immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-07-25 14:00:45 +03:00
Code Issues 783 Packages Projects Releases 22 Wiki Activity

[PR #651] [MERGED] feat(nginx): use non-root image for immich-proxy #8708

New Issue
Closed
opened 2026-02-05 13:51:51 +03:00 by OVERLORD · 0 comments
OVERLORD commented 2026-02-05 13:51:51 +03:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/immich-app/immich/pull/651
Author: @PixelJonas
Created: 9/9/2022
Status: ✅ Merged
Merged: 9/14/2022
Merged by: @alextran1502

Base: main ← Head: feat/nginx-ubi

📝 Commits (4)

  • c69667a feat(nginx): use non-root container for immich-proxy
  • d7ba45d re-add test env
  • c63977c feat(nginx): add correct port for staging
  • b27e993 add the new port to the default docker-compose.yml

📊 Changes

6 files changed (+84 additions, -73 deletions)

View changed files

📝 docker/.env.test (+1 -1)
📝 docker/docker-compose.dev.yml (+1 -2)
📝 docker/docker-compose.staging.yml (+1 -2)
📝 docker/docker-compose.yml (+1 -1)
📝 nginx/Dockerfile (+3 -4)
📝 nginx/nginx.conf (+77 -63)

📄 Description

This PR replaces the nginx:latest image used with ubi9/nginx-120:latest changing the image to not use a privileged user as well as a privileged port.

Running "privileged" containers is considered bad for containers, as most security flaws orbit around the user within the container (in this case root) bleeding into the host system. As such containers should be started by non-root users and don't use privileged ports at all.

This would be a breaking change for people not updating their docker-compose.yaml as they need to change the default port-mapping from 2283:80 to 2283:8080.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/immich-app/immich/pull/651 **Author:** [@PixelJonas](https://github.com/PixelJonas) **Created:** 9/9/2022 **Status:** ✅ Merged **Merged:** 9/14/2022 **Merged by:** [@alextran1502](https://github.com/alextran1502) **Base:** `main` ← **Head:** `feat/nginx-ubi` --- ### 📝 Commits (4) - [`c69667a`](https://github.com/immich-app/immich/commit/c69667ad216f1320d420e06424678dad50f065b5) feat(nginx): use non-root container for immich-proxy - [`d7ba45d`](https://github.com/immich-app/immich/commit/d7ba45d7cf1398d8ecd560049f6c379a1e0384f6) re-add test env - [`c63977c`](https://github.com/immich-app/immich/commit/c63977cd20cde3b179f1b7c11ef13d114d81839b) feat(nginx): add correct port for staging - [`b27e993`](https://github.com/immich-app/immich/commit/b27e99391163694526610c20b49cf4cc88a8c2f6) add the new port to the default docker-compose.yml ### 📊 Changes **6 files changed** (+84 additions, -73 deletions) <details> <summary>View changed files</summary> 📝 `docker/.env.test` (+1 -1) 📝 `docker/docker-compose.dev.yml` (+1 -2) 📝 `docker/docker-compose.staging.yml` (+1 -2) 📝 `docker/docker-compose.yml` (+1 -1) 📝 `nginx/Dockerfile` (+3 -4) 📝 `nginx/nginx.conf` (+77 -63) </details> ### 📄 Description This PR replaces the `nginx:latest` image used with `ubi9/nginx-120:latest` changing the image to not use a privileged user as well as a privileged port. Running "privileged" containers is considered bad for containers, as most security flaws orbit around the user within the container (in this case `root`) bleeding into the host system. As such containers should be started by non-root users and don't use privileged ports at all. This would be a breaking change for people not updating their `docker-compose.yaml` as they need to change the default port-mapping from `2283:80` to `2283:8080`. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
OVERLORD added the pull-request label 2026-02-05 13:51:51 +03:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
pull-request
Mirrored from GitHub Pull Request
 sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#8708
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?