bypass4netns VS docker-nginx

Socket activation should be the fastest alternative as then there is no need to process and interpret the network traffic that is sent over the socket. Both slirp4netns and netavark process the traffic. If I understand correctly the network driver bypass4netns could have similar performance as socket activation. The current bypass4netns implementation has some security problems but it seems that could be fixed.

(That could a be cool feature)

Also interesting would be to fix the security considerations of using bypass4netns:

"However, it is probably possible to connect to host loopback IPs by exploiting TOCTOU of struct sockaddr * pointers."

There seems to be an implementation idea for how the problem could be fixed:

https://github.com/rootless-containers/bypass4netns/issues/2...

The filesystem performance degradation was resolved in kernel 5.11 which added support for rootless overlayfs.

The network performance is caused by slirp (usermode TCP/IP) but it is being resolved too : https://github.com/rootless-containers/bypass4netns

Add a brief sleep to the Nginx container's CMD. The default is CMD ["nginx", "-g", "daemon off;"], so something like command: ["sleep", "4", "&&", "nginx", "-g", "daemon off;"]. Didn't try this so not sure whether it'll work or not. Glancing at their docker-entrypoint.sh this will disable autoconfiguration from /docker-entrypoint.d/ (sigh).

A few time ago, I created the this post about nginx official image ENTRYPOINT "issue": https://github.com/nginxinc/docker-nginx/pull/752 .

An alternative to this approach, you could also write a template Dockerfile and then write some shell script that you would run locally to take that template and then write/generate Dockerfiles for each. Many of the official Docker images are setup and built this way. Here is an easy example of the nginx Docker image repository. https://github.com/nginxinc/docker-nginx It has three different templates in the root of the repository and has the update.sh script that is run to take those and write them out to a directory and essentially do a find and replace on the templates in the template. Those generated directories are then committed to the repository and pushed up to be built and published as Docker images.

It's a bit odd to use a custom docker image, rather than the one maintained by nginx Inc though:

https://github.com/signalapp/Signal-TLS-Proxy/blob/main/ngin...

Vs

https://github.com/nginxinc/docker-nginx

For one, this is 5 versions behind (1.18 vs 1.23).

In general seems caddy or haproxy might be a better fit - but nginx is a perfectly fine choice I suppose.

The container image docker.io/library/nginx will hopefully soon have support for socket activation. My PR got merged 9 days ago but the current image does not yet have the funcationality.

} ``` I have fixed the templates at https://github.com/nginxinc/docker-nginx/pull/533