prplanit/static-site
Base image for serving a static site from a container.
Image
0
669
prplanit/static-site repository overview
static-site
Hardened, non-root nginx (with brotli) base image for prplanit static sites. Consumer repos are two-liners — FROM this image and COPY your static assets — and inherit non-root, readOnlyRootFilesystem-friendly, pinned, and security-scanned defaults.
Image contents
Base:
Packages:
Usage
Your site repo is just static assets + a two-line Dockerfile:
FROM docker.io/prplanit/static-site:vX.Y.Z
COPY www-data/ /usr/share/nginx/html/
Features
| Non-root | runs as uid 10001 on port 8080 — no privileged port, no root |
| Brotli + gzip | brotli (with brotli_static) preferred, gzip fallback |
| Read-only friendly | pid / temp / rendered config all live in /tmp → set readOnlyRootFilesystem: true |
| Pinned + scanned | Alpine + nginx + brotli pinned to exact versions; Trivy/Grype + SBOM in CI |
| Configurable port | LISTEN_PORT env (default 8080), applied via envsubst at startup |
| Security headers | X-Content-Type-Options, Referrer-Policy, Permissions-Policy on every response |
| Health endpoint | GET /healthz → 200 (for k8s probes) |
Configuration
| env | default | purpose |
|---|---|---|
LISTEN_PORT | 8080 | listen port |
LOG_LEVEL | warn | nginx error_log level |
WORKER_PROCESSES | auto | nginx worker_processes |
Kubernetes securityContext
Pairs with the image's non-root design:
securityContext:
runAsNonRoot: true
runAsUser: 10001
runAsGroup: 10001
seccompProfile:
type: RuntimeDefault
containers:
- securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop: ["ALL"]
ports:
- containerPort: 8080
License
Repository files (Dockerfile, nginx config, entrypoint): MIT. The built image bundles nginx (BSD-2-Clause), musl (MIT), busybox (GPL-2.0), brotli (MIT), and others under their own licenses. See LICENSE.
Tag summary
Content type
Image
Digest
sha256:b1acd873f…
Size
8.4 MB
Last updated
about 2 months ago
docker pull prplanit/static-site