https://github.com/openresty/headers-more-nginx-module/archive/v$MORE_HEADERS_VERSION.tar.gz"
 
 get_src fe683831f832aae4737de1e1026a4454017c2d5f98cb88b08c5411dc380062f8 \
         "https://github.com/atomx/nginx-http-auth-digest/archive/$NGINX_DIGEST_AUTH.tar.gz"
@@ -153,6 +167,18 @@ get_src db377619a07d538bdbf328272fdec3893e6f674bdf469b3b575f778866e3ace7 \
 get_src ff865a36bad5c72b8e7ebc4b7cf5f27a820fce4faff9c571c1791e3728355a39 \
         "https://github.com/msgpack/msgpack-c/archive/cpp-$MSGPACK_VERSION.tar.gz"
 
+get_src 7d5f3439c8df56046d0564b5857fd8a30296ab1bd6df0f048aed7afb56a0a4c2 \
+        "https://github.com/openresty/lua-nginx-module/archive/v$LUA_NGX_VERSION.tar.gz"
+
+get_src 99c47c75c159795c9faf76bbb9fa58e5a50b75286c86565ffcec8514b1c74bf9 \
+        "https://github.com/openresty/stream-lua-nginx-module/archive/v$LUA_STREAM_NGX_VERSION.tar.gz"
+
+get_src 2a69815e4ae01aa8b170941a8e1a10b6f6a9aab699dee485d58f021dd933829a \
+        "https://github.com/openresty/lua-upstream-nginx-module/archive/v$LUA_UPSTREAM_VERSION.tar.gz"
+
+get_src 266ed1abb70a9806d97cb958537a44b67db6afb33d3b32292a2d68a2acedea75 \
+        "https://github.com/openresty/luajit2/archive/$LUAJIT_VERSION.tar.gz"
+
 get_src 052fd37cd698e24ab73ee18fc3fa55acd1d43153c12a0e65b0fba0447de1117e \
         "https://github.com/DataDog/dd-opentracing-cpp/archive/v$DATADOG_CPP_VERSION.tar.gz"
 
@@ -162,17 +188,29 @@ get_src 6faab57557bd9cc9fc38208f6bc304c1c13cf048640779f98812cf1f9567e202 \
 get_src 1af5a5632dc8b00ae103d51b7bf225de3a7f0df82f5c6a401996c080106e600e \
         "https://github.com/influxdata/nginx-influxdb-module/archive/$NGINX_INFLUXDB_VERSION.tar.gz"
 
-get_src 15bd1005228cf2c869a6f09e8c41a6aaa6846e4936c473106786ae8ac860fab7 \
+get_src 41378438c833e313a18869d0c4a72704b4835c30acaf7fd68013ab6732ff78a7 \
         "https://github.com/leev/ngx_http_geoip2_module/archive/$GEOIP2_VERSION.tar.gz"
 
 get_src 5f629a50ba22347c441421091da70fdc2ac14586619934534e5a0f8a1390a950 \
         "https://github.com/yaoweibin/nginx_ajp_module/archive/$NGINX_AJP_VERSION.tar.gz"
 
-get_src c573435f495aac159e34eaa0a3847172a2298eb6295fcdc35d565f9f9b990513 \
+get_src f27e20c9cdb3ffb991ccdb85796c36a0690566676f8e1a59b0d0ee6598907d04 \
         "https://luarocks.github.io/luarocks/releases/luarocks-${RESTY_LUAROCKS_VERSION}.tar.gz"
 
+get_src 5d16e623d17d4f42cc64ea9cfb69ca960d313e12f5d828f785dd227cc483fcbd \
+        "https://github.com/openresty/lua-resty-upload/archive/v0.10.tar.gz"
+
+get_src 095615fe94e64615c4a27f4f4475b91c047cf8d10bc2dbde8d5ba6aa625fc5ab \
+        "https://github.com/openresty/lua-resty-string/archive/v0.11.tar.gz"
+
 get_src 82209d5a5d9545c6dde3db7857f84345db22162fdea9743d5e2b2094d8d407f8 \
-        "https://github.com/openresty/lua-resty-balancer/archive/v${LUA_RESTY_BALANCER_VERSION}.tar.gz"
+        "https://github.com/openresty/lua-resty-balancer/archive/v$LUA_RESTY_BALANCER.tar.gz"
+
+get_src 8f5f76d2689a3f6b0782f0a009c56a65e4c7a4382be86422c9b3549fe95b0dc4 \
+        "https://github.com/openresty/lua-resty-core/archive/v$LUA_RESTY_CORE.tar.gz"
+
+get_src 59d2f18ecadba48be61061004c8664eaed1111a3372cd2567cb24c5a47eb41fe \
+        "https://github.com/openresty/lua-cjson/archive/$LUA_CJSON_VERSION.tar.gz"
 
 # improve compilation times
 CORES=$(($(grep -c ^processor /proc/cpuinfo) - 0))
@@ -180,9 +218,17 @@ CORES=$(($(grep -c ^processor /proc/cpuinfo) - 0))
 export MAKEFLAGS=-j${CORES}
 export CTEST_BUILD_FLAGS=${MAKEFLAGS}
 export HUNTER_JOBS_NUMBER=${CORES}
-export HUNTER_KEEP_PACKAGE_SOURCES=false
 export HUNTER_USE_CACHE_SERVERS=true
 
+# Install luajit from openresty fork
+export LUAJIT_LIB=/usr/local/lib
+export LUA_LIB_DIR="$LUAJIT_LIB/lua"
+export LUAJIT_INC=/usr/local/include/luajit-2.1
+
+cd "$BUILD_PATH/luajit2-$LUAJIT_VERSION"
+make CCDEBUG=-g
+make install
+
 if [[ ${ARCH} == "armv7l" ]]; then
   export PCRE_DIR=/usr/lib/arm-linux-gnueabihf
 fi
@@ -197,8 +243,6 @@ fi
 
 cd "$BUILD_PATH"
 
-export PATH=$PATH:/usr/local/openresty/luajit
-
 # install openresty-gdb-utils
 cd /
 git clone --depth=1 https://github.com/openresty/openresty-gdb-utils.git
@@ -316,14 +360,31 @@ cd ngx_brotli
 git submodule init
 git submodule update
 
+cd "$BUILD_PATH"
+git clone https://github.com/ssdeep-project/ssdeep
+cd ssdeep/
+
+./bootstrap
+./configure
+
+make
+make install
+
 # build modsecurity library
 cd "$BUILD_PATH"
-git clone -b v$MODSECURITY_LIB_VERSION https://github.com/SpiderLabs/ModSecurity
+git clone https://github.com/SpiderLabs/ModSecurity
 cd ModSecurity/
+git checkout $MODSECURITY_LIB_VERSION
 git submodule init
 git submodule update
+
 sh build.sh
-./configure --disable-doxygen-doc --disable-examples --disable-dependency-tracking
+
+./configure \
+  --disable-doxygen-doc \
+  --disable-doxygen-html \
+  --disable-examples
+
 make
 make install
 
@@ -381,7 +442,13 @@ Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-999-EXCLUSION-RULES-AFTE
 " > /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf
 
 # build nginx
-cd "$BUILD_PATH/openresty-$OPENRESTY_VERSION"
+cd "$BUILD_PATH/nginx-$NGINX_VERSION"
+
+# apply nginx patches
+for PATCH in `ls /patches`;do
+  echo "Patch: $PATCH"
+  patch -p1 < /patches/$PATCH
+done
 
 WITH_FLAGS="--with-debug \
   --with-compat \
@@ -401,10 +468,7 @@ WITH_FLAGS="--with-debug \
   --with-stream_ssl_preread_module \
   --with-threads \
   --with-http_secure_link_module \
-  --with-http_gunzip_module \
-  --with-md5-asm \
-  --with-sha1-asm \
-  -j${CORES} "
+  --with-http_gunzip_module"
 
 # "Combining -flto with -g is currently experimental and expected to produce unexpected results."
 # https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html
@@ -434,8 +498,14 @@ if [[ ${ARCH} == "x86_64" ]]; then
   CC_OPT+=' -m64 -mtune=native'
 fi
 
-WITH_MODULES="--add-module=$BUILD_PATH/nginx-http-auth-digest-$NGINX_DIGEST_AUTH \
+WITH_MODULES="--add-module=$BUILD_PATH/ngx_devel_kit-$NDK_VERSION \
+  --add-module=$BUILD_PATH/set-misc-nginx-module-$SETMISC_VERSION \
+  --add-module=$BUILD_PATH/headers-more-nginx-module-$MORE_HEADERS_VERSION \
+  --add-module=$BUILD_PATH/nginx-http-auth-digest-$NGINX_DIGEST_AUTH \
   --add-module=$BUILD_PATH/ngx_http_substitutions_filter_module-$NGINX_SUBSTITUTIONS \
+  --add-module=$BUILD_PATH/lua-nginx-module-$LUA_NGX_VERSION \
+  --add-module=$BUILD_PATH/stream-lua-nginx-module-$LUA_STREAM_NGX_VERSION \
+  --add-module=$BUILD_PATH/lua-upstream-nginx-module-$LUA_UPSTREAM_VERSION \
   --add-module=$BUILD_PATH/nginx-influxdb-module-$NGINX_INFLUXDB_VERSION \
   --add-dynamic-module=$BUILD_PATH/nginx-opentracing-$NGINX_OPENTRACING_VERSION/opentracing \
   --add-dynamic-module=$BUILD_PATH/ModSecurity-nginx-$MODSECURITY_VERSION \
@@ -443,11 +513,19 @@ WITH_MODULES="--add-module=$BUILD_PATH/nginx-http-auth-digest-$NGINX_DIGEST_AUTH
   --add-module=$BUILD_PATH/nginx_ajp_module-${NGINX_AJP_VERSION} \
   --add-module=$BUILD_PATH/ngx_brotli"
 
-make
-
-cd openresty-1.17.4.1rc0
-
 ./configure \
+  --prefix=/usr/local/nginx \
+  --conf-path=/etc/nginx/nginx.conf \
+  --modules-path=/etc/nginx/modules \
+  --http-log-path=/var/log/nginx/access.log \
+  --error-log-path=/var/log/nginx/error.log \
+  --lock-path=/var/lock/nginx.lock \
+  --pid-path=/run/nginx.pid \
+  --http-client-body-temp-path=/var/lib/nginx/body \
+  --http-fastcgi-temp-path=/var/lib/nginx/fastcgi \
+  --http-proxy-temp-path=/var/lib/nginx/proxy \
+  --http-scgi-temp-path=/var/lib/nginx/scgi \
+  --http-uwsgi-temp-path=/var/lib/nginx/uwsgi \
   ${WITH_FLAGS} \
   --without-mail_pop3_module \
   --without-mail_smtp_module \
@@ -460,26 +538,18 @@ cd openresty-1.17.4.1rc0
   --group=www-data \
   ${WITH_MODULES}
 
-make || exit 1
-make install || exit 1
+make
+make install
 
 cd "$BUILD_PATH/luarocks-${RESTY_LUAROCKS_VERSION}"
 ./configure \
-  --prefix=/usr/local/openresty/luajit \
-  --with-lua=/usr/local/openresty/luajit \
   --lua-suffix=jit-2.1.0-beta3 \
-  --with-lua-include=/usr/local/openresty/luajit/include/luajit-2.1
-
-make || exit 1
-make install || exit 1
+  --with-lua-include=/usr/local/include/luajit-2.1
 
-export PATH=$PATH:/usr/local/openresty/luajit/bin
-
-cd /usr/local/openresty
+make
+make install
 
-# build and install lua-resty-waf with dependencies
-export LUA_LIB_DIR=/usr/local/openresty/lualib
-export LUA_INCLUDE_DIR=/tmp/build/openresty-$OPENRESTY_VERSION/openresty-1.17.4.1rc0/build/luajit-root/usr/local/openresty/luajit/include/luajit-2.1
+export LUA_INCLUDE_DIR=/usr/local/include/luajit-2.1
 
 ln -s $LUA_INCLUDE_DIR /usr/include/lua5.1
 
@@ -487,14 +557,33 @@ if [[ ${ARCH} != "armv7l" ]]; then
   luarocks install lrexlib-pcre 2.7.2-1 PCRE_LIBDIR=${PCRE_DIR}
 fi
 
+cd "$BUILD_PATH/lua-resty-core-$LUA_RESTY_CORE"
+make install
+
+cd "$BUILD_PATH/lua-resty-balancer-$LUA_RESTY_BALANCER"
+make all
+make install
+
+cd "$BUILD_PATH/lua-cjson-$LUA_CJSON_VERSION"
+make all
+make install
+
 luarocks install lua-resty-iputils 0.3.0-1
 luarocks install lua-resty-cookie 0.1.0-1
+luarocks install lua-resty-lrucache 0.09-2
+luarocks install lua-resty-lock 0.08-0
+luarocks install lua-resty-dns 0.21-1
 
-cd "$BUILD_PATH/lua-resty-balancer-$LUA_RESTY_BALANCER_VERSION"
+# required for OCSP verification
+luarocks install lua-resty-http
 
-make
+cd "$BUILD_PATH/lua-resty-upload-0.10"
+make install
+
+cd "$BUILD_PATH/lua-resty-string-0.11"
 make install
 
+
 # build Lua bridge tracer
 cd "$BUILD_PATH/lua-bridge-tracer-$LUA_BRIDGE_TRACER_VERSION"
 mkdir .build
@@ -513,76 +602,22 @@ cmake ../..
 make
 make install
 
-echo "Cleaning..."
-
-cd /
-
-apt-mark unmarkauto \
-  bash \
-  curl ca-certificates \
-  libgeoip1 \
-  libpcre3 \
-  zlib1g \
-  libaio1 \
-  geoip-bin \
-  libyajl2 liblmdb0 libxml2 libpcre++ \
-  gzip \
-  openssl \
-  libyaml-cpp0.6
-
-apt-get remove -y --purge \
-  build-essential \
-  libgeoip-dev \
-  libpcre3-dev \
-  libssl-dev \
-  zlib1g-dev \
-  libaio-dev \
-  linux-libc-dev \
-  cmake \
-  wget \
-  patch \
-  protobuf-compiler \
-  python \
-  xz-utils \
-  bc \
-  sensible-utils \
-  git g++ pkgconf flex bison doxygen libyajl-dev liblmdb-dev libgeoip-dev libtool dh-autoreconf libpcre++-dev libxml2-dev
-
-apt-get autoremove -y
-
-# Remove configuration files left after the package removal.
-# To see such packages run: apt list | grep residual
-dpkg -l | grep '^rc' | awk '{print $2}' | xargs apt-get purge --yes
-
-rm -rf "$BUILD_PATH"
-rm -Rf /usr/share/man /usr/share/doc
-rm -rf /tmp/* /var/tmp/*
-rm -rf /var/lib/apt/lists/*
-rm -rf /var/cache/apt/archives/*
-rm -rf /usr/local/modsecurity/bin
-rm -rf /usr/local/modsecurity/include
-rm -rf /usr/local/modsecurity/lib/libmodsecurity.a
-
-rm -rf /root/.cache
-
-rm -rf /etc/nginx/owasp-modsecurity-crs/.git
-rm -rf /etc/nginx/owasp-modsecurity-crs/util/regression-tests
-
-rm -rf $HOME/.hunter
-
-rm -rf $LUA_INCLUDE_DIR /usr/include/lua5.1
-
 # update image permissions
 writeDirs=( \
   /etc/nginx \
-  /usr/local/openresty/nginx \
+  /usr/local/nginx \
   /opt/modsecurity/var/log \
   /opt/modsecurity/var/upload \
   /opt/modsecurity/var/audit \
   /var/log/audit \
+  /var/log/nginx \
 );
 
 for dir in "${writeDirs[@]}"; do
   mkdir -p ${dir};
   chown -R www-data.www-data ${dir};
 done
+
+rm -rf /etc/nginx/owasp-modsecurity-crs/.git
+rm -rf /etc/nginx/owasp-modsecurity-crs/util/regression-tests
+rm -rf /usr/local/modsecurity/lib/libmodsecurity.a

From 9ba628905483ba2ddccf5f4af0a9270ae11195a3 Mon Sep 17 00:00:00 2001
From: Manuel Alejandro de Brito Fontes <aledbf@gmail.com>
Date: Wed, 25 Dec 2019 15:37:32 -0300
Subject: [PATCH 2/3] Add nginx patches

---
 .../nginx-1.17.4-balancer_status_code.patch   |  72 +++++++++++
 .../nginx-1.17.4-larger_max_error_str.patch   |  13 ++
 ...nx-1.17.4-reuseport_close_unused_fds.patch |  38 ++++++
 ...-1.17.4-single_process_graceful_exit.patch |  53 +++++++++
 .../nginx-1.17.4-ssl_cert_cb_yield.patch      |  64 ++++++++++
 .../nginx-1.17.4-ssl_sess_cb_yield.patch      |  41 +++++++
 ...nginx-1.17.4-upstream_timeout_fields.patch | 112 ++++++++++++++++++
 7 files changed, 393 insertions(+)
 create mode 100644 images/nginx/rootfs/patches/nginx-1.17.4-balancer_status_code.patch
 create mode 100644 images/nginx/rootfs/patches/nginx-1.17.4-larger_max_error_str.patch
 create mode 100644 images/nginx/rootfs/patches/nginx-1.17.4-reuseport_close_unused_fds.patch
 create mode 100644 images/nginx/rootfs/patches/nginx-1.17.4-single_process_graceful_exit.patch
 create mode 100644 images/nginx/rootfs/patches/nginx-1.17.4-ssl_cert_cb_yield.patch
 create mode 100644 images/nginx/rootfs/patches/nginx-1.17.4-ssl_sess_cb_yield.patch
 create mode 100644 images/nginx/rootfs/patches/nginx-1.17.4-upstream_timeout_fields.patch

diff --git a/images/nginx/rootfs/patches/nginx-1.17.4-balancer_status_code.patch b/images/nginx/rootfs/patches/nginx-1.17.4-balancer_status_code.patch
new file mode 100644
index 0000000000..c4d87e2fb2
--- /dev/null
+++ b/images/nginx/rootfs/patches/nginx-1.17.4-balancer_status_code.patch
@@ -0,0 +1,72 @@
+diff --git a/src/http/ngx_http_upstream.c b/src/http/ngx_http_upstream.c
+index f8d5707d..6efe0047 100644
+--- a/src/http/ngx_http_upstream.c
++++ b/src/http/ngx_http_upstream.c
+@@ -1515,6 +1515,11 @@ ngx_http_upstream_connect(ngx_http_request_t *r, ngx_http_upstream_t *u)
+         return;
+     }
+ 
++    if (rc >= NGX_HTTP_SPECIAL_RESPONSE) {
++        ngx_http_upstream_finalize_request(r, u, rc);
++        return;
++    }
++
+     u->state->peer = u->peer.name;
+ 
+     if (rc == NGX_BUSY) {
+diff --git a/src/http/ngx_http_upstream.h b/src/http/ngx_http_upstream.h
+index 3e714e5b..dfbb25e0 100644
+--- a/src/http/ngx_http_upstream.h
++++ b/src/http/ngx_http_upstream.h
+@@ -427,4 +427,9 @@ extern ngx_conf_bitmask_t  ngx_http_upstream_cache_method_mask[];
+ extern ngx_conf_bitmask_t  ngx_http_upstream_ignore_headers_masks[];
+ 
+ 
++#ifndef HAVE_BALANCER_STATUS_CODE_PATCH
++#define HAVE_BALANCER_STATUS_CODE_PATCH
++#endif
++
++
+ #endif /* _NGX_HTTP_UPSTREAM_H_INCLUDED_ */
+diff --git a/src/stream/ngx_stream.h b/src/stream/ngx_stream.h
+index 09d24593..d8b4b584 100644
+--- a/src/stream/ngx_stream.h
++++ b/src/stream/ngx_stream.h
+@@ -27,6 +27,7 @@ typedef struct ngx_stream_session_s  ngx_stream_session_t;
+ 
+ 
+ #define NGX_STREAM_OK                        200
++#define NGX_STREAM_SPECIAL_RESPONSE          300
+ #define NGX_STREAM_BAD_REQUEST               400
+ #define NGX_STREAM_FORBIDDEN                 403
+ #define NGX_STREAM_INTERNAL_SERVER_ERROR     500
+diff --git a/src/stream/ngx_stream_proxy_module.c b/src/stream/ngx_stream_proxy_module.c
+index 818d7329..329dcdc6 100644
+--- a/src/stream/ngx_stream_proxy_module.c
++++ b/src/stream/ngx_stream_proxy_module.c
+@@ -691,6 +691,11 @@ ngx_stream_proxy_connect(ngx_stream_session_t *s)
+         return;
+     }
+ 
++    if (rc >= NGX_STREAM_SPECIAL_RESPONSE) {
++        ngx_stream_proxy_finalize(s, rc);
++        return;
++    }
++
+     u->state->peer = u->peer.name;
+ 
+     if (rc == NGX_BUSY) {
+diff --git a/src/stream/ngx_stream_upstream.h b/src/stream/ngx_stream_upstream.h
+index 73947f46..21bc0ad7 100644
+--- a/src/stream/ngx_stream_upstream.h
++++ b/src/stream/ngx_stream_upstream.h
+@@ -151,4 +151,9 @@ ngx_stream_upstream_srv_conf_t *ngx_stream_upstream_add(ngx_conf_t *cf,
+ extern ngx_module_t  ngx_stream_upstream_module;
+ 
+ 
++#ifndef HAVE_BALANCER_STATUS_CODE_PATCH
++#define HAVE_BALANCER_STATUS_CODE_PATCH
++#endif
++
++
+ #endif /* _NGX_STREAM_UPSTREAM_H_INCLUDED_ */
diff --git a/images/nginx/rootfs/patches/nginx-1.17.4-larger_max_error_str.patch b/images/nginx/rootfs/patches/nginx-1.17.4-larger_max_error_str.patch
new file mode 100644
index 0000000000..77137f2640
--- /dev/null
+++ b/images/nginx/rootfs/patches/nginx-1.17.4-larger_max_error_str.patch
@@ -0,0 +1,13 @@
+--- nginx-1.17.4/src/core/ngx_log.h	2013-10-08 05:07:14.000000000 -0700
++++ nginx-1.17.4-patched/src/core/ngx_log.h	2013-12-05 20:35:35.996236720 -0800
+@@ -64,7 +64,9 @@ struct ngx_log_s {
+ };
+ 
+ 
+-#define NGX_MAX_ERROR_STR   2048
++#ifndef NGX_MAX_ERROR_STR
++#define NGX_MAX_ERROR_STR   4096
++#endif
+ 
+ 
+ /*********************************/
diff --git a/images/nginx/rootfs/patches/nginx-1.17.4-reuseport_close_unused_fds.patch b/images/nginx/rootfs/patches/nginx-1.17.4-reuseport_close_unused_fds.patch
new file mode 100644
index 0000000000..ff4a36fd22
--- /dev/null
+++ b/images/nginx/rootfs/patches/nginx-1.17.4-reuseport_close_unused_fds.patch
@@ -0,0 +1,38 @@
+diff --git a/src/core/ngx_connection.c b/src/core/ngx_connection.c
+--- a/src/core/ngx_connection.c
++++ b/src/core/ngx_connection.c
+@@ -1118,6 +1118,12 @@ ngx_close_listening_sockets(ngx_cycle_t *cycle)
+     ls = cycle->listening.elts;
+     for (i = 0; i < cycle->listening.nelts; i++) {
+ 
++#if (NGX_HAVE_REUSEPORT)
++        if (ls[i].fd == (ngx_socket_t) -1) {
++            continue;
++        }
++#endif
++
+         c = ls[i].connection;
+ 
+         if (c) {
+diff --git a/src/event/ngx_event.c b/src/event/ngx_event.c
+--- a/src/event/ngx_event.c
++++ b/src/event/ngx_event.c
+@@ -775,6 +775,18 @@ ngx_event_process_init(ngx_cycle_t *cycle)
+ 
+ #if (NGX_HAVE_REUSEPORT)
+         if (ls[i].reuseport && ls[i].worker != ngx_worker) {
++            ngx_log_debug2(NGX_LOG_DEBUG_CORE, cycle->log, 0,
++                           "closing unused fd:%d listening on %V",
++                           ls[i].fd, &ls[i].addr_text);
++
++            if (ngx_close_socket(ls[i].fd) == -1) {
++                ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_socket_errno,
++                              ngx_close_socket_n " %V failed",
++                              &ls[i].addr_text);
++            }
++
++            ls[i].fd = (ngx_socket_t) -1;
++
+             continue;
+         }
+ #endif
diff --git a/images/nginx/rootfs/patches/nginx-1.17.4-single_process_graceful_exit.patch b/images/nginx/rootfs/patches/nginx-1.17.4-single_process_graceful_exit.patch
new file mode 100644
index 0000000000..095e7fff70
--- /dev/null
+++ b/images/nginx/rootfs/patches/nginx-1.17.4-single_process_graceful_exit.patch
@@ -0,0 +1,53 @@
+diff --git a/src/os/unix/ngx_process_cycle.c b/src/os/unix/ngx_process_cycle.c
+index 1710ea81..b379da9c 100644
+--- a/src/os/unix/ngx_process_cycle.c
++++ b/src/os/unix/ngx_process_cycle.c
+@@ -304,11 +304,26 @@ ngx_single_process_cycle(ngx_cycle_t *cycle)
+     }
+ 
+     for ( ;; ) {
++        if (ngx_exiting) {
++            if (ngx_event_no_timers_left() == NGX_OK) {
++                ngx_log_error(NGX_LOG_NOTICE, cycle->log, 0, "exiting");
++
++                for (i = 0; cycle->modules[i]; i++) {
++                    if (cycle->modules[i]->exit_process) {
++                        cycle->modules[i]->exit_process(cycle);
++                    }
++                }
++
++                ngx_master_process_exit(cycle);
++            }
++        }
++
+         ngx_log_debug0(NGX_LOG_DEBUG_EVENT, cycle->log, 0, "worker cycle");
+ 
+         ngx_process_events_and_timers(cycle);
+ 
+-        if (ngx_terminate || ngx_quit) {
++        if (ngx_terminate) {
++            ngx_log_error(NGX_LOG_NOTICE, cycle->log, 0, "exiting");
+ 
+             for (i = 0; cycle->modules[i]; i++) {
+                 if (cycle->modules[i]->exit_process) {
+@@ -319,6 +334,20 @@ ngx_single_process_cycle(ngx_cycle_t *cycle)
+             ngx_master_process_exit(cycle);
+         }
+ 
++        if (ngx_quit) {
++            ngx_quit = 0;
++            ngx_log_error(NGX_LOG_NOTICE, cycle->log, 0,
++                          "gracefully shutting down");
++            ngx_setproctitle("process is shutting down");
++
++            if (!ngx_exiting) {
++                ngx_exiting = 1;
++                ngx_set_shutdown_timer(cycle);
++                ngx_close_listening_sockets(cycle);
++                ngx_close_idle_connections(cycle);
++            }
++        }
++
+         if (ngx_reconfigure) {
+             ngx_reconfigure = 0;
+             ngx_log_error(NGX_LOG_NOTICE, cycle->log, 0, "reconfiguring");
diff --git a/images/nginx/rootfs/patches/nginx-1.17.4-ssl_cert_cb_yield.patch b/images/nginx/rootfs/patches/nginx-1.17.4-ssl_cert_cb_yield.patch
new file mode 100644
index 0000000000..89773c05ef
--- /dev/null
+++ b/images/nginx/rootfs/patches/nginx-1.17.4-ssl_cert_cb_yield.patch
@@ -0,0 +1,64 @@
+# HG changeset patch
+# User Yichun Zhang <agentzh@openresty.org>
+# Date 1451762084 28800
+#      Sat Jan 02 11:14:44 2016 -0800
+# Node ID 449f0461859c16e95bdb18e8be6b94401545d3dd
+# Parent  78b4e10b4367b31367aad3c83c9c3acdd42397c4
+SSL: handled SSL_CTX_set_cert_cb() callback yielding.
+
+OpenSSL 1.0.2+ introduces SSL_CTX_set_cert_cb() to allow custom
+callbacks to serve the SSL certificiates and private keys dynamically
+and lazily. The callbacks may yield for nonblocking I/O or sleeping.
+Here we added support for such usage in NGINX 3rd-party modules
+(like ngx_lua) in NGINX's event handlers for downstream SSL
+connections.
+
+diff -r 78b4e10b4367 -r 449f0461859c src/event/ngx_event_openssl.c
+--- a/src/event/ngx_event_openssl.c Thu Dec 17 16:39:15 2015 +0300
++++ b/src/event/ngx_event_openssl.c Sat Jan 02 11:14:44 2016 -0800
+@@ -1445,6 +1445,23 @@ ngx_ssl_handshake(ngx_connection_t *c)
+         return NGX_AGAIN;
+     }
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x10002000L
++    if (sslerr == SSL_ERROR_WANT_X509_LOOKUP) {
++        c->read->handler = ngx_ssl_handshake_handler;
++        c->write->handler = ngx_ssl_handshake_handler;
++
++        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
++            return NGX_ERROR;
++        }
++
++        if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
++            return NGX_ERROR;
++        }
++
++        return NGX_AGAIN;
++    }
++#endif
++
+     err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
+ 
+     c->ssl->no_wait_shutdown = 1;
+@@ -1558,6 +1575,21 @@ ngx_ssl_try_early_data(ngx_connection_t *c)
+         return NGX_AGAIN;
+     }
+ 
++    if (sslerr == SSL_ERROR_WANT_X509_LOOKUP) {
++        c->read->handler = ngx_ssl_handshake_handler;
++        c->write->handler = ngx_ssl_handshake_handler;
++
++        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
++            return NGX_ERROR;
++        }
++
++        if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
++            return NGX_ERROR;
++        }
++
++        return NGX_AGAIN;
++    }
++
+     err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
+ 
+     c->ssl->no_wait_shutdown = 1;
diff --git a/images/nginx/rootfs/patches/nginx-1.17.4-ssl_sess_cb_yield.patch b/images/nginx/rootfs/patches/nginx-1.17.4-ssl_sess_cb_yield.patch
new file mode 100644
index 0000000000..ac5fe65eb2
--- /dev/null
+++ b/images/nginx/rootfs/patches/nginx-1.17.4-ssl_sess_cb_yield.patch
@@ -0,0 +1,41 @@
+diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
+--- a/src/event/ngx_event_openssl.c
++++ b/src/event/ngx_event_openssl.c
+@@ -1446,7 +1446,12 @@ ngx_ssl_handshake(ngx_connection_t *c)
+     }
+ 
+ #if OPENSSL_VERSION_NUMBER >= 0x10002000L
+-    if (sslerr == SSL_ERROR_WANT_X509_LOOKUP) {
++    if (sslerr == SSL_ERROR_WANT_X509_LOOKUP
++#   ifdef SSL_ERROR_PENDING_SESSION
++        || sslerr == SSL_ERROR_PENDING_SESSION
++#   endif
++       )
++    {
+         c->read->handler = ngx_ssl_handshake_handler;
+         c->write->handler = ngx_ssl_handshake_handler;
+ 
+@@ -1575,6 +1580,23 @@ ngx_ssl_try_early_data(ngx_connection_t *c)
+         return NGX_AGAIN;
+     }
+ 
++#ifdef SSL_ERROR_PENDING_SESSION
++    if (sslerr == SSL_ERROR_PENDING_SESSION) {
++        c->read->handler = ngx_ssl_handshake_handler;
++        c->write->handler = ngx_ssl_handshake_handler;
++
++        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
++            return NGX_ERROR;
++        }
++
++        if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
++            return NGX_ERROR;
++        }
++
++        return NGX_AGAIN;
++    }
++#endif
++
+     err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
+ 
+     c->ssl->no_wait_shutdown = 1;
diff --git a/images/nginx/rootfs/patches/nginx-1.17.4-upstream_timeout_fields.patch b/images/nginx/rootfs/patches/nginx-1.17.4-upstream_timeout_fields.patch
new file mode 100644
index 0000000000..2314ddf801
--- /dev/null
+++ b/images/nginx/rootfs/patches/nginx-1.17.4-upstream_timeout_fields.patch
@@ -0,0 +1,112 @@
+diff --git a/src/http/ngx_http_upstream.c b/src/http/ngx_http_upstream.c
+index 69019417..2265d8f7 100644
+--- a/src/http/ngx_http_upstream.c
++++ b/src/http/ngx_http_upstream.c
+@@ -509,12 +509,19 @@ void
+ ngx_http_upstream_init(ngx_http_request_t *r)
+ {
+     ngx_connection_t     *c;
++    ngx_http_upstream_t  *u;
+ 
+     c = r->connection;
+ 
+     ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0,
+                    "http init upstream, client timer: %d", c->read->timer_set);
+ 
++    u = r->upstream;
++
++    u->connect_timeout = u->conf->connect_timeout;
++    u->send_timeout = u->conf->send_timeout;
++    u->read_timeout = u->conf->read_timeout;
++
+ #if (NGX_HTTP_V2)
+     if (r->stream) {
+         ngx_http_upstream_init_request(r);
+@@ -1626,7 +1633,7 @@ ngx_http_upstream_connect(ngx_http_request_t *r, ngx_http_upstream_t *u)
+     u->request_body_blocked = 0;
+ 
+     if (rc == NGX_AGAIN) {
+-        ngx_add_timer(c->write, u->conf->connect_timeout);
++        ngx_add_timer(c->write, u->connect_timeout);
+         return;
+     }
+ 
+@@ -1704,7 +1711,7 @@ ngx_http_upstream_ssl_init_connection(ngx_http_request_t *r,
+     if (rc == NGX_AGAIN) {
+ 
+         if (!c->write->timer_set) {
+-            ngx_add_timer(c->write, u->conf->connect_timeout);
++            ngx_add_timer(c->write, u->connect_timeout);
+         }
+ 
+         c->ssl->handler = ngx_http_upstream_ssl_handshake_handler;
+@@ -2022,7 +2029,7 @@ ngx_http_upstream_send_request(ngx_http_request_t *r, ngx_http_upstream_t *u,
+ 
+     if (rc == NGX_AGAIN) {
+         if (!c->write->ready || u->request_body_blocked) {
+-            ngx_add_timer(c->write, u->conf->send_timeout);
++            ngx_add_timer(c->write, u->send_timeout);
+ 
+         } else if (c->write->timer_set) {
+             ngx_del_timer(c->write);
+@@ -2084,7 +2091,7 @@ ngx_http_upstream_send_request(ngx_http_request_t *r, ngx_http_upstream_t *u,
+             return;
+         }
+ 
+-        ngx_add_timer(c->read, u->conf->read_timeout);
++        ngx_add_timer(c->read, u->read_timeout);
+ 
+         if (c->read->ready) {
+             ngx_http_upstream_process_header(r, u);
+@@ -3213,7 +3220,7 @@ ngx_http_upstream_send_response(ngx_http_request_t *r, ngx_http_upstream_t *u)
+         p->cyclic_temp_file = 0;
+     }
+ 
+-    p->read_timeout = u->conf->read_timeout;
++    p->read_timeout = u->read_timeout;
+     p->send_timeout = clcf->send_timeout;
+     p->send_lowat = clcf->send_lowat;
+ 
+@@ -3458,7 +3465,7 @@ ngx_http_upstream_process_upgraded(ngx_http_request_t *r,
+     }
+ 
+     if (upstream->write->active && !upstream->write->ready) {
+-        ngx_add_timer(upstream->write, u->conf->send_timeout);
++        ngx_add_timer(upstream->write, u->send_timeout);
+ 
+     } else if (upstream->write->timer_set) {
+         ngx_del_timer(upstream->write);
+@@ -3470,7 +3477,7 @@ ngx_http_upstream_process_upgraded(ngx_http_request_t *r,
+     }
+ 
+     if (upstream->read->active && !upstream->read->ready) {
+-        ngx_add_timer(upstream->read, u->conf->read_timeout);
++        ngx_add_timer(upstream->read, u->read_timeout);
+ 
+     } else if (upstream->read->timer_set) {
+         ngx_del_timer(upstream->read);
+@@ -3664,7 +3671,7 @@ ngx_http_upstream_process_non_buffered_request(ngx_http_request_t *r,
+     }
+ 
+     if (upstream->read->active && !upstream->read->ready) {
+-        ngx_add_timer(upstream->read, u->conf->read_timeout);
++        ngx_add_timer(upstream->read, u->read_timeout);
+ 
+     } else if (upstream->read->timer_set) {
+         ngx_del_timer(upstream->read);
+diff --git a/src/http/ngx_http_upstream.h b/src/http/ngx_http_upstream.h
+index c2f4dc0b..b9eef118 100644
+--- a/src/http/ngx_http_upstream.h
++++ b/src/http/ngx_http_upstream.h
+@@ -333,6 +333,11 @@ struct ngx_http_upstream_s {
+     ngx_array_t                     *caches;
+ #endif
+ 
++#define HAVE_NGX_UPSTREAM_TIMEOUT_FIELDS  1
++    ngx_msec_t                       connect_timeout;
++    ngx_msec_t                       send_timeout;
++    ngx_msec_t                       read_timeout;
++
+     ngx_http_upstream_headers_in_t   headers_in;
+ 
+     ngx_http_upstream_resolved_t    *resolved;

From 048ce1a130fc1a664c987d1e4829d96ba1422e59 Mon Sep 17 00:00:00 2001
From: Manuel Alejandro de Brito Fontes <aledbf@gmail.com>
Date: Fri, 27 Dec 2019 19:45:05 -0300
Subject: [PATCH 3/3] Migrate to alpine linux

---
 images/nginx/Makefile          |  4 --
 images/nginx/README.md         |  6 +--
 images/nginx/rc.yaml           |  4 +-
 images/nginx/rootfs/Dockerfile | 43 +++++++++------------
 images/nginx/rootfs/build.sh   | 70 +++++++++++++++-------------------
 5 files changed, 53 insertions(+), 74 deletions(-)

diff --git a/images/nginx/Makefile b/images/nginx/Makefile
index 086251fe36..e52e8bf88a 100644
--- a/images/nginx/Makefile
+++ b/images/nginx/Makefile
@@ -32,9 +32,6 @@ IMGNAME = nginx
 IMAGE = $(REGISTRY)/$(IMGNAME)
 MULTI_ARCH_IMG = $(IMAGE)-$(ARCH)
 
-# Set default base image dynamically for each arch
-BASEIMAGE?=quay.io/kubernetes-ingress-controller/debian-base-$(ARCH):0.1
-
 ifeq ($(ARCH),arm)
 	QEMUARCH=arm
 endif
@@ -62,7 +59,6 @@ all-push: $(addprefix sub-push-,$(ALL_ARCH))
 container: .container-$(ARCH)
 .container-$(ARCH):
 	cp -r ./rootfs/* $(TEMP_DIR)
-	cd $(TEMP_DIR) && $(SED_I) 's|BASEIMAGE|$(BASEIMAGE)|g' Dockerfile
 	cd $(TEMP_DIR) && $(SED_I) "s|ARCH|$(QEMUARCH)|g" Dockerfile
 
 ifeq ($(ARCH),amd64)
diff --git a/images/nginx/README.md b/images/nginx/README.md
index 2cffdac2e7..f06f8dc37e 100644
--- a/images/nginx/README.md
+++ b/images/nginx/README.md
@@ -1,6 +1,4 @@
-OpenResty base image using [debian-base](https://quay.io/kubernetes-ingress-controller/debian-base-amd64)
-
-OpenResty® is a dynamic web platform based on NGINX and LuaJIT.
+NGINX base image using [alpine](https://www.alpinelinux.org/)
 
 This custom image contains:
 
@@ -20,7 +18,7 @@ This image provides a default configuration file with no backend servers.
 _Using docker_
 
 ```console
-docker run -v /some/nginx.con:/etc/nginx/nginx.conf:ro quay.io/kubernetes-ingress-controller/nginx:0.90
+docker run -v /some/nginx.con:/etc/nginx/nginx.conf:ro quay.io/kubernetes-ingress-controller/nginx:0.95
 ```
 
 _Creating a replication controller_
diff --git a/images/nginx/rc.yaml b/images/nginx/rc.yaml
index 084109814f..f5ce5521a4 100644
--- a/images/nginx/rc.yaml
+++ b/images/nginx/rc.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: nginxsvc
+  name: nginx
   labels:
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
@@ -38,7 +38,7 @@ spec:
     spec:
       containers:
         - name: nginx
-          image: quay.io/kubernetes-ingress-controller/nginx:0.90
+          image: quay.io/kubernetes-ingress-controller/nginx:0.95
           ports:
             - containerPort: 80
             - containerPort: 443
diff --git a/images/nginx/rootfs/Dockerfile b/images/nginx/rootfs/Dockerfile
index b8af478f0e..e4767dfe7b 100644
--- a/images/nginx/rootfs/Dockerfile
+++ b/images/nginx/rootfs/Dockerfile
@@ -13,18 +13,17 @@
 # limitations under the License.
 
 
-FROM BASEIMAGE as builder
+FROM alpine:3.11 as builder
 
 CROSS_BUILD_COPY qemu-ARCH-static /usr/bin/
 
-RUN clean-install bash
-
 COPY . /
 
-RUN /build.sh
+RUN apk add -U bash \
+  && /build.sh
 
 # Use a multi-stage build
-FROM BASEIMAGE
+FROM alpine:3.11
 
 ENV PATH=$PATH:/usr/local/luajit/bin:/usr/local/nginx/sbin:/usr/local/nginx/bin
 
@@ -33,33 +32,29 @@ ENV LUA_CPATH="/usr/local/lib/lua/?/?.so;/usr/local/lib/lua/?.so;;"
 
 COPY --from=builder /usr/local /usr/local
 COPY --from=builder /opt /opt
-COPY --chown=www-data:www-data --from=builder /etc/nginx /etc/nginx
+COPY --from=builder /etc/nginx /etc/nginx
 
-RUN apt-get update && apt-get dist-upgrade -y \
-  && clean-install \
+RUN apk add -U --no-cache \
     bash \
+    openssl \
+    pcre \
+    zlib \
+    geoip \
     curl ca-certificates \
-    libgeoip1 \
     patch \
-    libpcre3 \
-    zlib1g \
-    libaio1 \
-    openssl \
-    util-linux \
-    lmdb-utils \
-    libcurl4 \
-    libprotobuf17 \
-    libz3-4 \
-    procps \
-    libxml2 libpcre++0v5 \
-    liblmdb0 \
-    libmaxminddb0 \
+    yajl \
+    lmdb \
+    libxml2 \
+    libmaxminddb \
+    yaml-cpp \
     dumb-init \
     nano \
-    libyaml-cpp0.6 \
-    libyajl2 \
+    tzdata \
   && ln -s /usr/local/nginx/sbin/nginx /sbin/nginx \
   && ln -s /usr/local/lib/mimalloc-1.2/libmimalloc.so /usr/local/lib/libmimalloc.so \
+  && addgroup -Sg 101 www-data \
+  && adduser -S -D -H -u 101 -h /usr/local/nginx \
+    -s /sbin/nologin -G www-data -g www-data www-data \
   && bash -eu -c ' \
   writeDirs=( \
     /var/log/nginx \
diff --git a/images/nginx/rootfs/build.sh b/images/nginx/rootfs/build.sh
index c9248d3325..802e8f170b 100755
--- a/images/nginx/rootfs/build.sh
+++ b/images/nginx/rootfs/build.sh
@@ -67,47 +67,47 @@ get_src()
   rm -rf "$f"
 }
 
-apt-get update && apt-get dist-upgrade -y
+apk update
+apk upgrade
 
 # install required packages to build
-clean-install \
+apk add \
   bash \
-  build-essential \
+  gcc \
+  clang \
+  libc-dev \
+  make \
+  automake \
+  openssl-dev \
+  pcre-dev \
+  zlib-dev \
+  linux-headers \
+  libxslt-dev \
+  gd-dev \
+  geoip-dev \
+  perl-dev \
+  libedit-dev \
+  mercurial \
+  alpine-sdk \
+  findutils \
   curl ca-certificates \
-  libgeoip1 \
-  libgeoip-dev \
+  geoip-dev \
   patch \
-  libpcre3 \
-  libpcre3-dev \
-  libssl-dev \
-  zlib1g \
-  zlib1g-dev \
-  libaio1 \
   libaio-dev \
   openssl \
-  libperl-dev \
   cmake \
   util-linux \
-  lmdb-utils \
+  lmdb-tools \
   wget \
-  libcurl4-openssl-dev \
-  libprotobuf-dev protobuf-compiler \
-  libz-dev \
-  git g++ pkgconf flex bison doxygen libyajl-dev liblmdb-dev libtool dh-autoreconf libxml2 libpcre++-dev libxml2-dev \
+  curl-dev \
+  libprotobuf \
+  git g++ pkgconf flex bison doxygen yajl-dev lmdb-dev libtool autoconf libxml2 pcre-dev libxml2-dev \
   python \
   libmaxminddb-dev \
   bc \
   unzip \
   dos2unix mercurial \
-  libyaml-cpp0.6 \
-  || exit 1
-
-# https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1667178.html
-if [[ ${ARCH} == "armv7l" ]]; then
-  echo "Fixing ca-certificates"
-  touch /etc/ssl/certs/ca-certificates.crt
-  c_rehash
-fi
+  yaml-cpp
 
 mkdir -p /etc/nginx
 
@@ -229,18 +229,6 @@ cd "$BUILD_PATH/luajit2-$LUAJIT_VERSION"
 make CCDEBUG=-g
 make install
 
-if [[ ${ARCH} == "armv7l" ]]; then
-  export PCRE_DIR=/usr/lib/arm-linux-gnueabihf
-fi
-
-if [[ ${ARCH} == "x86_64" ]]; then
-  export PCRE_DIR=/usr/lib/x86_64-linux-gnu
-fi
-
-if [[ ${ARCH} == "aarch64" ]]; then
-  export PCRE_DIR=/usr/lib/aarch64-linux-gnu
-fi
-
 cd "$BUILD_PATH"
 
 # install openresty-gdb-utils
@@ -554,7 +542,7 @@ export LUA_INCLUDE_DIR=/usr/local/include/luajit-2.1
 ln -s $LUA_INCLUDE_DIR /usr/include/lua5.1
 
 if [[ ${ARCH} != "armv7l" ]]; then
-  luarocks install lrexlib-pcre 2.7.2-1 PCRE_LIBDIR=${PCRE_DIR}
+  luarocks install lrexlib-pcre 2.7.2-1
 fi
 
 cd "$BUILD_PATH/lua-resty-core-$LUA_RESTY_CORE"
@@ -583,7 +571,6 @@ make install
 cd "$BUILD_PATH/lua-resty-string-0.11"
 make install
 
-
 # build Lua bridge tracer
 cd "$BUILD_PATH/lua-bridge-tracer-$LUA_BRIDGE_TRACER_VERSION"
 mkdir .build
@@ -613,6 +600,9 @@ writeDirs=( \
   /var/log/nginx \
 );
 
+addgroup -Sg 101 www-data
+adduser -S -D -H -u 101 -h /usr/local/nginx -s /sbin/nologin -G www-data -g www-data www-data
+
 for dir in "${writeDirs[@]}"; do
   mkdir -p ${dir};
   chown -R www-data.www-data ${dir};