Skip to content

Conversation

@I501307
Copy link

@I501307 I501307 commented Dec 10, 2025

What This PR Does

Commit 1: OSS/Plus Images (Port 80)

File: common/etc/nginx/templates/default.conf.template
Change: Adds listen directives to template

server {
+   listen       80;
+   listen       [::]:80;
    include /etc/nginx/conf.d/gateway/server_variables.conf;

Result: OSS/Plus images listen on IPv4 and IPv6 port 80

Commit 2: Unprivileged Image (Port 8080)

File: Dockerfile.unprivileged
Change: REPLACES port 80 with 8080 (both IPv4 and IPv6)

-RUN sed -i "/^server {/a \    listen       8080;" ...
+RUN sed -i 's/listen[[:space:]]*80;/listen 8080;/g' ... \
+    && sed -i 's/listen[[:space:]]*\[::\]:80;/listen [::]:8080;/g' ... \

Result: Unprivileged image listens on IPv4 and IPv6 port 8080 ONLY

Final Configuration

OSS/Plus Containers:

server {
    listen       80;        # IPv4
    listen       [::]:80;   # IPv6
    ...
}

Unprivileged Containers:

server {
    listen       8080;      # IPv4 (replaced from 80)
    listen       [::]:8080; # IPv6 (replaced from [::]:80)
    ...
}

Why This Works

✅ Template has port 80 + IPv6 for OSS/Plus
✅ Unprivileged Dockerfile REPLACES port 80 → 8080 (no permission issues)
✅ No duplicate listen directives
✅ No privilege escalation required
✅ Fixes both #339 and #453
✅I have read the contributing guidelines.
✅I have signed the F5 Contributor License Agreement (CLA).
✅ The PR title follows the Conventional Commits specification.
✅If applicable, I have added tests that prove my fix is effective or that my feature works.
✅ If applicable, I have checked that any relevant tests pass after adding my changes.
✅I have updated any relevant documentation (e.g. README.md).

Issues Resolved

The OSS and Plus base images were missing IPv6 support.
The nginx base image's IPv6 enabler script modifies /etc/nginx/conf.d/default.conf,
but the template processing (which runs after) overwrites this file,
removing the IPv6 listen directive.

This fix adds both IPv4 and IPv6 listen directives directly to the
source template, ensuring they are present in the final configuration
for OSS and Plus image variants.

Fixes nginx#453

Signed-off-by: Jesse Awan <jesse.awan@sap.com>
The unprivileged image needs to replace port 80 with port 8080
(since unprivileged users cannot bind to port 80).

This fix modifies the sed commands to replace the port 80 listen
directives (both IPv4 and IPv6) with port 8080 equivalents,
ensuring dual-stack support without privilege issues.

Fixes nginx#339

Signed-off-by: Jesse Awan <jesse.awan@sap.com>
@I501307 I501307 requested a review from a team as a code owner December 10, 2025 21:04
@github-actions
Copy link

🎉 Thank you for your contribution! It appears you have not yet signed the F5 Contributor License Agreement (CLA), which is required for your changes to be incorporated into an F5 Open Source Software (OSS) project. Please kindly read the F5 CLA and reply on a new comment with the following text to agree:


I have hereby read the F5 CLA and agree to its terms


You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.

@I501307 I501307 changed the title Fix ipv6 unprivileged image fix: enable IPv6 dual-stack for OSS, Plus, and unprivileged images Dec 10, 2025
@I501307
Copy link
Author

I501307 commented Dec 10, 2025

I have hereby read the F5 CLA and agree to its terms

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

IPv6 enabler in /docker-entrypoint.d is broken Unprivileged Docker image does not listen on IPv6

1 participant