Docker nginx error: openssl: command not found

Question

I am using nginx as a proxy to forward requests to other components (servers).

Each component, including nginx is implemented as docker container, i.e. I have a docker container for 'nginx-proxy', 'dashboard-server', 'backend-server' (REST API), and 'landing-server' (Landing Page). The latter 3 components are all NodeJS Express servers and working properly when I use the command docker-compose build there are no errors but when I start the containers with docker-compose -f docker-compose.yml -f docker-compose.prod.yml up -d the NodeJS containers work fine, but the nginx container gives me this error using docker-compose logs nginx-proxy:

Attaching to docker_nginx-proxy_1
nginx-proxy_1       | /start.sh: line 5: openssl: command not found
nginx-proxy_1       | Creating dhparams…\c
nginx-proxy_1       | ok
nginx-proxy_1       | Starting nginx…
nginx-proxy_1       | 2017/08/23 23:27:20 [emerg] 6#6:
BIO_new_file(“/etc/letsencrypt/live/admin.domain.com/fullchain.pem”) 
failed (SSL: error:02001002:system library:fopen:No such file or directory:
fopen(‘/etc/letsencrypt/live/admin.domain.com/fullchain.pem’,‘r’) error:2006D080:BIO routines:BIO_new_file:no such file)
nginx-proxy_1       | nginx: [emerg]
BIO_new_file(“/etc/letsencrypt/live/admin.domain.com/fullchain.pem”) failed (SSL: error:02001002:system library:fopen:
No such file or directory:fopen(‘/etc/letsencrypt/live/admin.domain.com/fullchain.pem’,‘r’)error:2006D080:BIO routines:BIO_new_file:no such file)

I am using Lets Encrypt for the SSL certificates, however the command certbot certonly --webroot -w /var/www/letsencrypt -d admin.domain.com -d api.domain.com -d www.domain.com -d domain.com results in the error Connection Refused because the nginx server does not start to handle the requests.

My nginx Dockerfile (nginx-proxy/Dockerfile):

FROM nginx:1.12

COPY start.sh /start.sh
RUN chmod u+x /start.sh

COPY conf.d /etc/nginx/conf.d

COPY sites-enabled /etc/nginx/sites-enabled

ENTRYPOINT ["/start.sh"]

My start.sh file (nginx-proxy/start.sh):

#!/bin/bash

if [ ! -f /etc/nginx/ssl/dhparam.pem ]; then
    echo "Creating dhparams…\c"
    openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
    echo "ok"
fi

echo "Starting nginx…"
nginx -g 'daemon off;

My default.conf file (nginx-proxy/conf.d/default.conf):

include /etc/nginx/sites-enabled/*.conf;

My api.conf file (the others are similar) (nginx-proxy/sites-enabled/api.conf):

server {
    listen 80;
    server_name api.domain.com;

    location ^~ /.well-known/acme-challenge/ {
      default_type "text/plain";
      root /var/www/letsencrypt;
    }

    location = /.well-known/acme-challenge/ {
      return 404;
    }

    return 301 https://$host$request_uri;
  }


  server {
    listen 443;
    server_name api.domain.com;

    ssl on;
    ssl_certificate /etc/letsencrypt/live/api.domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.domain.com/privkey.pem;

    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
    ssl_prefer_server_ciphers on;

    ssl_session_cache shared:SSL:1m;
    ssl_dhparam /etc/nginx/ssl/dhparam.pem;

    client_max_body_size 0;
    chunked_transfer_encoding on;

    location ^~ /.well-known/acme-challenge/ {
      default_type "text/plain";
      root /var/www/letsencrypt;
    }

    location = /.well-known/acme-challenge/ {
      return 404;
    }

    location / {
        proxy_read_timeout  900;
        proxy_pass_header   Server;
        proxy_cookie_path   ~*^/.* /;
        proxy_pass          http://backend-server:3000;
        proxy_set_header    Host $http_host;
        proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Port $server_port;
        proxy_set_header    X-Forwarded-Proto $http_x_forwarded_proto;
      }
  }

Any ideas?

Answer 1

I found the solution.

In my nginx Dockerfile, I had to use

FROM nginx:1.12-alpine

RUN apk update \
    && apk add openssl


...

Then the openssl command worked properly.