Containerfile.pkg.j2

ARG BASE_VERSION=15.1

# Builder: setgroups@FBSD_1.8 shim, preloaded on FreeBSD 14 kernels (see
# /daemonless/libexec/nginx).
FROM ghcr.io/daemonless/base-exec:${BASE_VERSION} AS shim-builder

RUN pkg update && pkg install -y FreeBSD-clang FreeBSD-clibs-dev && \
    pkg clean -ay && rm -rf /var/cache/pkg/* /var/db/pkg/repos/* && \
    printf '#include <sys/types.h>\n#include <sys/syscall.h>\n#include <unistd.h>\n__asm__(".symver _sg_compat, setgroups@FBSD_1.8");\nint _sg_compat(int n, const gid_t *g) { return syscall(80, n, g); }\n' \
        > /tmp/fbsd14compat.c && \
    printf 'FBSD_1.8 { global: setgroups; local: *; };\n' > /tmp/fbsd14compat.map && \
    clang -shared -fPIC -Wl,--version-script=/tmp/fbsd14compat.map \
        -o /tmp/libfbsd14compat.so /tmp/fbsd14compat.c

FROM ghcr.io/daemonless/base-exec:${BASE_VERSION}

ARG FREEBSD_ARCH=amd64
ARG PKG_NAME="nginx"
ARG PACKAGES="nginx"
ARG HEALTHCHECK_ENDPOINT="http://localhost:80/daemonless-ping"
ENV HEALTHCHECK_URL="${HEALTHCHECK_ENDPOINT}"

LABEL org.opencontainers.image.title="{{ title }}" \
    org.opencontainers.image.description="{{ description }}" \
    org.opencontainers.image.source="{{ repo_url }}" \
    org.opencontainers.image.url="{{ web_url }}" \
    org.opencontainers.image.licenses="{{ license }}" \
    org.opencontainers.image.vendor="daemonless" \
    org.opencontainers.image.authors="daemonless" \
    io.daemonless.category="{{ category }}" \
    io.daemonless.port="80" \
    io.daemonless.arch="${FREEBSD_ARCH}" \
    io.daemonless.pkg-source="pkg" \
    io.daemonless.packages="${PACKAGES}" \
    io.daemonless.pkg-name="${PKG_NAME}" \
    io.daemonless.healthcheck-url="${HEALTHCHECK_ENDPOINT}"

RUN pkg update && \
    pkg install -y ${PACKAGES} && \
    mkdir -p /app && \
    pkg query '%v' ${PKG_NAME} > /app/version && \
    pkg clean -ay && \
    rm -rf /var/cache/pkg/* /var/db/pkg/repos/*

COPY --from=shim-builder /tmp/libfbsd14compat.so /usr/local/lib/libfbsd14compat.so
COPY root/ /

# Welcome page from the package; mount or COPY your site over it.
RUN mkdir -p /usr/local/www/html /usr/local/etc/nginx/conf.d && \
    cp /usr/local/www/nginx-dist/index.html /usr/local/www/html/ && \
    chmod +x /daemonless/libexec/nginx && \
    nginx -t && rm -rf /tmp/* # its pid and temp dirs, root-owned

# Master as root to bind port 80; workers drop to bsd (user bsd; in nginx.conf).
ENV DAEMONLESS_USER=root
STOPSIGNAL SIGQUIT
CMD ["/daemonless/libexec/nginx"]

EXPOSE 80