Español · Українська

O9S / Nginx

Nginx compiled from source with HTTP/3, brotli and zstd — every directive set by environment variable, with optional ACME, OpenTelemetry and security-header modules.

Features

• Built-in ACME certificate automation
• CDN-aware real client IP
• Brotli, zstd and gzip compression
• Configuration through environment variables only
• robots.txt with AI Content Signals
• Base for nginx-based images
• Localized, self-contained error pages
• HTTP/3 (QUIC)
• Live config reload
• Correct content types and caching
• OpenTelemetry tracing and JSON access logs
• Automatic resource hints
• Security headers
• Config validation and nginx-aware healthchecks
• Ready-made serving modes
• Static asset pre-compression
• Hardened TLS defaults

It also inherits the features of B19 / Ubuntu — see Features for the full list.

Quick Start

Save this as compose.yaml:

---
services:
  nginx:
    image: docker.io/damianbuho/o9s-nginx:latest
    ports:
      - "8080:8080"
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    restart: unless-stopped

Then start it with docker compose up --detach.

What this provides

• Container image ghcr.io/damian-buho/o9s/nginx:latest
• Container image damianbuho/o9s-nginx:latest
• Service nginx — listens on 8080 (http) — nginx web server

Installation

Pull the published container image:

Pull from GHCR — linux/amd64, linux/arm64

docker pull ghcr.io/damian-buho/o9s/nginx:latest

Pull from DockerHub — linux/amd64

docker pull damianbuho/o9s-nginx:latest

Stable releases also publish X.Y.Z, X.Y and X tags — pull the precision you want to pin.

If the registries above are unreachable, pull from the origin instead:

Pull from Kiota — linux/amd64

docker pull kiota.ch/o9s/nginx:latest

Usage

Run the service in the background, publishing its ports:

From GHCR

docker run --detach --publish 8080:8080/tcp ghcr.io/damian-buho/o9s/nginx:latest

From DockerHub

docker run --detach --publish 8080:8080/tcp damianbuho/o9s-nginx:latest

Then check that it answers:

curl http://localhost:8080/

Building

Clone the repository with its submodules:

git clone --recurse-submodules https://github.com/damian-buho/o9s-nginx nginx && cd nginx

Build the container image locally:

make container-build

• Makefile reference

Run make with no arguments for the default target; run make help to list every target.

For the local dev loop, make dev-container brings up the dev-container.

Pipeline entry points:

• make analyzed — Run the heavy analysis sweep (mutation testing, benchmarks)
• make audited — Re-scan the pinned dependencies and published artifacts for new vulnerabilities
• make check-outdated — Report every pinned dependency that lags upstream
• make release-is-ready — Run the pseudo-CI pipeline locally — build, test and scan, without publishing

Roadmap

See the Roadmap for what is planned next.

Policies

• How to contribute
• Security policy
• Getting support
• Code of Conduct
• AI and LLM Policy

Links

• Issues on GitHub
• Projectfile Specification

License

This project is licensed under MIT — see the LICENSE file for details.