Docker tooling for OpenResty
docker-openresty - Docker tooling for OpenResty
docker-openresty is Docker tooling for OpenResty.
Docker is a container management platform. OpenResty is a full-fledged web application server by bundling the standard nginx core, lots of 3rd-party nginx modules, as well as most of their external dependencies.
Thank you to Travis CI for donating their build infrastructure to this project for over seven years! We have since migrated to GitHub Actions.
We provide a series of pre-built images for various operating systems. Some are built-from the upstream OpenResty pre-built images and some are built from source.
You can learn more about building your own custom and derived images in BUILDING.md. You can learn more about securing your operations in HARDENING.md.
Table of Contents =================
- Table of Contents
- OpenResty Image Tags
- Image Mirror
- Usage
- Policies
- Nginx Config Files
- OPM
- LuaRocks
- Tips & Pitfalls
- Image Labels
- Docker CMD
- Feedback & Bug Reports
- Changelog & Authors
- Copyright & License
OpenResty Image Tags
It is best practice to pin your images to an explicit image tag. The next section below covers the conventions in detail, but here are some common examples:
| Image | Description | | --- | --- | | openresty/openresty:1.29.2.4-1-resolute | Built-from-source Ubuntu Resolute Raccoon | | openresty/openresty:1.29.2.4-1-noble | Built-from-source Ubuntu Noble Narwhal | | openresty/openresty:1.29.2.4-1-jammy | Built-from-source Ubuntu Jammy Jellyfish | | openresty/openresty:1.29.2.4-1-bookworm-fat | Built-from-upstream Debian Bookworm | | openresty/openresty:1.29.2.4-1-alpine | Built-from-source Alpine | | openresty/openresty:1.29.2.4-1-alpine-apk | Built-from-upstream Alpine | | openresty/openresty:1.31.1.1-1-restyrepo | Built-from-source OpenResty GitHub branch on Debian Trixie | | openresty/openresty:1.31-alpine | Latest Alpine image in the OpenResty 1.31 release series |
These are examples of untagged image names, for reference:
| Image | Description | | --- | --- | | openresty/openresty:resolute | Latest Ubuntu Resolute | | openresty/openresty:noble | Latest Ubuntu Noble | | openresty/openresty:jammy | Latest Ubuntu Jammy | | openresty/openresty:alpine | Latest Alpine | | openresty/openresty:restyrepo | Latest OpenResty GitHub source branch build |
There are also specific tags for Debug and Valgrind OpenResty variants: | Image | Description | | --- | --- | | openresty/openresty:bullseye-debug | Bullseye flavor with openresty-debug | | openresty/openresty:bullseye-valgrind | Bullseye flavor with openresty-valgrind | | openresty/openresty:bullseye-fat-debug | Bullseye FAT flavor with openresty-debug | | openresty/openresty:bullseye-fat-valgrind | Bullseye FAT flavor with openresty-valgrind |
Image Registries
The CI/CD pipeline builds images to the GitHub Container Registry (GHCR) as the primary source. *ghcr.io/neomantra/openresty
The images are then mirrored to Docker Hub for convenience and backward compatibility.
* openresty/openresty (or docker.io/openresty/openresty)
Usage =====
If you are happy with the build defaults, then you can use the openresty image from the Docker Hub. The image tags available there are listed at the top of this README.
docker run [options] openresty/openresty:bullseye-fat[options] would be things like -p to map ports, -v to map volumes, and -d to daemonize.
docker-openresty symlinks /usr/local/openresty/nginx/logs/access.log and error.log to /dev/stdout and /dev/stderr respectively, so that Docker logging works correctly. If you change the log paths in your nginx.conf, you should symlink those paths as well. This is not possible with the windows image.
Temporary directories such as clientbodytemp_path are stored in /var/run/openresty/. You may consider mounting that volume, rather than writing to a container-local directory. This is not done for windows.
Supported tags and respective Dockerfile links =========
The following "flavors" are available and built from upstream OpenResty packages:
alpine-apk, (alpine-apk/Dockerfile)bookworm-buildpack, (bookworm/Dockerfile.buildpack)bookworm-fat, (bookworm/Dockerfile.fat)bookworm, (bookworm/Dockerfile)bullseye-fat, (bullseye/Dockerfile.fat)bullseye, (bullseye/Dockerfile)fedora,fedora-rpm, (fedora/Dockerfile withfc36)rocky, (fedora/Dockerfile withrockylinux)windows, (windows/Dockerfile)
alma, (alma/Dockerfile)alpine-fat, (alpine/Dockerfile.fat)alpine, (alpine/Dockerfile)alpine-slim, (alpine/Dockerfile, stripped Alpine image)jammy, (jammy/Dockerfile)noble, (noble/Dockerfile)restyrepo, (restyrepo/Dockerfile)
openresty/openresty:latest tag points to the latest bookworm image.
Since 1.19.3.2-1, all flavors support multi-architecture builds, both amd64 and aarch64. Since 1.21.4.1-1, the s390x architecture is supported for build-from-source Ubuntu flavors (like jammy); prior to version 1.27.1.2-3, PCRE JIT is disabled for s390x.
Starting with 1.13.6.1, releases are tagged with <openresty-version>-<image-version>-<flavor>. The latest image-version will also be tagged <openresty-version>-<flavor>. OpenResty release series are also tagged as <openresty-major>.<openresty-minor>-<flavor>, such as 1.31-alpine. The HEAD of the master branch is also labeled plainly as <flavor>. The builds are managed by GitHub Actions.
There are architecture-specific tags as well, <openresty-version>-<image-version>-<flavor>-<arch> and <openresty-major>.<openresty-minor>-<flavor>-<arch>, but one would generally pull from the multi-architecture name above.
OpenResty supports SSE 4.2 optimizations. Starting with the 1.19.3.1 series, the architecture is auto-detected and the optimizations enabled accordingly. Earlier image series 1.15.8.1 and 1.17.8.2 have -nosse42 image flavors for systems which explicitly disable SSE 4.2 support; this is useful for older systems and embedded systems. They are built with -mno-sse4.2 appended to the build arg RESTYLUAJITOPTIONS. It is highly recommended NOT to use these if your system supports SSE 4.2 because the CRC32 instruction dramatically improves large string performance. These are only for built-from-source flavors, e.g. 1.15.8.1-3-bionic-nosse42, 1.15.8.1-3-alpine-nosse42, 1.15.8.1-3-alpine-fat-nosse42.
It is highly recommended that you use the upstream-based images for best support. For best stability, pin your images to the full tag, for example 1.21.4.1-0-bionic.
The restyrepo flavor is a built-from-source image that clones the OpenResty GitHub repository, builds the OpenResty source tarball from the selected branch or tag, and then builds OpenResty from that generated tarball. It uses Debian Trixie as its base image and is published for amd64 and arm64.
-fat images are ones that have LuaRocks and OPM installed in them. -buildpack images are based on buildpack-deps images; they might be useful when more build scaffolding is required in your application.
Policies ========
The Maintainers of this OpenResty Docker Tooling operate under the following policies:
* We track OpenResty releases for build-from-upstream and will continue to add new upstream releases:
alpine-apk, (alpine-apk/Dockerfile*) amzn2, (centos/Dockerfile* with amzn2) bullseye-fat, (bullseye/Dockerfile.fat*) bullseye, (bullseye/Dockerfile*) centos, centos-rpm, (centos/Dockerfile* with el8) centos7, (centos7/Dockerfile* with el7) fedora, fedora-rpm, (fedora/Dockerfile* with fc36) rocky, (fedora/Dockerfile* with rockylinux) windows, (windows/Dockerfile*)
* We track build-from-source images as follows: * Alma Linux latest stable * Alpine stable * Ubuntu "LTS"
* We try to include popular architectures (x86_64, aarch64, s390x)
* RC versions of upstream releases will be made available on tags
* If an image fails CI/CD too much, we will remove it.
* We operate in English and PRs must be English as well, unless for localization purposes. * We will accept issues in any language. We will provide our translations to English for clarity.
* All are welcome to particpate, but must show mutual respect to the community.
Nginx Config Files ==================
The Docker tooling installs its own nginx.conf file. If you want to directly override it, you can replace it in your own Dockerfile or via volume bind-mounting.
For the Linux images, that nginx.conf has the directive include /etc/nginx/conf.d/*.conf; so all nginx configurations in that directory will be included. The default virtual host configuration has the original OpenResty configuration and is copied to /etc/nginx/conf.d/default.conf.
Since 1.25.3.2-2, the nginx.conf also contains include /etc/nginx/conf.d/.main; at the main stanza level (rather than the http level of .conf). stream and other main level directives can be included there; see issue 257 for an example.
You can override that default.conf directly or volume bind-mount the /etc/nginx/conf.d directory to your own set of configurations:
docker run -v /my/custom/conf.d:/etc/nginx/conf.d openresty/openresty:alpineIf you are running on an selinux host (e.g. CentOS), you may need to add :Z to your volume bind-mount argument:
docker run -v /my/custom/conf.d:/etc/nginx/conf.d:Z openresty/openresty:alpineWhen using the windows image you can change the main configuration directly:
docker run -v C:/my/custom/nginx.conf:C:/openresty/conf/nginx.conf openresty/openresty:windowsOPM ===
Starting at version 1.11.2.2, OpenResty for Linux includes a package manager called opm, which can be found at /usr/local/openresty/bin/opm.
opm is built in all the images except alpine and bullseye and bookworm.
To use opm in the alpine image, you must also install the curl and perl packages; they are not included by default because they double the image size. You may install them like so: apk add --no-cache curl perl.
To use opm within the bullseye image, you can either use the bullseye-fat image or install the openresty-opm package in a custom build (which you would need to do to install your own opm packages anyway), as shown in this buster example.
LuaRocks ========
LuaRocks is included in the alpine-fat, centos, and bionic variants. It is excluded from alpine because it generally requires a build system and we want to keep that variant lean.
It is available at /usr/local/openresty/luajit/bin/luarocks. Packages can be added in your dependent Dockerfiles like so:
RUN /usr/local/openresty/luajit/bin/luarocks install <rock>Tips & Pitfalls ===============
* The envsubst utility is included in all images except alpine and windows; this utility is also included in the Nginx docker image and is used to template environment variables into configuration files.
* By default, OpenResty is built with SSE4.2 optimizations if the build machine supports it. If run on machine without SSE4.2, there will be invalid opcode issues. Thus all the Docker Hub images require SSE4.2. You can build a custom image from source explicitly without SSE4.2 support, using build arguments like so:
docker build -f bionic/Dockerfile --build-arg "RESTYLUAJITOPTIONS=--with-luajit-xcflags='-DLUAJITNUMMODE=2 -DLUAJITENABLE_LUA52COMPAT -mno-sse4.2'" .- OpenResty's OpenSSL library version must be compatible with your
opmand LuaRocks packages' version. At minimum, the numeric portion should be the same (e.g.1.1.1). The image labelrestyopensslversionindicates this value. see Labels.
- The
1.13.6.2-alpineis built fromOpenSSL 1.0.2rbecause of build issues on Alpine.1.15.8.1-alpineand later are built fromOpenSSL 1.1.1series.
- Windows images must be built from the same version as the host system it runs on. See Windows container version compatibility. Our images are currently built from the "Windows Server 2016" series.
- The
SIGQUITsignal will be sent to nginx to stop this container, to give it an opportunity to stop gracefully (i.e, finish processing active connections). The Docker default isSIGTERM, which immediately terminates active connections.
Image Labels ============
The image builds are labeled with various information, such as the versions of OpenResty and its dependent libraries. Here's an example of printing the labels using jq:
$ docker pull openresty/openresty:1.17.8.1-0-bionic
$ docker inspect openresty/openresty:1.17.8.1-0-bionic | jq '.[].Config.Labels'
{
"maintainer": "Evan Wies <evan@*.net>",
"restyaddpackage_builddeps": "",
"restyaddpackage_rundeps": "",
"restyconfigdeps": "--with-pcre --with-cc-opt='-DNGXLUAABORTATPANIC -I/usr/local/openresty/pcre/include -I/usr/local/openresty/openssl/include' --with-ld-opt='-L/usr/local/openresty/pcre/lib -L/usr/local/openresty/openssl/lib -Wl,-rpath,/usr/local/openresty/pcre/lib:/usr/local/openresty/openssl/lib' ",
"restyconfigoptions": " --with-compat --with-file-aio --with-httpadditionmodule --with-httpauthrequestmodule --with-httpdavmodule --with-httpflvmodule --with-httpgeoipmodule=dynamic --with-httpgunzipmodule --with-httpgzipstaticmodule --with-httpimagefiltermodule=dynamic --with-httpmp4module --with-httprandomindexmodule --with-httprealipmodule --with-httpsecurelinkmodule --with-httpslicemodule --with-httpsslmodule --with-httpstubstatusmodule --with-httpsubmodule --with-httpv2module --with-httpv3module --with-httpxsltmodule=dynamic --with-ipv6 --with-mail --with-mailsslmodule --with-md5-asm --with-pcre-jit --with-sha1-asm --with-stream --with-streamsslmodule --with-threads ",
"restyconfigoptions_more": "",
"restyevalpost_make": "",
"restyevalpre_configure": "",
"restyevalpostdownloadpre_configure": "",
"restyimagebase": "ubuntu",
"restyimagetag": "bionic",
"restyluarocksversion": "3.3.1",
"restyopensslpatch_version": "1.1.0d",
"restyopensslurl_base": "https://www.openssl.org/source/old/1.1.0",
"restyopensslversion": "1.1.0l",
"restypcreversion": "8.45",
"resty_version": "1.17.8.1"
}| Label Name | Description | |:-----------------------------------------|:----------------------------------------------------------------------------------------------------------------------| | maintainer | Maintainer of the image | | restyaddpackagebuilddeps | buildarg RESTYADDPACKAGEBUILDDEPS | | restyaddpackagerundeps | buildarg RESTYADDPACKAGERUNDEPS | | restyapkalpineversion | buildarg RESTYAPKALPINEVERSION | | restyapkkeyurl | buildarg RESTYAPKKEYURL | | restyapkrepourl | buildarg RESTYAPKREPOURL | | restyapkversion | buildarg RESTYAPKVERSION | | restyaptpgp | buildarg RESTYAPTPGP | | restyaptrepo | buildarg RESTYAPTREPO | | restyaptarch | buildarg RESTYAPTARCH | | restyconfigdeps | buildarg RESTYCONFIG_DEPS (internal) | | restyconfigoptionsmore | buildarg RESTYCONFIGOPTIONSMORE | | restyconfigoptions | buildarg RESTYCONFIGOPTIONS | | restydebflavor | buildarg RESTYDEBFLAVOR | | restydebversion | buildarg RESTYDEBVERSION (available versions) | | restyevalpremake | buildarg RESTYEVALPREMAKE | | restyevalpostmake | buildarg RESTYEVALPOSTMAKE | | restyevalpreconfigure | buildarg RESTYEVALPRECONFIGURE | | restyevalpostdownloadpreconfigure | buildarg RESTYEVALPOSTDOWNLOADPRECONFIGURE | | restyfatdebflavor | buildarg RESTYFATDEBFLAVOR | | restyfatdebversion | buildarg RESTYFATDEBVERSION | | restyfatimagebase | Name of the base image to build fat images from, buildarg RESTYFATIMAGEBASE | | restyfatimagetag | Tag of the base image to build fat images from, buildarg RESTYFATIMAGETAG | | restyimagebase | Name of the base image to build from, buildarg RESTYIMAGEBASE | | restyimagetag | Tag of the base image to build from, buildarg RESTYIMAGETAG | | restyinstallbase | buildarg RESTYINSTALLBASE | | restyinstalltag | buildarg RESTYINSTALLTAG | | restyluajitoptions | buildarg RESTYLUAJITOPTIONS | | restyluarocksversion | buildarg RESTYLUAROCKSVERSION | | restyopensslpatchversion | buildarg RESTYOPENSSLPATCHVERSION | | restyopensslurlbase | buildarg RESTYOPENSSLURLBASE | | restyopensslversion | buildarg RESTYOPENSSLVERSION | | restyopensslbuildoptions | buildarg RESTYOPENSSLBUILDOPTIONS | | restypcrebuildoptions | buildarg RESTYPCREBUILDOPTIONS | | restypcreoptions | buildarg RESTYPCREOPTIONS | | restypcresha256 | buildarg RESTYPCRESHA256 | | restypcreversion | buildarg RESTYPCREVERSION | | restyrpmarch | buildarg RESTYRPMARCH | | restyrpmdist | buildarg RESTYRPMDIST | | restyrpmflavor | buildarg RESTYRPMFLAVOR | | restyrpmversion | buildarg RESTYRPMVERSION | | restystripbinaries | buildarg RESTYSTRIPBINARIES | | restyversion | buildarg RESTYVERSION | | restyyumrepo | buildarg RESTYYUMREPO |
Docker CMD ==========
The -g "daemon off;" directive is used in the Dockerfile CMD to keep the Nginx daemon running after container creation. If this directive is added to the nginx.conf, then the docker run should explicitly invoke openresty (or nginx for windows images):
docker run [options] openresty/openresty:noble openrestyInvoke another CMD, for example the resty utility, like so:
docker run [options] openresty/openresty:noble resty [script.lua]NOTE The alpine images do not include the packages perl and ncurses, which is needed by the resty utility.
Feedback & Bug Reports ======================
You're very welcome to report bugs and give feedback as GitHub Issues:
https://github.com/openresty/docker-openresty/issues
Changelog & Authors ===================
Copyright & License ===================
docker-openresty is licensed under the 2-clause BSD license.
Copyright (c) 2017-2026, Evan Wies
This module is licensed under the terms of the BSD license.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
- Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
