feat(container): drop privileges.

wiremind · Apr 5, 2022 · d7d843a · d7d843a
1 parent 9cc7ef2
commit d7d843a
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/container/Dockerfile b/container/Dockerfile
@@ -18,7 +18,7 @@ RUN npm run build
 
 ### Second stage
 ### Build "serve" image with nginx + dist from second stage
-FROM nginx:mainline as serve
+FROM nginxinc/nginx-unprivileged:mainline as serve
 
 # Can be dynamicaly changed if your backend is located somewhere else (also takes unix sockets)
 ENV REMOULADE_BACKEND_LOCATION=http://127.0.0.1:5000

diff --git a/container/nginx-remoulade.conf.template b/container/nginx-remoulade.conf.template
@@ -1,5 +1,12 @@
 access_log off;
 
+# No temporary files
+proxy_buffering off;
+# These two should be the same or nginx will start writing
+# large request bodies to temp files
+client_body_buffer_size 10m;
+client_max_body_size    10m;
+
 map $http_upgrade $connection_upgrade {
   default upgrade;
   '' close;