boring-nginx: update Dockerfile, optimisations

boring-nginx/Dockerfile

@@ -28,15 +28,33 @@ ARG NGINX_3RD_PARTY_MODULES=" \
     --add-module=/tmp/headers-more-nginx-module \
     --add-module=/tmp/ngx_brotli"
 
-RUN echo "@commuedge https://nl.alpinelinux.org/alpine/edge/community" >> /etc/apk/repositories \
- && NB_CORES=${BUILD_CORES-$(getconf _NPROCESSORS_CONF)} \
- && BUILD_DEPS=" \
+RUN NB_CORES=${BUILD_CORES-$(getconf _NPROCESSORS_CONF)} \
+
+# Update system
+ && apk -U upgrade \
+
+# Installing runtime dependencies
+ && apk add \
+    ${BUILD_DEPS} \
+    pcre \
+    zlib \
+    libgcc \
+    libstdc++ \
+    jemalloc \
+    su-exec \
+    libressl \
+    bind-tools \
+    tini \
+
+# Installing build dependencies
+ && apk add -t build-dependencies \
     build-base \
     linux-headers \
     ca-certificates \
     automake \
     autoconf \
     git \
+    jemalloc-dev \
     tar \
     libtool \
     pcre-dev \
@@ -44,22 +62,18 @@ RUN echo "@commuedge https://nl.alpinelinux.org/alpine/edge/community" >> /etc/a
     binutils \
     gnupg \
     cmake \
-    go" \
- && apk -U upgrade && apk add \
-    ${BUILD_DEPS} \
-    pcre \
-    zlib \
-    libgcc \
-    libstdc++ \
-    su-exec \
-    libressl \
-    bind-tools \
-    tini@commuedge \
+    go \
+
+# Brotli
  && cd /tmp && git clone https://github.com/bagder/libbrotli --depth=1 \
  && cd libbrotli && ./autogen.sh && ./configure && make -j ${NB_CORES} && make install \
  && cd /tmp && git clone https://github.com/google/ngx_brotli --depth=1 \
  && cd ngx_brotli && git submodule update --init \
+
+# Headers More
  && cd /tmp && git clone https://github.com/openresty/headers-more-nginx-module --depth=1 \
+
+# BoringSSL
  && git clone https://boringssl.googlesource.com/boringssl --depth=1 \
  && cd boringssl \
  && sed -i 's@out \([>=]\) TLS1_2_VERSION@out \1 TLS1_3_VERSION@' ssl/ssl_lib.cc \
@@ -72,6 +86,8 @@ RUN echo "@commuedge https://nl.alpinelinux.org/alpine/edge/community" >> /etc/a
  && make -j ${NB_CORES} && cd .. \
  && mkdir -p .openssl/lib/ && cd .openssl && ln -s ../include && cd .. \
  && cp build/crypto/libcrypto.a build/ssl/libssl.a .openssl/lib && cd /tmp \
+
+# Nginx tarball checking
  && NGINX_TARBALL="nginx-${NGINX_VERSION}.tar.gz" \
  && wget -q https://nginx.org/download/${NGINX_TARBALL} \
  && echo "Verifying ${NGINX_TARBALL} using GPG..." \
@@ -84,31 +100,33 @@ RUN echo "@commuedge https://nl.alpinelinux.org/alpine/edge/community" >> /etc/a
  && if [ "${FINGERPRINT}" != "${GPG_NGINX}" ]; then echo "Warning! Wrong GPG fingerprint!" && exit 1; fi \
  && echo "All seems good, now unpacking ${NGINX_TARBALL}..." \
  && tar xzf ${NGINX_TARBALL} && cd nginx-${NGINX_VERSION} \
+
+# Nginx patch : dynamic TLS records
  && wget -q https://raw.githubusercontent.com/cujanovic/nginx-dynamic-tls-records-patch/master/nginx__dynamic_tls_records_1.13.0%2B.patch -O dynamic_records.patch \
  && patch -p1 < dynamic_records.patch \
+
+# Nginx full HPACK encoding support
+# && wget -q https://raw.githubusercontent.com/cloudflare/sslconfig/master/patches/nginx_1.13.1_http2_hpack.patch \
+# && patch -p1 < nginx_1.13.1_http2_hpack.patch \
+
+# Nginx compilation
  && ./configure \
     --prefix=/etc/nginx \
     --sbin-path=/usr/sbin/nginx \
-    --with-cc-opt="-O3 -fPIE -fstack-protector-strong -Wformat -Werror=format-security -Wno-deprecated-declarations -I ../boringssl/.openssl/include/" \
-    --with-ld-opt="-Wl,-Bsymbolic-functions -Wl,-z,relro -L ../boringssl/.openssl/lib" \
+    --with-cc-opt="-m64 -march=native -mtune=native -DTCP_FASTOPEN=23 -Ofast -fPIE -fstack-protector-strong -D_FORTIFY_SOURCE=2 -Wformat -Werror=format-security -Wno-deprecated-declarations -I ../boringssl/.openssl/include/" \
+    --with-ld-opt="-lrt -ljemalloc -Wl,-Bsymbolic-functions -Wl,-z,relro -L ../boringssl/.openssl/lib" \
     --http-log-path=/var/log/nginx/access.log \
     --error-log-path=/var/log/nginx/error.log \
     ${NGINX_MODULES} \
     ${NGINX_3RD_PARTY_MODULES} \
  && make -j ${NB_CORES} && make install && make clean \
  && strip -s /usr/sbin/nginx \
- && apk del ${BUILD_DEPS} \
+
+# Clean
+ && apk del build-dependencies \
  && rm -rf /tmp/* /var/cache/apk/* /root/.gnupg
 
-COPY nginx.conf /etc/nginx/conf/nginx.conf
-COPY run.sh /usr/local/bin/run.sh
-COPY ngxpasswd /usr/local/bin/ngxpasswd
-COPY ngxproxy /usr/local/bin/ngxproxy
-COPY vhost_http.conf /etc/nginx/conf/vhost_http.conf
-COPY vhost_https.conf /etc/nginx/conf/vhost_https.conf
-COPY ssl_params /etc/nginx/conf/ssl_params
-COPY headers_params /etc/nginx/conf/headers_params
-COPY proxy_params /etc/nginx/conf/proxy_params
+COPY rootfs /
 
 RUN chmod +x /usr/local/bin/*