Skip to content

feat: Update NGINX App Protect docker build commands #443

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Apr 23, 2025
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion content/includes/nap-waf/build-nginx-image-cmd.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ To build the image, execute the following command in the directory containing th


```shell
sudo docker build --no-cache \
sudo docker build --no-cache --platform linux/amd64 \
--secret id=nginx-crt,src=nginx-repo.crt \
--secret id=nginx-key,src=nginx-repo.key \
-t nginx-app-protect-5 .
Expand Down
6 changes: 3 additions & 3 deletions content/nap-dos/deployment-guide/learn-about-deployment.md
Original file line number Diff line number Diff line change
Expand Up @@ -1405,7 +1405,7 @@ You need root permissions to execute the following steps.
6. Create a Docker image:

```shell
docker build --no-cache -t app-protect-dos .
docker build --no-cache --platform linux/amd64 -t app-protect-dos .
```

The `--no-cache` option tells Docker to build the image from scratch and ensures the installation of the latest version of NGINX Plus and NGINX App Protect DoS. If the Dockerfile was previously used to build an image without the `--no-cache` option, the new image uses versions from the previously built image from the Docker cache.
Expand Down Expand Up @@ -1966,13 +1966,13 @@ Make sure to replace upstream and proxy pass directives in this example with rel
For CentOS:

```shell
docker build --no-cache -t app-protect-dos .
docker build --no-cache --platform linux/amd64 -t app-protect-dos .
```

For RHEL:

```shell
docker build --build-arg RHEL_ORGANIZATION=${RHEL_ORGANIZATION} --build-arg RHEL_ACTIVATION_KEY=${RHEL_ACTIVATION_KEY} --no-cache -t app-protect-dos .
docker build --platform linux/amd64 --build-arg RHEL_ORGANIZATION=${RHEL_ORGANIZATION} --build-arg RHEL_ACTIVATION_KEY=${RHEL_ACTIVATION_KEY} --no-cache -t app-protect-dos .
```

The `--no-cache` option tells Docker to build the image from scratch and ensures the installation of the latest version of NGINX Plus and NGINX App Protect DoS. If the Dockerfile was previously used to build an image without the `--no-cache` option, the new image uses versions from the previously built image from the Docker cache.
Expand Down
4 changes: 2 additions & 2 deletions content/nap-waf/v4/admin-guide/install.md
Original file line number Diff line number Diff line change
Expand Up @@ -939,7 +939,7 @@ If a user other than **nginx** is to be used, note the following:
- For Oracle Linux/Debian/Ubuntu/Alpine/Amazon Linux:

```shell
DOCKER_BUILDKIT=1 docker build --no-cache --secret id=nginx-crt,src=nginx-repo.crt --secret id=nginx-key,src=nginx-repo.key -t app-protect .
DOCKER_BUILDKIT=1 docker build --no-cache --platform linux/amd64 --secret id=nginx-crt,src=nginx-repo.crt --secret id=nginx-key,src=nginx-repo.key -t app-protect .
```

The `DOCKER_BUILDKIT=1` enables `docker build` to recognize the `--secret` flag which allows the user to pass secret information to be used in the Dockerfile for building docker images in a safe way that will not end up stored in the final image. This is a recommended practice for the handling of the certificate and private key for NGINX repository access (`nginx-repo.crt` and `nginx-repo.key` files). More information [here](https://docs.docker.com/engine/reference/commandline/buildx_build/#secret).
Expand Down Expand Up @@ -1289,7 +1289,7 @@ You need root permissions to execute the following steps.
- For Oracle Linux/Debian/Ubuntu/Alpine/Amazon Linux:

```shell
DOCKER_BUILDKIT=1 docker build --no-cache --secret id=nginx-crt,src=nginx-repo.crt --secret id=nginx-key,src=nginx-repo.key -t app-protect-converter .
DOCKER_BUILDKIT=1 docker build --no-cache --platform linux/amd64 --secret id=nginx-crt,src=nginx-repo.crt --secret id=nginx-key,src=nginx-repo.key -t app-protect-converter .
```

The `DOCKER_BUILDKIT=1` enables `docker build` to recognize the `--secret` flag which allows the user to pass secret information to be used in the Dockerfile for building docker images in a safe way that will not end up stored in the final image. This is a recommended practice for the handling of the certificate and private key for NGINX repository access (`nginx-repo.crt` and `nginx-repo.key` files). More information [here](https://docs.docker.com/engine/reference/commandline/buildx_build/#secret).
Expand Down
2 changes: 1 addition & 1 deletion content/nap-waf/v5/admin-guide/compiler.md
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,7 @@ curl -s https://private-registry.nginx.com/v2/nap/waf-compiler/tags/list --key <
Run the command below to build your image, where `waf-compiler-<version-tag>:custom` is an example of the image tag:

```shell
sudo docker build --no-cache \
sudo docker build --no-cache --platform linux/amd64 \
--secret id=nginx-crt,src=nginx-repo.crt \
--secret id=nginx-key,src=nginx-repo.key \
-t waf-compiler-<version-tag>:custom .
Expand Down
Loading