nginx Web Servers & Proxies

Shell-less Nginx built on Wolfi.

Size 25 MB Arch x86_64, aarch64 User nginx (65532) Updated today Upstream nginx.org

Pull this image

docker pull ghcr.io/rtvkiz/minimal-nginx:latest

Details

Repository: ghcr.io/rtvkiz/minimal-nginx
Size (compressed): 25 MB
Built: 2026-09-28T23:20:44Z (today)
Architectures: x86_64, aarch64
Primary package: nginx-mainline

Entrypoint

/usr/sbin/nginx -g "daemon off;"

User

nginx (65532)

Working dir

Architectures

x86_64, aarch64

Environment

Labels

org.opencontainers.image.title	minimal-nginx
org.opencontainers.image.description	Hardened shell-less Nginx image built on Wolfi with daily CVE patches
org.opencontainers.image.url	https://github.com/rtvkiz/minimal
org.opencontainers.image.source	https://github.com/rtvkiz/minimal/tree/main/images/nginx
org.opencontainers.image.licenses	Apache-2.0

Tag	Pull	Published
1	ghcr.io/rtvkiz/minimal-nginx:1	2026-09-28
1.31	ghcr.io/rtvkiz/minimal-nginx:1.31	2026-09-28
1.31.6-r2	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r2	2026-09-28
1.31.6-r2-20260928	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r2-20260928	2026-09-28
latest	ghcr.io/rtvkiz/minimal-nginx:latest	2026-09-28
1-dev	ghcr.io/rtvkiz/minimal-nginx:1-dev	2026-09-28
1.31-dev	ghcr.io/rtvkiz/minimal-nginx:1.31-dev	2026-09-28
1.31.6-r2-20260928-dev	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r2-20260928-dev	2026-09-28
1.31.6-r2-dev	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r2-dev	2026-09-28
latest-dev	ghcr.io/rtvkiz/minimal-nginx:latest-dev	2026-09-28
1.31.6-r2-20260927	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r2-20260927	2026-09-27
1.31.6-r2-20260927-dev	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r2-20260927-dev	2026-09-27
1.31.6-r2-20260926	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r2-20260926	2026-09-26
1.31.6-r2-20260926-dev	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r2-20260926-dev	2026-09-26
1.31.6-r2-20260925	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r2-20260925	2026-09-25
1.31.6-r2-20260925-dev	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r2-20260925-dev	2026-09-25
1.31.6-r2-20260924	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r2-20260924	2026-09-24
1.31.6-r2-20260924-dev	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r2-20260924-dev	2026-09-24
1.31.6-r1	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r1	2026-09-23
1.31.6-r1-20260923	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r1-20260923	2026-09-23
1.31.6-r1-20260923-dev	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r1-20260923-dev	2026-09-23
1.31.6-r1-dev	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r1-dev	2026-09-23
1.31.6-r1-20260922	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r1-20260922	2026-09-22
1.31.6-r1-20260922-dev	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r1-20260922-dev	2026-09-22
1.31.6-r1-20260921	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r1-20260921	2026-09-21
1.31.6-r1-20260921-dev	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r1-20260921-dev	2026-09-21
1.31.6-r0	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r0	2026-09-21
1.31.6-r0-20260921	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r0-20260921	2026-09-21
1.31.6-r0-20260921-dev	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r0-20260921-dev	2026-09-21
1.31.6-r0-dev	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r0-dev	2026-09-21
1.31.6-r0-20260920	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r0-20260920	2026-09-20
1.31.6-r0-20260920-dev	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r0-20260920-dev	2026-09-20
1.31.6-r0-20260919	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r0-20260919	2026-09-19
1.31.6-r0-20260919-dev	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r0-20260919-dev	2026-09-19
1.31.6-r0-20260918	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r0-20260918	2026-09-18
1.31.6-r0-20260918-dev	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r0-20260918-dev	2026-09-18
1.31.6-r0-20260917	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r0-20260917	2026-09-17
1.31.6-r0-20260917-dev	ghcr.io/rtvkiz/minimal-nginx:1.31.6-r0-20260917-dev	2026-09-17

100 packages in the image, resolved from the SPDX SBOM.

Package	Version	License
alpine/ca-certificates	20260909	MPL-2.0 AND MIT
brotli	v1.2.0	MIT
brotli.yaml	9db3aeed30b6359289528ef564a4909f78faeac9	Apache-2.0
ca-certificates-bundle	20260909-r1	MPL-2.0 AND MIT
ca-certificates-bundle	20260909-r1	(MPL-2.0 AND MIT)
ca-certificates-bundle	20260909-r1	—
ca-certificates.yaml	ee3eac73dda22e8dd32fa5fb3e3a1712a6e812d7	Apache-2.0
gcc.yaml	794cf72f88e1b408eca5da0dbf5c5ed25543606d	Apache-2.0
git/glibc	b4f51887c48ac82acfdb13f96d9eab5d120cb2b7	LGPL-2.1-or-later
glibc-2.44	2.44-r7	LGPL-2.1-or-later
glibc-2.44	2.44-r7	LGPL-2.1-or-later
glibc-2.44	2.44-r7	—
glibc-2.44-locale-posix	2.44-r7	LGPL-2.1-or-later
glibc-2.44-locale-posix	2.44-r7	LGPL-2.1-or-later
glibc-2.44-locale-posix	2.44-r7	—
glibc-2.44.yaml	2f4fbb70b55156f2d4cabff471b50dab0e75aa89	Apache-2.0
gnutools/gcc	releases/gcc-16.2.0	GPL-3.0-or-later WITH GCC-exception-3.1
ld-linux-2.44	2.44-r7	LGPL-2.1-or-later
ld-linux-2.44	2.44-r7	LGPL-2.1-or-later
ld-linux-2.44	2.44-r7	—
libbrotlicommon1	1.2.0-r5	MIT
libbrotlicommon1	1.2.0-r5	MIT
libbrotlicommon1	1.2.0-r5	—
libbrotlidec1	1.2.0-r5	MIT
libbrotlidec1	1.2.0-r5	MIT
libbrotlidec1	1.2.0-r5	—
libbrotlienc1	1.2.0-r5	MIT
libbrotlienc1	1.2.0-r5	MIT
libbrotlienc1	1.2.0-r5	—
libcrypt1-2.44	2.44-r7	LGPL-2.1-or-later
libcrypt1-2.44	2.44-r7	LGPL-2.1-or-later
libcrypt1-2.44	2.44-r7	—
libcrypto3	3.6.4-r8	Apache-2.0
libcrypto3	3.6.4-r8	Apache-2.0
libcrypto3	3.6.4-r8	—
libgcc	16.2.0-r1	GPL-3.0-or-later WITH GCC-exception-3.1
libgcc	16.2.0-r1	(GPL-3.0-or-later WITH GCC-exception-3.1)
libgcc	16.2.0-r1	—
libpcre2-8-0	10.49-r0	BSD-3-Clause
libpcre2-8-0	10.49-r0	BSD-3-Clause
libpcre2-8-0	10.49-r0	—
libssl3	3.6.4-r8	Apache-2.0
libssl3	3.6.4-r8	Apache-2.0
libssl3	3.6.4-r8	—
libxcrypt	4.5.2-r5	GPL-2.0-or-later AND LGPL-2.1-or-later
libxcrypt	v4.5.2	GPL-2.0-or-later AND LGPL-2.1-or-later
libxcrypt	4.5.2-r5	(GPL-2.0-or-later AND LGPL-2.1-or-later)
libxcrypt	4.5.2-r5	—
libxcrypt.yaml	e199a2ea58e2f64dce226ac5edb148fa8ff72664	Apache-2.0
nginx	release-1.31.6	BSD-2-Clause
nginx-mainline	1.31.6-r2	BSD-2-Clause
nginx-mainline	1.31.6-r2	BSD-2-Clause
nginx-mainline	1.31.6-r2	—
nginx-mainline-config	1.31.6-r2	BSD-2-Clause
nginx-mainline-config	1.31.6-r2	BSD-2-Clause
nginx-mainline-config	1.31.6-r2	—
nginx-mainline-fastcgi-params	1.31.6-r2	BSD-2-Clause
nginx-mainline-fastcgi-params	1.31.6-r2	BSD-2-Clause
nginx-mainline-fastcgi-params	1.31.6-r2	—
nginx-mainline-mime-types	1.31.6-r2	BSD-2-Clause
nginx-mainline-mime-types	1.31.6-r2	BSD-2-Clause
nginx-mainline-mime-types	1.31.6-r2	—
nginx-mainline-package-config	1.31.6-r2	BSD-2-Clause
nginx-mainline-package-config	1.31.6-r2	BSD-2-Clause
nginx-mainline-package-config	1.31.6-r2	—
nginx-mainline-scgi-params	1.31.6-r2	BSD-2-Clause
nginx-mainline-scgi-params	1.31.6-r2	BSD-2-Clause
nginx-mainline-scgi-params	1.31.6-r2	—
nginx-mainline-uwsgi-params	1.31.6-r2	BSD-2-Clause
nginx-mainline-uwsgi-params	1.31.6-r2	BSD-2-Clause
nginx-mainline-uwsgi-params	1.31.6-r2	—
nginx-mainline.yaml	88d034c8a90ab9303114c4a82765cd63372ec5f3	Apache-2.0
openssl	openssl-4.0.2	Apache-2.0
openssl	openssl-3.6.4	Apache-2.0
openssl-4.0-libcrypto	4.0.2-r2	Apache-2.0
openssl-4.0-libcrypto	4.0.2-r2	Apache-2.0
openssl-4.0-libcrypto	4.0.2-r2	—
openssl-4.0-libssl	4.0.2-r2	Apache-2.0
openssl-4.0-libssl	4.0.2-r2	Apache-2.0
openssl-4.0-libssl	4.0.2-r2	—
openssl-4.0.yaml	b8f04118437fbbf25bbaad575ccb9f2ed62b8503	Apache-2.0
openssl-provider-legacy-allowed	4.0.2-r3	Apache-2.0
openssl-provider-legacy-allowed	4.0.2-r3	Apache-2.0
openssl-provider-legacy-allowed	4.0.2-r3	—
openssl-provider-legacy-allowed.yaml	b8f04118437fbbf25bbaad575ccb9f2ed62b8503	Apache-2.0
openssl.yaml	be56cfaac075e77bffb92439e0438bb31a21a2c7	Apache-2.0
pcre2	pcre2-10.49	BSD-3-Clause
pcre2.yaml	12446114fe264503593128d308520875edaca797	Apache-2.0
sha256:df167632bf150955801fe8a6b6af63f7bd664c77743f51e1ff46919f47db27d0	sha256:df167632bf150955801fe8a6b6af63f7bd664c77743f51e1ff46919f47db27d0	—
sha256:f2027425655b2f8d7a3a0e54d562324618e80cb16d291ef1f698590f2388d4f2	20230201	—
wolfi	20230201	—
wolfi-baselayout	20230201-r30	MIT
wolfi-baselayout	20230201-r30	MIT
wolfi-baselayout	20230201-r30	—
wolfi-baselayout.yaml	a4472f6292a5e48d6d611bf24c6e119b1a483e66	Apache-2.0
zlib	1.3.2.1_rc20260601-r0	MPL-2.0 AND MIT
zlib	e3dc0a85b7032e98380dec011bc8f2c2ee0d8fca	MPL-2.0 AND MIT
zlib	1.3.2.1_rc20260601-r0	(MPL-2.0 AND MIT)
zlib	1.3.2.1_rc20260601-r0	—
zlib.yaml	f2ad881d0053f3f3b6b639e041b171fc0e5b7244	Apache-2.0

4 medium 0 fixable

CVE	Severity	Package	Installed	Fixed in
CVE-2026-77117	Medium	glibc-2.44	2.44-r7	—
CVE-2026-80489	Medium	glibc-2.44	2.44-r7	—
CVE-2026-8674	Medium	glibc-2.44	2.44-r7	—
CVE-2026-89092	Medium	glibc-2.44	2.44-r7	—

Everything is verifiable without an account. Copy and run:

Build provenance (SLSA v1.0, Build L2)

gh attestation verify oci://ghcr.io/rtvkiz/minimal-nginx:latest --owner rtvkiz

Cosign signature

cosign verify \
  --certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/rtvkiz/minimal-nginx:latest

SBOM attestation (SPDX)

cosign verify-attestation --type spdxjson \
  --certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/rtvkiz/minimal-nginx:latest \
  | jq -r '.payload | @base64d | fromjson | .predicate'

Signatures are logged in the public Rekor transparency log.

More Web Servers & Proxies images

Weighing this against another provider? The comparison pages publish head-to-head scan data with the raw dataset, including the images where Minimal comes off worse — or read the migration guide for what actually breaks when you switch.

org.opencontainers.image.title	minimal-nginx-dev
org.opencontainers.image.description	Dev variant of minimal-nginx: same nginx mainline + shell + curl/openssl/dig for HTTP/TLS/DNS debugging. Not for production.
org.opencontainers.image.url	https://github.com/rtvkiz/minimal
org.opencontainers.image.source	https://github.com/rtvkiz/minimal/tree/main/images/nginx
org.opencontainers.image.licenses	Apache-2.0
dev.minimal.variant	dev