Docker: based docker images off official languages ones.

Language versions are bumped to:
 - python 3.9
 - ruby 2.7
 - go 1.15
 - node 15
 - perl 5.32

Removed images:
 - python 2.7 due to EOL
 - full/latest due to incompatibility with the new scheme

3 files changed, 151 insertions, 141 deletions

diff --git a/pkg/docker/Dockerfile.tmpl b/pkg/docker/Dockerfile.tmpl
deleted file mode 100644
index 8b0e35e4..00000000
--- a/pkg/docker/Dockerfile.tmpl
+++ /dev/null
@@ -1,95 +0,0 @@
-FROM debian:buster-slim
-
-LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
-
-ENV UNIT_VERSION          @@UNIT_VERSION@@
-
-RUN set -x \
-	&& apt-get update \
-	&& apt-get install --no-install-recommends --no-install-suggests -y gnupg1 apt-transport-https ca-certificates \
-	&& \
-	NGINX_GPGKEY=573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62; \
-	found=''; \
-	for server in \
-		ha.pool.sks-keyservers.net \
-		hkp://keyserver.ubuntu.com:80 \
-		hkp://p80.pool.sks-keyservers.net:80 \
-		pgp.mit.edu \
-	; do \
-		echo "Fetching GPG key $NGINX_GPGKEY from $server"; \
-		apt-key adv --keyserver "$server" --keyserver-options timeout=10 --recv-keys "$NGINX_GPGKEY" && found=yes && break; \
-	done; \
-	test -z "$found" && echo >&2 "error: failed to fetch GPG key $NGINX_GPGKEY" && exit 1; \
-	apt-get remove --purge --auto-remove -y gnupg1 && rm -rf /var/lib/apt/lists/* \
-# work-around debian bug 863199
-	&& mkdir -p /usr/share/man/man1 \
-	&& dpkgArch="$(dpkg --print-architecture)" \
-	&& unitPackages=@@UNITPACKAGES@@ \
-	&& case "$dpkgArch" in \
-		amd64|i386) \
-# arches officialy built by upstream
-			echo "deb https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			&& apt-get update \
-			;; \
-		*) \
-# we're on an architecture upstream doesn't officially build for
-# let's build binaries from the published source packages
-			echo "deb-src https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			\
-# new directory for storing sources and .deb files
-			&& tempDir="$(mktemp -d)" \
-			&& chmod 777 "$tempDir" \
-# (777 to ensure APT's "_apt" user can access it too)
-			\
-# save list of currently-installed packages so build dependencies can be cleanly removed later
-			&& savedAptMark="$(apt-mark showmanual)" \
-			\
-# build .deb files from upstream's source packages (which are verified by apt-get)
-			&& apt-get update \
-			&& apt-get build-dep -y $unitPackages \
-			&& ( \
-				cd "$tempDir" \
-				&& DEB_BUILD_OPTIONS="nocheck parallel=$(nproc)" \
-					apt-get source --compile $unitPackages \
-			) \
-# we don't remove APT lists here because they get re-downloaded and removed later
-			\
-# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
-# (which is done after we install the built packages so we don't have to redownload any overlapping dependencies)
-			&& apt-mark showmanual | xargs apt-mark auto > /dev/null \
-			&& { [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; } \
-			\
-# create a temporary local APT repo to install from (so that dependency resolution can be handled by APT, as it should be)
-			&& ls -lAFh "$tempDir" \
-			&& ( cd "$tempDir" && dpkg-scanpackages . > Packages ) \
-			&& grep '^Package: ' "$tempDir/Packages" \
-			&& echo "deb [ trusted=yes ] file://$tempDir ./" > /etc/apt/sources.list.d/temp.list \
-# work around the following APT issue by using "Acquire::GzipIndexes=false" (overriding "/etc/apt/apt.conf.d/docker-gzip-indexes")
-#   Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-#   ...
-#   E: Failed to fetch store:/var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages  Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-			&& apt-get -o Acquire::GzipIndexes=false update \
-			;; \
-	esac \
-	\
-	&& apt-get install --no-install-recommends --no-install-suggests -y \
-						$unitPackages \
-                        curl \
-	&& apt-get remove --purge --auto-remove -y apt-transport-https && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/unit.list \
-	\
-# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
-	&& if [ -n "$tempDir" ]; then \
-		apt-get purge -y --auto-remove \
-		&& rm -rf "$tempDir" /etc/apt/sources.list.d/temp.list; \
-	fi
-
-# forward log to docker log collector
-RUN ln -sf /dev/stdout /var/log/unit.log
-
-STOPSIGNAL SIGTERM
-
-COPY docker-entrypoint.sh /usr/local/bin/
-RUN mkdir /docker-entrypoint.d/
-ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
-
-CMD ["unitd", "--no-daemon", "--control", "unix:/var/run/control.unit.sock"]
diff --git a/pkg/docker/Makefile b/pkg/docker/Makefile
index 455e9fb1..44fb5443 100644
--- a/pkg/docker/Makefile
+++ b/pkg/docker/Makefile
@@ -4,54 +4,95 @@ include ../../version
 include ../shasum.mak
 
 DEFAULT_VERSION := $(NXT_VERSION)
-DEFAULT_RELEASE := 1
 
 VERSION ?= $(DEFAULT_VERSION)
-RELEASE ?= $(DEFAULT_RELEASE)
-CODENAME := buster
-
-UNIT_VERSION = $(VERSION)-$(RELEASE)~$(CODENAME)
-
-MODULES = python2.7 python3.7 php7.3 go1.11-dev perl5.28 ruby2.5 \
-          jsc11 full minimal
-
-MODULE_php7.3="unit=$${UNIT_VERSION} unit-php=$${UNIT_VERSION}"
-
-MODULE_python2.7="unit=$${UNIT_VERSION} unit-python2.7=$${UNIT_VERSION}"
-
-MODULE_python3.7="unit=$${UNIT_VERSION} unit-python3.7=$${UNIT_VERSION}"
-
-MODULE_go1.11-dev="unit=$${UNIT_VERSION} unit-go=$${UNIT_VERSION} gcc"
-
-MODULE_perl5.28="unit=$${UNIT_VERSION} unit-perl=$${UNIT_VERSION}"
-
-MODULE_ruby2.5="unit=$${UNIT_VERSION} unit-ruby=$${UNIT_VERSION}"
-
-MODULE_jsc11="unit=$${UNIT_VERSION} unit-jsc11=$${UNIT_VERSION}"
-
-MODULE_full="unit=$${UNIT_VERSION} unit-php=$${UNIT_VERSION} unit-python2.7=$${UNIT_VERSION} unit-python3.7=$${UNIT_VERSION} unit-perl=$${UNIT_VERSION} unit-ruby=$${UNIT_VERSION} unit-jsc11=$${UNIT_VERSION}"
-
-MODULE_minimal="unit=$${UNIT_VERSION}"
 
 EXPORT_DIR := $(VERSION)
 
+MODULES ?= go jsc node perl php python ruby minimal
+
+VERSION_minimal ?=
+CONTAINER_minimal ?= debian:buster-slim
+CONFIGURE_minimal ?=
+INSTALL_minimal ?=	version
+define COPY_minimal
+endef
+
+VERSION_go ?=		1.15
+CONTAINER_go ?=		golang:$(VERSION_go)
+CONFIGURE_go ?=		go --go-path=$$GOPATH
+INSTALL_go ?=		go-install-src libunit-install
+define COPY_go
+COPY --from=BUILDER /usr/lib/x86_64-linux-gnu/libunit.a /usr/lib/x86_64-linux-gnu/\n\$
+COPY --from=BUILDER /usr/include/nxt_* /usr/include/\n\$
+COPY --from=BUILDER /go/src/ /go/src/
+endef
+
+VERSION_jsc ?=		11
+CONTAINER_jsc ?=	openjdk:$(VERSION_jsc)-jdk
+CONFIGURE_jsc ?=	java --jars=/usr/share/unit-jsc-common/
+INSTALL_jsc ?=		java-shared-install java-install
+COPY_jsc =	 		COPY --from=BUILDER /usr/share/unit-jsc-common/ /usr/share/unit-jsc-common/
+
+VERSION_node ?=		15
+CONTAINER_node ?=	node:$(VERSION_node)
+CONFIGURE_node ?=	nodejs --node-gyp=/usr/local/lib/node_modules/npm/bin/node-gyp-bin/node-gyp
+INSTALL_node ?=		node node-install libunit-install
+define COPY_node
+COPY --from=BUILDER /usr/lib/x86_64-linux-gnu/libunit.a /usr/lib/x86_64-linux-gnu/\n\$
+COPY --from=BUILDER /usr/include/nxt_* /usr/include/\n\$
+COPY --from=BUILDER /usr/local/lib/node_modules/unit-http/ /usr/local/lib/node_modules/unit-http/
+endef
+
+VERSION_perl ?=		5.32
+CONTAINER_perl ?=	perl:$(VERSION_perl)
+CONFIGURE_perl ?=	perl
+INSTALL_perl ?=		perl-install
+COPY_perl =
+
+VERSION_php ?=		8.0
+CONTAINER_php ?=	php:$(VERSION_php)-cli
+CONFIGURE_php ?=	php
+INSTALL_php ?=		php-install
+COPY_php =			RUN ldconfig
+
+VERSION_python ?=	3.9
+CONTAINER_python ?=	python:$(VERSION_python)
+CONFIGURE_python ?=	python --config=/usr/local/bin/python3-config
+INSTALL_python ?=	python3-install
+COPY_python =
+
+VERSION_ruby ?=		2.7
+CONTAINER_ruby ?=	ruby:$(VERSION_ruby)
+CONFIGURE_ruby ?=	ruby
+INSTALL_ruby ?=		ruby-install
+COPY_ruby =			RUN gem install rack
+
 default:
 	@echo "valid targets: all build dockerfiles push tag export clean"
 
-dockerfiles: $(addprefix Dockerfile., $(MODULES))
-build: refresh-base $(addprefix build-,$(MODULES))
-tag: $(addprefix tag-,$(MODULES))
-push: $(addprefix push-,$(MODULES)) latest
-export: $(addsuffix .tar.gz,$(addprefix $(EXPORT_DIR)/nginx-unit-$(VERSION)-,$(MODULES))) $(addsuffix .tar.gz.sha512, $(addprefix $(EXPORT_DIR)/nginx-unit-$(VERSION)-,$(MODULES)))
+MODVERSIONS = $(foreach module,$(MODULES),$(module)$(VERSION_$(module)))
+
+modname = $(shell echo $1 | /usr/bin/tr -d '.01234567890-')
+
+dockerfiles: $(addprefix Dockerfile., $(MODVERSIONS))
+build: $(addprefix build-,$(MODVERSIONS))
+tag: $(addprefix tag-,$(MODVERSIONS))
+push: $(addprefix push-,$(MODVERSIONS))
+export: $(addsuffix .tar.gz,$(addprefix $(EXPORT_DIR)/nginx-unit-$(VERSION)-,$(MODVERSIONS))) $(addsuffix .tar.gz.sha512, $(addprefix $(EXPORT_DIR)/nginx-unit-$(VERSION)-,$(MODVERSIONS)))
 
 Dockerfile.%: ../../version
 	@echo "===> Building $@"
-	cat Dockerfile.tmpl | sed \
-			-e 's,@@UNITPACKAGES@@,$(MODULE_$*),g' \
-			-e 's,@@UNIT_VERSION@@,$(UNIT_VERSION),g' \
+	cat template.Dockerfile | sed \
+			-e 's,@@VERSION@@,$(VERSION),g' \
+			-e 's,@@CONTAINER@@,$(CONTAINER_$(call modname, $*)),g' \
+			-e 's,@@CONFIGURE@@,$(CONFIGURE_$(call modname, $*)),g' \
+			-e 's,@@INSTALL@@,$(INSTALL_$(call modname, $*)),g' \
+			-e 's,@@COPY@@,$(COPY_$(call modname, $*)),g' \
 			> $@
 
 build-%: Dockerfile.%
+	docker pull $(CONTAINER_$(call modname, $*))
 	docker build --no-cache -t unit:$(VERSION)-$* -f Dockerfile.$* .
 
 tag-%: build-%
@@ -62,15 +103,6 @@ push-%: tag-%
 	docker push nginx/unit:$(VERSION)-$*
 	docker push public.ecr.aws/nginx/unit:$(VERSION)-$*
 
-latest:
-	docker tag nginx/unit:$(VERSION)-full nginx/unit:latest
-	docker tag nginx/unit:$(VERSION)-full public.ecr.aws/nginx/unit:latest
-	docker push nginx/unit:latest
-	docker push public.ecr.aws/nginx/unit:latest
-
-refresh-base:
-	docker pull $(shell head -n 1 Dockerfile.tmpl | cut -d' ' -f 2)
-
 $(EXPORT_DIR):
 	mkdir -p $@
 
@@ -80,10 +112,10 @@ $(EXPORT_DIR)/nginx-unit-$(VERSION)-%.tar.gz: $(EXPORT_DIR) tag-%
 $(EXPORT_DIR)/nginx-unit-$(VERSION)-%.tar.gz.sha512: $(EXPORT_DIR)/nginx-unit-$(VERSION)-%.tar.gz
 	$(SHA512SUM) $< | sed 's,$(EXPORT_DIR)/,,' > $@
 
-all: $(addprefix Dockerfile., $(MODULES))
+all: $(addprefix Dockerfile., $(MODVERSIONS))
 
 clean:
-	rm -f $(addprefix Dockerfile., $(MODULES))
+	rm -f $(addprefix Dockerfile., $(MODVERSIONS))
 	rm -rf $(EXPORT_DIR)
 
-.PHONY: default all build dockerfiles latest push tag export clean refresh-base
+.PHONY: default build dockerfiles push tag export clean
diff --git a/pkg/docker/template.Dockerfile b/pkg/docker/template.Dockerfile
new file mode 100644
index 00000000..d96d7982
--- /dev/null
+++ b/pkg/docker/template.Dockerfile
@@ -0,0 +1,73 @@
+FROM @@CONTAINER@@ as BUILDER
+
+LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
+
+RUN set -ex \
+    && apt-get update \
+    && apt-get install --no-install-recommends --no-install-suggests -y ca-certificates mercurial build-essential libssl-dev libpcre2-dev \
+    && mkdir -p /usr/lib/unit/modules /usr/lib/unit/debug-modules \
+    && hg clone https://hg.nginx.org/unit \
+    && cd unit \
+    && hg up @@VERSION@@ \
+    && NCPU="$(getconf _NPROCESSORS_ONLN)" \
+    && DEB_HOST_MULTIARCH="$(dpkg-architecture -q DEB_HOST_MULTIARCH)" \
+    && CC_OPT="$(DEB_BUILD_MAINT_OPTIONS="hardening=+all,-pie" DEB_CFLAGS_MAINT_APPEND="-Wp,-D_FORTIFY_SOURCE=2 -fPIC" dpkg-buildflags --get CFLAGS)" \
+    && LD_OPT="$(DEB_BUILD_MAINT_OPTIONS="hardening=+all,-pie" DEB_LDFLAGS_MAINT_APPEND="-Wl,--as-needed -pie" dpkg-buildflags --get LDFLAGS)" \
+    && CONFIGURE_ARGS="--prefix=/usr \
+                --state=/var/lib/unit \
+                --control=unix:/var/run/control.unit.sock \
+                --pid=/var/run/unit.pid \
+                --log=/var/log/unit.log \
+                --tmp=/var/tmp \
+                --user=unit \
+                --group=unit \
+                --openssl \
+                --libdir=/usr/lib/$DEB_HOST_MULTIARCH" \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --ld-opt="$LD_OPT" --modules=/usr/lib/unit/debug-modules --debug \
+    && make -j $NCPU unitd \
+    && install -pm755 build/unitd /usr/sbin/unitd-debug \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --ld-opt="$LD_OPT" --modules=/usr/lib/unit/modules \
+    && make -j $NCPU unitd \
+    && install -pm755 build/unitd /usr/sbin/unitd \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --modules=/usr/lib/unit/debug-modules --debug \
+    && ./configure @@CONFIGURE@@ \
+    && make -j $NCPU @@INSTALL@@ \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --modules=/usr/lib/unit/modules \
+    && ./configure @@CONFIGURE@@ \
+    && make -j $NCPU @@INSTALL@@ \
+    && ldd /usr/sbin/unitd | awk '/=>/{print $(NF-1)}' | while read n; do dpkg-query -S $n; done | sed 's/^\([^:]\+\):.*$/\1/' | sort | uniq > /requirements.apt
+
+FROM @@CONTAINER@@
+COPY docker-entrypoint.sh /usr/local/bin/
+COPY --from=BUILDER /usr/sbin/unitd /usr/sbin/unitd
+COPY --from=BUILDER /usr/sbin/unitd-debug /usr/sbin/unitd-debug
+COPY --from=BUILDER /usr/lib/unit/ /usr/lib/unit/
+COPY --from=BUILDER /requirements.apt /requirements.apt
+@@COPY@@
+RUN set -x \
+    && mkdir -p /var/lib/unit/ \
+    && mkdir /docker-entrypoint.d/ \
+    && addgroup --system unit \
+    && adduser \
+         --system \
+         --disabled-login \
+         --ingroup unit \
+         --no-create-home \
+         --home /nonexistent \
+         --gecos "unit user" \
+         --shell /bin/false \
+         unit \
+    && apt update \
+    && apt --no-install-recommends --no-install-suggests -y install $(cat /requirements.apt) \
+    && apt-get clean && rm -rf /var/lib/apt/lists/* \
+    && rm -f /requirements.apt \
+    && ln -sf /dev/stdout /var/log/unit.log
+
+STOPSIGNAL SIGTERM
+
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
+
+CMD ["unitd", "--no-daemon", "--control", "unix:/var/run/control.unit.sock"]