Merged with the default branch.

56 files changed, 903 insertions, 1160 deletions

diff --git a/pkg/deb/Makefile b/pkg/deb/Makefile
index 8a02105c..16e73b94 100644
--- a/pkg/deb/Makefile
+++ b/pkg/deb/Makefile
@@ -2,9 +2,10 @@
 
 include ../../version
 
+DEFAULT_VERSION := $(NXT_VERSION)
 DEFAULT_RELEASE := 1
 
-VERSION ?= $(NXT_VERSION)
+VERSION ?= $(DEFAULT_VERSION)
 RELEASE ?= $(DEFAULT_RELEASE)
 
 SRCDIR=	unit-$(VERSION)
@@ -157,6 +158,8 @@ CONFIGURE_ARGS=\
 	--pid=/var/run/unit.pid \
 	--log=/var/log/unit.log \
 	--tmp=/var/tmp \
+	--user=unit \
+	--group=unit \
 	--tests \
 	--openssl
 
@@ -205,6 +208,7 @@ debuild/$(SRCDIR)/debian:
         cat debian/rules.in | sed \
                 -e "s#%%CONFIGURE_ARGS%%#$(CONFIGURE_ARGS)#g" \
         > debuild/$(SRCDIR)/debian/rules ; \
+	chmod +x debuild/$(SRCDIR)/debian/rules ; \
 	}
 
 debuild/$(SRCDIR)/debian/changelog: ../../docs/changes.xml | debuild/$(SRCDIR)/debian
@@ -314,7 +318,7 @@ test: unit modules
 		test -h debuild/unit-$(VERSION)/debian/build-unit/build/$${soname} || \
 		ln -fs `pwd`/$${so} debuild/unit-$(VERSION)/debian/build-unit/build/$${soname} ; \
 	done ; \
-	( cd debuild/unit-$(VERSION)/debian/build-unit && env python3 -m pytest ) ; \
+	( cd debuild/unit-$(VERSION)/debian/build-unit && env python3 -m pytest --user=nobody $(PYTEST_ARGS) ) ; \
 	}
 
 test-debug: unit modules
@@ -325,7 +329,7 @@ test-debug: unit modules
 		test -h debuild/unit-$(VERSION)/debian/build-unit-debug/build/$${soname} || \
 		ln -fs `pwd`/$${so} debuild/unit-$(VERSION)/debian/build-unit-debug/build/$${soname} ; \
 	done ; \
-	( cd debuild/unit-$(VERSION)/debian/build-unit-debug && env python3 -m pytest ) ; \
+	( cd debuild/unit-$(VERSION)/debian/build-unit-debug && env python3 -m pytest --user=nobody $(PYTEST_ARGS) ) ; \
 	}
 
 clean:
diff --git a/pkg/deb/debian.module/control.in b/pkg/deb/debian.module/control.in
index e9b8b8e2..7e28f5e9 100644
--- a/pkg/deb/debian.module/control.in
+++ b/pkg/deb/debian.module/control.in
@@ -3,7 +3,9 @@ Section: admin
 Priority: extra
 Maintainer: Andrei Belov <defan@nginx.com>
 Build-Depends: debhelper (>= 9),
-               linux-libc-dev%%MODULE_BUILD_DEPENDS%%
+               linux-libc-dev,
+               libssl-dev,
+               libpcre2-dev%%MODULE_BUILD_DEPENDS%%
 Standards-Version: 3.9.5
 Homepage: https://unit.nginx.org
 
diff --git a/pkg/deb/debian.module/unit.example-go-config b/pkg/deb/debian.module/unit.example-go-config
index a2c91e80..8aa65939 100644
--- a/pkg/deb/debian.module/unit.example-go-config
+++ b/pkg/deb/debian.module/unit.example-go-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_go": {
 			"type": "external",
-			"user": "nobody",
 			"executable": "/tmp/go-app"
 		}
 	},
diff --git a/pkg/deb/debian.module/unit.example-perl-config b/pkg/deb/debian.module/unit.example-perl-config
index 031928ce..2182fc46 100644
--- a/pkg/deb/debian.module/unit.example-perl-config
+++ b/pkg/deb/debian.module/unit.example-perl-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_perl": {
 			"type": "perl",
-			"user": "nobody",
 			"processes": 1,
 			"working_directory": "/usr/share/doc/unit-perl/examples/perl-app",
 			"script": "/usr/share/doc/unit-perl/examples/perl-app/index.pl"
diff --git a/pkg/deb/debian.module/unit.example-php-config b/pkg/deb/debian.module/unit.example-php-config
index 8f23c984..9673385f 100644
--- a/pkg/deb/debian.module/unit.example-php-config
+++ b/pkg/deb/debian.module/unit.example-php-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_php": {
 			"type": "php",
-			"user": "nobody",
 			"processes": 2,
 			"root": "/usr/share/doc/unit-php/examples/phpinfo-app",
 			"index": "index.php"
diff --git a/pkg/deb/debian.module/unit.example-python-config b/pkg/deb/debian.module/unit.example-python-config
index d612c89d..b3d3a2e5 100644
--- a/pkg/deb/debian.module/unit.example-python-config
+++ b/pkg/deb/debian.module/unit.example-python-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_python": {
 			"type": "python",
-			"user": "nobody",
 			"processes": 2,
 			"path": "/usr/share/doc/unit-python/examples/python-app",
 			"module": "wsgi"
diff --git a/pkg/deb/debian.module/unit.example-python2.7-config b/pkg/deb/debian.module/unit.example-python2.7-config
index bede8899..4f1d16c9 100644
--- a/pkg/deb/debian.module/unit.example-python2.7-config
+++ b/pkg/deb/debian.module/unit.example-python2.7-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_python": {
 			"type": "python 2.7",
-			"user": "nobody",
 			"processes": 2,
 			"path": "/usr/share/doc/unit-python2.7/examples/python-app",
 			"module": "wsgi"
diff --git a/pkg/deb/debian.module/unit.example-python3.4-config b/pkg/deb/debian.module/unit.example-python3.4-config
index dd496bd8..e6d90acf 100644
--- a/pkg/deb/debian.module/unit.example-python3.4-config
+++ b/pkg/deb/debian.module/unit.example-python3.4-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_python": {
 			"type": "python 3.4",
-			"user": "nobody",
 			"processes": 2,
 			"path": "/usr/share/doc/unit-python3.4/examples/python-app",
 			"module": "wsgi"
diff --git a/pkg/deb/debian.module/unit.example-python3.5-config b/pkg/deb/debian.module/unit.example-python3.5-config
index 2be6de4a..480327ec 100644
--- a/pkg/deb/debian.module/unit.example-python3.5-config
+++ b/pkg/deb/debian.module/unit.example-python3.5-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_python": {
 			"type": "python 3.5",
-			"user": "nobody",
 			"processes": 2,
 			"path": "/usr/share/doc/unit-python3.5/examples/python-app",
 			"module": "wsgi"
diff --git a/pkg/deb/debian.module/unit.example-python3.6-config b/pkg/deb/debian.module/unit.example-python3.6-config
index a77e8e07..543024ff 100644
--- a/pkg/deb/debian.module/unit.example-python3.6-config
+++ b/pkg/deb/debian.module/unit.example-python3.6-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_python": {
 			"type": "python 3.6",
-			"user": "nobody",
 			"processes": 2,
 			"path": "/usr/share/doc/unit-python3.6/examples/python-app",
 			"module": "wsgi"
diff --git a/pkg/deb/debian.module/unit.example-python3.7-config b/pkg/deb/debian.module/unit.example-python3.7-config
index 9b13c058..e7b8dbc3 100644
--- a/pkg/deb/debian.module/unit.example-python3.7-config
+++ b/pkg/deb/debian.module/unit.example-python3.7-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_python": {
 			"type": "python 3.7",
-			"user": "nobody",
 			"processes": 2,
 			"path": "/usr/share/doc/unit-python3.7/examples/python-app",
 			"module": "wsgi"
diff --git a/pkg/deb/debian.module/unit.example-python3.8-config b/pkg/deb/debian.module/unit.example-python3.8-config
index 435e025f..dc649e30 100644
--- a/pkg/deb/debian.module/unit.example-python3.8-config
+++ b/pkg/deb/debian.module/unit.example-python3.8-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_python": {
 			"type": "python 3.8",
-			"user": "nobody",
 			"processes": 2,
 			"path": "/usr/share/doc/unit-python3.8/examples/python-app",
 			"module": "wsgi"
diff --git a/pkg/deb/debian.module/unit.example-ruby-config b/pkg/deb/debian.module/unit.example-ruby-config
index 15a92735..930aa987 100644
--- a/pkg/deb/debian.module/unit.example-ruby-config
+++ b/pkg/deb/debian.module/unit.example-ruby-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_ruby": {
 			"type": "ruby",
-			"user": "nobody",
 			"processes": 2,
 			"script": "/usr/share/doc/unit-ruby/examples/ruby-app.ru"
 		}
diff --git a/pkg/deb/debian/control b/pkg/deb/debian/control
index 9828b6ab..a8e8cdc4 100644
--- a/pkg/deb/debian/control
+++ b/pkg/deb/debian/control
@@ -4,7 +4,8 @@ Priority: extra
 Maintainer: Andrei Belov <defan@nginx.com>
 Build-Depends: debhelper (>= 9),
                linux-libc-dev,
-               libssl-dev
+               libssl-dev,
+               libpcre2-dev
 Standards-Version: 3.9.5
 Homepage: https://unit.nginx.org
 
diff --git a/pkg/deb/debian/copyright b/pkg/deb/debian/copyright
index 2acb87b9..2a2c5fd0 100644
--- a/pkg/deb/debian/copyright
+++ b/pkg/deb/debian/copyright
@@ -1,14 +1,14 @@
 
    NGINX Unit.
 
-   Copyright 2017-2020 NGINX, Inc.
-   Copyright 2017-2020 Igor Sysoev
-   Copyright 2017-2020 Valentin V. Bartenev
-   Copyright 2017-2020 Max Romanov
-   Copyright 2017-2020 Andrei Zeliankou
-   Copyright 2017-2020 Andrei Belov
-   Copyright 2018-2020 Konstantin Pavlov
-   Copyright 2019-2020 Tiago Natel de Moura
+   Copyright 2017-2021 NGINX, Inc.
+   Copyright 2017-2021 Igor Sysoev
+   Copyright 2017-2021 Valentin V. Bartenev
+   Copyright 2017-2021 Max Romanov
+   Copyright 2017-2021 Andrei Zeliankou
+   Copyright 2017-2021 Andrei Belov
+   Copyright 2018-2021 Konstantin Pavlov
+   Copyright 2019-2021 Tiago Natel de Moura
    Copyright 2019-2020 Axel Duch
    Copyright 2018-2019 Alexander Borisov
 
diff --git a/pkg/deb/debian/rules.in b/pkg/deb/debian/rules.in
index a4696793..aa7921d1 100644
--- a/pkg/deb/debian/rules.in
+++ b/pkg/deb/debian/rules.in
@@ -10,6 +10,7 @@ DPKG_EXPORT_BUILDFLAGS = 1
 include /usr/share/dpkg/buildflags.mk
 
 DEB_HOST_MULTIARCH ?= $(shell dpkg-architecture -qDEB_HOST_MULTIARCH)
+CODENAME := $(shell lsb_release -cs)
 
 BUILDDIR_unit = $(CURDIR)/debian/build-unit
 BUILDDIR_unit_debug = $(CURDIR)/debian/build-unit-debug
@@ -96,7 +97,11 @@ install: build do.tests
 	dh_testroot
 	dh_prep
 	dh_installdirs
+ifeq ($(CODENAME), xenial)
 	dh_installinit
+else
+	dh_installsystemd
+endif
 	dh_installlogrotate
 	cd $(BUILDDIR_unit) && DESTDIR=$(INSTALLDIR) make install
 	cd $(BUILDDIR_unit) && DESTDIR=$(INSTALLDIR_dev) make libunit-install
@@ -104,8 +109,9 @@ install: build do.tests
 	install -m 644 $(BUILDDIR_unit_debug)/build/libunit.a $(INSTALLDIR_dev)/usr/lib/$(DEB_HOST_MULTIARCH)/libunit-debug.a
 	mkdir -p $(INSTALLDIR)/usr/share/doc/unit/examples
 	install -m 644 debian/unit.example.config $(INSTALLDIR)/usr/share/doc/unit/examples/example.config
-	install -m 644 CHANGES $(INSTALLDIR)/usr/share/doc/unit/
+	install -m 644 CHANGES $(INSTALLDIR)/usr/share/doc/unit/changelog
 	install -m 644 README $(INSTALLDIR)/usr/share/doc/unit/
+	install -m 644 NOTICE $(INSTALLDIR)/usr/share/doc/unit/
 
 binary-indep: build install
 	dh_testdir
diff --git a/pkg/deb/debian/unit.example.config b/pkg/deb/debian/unit.example.config
index 5610cb3a..66695327 100644
--- a/pkg/deb/debian/unit.example.config
+++ b/pkg/deb/debian/unit.example.config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_php": {
 			"type": "php",
-			"user": "nobody",
 			"processes": 2,
 			"root": "/usr/share/doc/unit/examples/php-app",
 			"index": "index.php"
@@ -10,7 +9,6 @@
 
 		"example_python": {
 			"type": "python",
-			"user": "nobody",
 			"processes": 2,
 			"path": "/usr/share/doc/unit/examples/python-app",
 			"module": "wsgi"
@@ -18,13 +16,11 @@
 
 		"example_go": {
 			"type": "external",
-			"user": "nobody",
 			"executable": "/tmp/go-app"
 		},
 
 		"example_perl": {
 			"type": "perl",
-			"user": "nobody",
 			"processes": 1,
 			"working_directory": "/usr/share/doc/unit-perl/examples/perl-app",
 			"script": "/usr/share/doc/unit-perl/examples/perl-app/index.pl"
diff --git a/pkg/deb/debian/unit.postinst b/pkg/deb/debian/unit.postinst
index 76375a2b..8aa476b3 100755
--- a/pkg/deb/debian/unit.postinst
+++ b/pkg/deb/debian/unit.postinst
@@ -6,6 +6,40 @@ if [ "$1" != "configure" ]; then
     exit 0
 fi
 
+if [ -n "$2" ]; then
+    if dpkg --compare-versions "${2%%-*}" le "1.21.0"; then
+      cat <<BANNER
+----------------------------------------------------------------------
+
+WARNING:
+
+Since version 1.22.0, Unit's non-privileged processes run as unit:unit by
+default.  Review your system permissions and Unit configuration so apps and
+routes that relied on these processes running as nobody:nogroup stay working.
+
+More info: https://unit.nginx.org/installation/#official-packages
+
+----------------------------------------------------------------------
+BANNER
+    fi
+fi
+
+if ! getent group unit >/dev/null; then
+    addgroup --system unit >/dev/null
+fi
+
+if ! getent passwd unit >/dev/null; then
+    adduser \
+      --system \
+      --disabled-login \
+      --ingroup unit \
+      --no-create-home \
+      --home /nonexistent \
+      --gecos "unit user" \
+      --shell /bin/false \
+      unit >/dev/null
+fi
+
 #DEBHELPER#
 
 exit 0
diff --git a/pkg/deb/debian/unit.preinst b/pkg/deb/debian/unit.preinst
index d4be468d..bd513788 100644
--- a/pkg/deb/debian/unit.preinst
+++ b/pkg/deb/debian/unit.preinst
@@ -17,6 +17,7 @@ Online documentation is available at https://unit.nginx.org/
 ----------------------------------------------------------------------
 BANNER
         ;;
+
     upgrade)
         ;;
 
diff --git a/pkg/docker/Dockerfile.full b/pkg/docker/Dockerfile.full
deleted file mode 100644
index a5f3e13f..00000000
--- a/pkg/docker/Dockerfile.full
+++ /dev/null
@@ -1,95 +0,0 @@
-FROM debian:buster-slim
-
-LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
-
-ENV UNIT_VERSION          1.21.0-1~buster
-
-RUN set -x \
-	&& apt-get update \
-	&& apt-get install --no-install-recommends --no-install-suggests -y gnupg1 apt-transport-https ca-certificates \
-	&& \
-	NGINX_GPGKEY=573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62; \
-	found=''; \
-	for server in \
-		ha.pool.sks-keyservers.net \
-		hkp://keyserver.ubuntu.com:80 \
-		hkp://p80.pool.sks-keyservers.net:80 \
-		pgp.mit.edu \
-	; do \
-		echo "Fetching GPG key $NGINX_GPGKEY from $server"; \
-		apt-key adv --keyserver "$server" --keyserver-options timeout=10 --recv-keys "$NGINX_GPGKEY" && found=yes && break; \
-	done; \
-	test -z "$found" && echo >&2 "error: failed to fetch GPG key $NGINX_GPGKEY" && exit 1; \
-	apt-get remove --purge --auto-remove -y gnupg1 && rm -rf /var/lib/apt/lists/* \
-# work-around debian bug 863199
-	&& mkdir -p /usr/share/man/man1 \
-	&& dpkgArch="$(dpkg --print-architecture)" \
-	&& unitPackages="unit=${UNIT_VERSION} unit-php=${UNIT_VERSION} unit-python2.7=${UNIT_VERSION} unit-python3.7=${UNIT_VERSION} unit-perl=${UNIT_VERSION} unit-ruby=${UNIT_VERSION} unit-jsc11=${UNIT_VERSION}" \
-	&& case "$dpkgArch" in \
-		amd64|i386) \
-# arches officialy built by upstream
-			echo "deb https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			&& apt-get update \
-			;; \
-		*) \
-# we're on an architecture upstream doesn't officially build for
-# let's build binaries from the published source packages
-			echo "deb-src https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			\
-# new directory for storing sources and .deb files
-			&& tempDir="$(mktemp -d)" \
-			&& chmod 777 "$tempDir" \
-# (777 to ensure APT's "_apt" user can access it too)
-			\
-# save list of currently-installed packages so build dependencies can be cleanly removed later
-			&& savedAptMark="$(apt-mark showmanual)" \
-			\
-# build .deb files from upstream's source packages (which are verified by apt-get)
-			&& apt-get update \
-			&& apt-get build-dep -y $unitPackages \
-			&& ( \
-				cd "$tempDir" \
-				&& DEB_BUILD_OPTIONS="nocheck parallel=$(nproc)" \
-					apt-get source --compile $unitPackages \
-			) \
-# we don't remove APT lists here because they get re-downloaded and removed later
-			\
-# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
-# (which is done after we install the built packages so we don't have to redownload any overlapping dependencies)
-			&& apt-mark showmanual | xargs apt-mark auto > /dev/null \
-			&& { [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; } \
-			\
-# create a temporary local APT repo to install from (so that dependency resolution can be handled by APT, as it should be)
-			&& ls -lAFh "$tempDir" \
-			&& ( cd "$tempDir" && dpkg-scanpackages . > Packages ) \
-			&& grep '^Package: ' "$tempDir/Packages" \
-			&& echo "deb [ trusted=yes ] file://$tempDir ./" > /etc/apt/sources.list.d/temp.list \
-# work around the following APT issue by using "Acquire::GzipIndexes=false" (overriding "/etc/apt/apt.conf.d/docker-gzip-indexes")
-#   Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-#   ...
-#   E: Failed to fetch store:/var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages  Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-			&& apt-get -o Acquire::GzipIndexes=false update \
-			;; \
-	esac \
-	\
-	&& apt-get install --no-install-recommends --no-install-suggests -y \
-						$unitPackages \
-                        curl \
-	&& apt-get remove --purge --auto-remove -y apt-transport-https && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/unit.list \
-	\
-# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
-	&& if [ -n "$tempDir" ]; then \
-		apt-get purge -y --auto-remove \
-		&& rm -rf "$tempDir" /etc/apt/sources.list.d/temp.list; \
-	fi
-
-# forward log to docker log collector
-RUN ln -sf /dev/stdout /var/log/unit.log
-
-STOPSIGNAL SIGTERM
-
-COPY docker-entrypoint.sh /usr/local/bin/
-RUN mkdir /docker-entrypoint.d/
-ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
-
-CMD ["unitd", "--no-daemon", "--control", "unix:/var/run/control.unit.sock"]
diff --git a/pkg/docker/Dockerfile.go1.11-dev b/pkg/docker/Dockerfile.go1.11-dev
deleted file mode 100644
index cb1c1d85..00000000
--- a/pkg/docker/Dockerfile.go1.11-dev
+++ /dev/null
@@ -1,95 +0,0 @@
-FROM debian:buster-slim
-
-LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
-
-ENV UNIT_VERSION          1.21.0-1~buster
-
-RUN set -x \
-	&& apt-get update \
-	&& apt-get install --no-install-recommends --no-install-suggests -y gnupg1 apt-transport-https ca-certificates \
-	&& \
-	NGINX_GPGKEY=573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62; \
-	found=''; \
-	for server in \
-		ha.pool.sks-keyservers.net \
-		hkp://keyserver.ubuntu.com:80 \
-		hkp://p80.pool.sks-keyservers.net:80 \
-		pgp.mit.edu \
-	; do \
-		echo "Fetching GPG key $NGINX_GPGKEY from $server"; \
-		apt-key adv --keyserver "$server" --keyserver-options timeout=10 --recv-keys "$NGINX_GPGKEY" && found=yes && break; \
-	done; \
-	test -z "$found" && echo >&2 "error: failed to fetch GPG key $NGINX_GPGKEY" && exit 1; \
-	apt-get remove --purge --auto-remove -y gnupg1 && rm -rf /var/lib/apt/lists/* \
-# work-around debian bug 863199
-	&& mkdir -p /usr/share/man/man1 \
-	&& dpkgArch="$(dpkg --print-architecture)" \
-	&& unitPackages="unit=${UNIT_VERSION} unit-go=${UNIT_VERSION} gcc" \
-	&& case "$dpkgArch" in \
-		amd64|i386) \
-# arches officialy built by upstream
-			echo "deb https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			&& apt-get update \
-			;; \
-		*) \
-# we're on an architecture upstream doesn't officially build for
-# let's build binaries from the published source packages
-			echo "deb-src https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			\
-# new directory for storing sources and .deb files
-			&& tempDir="$(mktemp -d)" \
-			&& chmod 777 "$tempDir" \
-# (777 to ensure APT's "_apt" user can access it too)
-			\
-# save list of currently-installed packages so build dependencies can be cleanly removed later
-			&& savedAptMark="$(apt-mark showmanual)" \
-			\
-# build .deb files from upstream's source packages (which are verified by apt-get)
-			&& apt-get update \
-			&& apt-get build-dep -y $unitPackages \
-			&& ( \
-				cd "$tempDir" \
-				&& DEB_BUILD_OPTIONS="nocheck parallel=$(nproc)" \
-					apt-get source --compile $unitPackages \
-			) \
-# we don't remove APT lists here because they get re-downloaded and removed later
-			\
-# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
-# (which is done after we install the built packages so we don't have to redownload any overlapping dependencies)
-			&& apt-mark showmanual | xargs apt-mark auto > /dev/null \
-			&& { [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; } \
-			\
-# create a temporary local APT repo to install from (so that dependency resolution can be handled by APT, as it should be)
-			&& ls -lAFh "$tempDir" \
-			&& ( cd "$tempDir" && dpkg-scanpackages . > Packages ) \
-			&& grep '^Package: ' "$tempDir/Packages" \
-			&& echo "deb [ trusted=yes ] file://$tempDir ./" > /etc/apt/sources.list.d/temp.list \
-# work around the following APT issue by using "Acquire::GzipIndexes=false" (overriding "/etc/apt/apt.conf.d/docker-gzip-indexes")
-#   Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-#   ...
-#   E: Failed to fetch store:/var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages  Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-			&& apt-get -o Acquire::GzipIndexes=false update \
-			;; \
-	esac \
-	\
-	&& apt-get install --no-install-recommends --no-install-suggests -y \
-						$unitPackages \
-                        curl \
-	&& apt-get remove --purge --auto-remove -y apt-transport-https && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/unit.list \
-	\
-# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
-	&& if [ -n "$tempDir" ]; then \
-		apt-get purge -y --auto-remove \
-		&& rm -rf "$tempDir" /etc/apt/sources.list.d/temp.list; \
-	fi
-
-# forward log to docker log collector
-RUN ln -sf /dev/stdout /var/log/unit.log
-
-STOPSIGNAL SIGTERM
-
-COPY docker-entrypoint.sh /usr/local/bin/
-RUN mkdir /docker-entrypoint.d/
-ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
-
-CMD ["unitd", "--no-daemon", "--control", "unix:/var/run/control.unit.sock"]
diff --git a/pkg/docker/Dockerfile.go1.15 b/pkg/docker/Dockerfile.go1.15
new file mode 100644
index 00000000..270dc428
--- /dev/null
+++ b/pkg/docker/Dockerfile.go1.15
@@ -0,0 +1,75 @@
+FROM golang:1.15 as BUILDER
+
+LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
+
+RUN set -ex \
+    && apt-get update \
+    && apt-get install --no-install-recommends --no-install-suggests -y ca-certificates mercurial build-essential libssl-dev libpcre2-dev \
+    && mkdir -p /usr/lib/unit/modules /usr/lib/unit/debug-modules \
+    && hg clone https://hg.nginx.org/unit \
+    && cd unit \
+    && hg up 1.22.0 \
+    && NCPU="$(getconf _NPROCESSORS_ONLN)" \
+    && DEB_HOST_MULTIARCH="$(dpkg-architecture -q DEB_HOST_MULTIARCH)" \
+    && CC_OPT="$(DEB_BUILD_MAINT_OPTIONS="hardening=+all,-pie" DEB_CFLAGS_MAINT_APPEND="-Wp,-D_FORTIFY_SOURCE=2 -fPIC" dpkg-buildflags --get CFLAGS)" \
+    && LD_OPT="$(DEB_BUILD_MAINT_OPTIONS="hardening=+all,-pie" DEB_LDFLAGS_MAINT_APPEND="-Wl,--as-needed -pie" dpkg-buildflags --get LDFLAGS)" \
+    && CONFIGURE_ARGS="--prefix=/usr \
+                --state=/var/lib/unit \
+                --control=unix:/var/run/control.unit.sock \
+                --pid=/var/run/unit.pid \
+                --log=/var/log/unit.log \
+                --tmp=/var/tmp \
+                --user=unit \
+                --group=unit \
+                --openssl \
+                --libdir=/usr/lib/$DEB_HOST_MULTIARCH" \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --ld-opt="$LD_OPT" --modules=/usr/lib/unit/debug-modules --debug \
+    && make -j $NCPU unitd \
+    && install -pm755 build/unitd /usr/sbin/unitd-debug \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --ld-opt="$LD_OPT" --modules=/usr/lib/unit/modules \
+    && make -j $NCPU unitd \
+    && install -pm755 build/unitd /usr/sbin/unitd \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --modules=/usr/lib/unit/debug-modules --debug \
+    && ./configure go --go-path=$GOPATH \
+    && make -j $NCPU go-install-src libunit-install \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --modules=/usr/lib/unit/modules \
+    && ./configure go --go-path=$GOPATH \
+    && make -j $NCPU go-install-src libunit-install \
+    && ldd /usr/sbin/unitd | awk '/=>/{print $(NF-1)}' | while read n; do dpkg-query -S $n; done | sed 's/^\([^:]\+\):.*$/\1/' | sort | uniq > /requirements.apt
+
+FROM golang:1.15
+COPY docker-entrypoint.sh /usr/local/bin/
+COPY --from=BUILDER /usr/sbin/unitd /usr/sbin/unitd
+COPY --from=BUILDER /usr/sbin/unitd-debug /usr/sbin/unitd-debug
+COPY --from=BUILDER /usr/lib/unit/ /usr/lib/unit/
+COPY --from=BUILDER /requirements.apt /requirements.apt
+COPY --from=BUILDER /usr/lib/x86_64-linux-gnu/libunit.a /usr/lib/x86_64-linux-gnu/
+COPY --from=BUILDER /usr/include/nxt_* /usr/include/
+COPY --from=BUILDER /go/src/ /go/src/
+RUN set -x \
+    && mkdir -p /var/lib/unit/ \
+    && mkdir /docker-entrypoint.d/ \
+    && addgroup --system unit \
+    && adduser \
+         --system \
+         --disabled-login \
+         --ingroup unit \
+         --no-create-home \
+         --home /nonexistent \
+         --gecos "unit user" \
+         --shell /bin/false \
+         unit \
+    && apt update \
+    && apt --no-install-recommends --no-install-suggests -y install $(cat /requirements.apt) \
+    && apt-get clean && rm -rf /var/lib/apt/lists/* \
+    && rm -f /requirements.apt \
+    && ln -sf /dev/stdout /var/log/unit.log
+
+STOPSIGNAL SIGTERM
+
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
+
+CMD ["unitd", "--no-daemon", "--control", "unix:/var/run/control.unit.sock"]
diff --git a/pkg/docker/Dockerfile.jsc11 b/pkg/docker/Dockerfile.jsc11
index f3d1d22d..cde7c590 100644
--- a/pkg/docker/Dockerfile.jsc11
+++ b/pkg/docker/Dockerfile.jsc11
@@ -1,95 +1,73 @@
-FROM debian:buster-slim
+FROM openjdk:11-jdk as BUILDER
 
 LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
 
-ENV UNIT_VERSION          1.21.0-1~buster
+RUN set -ex \
+    && apt-get update \
+    && apt-get install --no-install-recommends --no-install-suggests -y ca-certificates mercurial build-essential libssl-dev libpcre2-dev \
+    && mkdir -p /usr/lib/unit/modules /usr/lib/unit/debug-modules \
+    && hg clone https://hg.nginx.org/unit \
+    && cd unit \
+    && hg up 1.22.0 \
+    && NCPU="$(getconf _NPROCESSORS_ONLN)" \
+    && DEB_HOST_MULTIARCH="$(dpkg-architecture -q DEB_HOST_MULTIARCH)" \
+    && CC_OPT="$(DEB_BUILD_MAINT_OPTIONS="hardening=+all,-pie" DEB_CFLAGS_MAINT_APPEND="-Wp,-D_FORTIFY_SOURCE=2 -fPIC" dpkg-buildflags --get CFLAGS)" \
+    && LD_OPT="$(DEB_BUILD_MAINT_OPTIONS="hardening=+all,-pie" DEB_LDFLAGS_MAINT_APPEND="-Wl,--as-needed -pie" dpkg-buildflags --get LDFLAGS)" \
+    && CONFIGURE_ARGS="--prefix=/usr \
+                --state=/var/lib/unit \
+                --control=unix:/var/run/control.unit.sock \
+                --pid=/var/run/unit.pid \
+                --log=/var/log/unit.log \
+                --tmp=/var/tmp \
+                --user=unit \
+                --group=unit \
+                --openssl \
+                --libdir=/usr/lib/$DEB_HOST_MULTIARCH" \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --ld-opt="$LD_OPT" --modules=/usr/lib/unit/debug-modules --debug \
+    && make -j $NCPU unitd \
+    && install -pm755 build/unitd /usr/sbin/unitd-debug \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --ld-opt="$LD_OPT" --modules=/usr/lib/unit/modules \
+    && make -j $NCPU unitd \
+    && install -pm755 build/unitd /usr/sbin/unitd \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --modules=/usr/lib/unit/debug-modules --debug \
+    && ./configure java --jars=/usr/share/unit-jsc-common/ \
+    && make -j $NCPU java-shared-install java-install \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --modules=/usr/lib/unit/modules \
+    && ./configure java --jars=/usr/share/unit-jsc-common/ \
+    && make -j $NCPU java-shared-install java-install \
+    && ldd /usr/sbin/unitd | awk '/=>/{print $(NF-1)}' | while read n; do dpkg-query -S $n; done | sed 's/^\([^:]\+\):.*$/\1/' | sort | uniq > /requirements.apt
 
+FROM openjdk:11-jdk
+COPY docker-entrypoint.sh /usr/local/bin/
+COPY --from=BUILDER /usr/sbin/unitd /usr/sbin/unitd
+COPY --from=BUILDER /usr/sbin/unitd-debug /usr/sbin/unitd-debug
+COPY --from=BUILDER /usr/lib/unit/ /usr/lib/unit/
+COPY --from=BUILDER /requirements.apt /requirements.apt
+COPY --from=BUILDER /usr/share/unit-jsc-common/ /usr/share/unit-jsc-common/
 RUN set -x \
-	&& apt-get update \
-	&& apt-get install --no-install-recommends --no-install-suggests -y gnupg1 apt-transport-https ca-certificates \
-	&& \
-	NGINX_GPGKEY=573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62; \
-	found=''; \
-	for server in \
-		ha.pool.sks-keyservers.net \
-		hkp://keyserver.ubuntu.com:80 \
-		hkp://p80.pool.sks-keyservers.net:80 \
-		pgp.mit.edu \
-	; do \
-		echo "Fetching GPG key $NGINX_GPGKEY from $server"; \
-		apt-key adv --keyserver "$server" --keyserver-options timeout=10 --recv-keys "$NGINX_GPGKEY" && found=yes && break; \
-	done; \
-	test -z "$found" && echo >&2 "error: failed to fetch GPG key $NGINX_GPGKEY" && exit 1; \
-	apt-get remove --purge --auto-remove -y gnupg1 && rm -rf /var/lib/apt/lists/* \
-# work-around debian bug 863199
-	&& mkdir -p /usr/share/man/man1 \
-	&& dpkgArch="$(dpkg --print-architecture)" \
-	&& unitPackages="unit=${UNIT_VERSION} unit-jsc11=${UNIT_VERSION}" \
-	&& case "$dpkgArch" in \
-		amd64|i386) \
-# arches officialy built by upstream
-			echo "deb https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			&& apt-get update \
-			;; \
-		*) \
-# we're on an architecture upstream doesn't officially build for
-# let's build binaries from the published source packages
-			echo "deb-src https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			\
-# new directory for storing sources and .deb files
-			&& tempDir="$(mktemp -d)" \
-			&& chmod 777 "$tempDir" \
-# (777 to ensure APT's "_apt" user can access it too)
-			\
-# save list of currently-installed packages so build dependencies can be cleanly removed later
-			&& savedAptMark="$(apt-mark showmanual)" \
-			\
-# build .deb files from upstream's source packages (which are verified by apt-get)
-			&& apt-get update \
-			&& apt-get build-dep -y $unitPackages \
-			&& ( \
-				cd "$tempDir" \
-				&& DEB_BUILD_OPTIONS="nocheck parallel=$(nproc)" \
-					apt-get source --compile $unitPackages \
-			) \
-# we don't remove APT lists here because they get re-downloaded and removed later
-			\
-# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
-# (which is done after we install the built packages so we don't have to redownload any overlapping dependencies)
-			&& apt-mark showmanual | xargs apt-mark auto > /dev/null \
-			&& { [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; } \
-			\
-# create a temporary local APT repo to install from (so that dependency resolution can be handled by APT, as it should be)
-			&& ls -lAFh "$tempDir" \
-			&& ( cd "$tempDir" && dpkg-scanpackages . > Packages ) \
-			&& grep '^Package: ' "$tempDir/Packages" \
-			&& echo "deb [ trusted=yes ] file://$tempDir ./" > /etc/apt/sources.list.d/temp.list \
-# work around the following APT issue by using "Acquire::GzipIndexes=false" (overriding "/etc/apt/apt.conf.d/docker-gzip-indexes")
-#   Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-#   ...
-#   E: Failed to fetch store:/var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages  Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-			&& apt-get -o Acquire::GzipIndexes=false update \
-			;; \
-	esac \
-	\
-	&& apt-get install --no-install-recommends --no-install-suggests -y \
-						$unitPackages \
-                        curl \
-	&& apt-get remove --purge --auto-remove -y apt-transport-https && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/unit.list \
-	\
-# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
-	&& if [ -n "$tempDir" ]; then \
-		apt-get purge -y --auto-remove \
-		&& rm -rf "$tempDir" /etc/apt/sources.list.d/temp.list; \
-	fi
-
-# forward log to docker log collector
-RUN ln -sf /dev/stdout /var/log/unit.log
+    && mkdir -p /var/lib/unit/ \
+    && mkdir /docker-entrypoint.d/ \
+    && addgroup --system unit \
+    && adduser \
+         --system \
+         --disabled-login \
+         --ingroup unit \
+         --no-create-home \
+         --home /nonexistent \
+         --gecos "unit user" \
+         --shell /bin/false \
+         unit \
+    && apt update \
+    && apt --no-install-recommends --no-install-suggests -y install $(cat /requirements.apt) \
+    && apt-get clean && rm -rf /var/lib/apt/lists/* \
+    && rm -f /requirements.apt \
+    && ln -sf /dev/stdout /var/log/unit.log
 
 STOPSIGNAL SIGTERM
 
-COPY docker-entrypoint.sh /usr/local/bin/
-RUN mkdir /docker-entrypoint.d/
 ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 
 CMD ["unitd", "--no-daemon", "--control", "unix:/var/run/control.unit.sock"]
diff --git a/pkg/docker/Dockerfile.minimal b/pkg/docker/Dockerfile.minimal
index da9c8712..91fd79d0 100644
--- a/pkg/docker/Dockerfile.minimal
+++ b/pkg/docker/Dockerfile.minimal
@@ -1,95 +1,73 @@
-FROM debian:buster-slim
+FROM debian:buster-slim as BUILDER
 
 LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
 
-ENV UNIT_VERSION          1.21.0-1~buster
+RUN set -ex \
+    && apt-get update \
+    && apt-get install --no-install-recommends --no-install-suggests -y ca-certificates mercurial build-essential libssl-dev libpcre2-dev \
+    && mkdir -p /usr/lib/unit/modules /usr/lib/unit/debug-modules \
+    && hg clone https://hg.nginx.org/unit \
+    && cd unit \
+    && hg up 1.22.0 \
+    && NCPU="$(getconf _NPROCESSORS_ONLN)" \
+    && DEB_HOST_MULTIARCH="$(dpkg-architecture -q DEB_HOST_MULTIARCH)" \
+    && CC_OPT="$(DEB_BUILD_MAINT_OPTIONS="hardening=+all,-pie" DEB_CFLAGS_MAINT_APPEND="-Wp,-D_FORTIFY_SOURCE=2 -fPIC" dpkg-buildflags --get CFLAGS)" \
+    && LD_OPT="$(DEB_BUILD_MAINT_OPTIONS="hardening=+all,-pie" DEB_LDFLAGS_MAINT_APPEND="-Wl,--as-needed -pie" dpkg-buildflags --get LDFLAGS)" \
+    && CONFIGURE_ARGS="--prefix=/usr \
+                --state=/var/lib/unit \
+                --control=unix:/var/run/control.unit.sock \
+                --pid=/var/run/unit.pid \
+                --log=/var/log/unit.log \
+                --tmp=/var/tmp \
+                --user=unit \
+                --group=unit \
+                --openssl \
+                --libdir=/usr/lib/$DEB_HOST_MULTIARCH" \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --ld-opt="$LD_OPT" --modules=/usr/lib/unit/debug-modules --debug \
+    && make -j $NCPU unitd \
+    && install -pm755 build/unitd /usr/sbin/unitd-debug \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --ld-opt="$LD_OPT" --modules=/usr/lib/unit/modules \
+    && make -j $NCPU unitd \
+    && install -pm755 build/unitd /usr/sbin/unitd \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --modules=/usr/lib/unit/debug-modules --debug \
+    && ./configure  \
+    && make -j $NCPU version \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --modules=/usr/lib/unit/modules \
+    && ./configure  \
+    && make -j $NCPU version \
+    && ldd /usr/sbin/unitd | awk '/=>/{print $(NF-1)}' | while read n; do dpkg-query -S $n; done | sed 's/^\([^:]\+\):.*$/\1/' | sort | uniq > /requirements.apt
 
-RUN set -x \
-	&& apt-get update \
-	&& apt-get install --no-install-recommends --no-install-suggests -y gnupg1 apt-transport-https ca-certificates \
-	&& \
-	NGINX_GPGKEY=573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62; \
-	found=''; \
-	for server in \
-		ha.pool.sks-keyservers.net \
-		hkp://keyserver.ubuntu.com:80 \
-		hkp://p80.pool.sks-keyservers.net:80 \
-		pgp.mit.edu \
-	; do \
-		echo "Fetching GPG key $NGINX_GPGKEY from $server"; \
-		apt-key adv --keyserver "$server" --keyserver-options timeout=10 --recv-keys "$NGINX_GPGKEY" && found=yes && break; \
-	done; \
-	test -z "$found" && echo >&2 "error: failed to fetch GPG key $NGINX_GPGKEY" && exit 1; \
-	apt-get remove --purge --auto-remove -y gnupg1 && rm -rf /var/lib/apt/lists/* \
-# work-around debian bug 863199
-	&& mkdir -p /usr/share/man/man1 \
-	&& dpkgArch="$(dpkg --print-architecture)" \
-	&& unitPackages="unit=${UNIT_VERSION}" \
-	&& case "$dpkgArch" in \
-		amd64|i386) \
-# arches officialy built by upstream
-			echo "deb https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			&& apt-get update \
-			;; \
-		*) \
-# we're on an architecture upstream doesn't officially build for
-# let's build binaries from the published source packages
-			echo "deb-src https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			\
-# new directory for storing sources and .deb files
-			&& tempDir="$(mktemp -d)" \
-			&& chmod 777 "$tempDir" \
-# (777 to ensure APT's "_apt" user can access it too)
-			\
-# save list of currently-installed packages so build dependencies can be cleanly removed later
-			&& savedAptMark="$(apt-mark showmanual)" \
-			\
-# build .deb files from upstream's source packages (which are verified by apt-get)
-			&& apt-get update \
-			&& apt-get build-dep -y $unitPackages \
-			&& ( \
-				cd "$tempDir" \
-				&& DEB_BUILD_OPTIONS="nocheck parallel=$(nproc)" \
-					apt-get source --compile $unitPackages \
-			) \
-# we don't remove APT lists here because they get re-downloaded and removed later
-			\
-# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
-# (which is done after we install the built packages so we don't have to redownload any overlapping dependencies)
-			&& apt-mark showmanual | xargs apt-mark auto > /dev/null \
-			&& { [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; } \
-			\
-# create a temporary local APT repo to install from (so that dependency resolution can be handled by APT, as it should be)
-			&& ls -lAFh "$tempDir" \
-			&& ( cd "$tempDir" && dpkg-scanpackages . > Packages ) \
-			&& grep '^Package: ' "$tempDir/Packages" \
-			&& echo "deb [ trusted=yes ] file://$tempDir ./" > /etc/apt/sources.list.d/temp.list \
-# work around the following APT issue by using "Acquire::GzipIndexes=false" (overriding "/etc/apt/apt.conf.d/docker-gzip-indexes")
-#   Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-#   ...
-#   E: Failed to fetch store:/var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages  Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-			&& apt-get -o Acquire::GzipIndexes=false update \
-			;; \
-	esac \
-	\
-	&& apt-get install --no-install-recommends --no-install-suggests -y \
-						$unitPackages \
-                        curl \
-	&& apt-get remove --purge --auto-remove -y apt-transport-https && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/unit.list \
-	\
-# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
-	&& if [ -n "$tempDir" ]; then \
-		apt-get purge -y --auto-remove \
-		&& rm -rf "$tempDir" /etc/apt/sources.list.d/temp.list; \
-	fi
+FROM debian:buster-slim
+COPY docker-entrypoint.sh /usr/local/bin/
+COPY --from=BUILDER /usr/sbin/unitd /usr/sbin/unitd
+COPY --from=BUILDER /usr/sbin/unitd-debug /usr/sbin/unitd-debug
+COPY --from=BUILDER /usr/lib/unit/ /usr/lib/unit/
+COPY --from=BUILDER /requirements.apt /requirements.apt
 
-# forward log to docker log collector
-RUN ln -sf /dev/stdout /var/log/unit.log
+RUN set -x \
+    && mkdir -p /var/lib/unit/ \
+    && mkdir /docker-entrypoint.d/ \
+    && addgroup --system unit \
+    && adduser \
+         --system \
+         --disabled-login \
+         --ingroup unit \
+         --no-create-home \
+         --home /nonexistent \
+         --gecos "unit user" \
+         --shell /bin/false \
+         unit \
+    && apt update \
+    && apt --no-install-recommends --no-install-suggests -y install $(cat /requirements.apt) \
+    && apt-get clean && rm -rf /var/lib/apt/lists/* \
+    && rm -f /requirements.apt \
+    && ln -sf /dev/stdout /var/log/unit.log
 
 STOPSIGNAL SIGTERM
 
-COPY docker-entrypoint.sh /usr/local/bin/
-RUN mkdir /docker-entrypoint.d/
 ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 
 CMD ["unitd", "--no-daemon", "--control", "unix:/var/run/control.unit.sock"]
diff --git a/pkg/docker/Dockerfile.node15 b/pkg/docker/Dockerfile.node15
new file mode 100644
index 00000000..59b12012
--- /dev/null
+++ b/pkg/docker/Dockerfile.node15
@@ -0,0 +1,75 @@
+FROM node:15 as BUILDER
+
+LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
+
+RUN set -ex \
+    && apt-get update \
+    && apt-get install --no-install-recommends --no-install-suggests -y ca-certificates mercurial build-essential libssl-dev libpcre2-dev \
+    && mkdir -p /usr/lib/unit/modules /usr/lib/unit/debug-modules \
+    && hg clone https://hg.nginx.org/unit \
+    && cd unit \
+    && hg up 1.22.0 \
+    && NCPU="$(getconf _NPROCESSORS_ONLN)" \
+    && DEB_HOST_MULTIARCH="$(dpkg-architecture -q DEB_HOST_MULTIARCH)" \
+    && CC_OPT="$(DEB_BUILD_MAINT_OPTIONS="hardening=+all,-pie" DEB_CFLAGS_MAINT_APPEND="-Wp,-D_FORTIFY_SOURCE=2 -fPIC" dpkg-buildflags --get CFLAGS)" \
+    && LD_OPT="$(DEB_BUILD_MAINT_OPTIONS="hardening=+all,-pie" DEB_LDFLAGS_MAINT_APPEND="-Wl,--as-needed -pie" dpkg-buildflags --get LDFLAGS)" \
+    && CONFIGURE_ARGS="--prefix=/usr \
+                --state=/var/lib/unit \
+                --control=unix:/var/run/control.unit.sock \
+                --pid=/var/run/unit.pid \
+                --log=/var/log/unit.log \
+                --tmp=/var/tmp \
+                --user=unit \
+                --group=unit \
+                --openssl \
+                --libdir=/usr/lib/$DEB_HOST_MULTIARCH" \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --ld-opt="$LD_OPT" --modules=/usr/lib/unit/debug-modules --debug \
+    && make -j $NCPU unitd \
+    && install -pm755 build/unitd /usr/sbin/unitd-debug \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --ld-opt="$LD_OPT" --modules=/usr/lib/unit/modules \
+    && make -j $NCPU unitd \
+    && install -pm755 build/unitd /usr/sbin/unitd \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --modules=/usr/lib/unit/debug-modules --debug \
+    && ./configure nodejs --node-gyp=/usr/local/lib/node_modules/npm/bin/node-gyp-bin/node-gyp \
+    && make -j $NCPU node node-install libunit-install \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --modules=/usr/lib/unit/modules \
+    && ./configure nodejs --node-gyp=/usr/local/lib/node_modules/npm/bin/node-gyp-bin/node-gyp \
+    && make -j $NCPU node node-install libunit-install \
+    && ldd /usr/sbin/unitd | awk '/=>/{print $(NF-1)}' | while read n; do dpkg-query -S $n; done | sed 's/^\([^:]\+\):.*$/\1/' | sort | uniq > /requirements.apt
+
+FROM node:15
+COPY docker-entrypoint.sh /usr/local/bin/
+COPY --from=BUILDER /usr/sbin/unitd /usr/sbin/unitd
+COPY --from=BUILDER /usr/sbin/unitd-debug /usr/sbin/unitd-debug
+COPY --from=BUILDER /usr/lib/unit/ /usr/lib/unit/
+COPY --from=BUILDER /requirements.apt /requirements.apt
+COPY --from=BUILDER /usr/lib/x86_64-linux-gnu/libunit.a /usr/lib/x86_64-linux-gnu/
+COPY --from=BUILDER /usr/include/nxt_* /usr/include/
+COPY --from=BUILDER /usr/local/lib/node_modules/unit-http/ /usr/local/lib/node_modules/unit-http/
+RUN set -x \
+    && mkdir -p /var/lib/unit/ \
+    && mkdir /docker-entrypoint.d/ \
+    && addgroup --system unit \
+    && adduser \
+         --system \
+         --disabled-login \
+         --ingroup unit \
+         --no-create-home \
+         --home /nonexistent \
+         --gecos "unit user" \
+         --shell /bin/false \
+         unit \
+    && apt update \
+    && apt --no-install-recommends --no-install-suggests -y install $(cat /requirements.apt) \
+    && apt-get clean && rm -rf /var/lib/apt/lists/* \
+    && rm -f /requirements.apt \
+    && ln -sf /dev/stdout /var/log/unit.log
+
+STOPSIGNAL SIGTERM
+
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
+
+CMD ["unitd", "--no-daemon", "--control", "unix:/var/run/control.unit.sock"]
diff --git a/pkg/docker/Dockerfile.perl5.28 b/pkg/docker/Dockerfile.perl5.28
deleted file mode 100644
index 976fa7b0..00000000
--- a/pkg/docker/Dockerfile.perl5.28
+++ /dev/null
@@ -1,95 +0,0 @@
-FROM debian:buster-slim
-
-LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
-
-ENV UNIT_VERSION          1.21.0-1~buster
-
-RUN set -x \
-	&& apt-get update \
-	&& apt-get install --no-install-recommends --no-install-suggests -y gnupg1 apt-transport-https ca-certificates \
-	&& \
-	NGINX_GPGKEY=573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62; \
-	found=''; \
-	for server in \
-		ha.pool.sks-keyservers.net \
-		hkp://keyserver.ubuntu.com:80 \
-		hkp://p80.pool.sks-keyservers.net:80 \
-		pgp.mit.edu \
-	; do \
-		echo "Fetching GPG key $NGINX_GPGKEY from $server"; \
-		apt-key adv --keyserver "$server" --keyserver-options timeout=10 --recv-keys "$NGINX_GPGKEY" && found=yes && break; \
-	done; \
-	test -z "$found" && echo >&2 "error: failed to fetch GPG key $NGINX_GPGKEY" && exit 1; \
-	apt-get remove --purge --auto-remove -y gnupg1 && rm -rf /var/lib/apt/lists/* \
-# work-around debian bug 863199
-	&& mkdir -p /usr/share/man/man1 \
-	&& dpkgArch="$(dpkg --print-architecture)" \
-	&& unitPackages="unit=${UNIT_VERSION} unit-perl=${UNIT_VERSION}" \
-	&& case "$dpkgArch" in \
-		amd64|i386) \
-# arches officialy built by upstream
-			echo "deb https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			&& apt-get update \
-			;; \
-		*) \
-# we're on an architecture upstream doesn't officially build for
-# let's build binaries from the published source packages
-			echo "deb-src https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			\
-# new directory for storing sources and .deb files
-			&& tempDir="$(mktemp -d)" \
-			&& chmod 777 "$tempDir" \
-# (777 to ensure APT's "_apt" user can access it too)
-			\
-# save list of currently-installed packages so build dependencies can be cleanly removed later
-			&& savedAptMark="$(apt-mark showmanual)" \
-			\
-# build .deb files from upstream's source packages (which are verified by apt-get)
-			&& apt-get update \
-			&& apt-get build-dep -y $unitPackages \
-			&& ( \
-				cd "$tempDir" \
-				&& DEB_BUILD_OPTIONS="nocheck parallel=$(nproc)" \
-					apt-get source --compile $unitPackages \
-			) \
-# we don't remove APT lists here because they get re-downloaded and removed later
-			\
-# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
-# (which is done after we install the built packages so we don't have to redownload any overlapping dependencies)
-			&& apt-mark showmanual | xargs apt-mark auto > /dev/null \
-			&& { [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; } \
-			\
-# create a temporary local APT repo to install from (so that dependency resolution can be handled by APT, as it should be)
-			&& ls -lAFh "$tempDir" \
-			&& ( cd "$tempDir" && dpkg-scanpackages . > Packages ) \
-			&& grep '^Package: ' "$tempDir/Packages" \
-			&& echo "deb [ trusted=yes ] file://$tempDir ./" > /etc/apt/sources.list.d/temp.list \
-# work around the following APT issue by using "Acquire::GzipIndexes=false" (overriding "/etc/apt/apt.conf.d/docker-gzip-indexes")
-#   Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-#   ...
-#   E: Failed to fetch store:/var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages  Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-			&& apt-get -o Acquire::GzipIndexes=false update \
-			;; \
-	esac \
-	\
-	&& apt-get install --no-install-recommends --no-install-suggests -y \
-						$unitPackages \
-                        curl \
-	&& apt-get remove --purge --auto-remove -y apt-transport-https && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/unit.list \
-	\
-# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
-	&& if [ -n "$tempDir" ]; then \
-		apt-get purge -y --auto-remove \
-		&& rm -rf "$tempDir" /etc/apt/sources.list.d/temp.list; \
-	fi
-
-# forward log to docker log collector
-RUN ln -sf /dev/stdout /var/log/unit.log
-
-STOPSIGNAL SIGTERM
-
-COPY docker-entrypoint.sh /usr/local/bin/
-RUN mkdir /docker-entrypoint.d/
-ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
-
-CMD ["unitd", "--no-daemon", "--control", "unix:/var/run/control.unit.sock"]
diff --git a/pkg/docker/Dockerfile.perl5.32 b/pkg/docker/Dockerfile.perl5.32
new file mode 100644
index 00000000..589eb989
--- /dev/null
+++ b/pkg/docker/Dockerfile.perl5.32
@@ -0,0 +1,73 @@
+FROM perl:5.32 as BUILDER
+
+LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
+
+RUN set -ex \
+    && apt-get update \
+    && apt-get install --no-install-recommends --no-install-suggests -y ca-certificates mercurial build-essential libssl-dev libpcre2-dev \
+    && mkdir -p /usr/lib/unit/modules /usr/lib/unit/debug-modules \
+    && hg clone https://hg.nginx.org/unit \
+    && cd unit \
+    && hg up 1.22.0 \
+    && NCPU="$(getconf _NPROCESSORS_ONLN)" \
+    && DEB_HOST_MULTIARCH="$(dpkg-architecture -q DEB_HOST_MULTIARCH)" \
+    && CC_OPT="$(DEB_BUILD_MAINT_OPTIONS="hardening=+all,-pie" DEB_CFLAGS_MAINT_APPEND="-Wp,-D_FORTIFY_SOURCE=2 -fPIC" dpkg-buildflags --get CFLAGS)" \
+    && LD_OPT="$(DEB_BUILD_MAINT_OPTIONS="hardening=+all,-pie" DEB_LDFLAGS_MAINT_APPEND="-Wl,--as-needed -pie" dpkg-buildflags --get LDFLAGS)" \
+    && CONFIGURE_ARGS="--prefix=/usr \
+                --state=/var/lib/unit \
+                --control=unix:/var/run/control.unit.sock \
+                --pid=/var/run/unit.pid \
+                --log=/var/log/unit.log \
+                --tmp=/var/tmp \
+                --user=unit \
+                --group=unit \
+                --openssl \
+                --libdir=/usr/lib/$DEB_HOST_MULTIARCH" \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --ld-opt="$LD_OPT" --modules=/usr/lib/unit/debug-modules --debug \
+    && make -j $NCPU unitd \
+    && install -pm755 build/unitd /usr/sbin/unitd-debug \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --ld-opt="$LD_OPT" --modules=/usr/lib/unit/modules \
+    && make -j $NCPU unitd \
+    && install -pm755 build/unitd /usr/sbin/unitd \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --modules=/usr/lib/unit/debug-modules --debug \
+    && ./configure perl \
+    && make -j $NCPU perl-install \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --modules=/usr/lib/unit/modules \
+    && ./configure perl \
+    && make -j $NCPU perl-install \
+    && ldd /usr/sbin/unitd | awk '/=>/{print $(NF-1)}' | while read n; do dpkg-query -S $n; done | sed 's/^\([^:]\+\):.*$/\1/' | sort | uniq > /requirements.apt
+
+FROM perl:5.32
+COPY docker-entrypoint.sh /usr/local/bin/
+COPY --from=BUILDER /usr/sbin/unitd /usr/sbin/unitd
+COPY --from=BUILDER /usr/sbin/unitd-debug /usr/sbin/unitd-debug
+COPY --from=BUILDER /usr/lib/unit/ /usr/lib/unit/
+COPY --from=BUILDER /requirements.apt /requirements.apt
+
+RUN set -x \
+    && mkdir -p /var/lib/unit/ \
+    && mkdir /docker-entrypoint.d/ \
+    && addgroup --system unit \
+    && adduser \
+         --system \
+         --disabled-login \
+         --ingroup unit \
+         --no-create-home \
+         --home /nonexistent \
+         --gecos "unit user" \
+         --shell /bin/false \
+         unit \
+    && apt update \
+    && apt --no-install-recommends --no-install-suggests -y install $(cat /requirements.apt) \
+    && apt-get clean && rm -rf /var/lib/apt/lists/* \
+    && rm -f /requirements.apt \
+    && ln -sf /dev/stdout /var/log/unit.log
+
+STOPSIGNAL SIGTERM
+
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
+
+CMD ["unitd", "--no-daemon", "--control", "unix:/var/run/control.unit.sock"]
diff --git a/pkg/docker/Dockerfile.php7.3 b/pkg/docker/Dockerfile.php7.3
deleted file mode 100644
index f1178551..00000000
--- a/pkg/docker/Dockerfile.php7.3
+++ /dev/null
@@ -1,95 +0,0 @@
-FROM debian:buster-slim
-
-LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
-
-ENV UNIT_VERSION          1.21.0-1~buster
-
-RUN set -x \
-	&& apt-get update \
-	&& apt-get install --no-install-recommends --no-install-suggests -y gnupg1 apt-transport-https ca-certificates \
-	&& \
-	NGINX_GPGKEY=573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62; \
-	found=''; \
-	for server in \
-		ha.pool.sks-keyservers.net \
-		hkp://keyserver.ubuntu.com:80 \
-		hkp://p80.pool.sks-keyservers.net:80 \
-		pgp.mit.edu \
-	; do \
-		echo "Fetching GPG key $NGINX_GPGKEY from $server"; \
-		apt-key adv --keyserver "$server" --keyserver-options timeout=10 --recv-keys "$NGINX_GPGKEY" && found=yes && break; \
-	done; \
-	test -z "$found" && echo >&2 "error: failed to fetch GPG key $NGINX_GPGKEY" && exit 1; \
-	apt-get remove --purge --auto-remove -y gnupg1 && rm -rf /var/lib/apt/lists/* \
-# work-around debian bug 863199
-	&& mkdir -p /usr/share/man/man1 \
-	&& dpkgArch="$(dpkg --print-architecture)" \
-	&& unitPackages="unit=${UNIT_VERSION} unit-php=${UNIT_VERSION}" \
-	&& case "$dpkgArch" in \
-		amd64|i386) \
-# arches officialy built by upstream
-			echo "deb https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			&& apt-get update \
-			;; \
-		*) \
-# we're on an architecture upstream doesn't officially build for
-# let's build binaries from the published source packages
-			echo "deb-src https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			\
-# new directory for storing sources and .deb files
-			&& tempDir="$(mktemp -d)" \
-			&& chmod 777 "$tempDir" \
-# (777 to ensure APT's "_apt" user can access it too)
-			\
-# save list of currently-installed packages so build dependencies can be cleanly removed later
-			&& savedAptMark="$(apt-mark showmanual)" \
-			\
-# build .deb files from upstream's source packages (which are verified by apt-get)
-			&& apt-get update \
-			&& apt-get build-dep -y $unitPackages \
-			&& ( \
-				cd "$tempDir" \
-				&& DEB_BUILD_OPTIONS="nocheck parallel=$(nproc)" \
-					apt-get source --compile $unitPackages \
-			) \
-# we don't remove APT lists here because they get re-downloaded and removed later
-			\
-# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
-# (which is done after we install the built packages so we don't have to redownload any overlapping dependencies)
-			&& apt-mark showmanual | xargs apt-mark auto > /dev/null \
-			&& { [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; } \
-			\
-# create a temporary local APT repo to install from (so that dependency resolution can be handled by APT, as it should be)
-			&& ls -lAFh "$tempDir" \
-			&& ( cd "$tempDir" && dpkg-scanpackages . > Packages ) \
-			&& grep '^Package: ' "$tempDir/Packages" \
-			&& echo "deb [ trusted=yes ] file://$tempDir ./" > /etc/apt/sources.list.d/temp.list \
-# work around the following APT issue by using "Acquire::GzipIndexes=false" (overriding "/etc/apt/apt.conf.d/docker-gzip-indexes")
-#   Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-#   ...
-#   E: Failed to fetch store:/var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages  Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-			&& apt-get -o Acquire::GzipIndexes=false update \
-			;; \
-	esac \
-	\
-	&& apt-get install --no-install-recommends --no-install-suggests -y \
-						$unitPackages \
-                        curl \
-	&& apt-get remove --purge --auto-remove -y apt-transport-https && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/unit.list \
-	\
-# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
-	&& if [ -n "$tempDir" ]; then \
-		apt-get purge -y --auto-remove \
-		&& rm -rf "$tempDir" /etc/apt/sources.list.d/temp.list; \
-	fi
-
-# forward log to docker log collector
-RUN ln -sf /dev/stdout /var/log/unit.log
-
-STOPSIGNAL SIGTERM
-
-COPY docker-entrypoint.sh /usr/local/bin/
-RUN mkdir /docker-entrypoint.d/
-ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
-
-CMD ["unitd", "--no-daemon", "--control", "unix:/var/run/control.unit.sock"]
diff --git a/pkg/docker/Dockerfile.php8.0 b/pkg/docker/Dockerfile.php8.0
new file mode 100644
index 00000000..c31513d4
--- /dev/null
+++ b/pkg/docker/Dockerfile.php8.0
@@ -0,0 +1,73 @@
+FROM php:8.0-cli as BUILDER
+
+LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
+
+RUN set -ex \
+    && apt-get update \
+    && apt-get install --no-install-recommends --no-install-suggests -y ca-certificates mercurial build-essential libssl-dev libpcre2-dev \
+    && mkdir -p /usr/lib/unit/modules /usr/lib/unit/debug-modules \
+    && hg clone https://hg.nginx.org/unit \
+    && cd unit \
+    && hg up 1.22.0 \
+    && NCPU="$(getconf _NPROCESSORS_ONLN)" \
+    && DEB_HOST_MULTIARCH="$(dpkg-architecture -q DEB_HOST_MULTIARCH)" \
+    && CC_OPT="$(DEB_BUILD_MAINT_OPTIONS="hardening=+all,-pie" DEB_CFLAGS_MAINT_APPEND="-Wp,-D_FORTIFY_SOURCE=2 -fPIC" dpkg-buildflags --get CFLAGS)" \
+    && LD_OPT="$(DEB_BUILD_MAINT_OPTIONS="hardening=+all,-pie" DEB_LDFLAGS_MAINT_APPEND="-Wl,--as-needed -pie" dpkg-buildflags --get LDFLAGS)" \
+    && CONFIGURE_ARGS="--prefix=/usr \
+                --state=/var/lib/unit \
+                --control=unix:/var/run/control.unit.sock \
+                --pid=/var/run/unit.pid \
+                --log=/var/log/unit.log \
+                --tmp=/var/tmp \
+                --user=unit \
+                --group=unit \
+                --openssl \
+                --libdir=/usr/lib/$DEB_HOST_MULTIARCH" \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --ld-opt="$LD_OPT" --modules=/usr/lib/unit/debug-modules --debug \
+    && make -j $NCPU unitd \
+    && install -pm755 build/unitd /usr/sbin/unitd-debug \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --ld-opt="$LD_OPT" --modules=/usr/lib/unit/modules \
+    && make -j $NCPU unitd \
+    && install -pm755 build/unitd /usr/sbin/unitd \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --modules=/usr/lib/unit/debug-modules --debug \
+    && ./configure php \
+    && make -j $NCPU php-install \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --modules=/usr/lib/unit/modules \
+    && ./configure php \
+    && make -j $NCPU php-install \
+    && ldd /usr/sbin/unitd | awk '/=>/{print $(NF-1)}' | while read n; do dpkg-query -S $n; done | sed 's/^\([^:]\+\):.*$/\1/' | sort | uniq > /requirements.apt
+
+FROM php:8.0-cli
+COPY docker-entrypoint.sh /usr/local/bin/
+COPY --from=BUILDER /usr/sbin/unitd /usr/sbin/unitd
+COPY --from=BUILDER /usr/sbin/unitd-debug /usr/sbin/unitd-debug
+COPY --from=BUILDER /usr/lib/unit/ /usr/lib/unit/
+COPY --from=BUILDER /requirements.apt /requirements.apt
+RUN ldconfig
+RUN set -x \
+    && mkdir -p /var/lib/unit/ \
+    && mkdir /docker-entrypoint.d/ \
+    && addgroup --system unit \
+    && adduser \
+         --system \
+         --disabled-login \
+         --ingroup unit \
+         --no-create-home \
+         --home /nonexistent \
+         --gecos "unit user" \
+         --shell /bin/false \
+         unit \
+    && apt update \
+    && apt --no-install-recommends --no-install-suggests -y install $(cat /requirements.apt) \
+    && apt-get clean && rm -rf /var/lib/apt/lists/* \
+    && rm -f /requirements.apt \
+    && ln -sf /dev/stdout /var/log/unit.log
+
+STOPSIGNAL SIGTERM
+
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
+
+CMD ["unitd", "--no-daemon", "--control", "unix:/var/run/control.unit.sock"]
diff --git a/pkg/docker/Dockerfile.python2.7 b/pkg/docker/Dockerfile.python2.7
deleted file mode 100644
index 95241af6..00000000
--- a/pkg/docker/Dockerfile.python2.7
+++ /dev/null
@@ -1,95 +0,0 @@
-FROM debian:buster-slim
-
-LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
-
-ENV UNIT_VERSION          1.21.0-1~buster
-
-RUN set -x \
-	&& apt-get update \
-	&& apt-get install --no-install-recommends --no-install-suggests -y gnupg1 apt-transport-https ca-certificates \
-	&& \
-	NGINX_GPGKEY=573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62; \
-	found=''; \
-	for server in \
-		ha.pool.sks-keyservers.net \
-		hkp://keyserver.ubuntu.com:80 \
-		hkp://p80.pool.sks-keyservers.net:80 \
-		pgp.mit.edu \
-	; do \
-		echo "Fetching GPG key $NGINX_GPGKEY from $server"; \
-		apt-key adv --keyserver "$server" --keyserver-options timeout=10 --recv-keys "$NGINX_GPGKEY" && found=yes && break; \
-	done; \
-	test -z "$found" && echo >&2 "error: failed to fetch GPG key $NGINX_GPGKEY" && exit 1; \
-	apt-get remove --purge --auto-remove -y gnupg1 && rm -rf /var/lib/apt/lists/* \
-# work-around debian bug 863199
-	&& mkdir -p /usr/share/man/man1 \
-	&& dpkgArch="$(dpkg --print-architecture)" \
-	&& unitPackages="unit=${UNIT_VERSION} unit-python2.7=${UNIT_VERSION}" \
-	&& case "$dpkgArch" in \
-		amd64|i386) \
-# arches officialy built by upstream
-			echo "deb https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			&& apt-get update \
-			;; \
-		*) \
-# we're on an architecture upstream doesn't officially build for
-# let's build binaries from the published source packages
-			echo "deb-src https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			\
-# new directory for storing sources and .deb files
-			&& tempDir="$(mktemp -d)" \
-			&& chmod 777 "$tempDir" \
-# (777 to ensure APT's "_apt" user can access it too)
-			\
-# save list of currently-installed packages so build dependencies can be cleanly removed later
-			&& savedAptMark="$(apt-mark showmanual)" \
-			\
-# build .deb files from upstream's source packages (which are verified by apt-get)
-			&& apt-get update \
-			&& apt-get build-dep -y $unitPackages \
-			&& ( \
-				cd "$tempDir" \
-				&& DEB_BUILD_OPTIONS="nocheck parallel=$(nproc)" \
-					apt-get source --compile $unitPackages \
-			) \
-# we don't remove APT lists here because they get re-downloaded and removed later
-			\
-# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
-# (which is done after we install the built packages so we don't have to redownload any overlapping dependencies)
-			&& apt-mark showmanual | xargs apt-mark auto > /dev/null \
-			&& { [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; } \
-			\
-# create a temporary local APT repo to install from (so that dependency resolution can be handled by APT, as it should be)
-			&& ls -lAFh "$tempDir" \
-			&& ( cd "$tempDir" && dpkg-scanpackages . > Packages ) \
-			&& grep '^Package: ' "$tempDir/Packages" \
-			&& echo "deb [ trusted=yes ] file://$tempDir ./" > /etc/apt/sources.list.d/temp.list \
-# work around the following APT issue by using "Acquire::GzipIndexes=false" (overriding "/etc/apt/apt.conf.d/docker-gzip-indexes")
-#   Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-#   ...
-#   E: Failed to fetch store:/var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages  Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-			&& apt-get -o Acquire::GzipIndexes=false update \
-			;; \
-	esac \
-	\
-	&& apt-get install --no-install-recommends --no-install-suggests -y \
-						$unitPackages \
-                        curl \
-	&& apt-get remove --purge --auto-remove -y apt-transport-https && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/unit.list \
-	\
-# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
-	&& if [ -n "$tempDir" ]; then \
-		apt-get purge -y --auto-remove \
-		&& rm -rf "$tempDir" /etc/apt/sources.list.d/temp.list; \
-	fi
-
-# forward log to docker log collector
-RUN ln -sf /dev/stdout /var/log/unit.log
-
-STOPSIGNAL SIGTERM
-
-COPY docker-entrypoint.sh /usr/local/bin/
-RUN mkdir /docker-entrypoint.d/
-ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
-
-CMD ["unitd", "--no-daemon", "--control", "unix:/var/run/control.unit.sock"]
diff --git a/pkg/docker/Dockerfile.python3.7 b/pkg/docker/Dockerfile.python3.7
deleted file mode 100644
index 52a5a257..00000000
--- a/pkg/docker/Dockerfile.python3.7
+++ /dev/null
@@ -1,95 +0,0 @@
-FROM debian:buster-slim
-
-LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
-
-ENV UNIT_VERSION          1.21.0-1~buster
-
-RUN set -x \
-	&& apt-get update \
-	&& apt-get install --no-install-recommends --no-install-suggests -y gnupg1 apt-transport-https ca-certificates \
-	&& \
-	NGINX_GPGKEY=573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62; \
-	found=''; \
-	for server in \
-		ha.pool.sks-keyservers.net \
-		hkp://keyserver.ubuntu.com:80 \
-		hkp://p80.pool.sks-keyservers.net:80 \
-		pgp.mit.edu \
-	; do \
-		echo "Fetching GPG key $NGINX_GPGKEY from $server"; \
-		apt-key adv --keyserver "$server" --keyserver-options timeout=10 --recv-keys "$NGINX_GPGKEY" && found=yes && break; \
-	done; \
-	test -z "$found" && echo >&2 "error: failed to fetch GPG key $NGINX_GPGKEY" && exit 1; \
-	apt-get remove --purge --auto-remove -y gnupg1 && rm -rf /var/lib/apt/lists/* \
-# work-around debian bug 863199
-	&& mkdir -p /usr/share/man/man1 \
-	&& dpkgArch="$(dpkg --print-architecture)" \
-	&& unitPackages="unit=${UNIT_VERSION} unit-python3.7=${UNIT_VERSION}" \
-	&& case "$dpkgArch" in \
-		amd64|i386) \
-# arches officialy built by upstream
-			echo "deb https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			&& apt-get update \
-			;; \
-		*) \
-# we're on an architecture upstream doesn't officially build for
-# let's build binaries from the published source packages
-			echo "deb-src https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			\
-# new directory for storing sources and .deb files
-			&& tempDir="$(mktemp -d)" \
-			&& chmod 777 "$tempDir" \
-# (777 to ensure APT's "_apt" user can access it too)
-			\
-# save list of currently-installed packages so build dependencies can be cleanly removed later
-			&& savedAptMark="$(apt-mark showmanual)" \
-			\
-# build .deb files from upstream's source packages (which are verified by apt-get)
-			&& apt-get update \
-			&& apt-get build-dep -y $unitPackages \
-			&& ( \
-				cd "$tempDir" \
-				&& DEB_BUILD_OPTIONS="nocheck parallel=$(nproc)" \
-					apt-get source --compile $unitPackages \
-			) \
-# we don't remove APT lists here because they get re-downloaded and removed later
-			\
-# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
-# (which is done after we install the built packages so we don't have to redownload any overlapping dependencies)
-			&& apt-mark showmanual | xargs apt-mark auto > /dev/null \
-			&& { [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; } \
-			\
-# create a temporary local APT repo to install from (so that dependency resolution can be handled by APT, as it should be)
-			&& ls -lAFh "$tempDir" \
-			&& ( cd "$tempDir" && dpkg-scanpackages . > Packages ) \
-			&& grep '^Package: ' "$tempDir/Packages" \
-			&& echo "deb [ trusted=yes ] file://$tempDir ./" > /etc/apt/sources.list.d/temp.list \
-# work around the following APT issue by using "Acquire::GzipIndexes=false" (overriding "/etc/apt/apt.conf.d/docker-gzip-indexes")
-#   Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-#   ...
-#   E: Failed to fetch store:/var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages  Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-			&& apt-get -o Acquire::GzipIndexes=false update \
-			;; \
-	esac \
-	\
-	&& apt-get install --no-install-recommends --no-install-suggests -y \
-						$unitPackages \
-                        curl \
-	&& apt-get remove --purge --auto-remove -y apt-transport-https && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/unit.list \
-	\
-# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
-	&& if [ -n "$tempDir" ]; then \
-		apt-get purge -y --auto-remove \
-		&& rm -rf "$tempDir" /etc/apt/sources.list.d/temp.list; \
-	fi
-
-# forward log to docker log collector
-RUN ln -sf /dev/stdout /var/log/unit.log
-
-STOPSIGNAL SIGTERM
-
-COPY docker-entrypoint.sh /usr/local/bin/
-RUN mkdir /docker-entrypoint.d/
-ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
-
-CMD ["unitd", "--no-daemon", "--control", "unix:/var/run/control.unit.sock"]
diff --git a/pkg/docker/Dockerfile.python3.9 b/pkg/docker/Dockerfile.python3.9
new file mode 100644
index 00000000..76f50733
--- /dev/null
+++ b/pkg/docker/Dockerfile.python3.9
@@ -0,0 +1,73 @@
+FROM python:3.9 as BUILDER
+
+LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
+
+RUN set -ex \
+    && apt-get update \
+    && apt-get install --no-install-recommends --no-install-suggests -y ca-certificates mercurial build-essential libssl-dev libpcre2-dev \
+    && mkdir -p /usr/lib/unit/modules /usr/lib/unit/debug-modules \
+    && hg clone https://hg.nginx.org/unit \
+    && cd unit \
+    && hg up 1.22.0 \
+    && NCPU="$(getconf _NPROCESSORS_ONLN)" \
+    && DEB_HOST_MULTIARCH="$(dpkg-architecture -q DEB_HOST_MULTIARCH)" \
+    && CC_OPT="$(DEB_BUILD_MAINT_OPTIONS="hardening=+all,-pie" DEB_CFLAGS_MAINT_APPEND="-Wp,-D_FORTIFY_SOURCE=2 -fPIC" dpkg-buildflags --get CFLAGS)" \
+    && LD_OPT="$(DEB_BUILD_MAINT_OPTIONS="hardening=+all,-pie" DEB_LDFLAGS_MAINT_APPEND="-Wl,--as-needed -pie" dpkg-buildflags --get LDFLAGS)" \
+    && CONFIGURE_ARGS="--prefix=/usr \
+                --state=/var/lib/unit \
+                --control=unix:/var/run/control.unit.sock \
+                --pid=/var/run/unit.pid \
+                --log=/var/log/unit.log \
+                --tmp=/var/tmp \
+                --user=unit \
+                --group=unit \
+                --openssl \
+                --libdir=/usr/lib/$DEB_HOST_MULTIARCH" \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --ld-opt="$LD_OPT" --modules=/usr/lib/unit/debug-modules --debug \
+    && make -j $NCPU unitd \
+    && install -pm755 build/unitd /usr/sbin/unitd-debug \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --ld-opt="$LD_OPT" --modules=/usr/lib/unit/modules \
+    && make -j $NCPU unitd \
+    && install -pm755 build/unitd /usr/sbin/unitd \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --modules=/usr/lib/unit/debug-modules --debug \
+    && ./configure python --config=/usr/local/bin/python3-config \
+    && make -j $NCPU python3-install \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --modules=/usr/lib/unit/modules \
+    && ./configure python --config=/usr/local/bin/python3-config \
+    && make -j $NCPU python3-install \
+    && ldd /usr/sbin/unitd | awk '/=>/{print $(NF-1)}' | while read n; do dpkg-query -S $n; done | sed 's/^\([^:]\+\):.*$/\1/' | sort | uniq > /requirements.apt
+
+FROM python:3.9
+COPY docker-entrypoint.sh /usr/local/bin/
+COPY --from=BUILDER /usr/sbin/unitd /usr/sbin/unitd
+COPY --from=BUILDER /usr/sbin/unitd-debug /usr/sbin/unitd-debug
+COPY --from=BUILDER /usr/lib/unit/ /usr/lib/unit/
+COPY --from=BUILDER /requirements.apt /requirements.apt
+
+RUN set -x \
+    && mkdir -p /var/lib/unit/ \
+    && mkdir /docker-entrypoint.d/ \
+    && addgroup --system unit \
+    && adduser \
+         --system \
+         --disabled-login \
+         --ingroup unit \
+         --no-create-home \
+         --home /nonexistent \
+         --gecos "unit user" \
+         --shell /bin/false \
+         unit \
+    && apt update \
+    && apt --no-install-recommends --no-install-suggests -y install $(cat /requirements.apt) \
+    && apt-get clean && rm -rf /var/lib/apt/lists/* \
+    && rm -f /requirements.apt \
+    && ln -sf /dev/stdout /var/log/unit.log
+
+STOPSIGNAL SIGTERM
+
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
+
+CMD ["unitd", "--no-daemon", "--control", "unix:/var/run/control.unit.sock"]
diff --git a/pkg/docker/Dockerfile.ruby2.5 b/pkg/docker/Dockerfile.ruby2.5
deleted file mode 100644
index 342ccc9a..00000000
--- a/pkg/docker/Dockerfile.ruby2.5
+++ /dev/null
@@ -1,95 +0,0 @@
-FROM debian:buster-slim
-
-LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
-
-ENV UNIT_VERSION          1.21.0-1~buster
-
-RUN set -x \
-	&& apt-get update \
-	&& apt-get install --no-install-recommends --no-install-suggests -y gnupg1 apt-transport-https ca-certificates \
-	&& \
-	NGINX_GPGKEY=573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62; \
-	found=''; \
-	for server in \
-		ha.pool.sks-keyservers.net \
-		hkp://keyserver.ubuntu.com:80 \
-		hkp://p80.pool.sks-keyservers.net:80 \
-		pgp.mit.edu \
-	; do \
-		echo "Fetching GPG key $NGINX_GPGKEY from $server"; \
-		apt-key adv --keyserver "$server" --keyserver-options timeout=10 --recv-keys "$NGINX_GPGKEY" && found=yes && break; \
-	done; \
-	test -z "$found" && echo >&2 "error: failed to fetch GPG key $NGINX_GPGKEY" && exit 1; \
-	apt-get remove --purge --auto-remove -y gnupg1 && rm -rf /var/lib/apt/lists/* \
-# work-around debian bug 863199
-	&& mkdir -p /usr/share/man/man1 \
-	&& dpkgArch="$(dpkg --print-architecture)" \
-	&& unitPackages="unit=${UNIT_VERSION} unit-ruby=${UNIT_VERSION}" \
-	&& case "$dpkgArch" in \
-		amd64|i386) \
-# arches officialy built by upstream
-			echo "deb https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			&& apt-get update \
-			;; \
-		*) \
-# we're on an architecture upstream doesn't officially build for
-# let's build binaries from the published source packages
-			echo "deb-src https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			\
-# new directory for storing sources and .deb files
-			&& tempDir="$(mktemp -d)" \
-			&& chmod 777 "$tempDir" \
-# (777 to ensure APT's "_apt" user can access it too)
-			\
-# save list of currently-installed packages so build dependencies can be cleanly removed later
-			&& savedAptMark="$(apt-mark showmanual)" \
-			\
-# build .deb files from upstream's source packages (which are verified by apt-get)
-			&& apt-get update \
-			&& apt-get build-dep -y $unitPackages \
-			&& ( \
-				cd "$tempDir" \
-				&& DEB_BUILD_OPTIONS="nocheck parallel=$(nproc)" \
-					apt-get source --compile $unitPackages \
-			) \
-# we don't remove APT lists here because they get re-downloaded and removed later
-			\
-# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
-# (which is done after we install the built packages so we don't have to redownload any overlapping dependencies)
-			&& apt-mark showmanual | xargs apt-mark auto > /dev/null \
-			&& { [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; } \
-			\
-# create a temporary local APT repo to install from (so that dependency resolution can be handled by APT, as it should be)
-			&& ls -lAFh "$tempDir" \
-			&& ( cd "$tempDir" && dpkg-scanpackages . > Packages ) \
-			&& grep '^Package: ' "$tempDir/Packages" \
-			&& echo "deb [ trusted=yes ] file://$tempDir ./" > /etc/apt/sources.list.d/temp.list \
-# work around the following APT issue by using "Acquire::GzipIndexes=false" (overriding "/etc/apt/apt.conf.d/docker-gzip-indexes")
-#   Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-#   ...
-#   E: Failed to fetch store:/var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages  Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-			&& apt-get -o Acquire::GzipIndexes=false update \
-			;; \
-	esac \
-	\
-	&& apt-get install --no-install-recommends --no-install-suggests -y \
-						$unitPackages \
-                        curl \
-	&& apt-get remove --purge --auto-remove -y apt-transport-https && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/unit.list \
-	\
-# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
-	&& if [ -n "$tempDir" ]; then \
-		apt-get purge -y --auto-remove \
-		&& rm -rf "$tempDir" /etc/apt/sources.list.d/temp.list; \
-	fi
-
-# forward log to docker log collector
-RUN ln -sf /dev/stdout /var/log/unit.log
-
-STOPSIGNAL SIGTERM
-
-COPY docker-entrypoint.sh /usr/local/bin/
-RUN mkdir /docker-entrypoint.d/
-ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
-
-CMD ["unitd", "--no-daemon", "--control", "unix:/var/run/control.unit.sock"]
diff --git a/pkg/docker/Dockerfile.ruby2.7 b/pkg/docker/Dockerfile.ruby2.7
new file mode 100644
index 00000000..aa823756
--- /dev/null
+++ b/pkg/docker/Dockerfile.ruby2.7
@@ -0,0 +1,73 @@
+FROM ruby:2.7 as BUILDER
+
+LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
+
+RUN set -ex \
+    && apt-get update \
+    && apt-get install --no-install-recommends --no-install-suggests -y ca-certificates mercurial build-essential libssl-dev libpcre2-dev \
+    && mkdir -p /usr/lib/unit/modules /usr/lib/unit/debug-modules \
+    && hg clone https://hg.nginx.org/unit \
+    && cd unit \
+    && hg up 1.22.0 \
+    && NCPU="$(getconf _NPROCESSORS_ONLN)" \
+    && DEB_HOST_MULTIARCH="$(dpkg-architecture -q DEB_HOST_MULTIARCH)" \
+    && CC_OPT="$(DEB_BUILD_MAINT_OPTIONS="hardening=+all,-pie" DEB_CFLAGS_MAINT_APPEND="-Wp,-D_FORTIFY_SOURCE=2 -fPIC" dpkg-buildflags --get CFLAGS)" \
+    && LD_OPT="$(DEB_BUILD_MAINT_OPTIONS="hardening=+all,-pie" DEB_LDFLAGS_MAINT_APPEND="-Wl,--as-needed -pie" dpkg-buildflags --get LDFLAGS)" \
+    && CONFIGURE_ARGS="--prefix=/usr \
+                --state=/var/lib/unit \
+                --control=unix:/var/run/control.unit.sock \
+                --pid=/var/run/unit.pid \
+                --log=/var/log/unit.log \
+                --tmp=/var/tmp \
+                --user=unit \
+                --group=unit \
+                --openssl \
+                --libdir=/usr/lib/$DEB_HOST_MULTIARCH" \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --ld-opt="$LD_OPT" --modules=/usr/lib/unit/debug-modules --debug \
+    && make -j $NCPU unitd \
+    && install -pm755 build/unitd /usr/sbin/unitd-debug \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --ld-opt="$LD_OPT" --modules=/usr/lib/unit/modules \
+    && make -j $NCPU unitd \
+    && install -pm755 build/unitd /usr/sbin/unitd \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --modules=/usr/lib/unit/debug-modules --debug \
+    && ./configure ruby \
+    && make -j $NCPU ruby-install \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --modules=/usr/lib/unit/modules \
+    && ./configure ruby \
+    && make -j $NCPU ruby-install \
+    && ldd /usr/sbin/unitd | awk '/=>/{print $(NF-1)}' | while read n; do dpkg-query -S $n; done | sed 's/^\([^:]\+\):.*$/\1/' | sort | uniq > /requirements.apt
+
+FROM ruby:2.7
+COPY docker-entrypoint.sh /usr/local/bin/
+COPY --from=BUILDER /usr/sbin/unitd /usr/sbin/unitd
+COPY --from=BUILDER /usr/sbin/unitd-debug /usr/sbin/unitd-debug
+COPY --from=BUILDER /usr/lib/unit/ /usr/lib/unit/
+COPY --from=BUILDER /requirements.apt /requirements.apt
+RUN gem install rack
+RUN set -x \
+    && mkdir -p /var/lib/unit/ \
+    && mkdir /docker-entrypoint.d/ \
+    && addgroup --system unit \
+    && adduser \
+         --system \
+         --disabled-login \
+         --ingroup unit \
+         --no-create-home \
+         --home /nonexistent \
+         --gecos "unit user" \
+         --shell /bin/false \
+         unit \
+    && apt update \
+    && apt --no-install-recommends --no-install-suggests -y install $(cat /requirements.apt) \
+    && apt-get clean && rm -rf /var/lib/apt/lists/* \
+    && rm -f /requirements.apt \
+    && ln -sf /dev/stdout /var/log/unit.log
+
+STOPSIGNAL SIGTERM
+
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
+
+CMD ["unitd", "--no-daemon", "--control", "unix:/var/run/control.unit.sock"]
diff --git a/pkg/docker/Dockerfile.tmpl b/pkg/docker/Dockerfile.tmpl
deleted file mode 100644
index 8b0e35e4..00000000
--- a/pkg/docker/Dockerfile.tmpl
+++ /dev/null
@@ -1,95 +0,0 @@
-FROM debian:buster-slim
-
-LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
-
-ENV UNIT_VERSION          @@UNIT_VERSION@@
-
-RUN set -x \
-	&& apt-get update \
-	&& apt-get install --no-install-recommends --no-install-suggests -y gnupg1 apt-transport-https ca-certificates \
-	&& \
-	NGINX_GPGKEY=573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62; \
-	found=''; \
-	for server in \
-		ha.pool.sks-keyservers.net \
-		hkp://keyserver.ubuntu.com:80 \
-		hkp://p80.pool.sks-keyservers.net:80 \
-		pgp.mit.edu \
-	; do \
-		echo "Fetching GPG key $NGINX_GPGKEY from $server"; \
-		apt-key adv --keyserver "$server" --keyserver-options timeout=10 --recv-keys "$NGINX_GPGKEY" && found=yes && break; \
-	done; \
-	test -z "$found" && echo >&2 "error: failed to fetch GPG key $NGINX_GPGKEY" && exit 1; \
-	apt-get remove --purge --auto-remove -y gnupg1 && rm -rf /var/lib/apt/lists/* \
-# work-around debian bug 863199
-	&& mkdir -p /usr/share/man/man1 \
-	&& dpkgArch="$(dpkg --print-architecture)" \
-	&& unitPackages=@@UNITPACKAGES@@ \
-	&& case "$dpkgArch" in \
-		amd64|i386) \
-# arches officialy built by upstream
-			echo "deb https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			&& apt-get update \
-			;; \
-		*) \
-# we're on an architecture upstream doesn't officially build for
-# let's build binaries from the published source packages
-			echo "deb-src https://packages.nginx.org/unit/debian/ buster unit" >> /etc/apt/sources.list.d/unit.list \
-			\
-# new directory for storing sources and .deb files
-			&& tempDir="$(mktemp -d)" \
-			&& chmod 777 "$tempDir" \
-# (777 to ensure APT's "_apt" user can access it too)
-			\
-# save list of currently-installed packages so build dependencies can be cleanly removed later
-			&& savedAptMark="$(apt-mark showmanual)" \
-			\
-# build .deb files from upstream's source packages (which are verified by apt-get)
-			&& apt-get update \
-			&& apt-get build-dep -y $unitPackages \
-			&& ( \
-				cd "$tempDir" \
-				&& DEB_BUILD_OPTIONS="nocheck parallel=$(nproc)" \
-					apt-get source --compile $unitPackages \
-			) \
-# we don't remove APT lists here because they get re-downloaded and removed later
-			\
-# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
-# (which is done after we install the built packages so we don't have to redownload any overlapping dependencies)
-			&& apt-mark showmanual | xargs apt-mark auto > /dev/null \
-			&& { [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; } \
-			\
-# create a temporary local APT repo to install from (so that dependency resolution can be handled by APT, as it should be)
-			&& ls -lAFh "$tempDir" \
-			&& ( cd "$tempDir" && dpkg-scanpackages . > Packages ) \
-			&& grep '^Package: ' "$tempDir/Packages" \
-			&& echo "deb [ trusted=yes ] file://$tempDir ./" > /etc/apt/sources.list.d/temp.list \
-# work around the following APT issue by using "Acquire::GzipIndexes=false" (overriding "/etc/apt/apt.conf.d/docker-gzip-indexes")
-#   Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-#   ...
-#   E: Failed to fetch store:/var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages  Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
-			&& apt-get -o Acquire::GzipIndexes=false update \
-			;; \
-	esac \
-	\
-	&& apt-get install --no-install-recommends --no-install-suggests -y \
-						$unitPackages \
-                        curl \
-	&& apt-get remove --purge --auto-remove -y apt-transport-https && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/unit.list \
-	\
-# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
-	&& if [ -n "$tempDir" ]; then \
-		apt-get purge -y --auto-remove \
-		&& rm -rf "$tempDir" /etc/apt/sources.list.d/temp.list; \
-	fi
-
-# forward log to docker log collector
-RUN ln -sf /dev/stdout /var/log/unit.log
-
-STOPSIGNAL SIGTERM
-
-COPY docker-entrypoint.sh /usr/local/bin/
-RUN mkdir /docker-entrypoint.d/
-ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
-
-CMD ["unitd", "--no-daemon", "--control", "unix:/var/run/control.unit.sock"]
diff --git a/pkg/docker/Makefile b/pkg/docker/Makefile
index aed5b8f7..00625526 100644
--- a/pkg/docker/Makefile
+++ b/pkg/docker/Makefile
@@ -3,54 +3,96 @@
 include ../../version
 include ../shasum.mak
 
-DEFAULT_RELEASE := 1
+DEFAULT_VERSION := $(NXT_VERSION)
 
-VERSION ?= $(NXT_VERSION)
-RELEASE ?= $(DEFAULT_RELEASE)
-CODENAME := buster
-
-UNIT_VERSION = $(VERSION)-$(RELEASE)~$(CODENAME)
-
-MODULES = python2.7 python3.7 php7.3 go1.11-dev perl5.28 ruby2.5 \
-          jsc11 full minimal
-
-MODULE_php7.3="unit=$${UNIT_VERSION} unit-php=$${UNIT_VERSION}"
-
-MODULE_python2.7="unit=$${UNIT_VERSION} unit-python2.7=$${UNIT_VERSION}"
-
-MODULE_python3.7="unit=$${UNIT_VERSION} unit-python3.7=$${UNIT_VERSION}"
-
-MODULE_go1.11-dev="unit=$${UNIT_VERSION} unit-go=$${UNIT_VERSION} gcc"
-
-MODULE_perl5.28="unit=$${UNIT_VERSION} unit-perl=$${UNIT_VERSION}"
-
-MODULE_ruby2.5="unit=$${UNIT_VERSION} unit-ruby=$${UNIT_VERSION}"
-
-MODULE_jsc11="unit=$${UNIT_VERSION} unit-jsc11=$${UNIT_VERSION}"
-
-MODULE_full="unit=$${UNIT_VERSION} unit-php=$${UNIT_VERSION} unit-python2.7=$${UNIT_VERSION} unit-python3.7=$${UNIT_VERSION} unit-perl=$${UNIT_VERSION} unit-ruby=$${UNIT_VERSION} unit-jsc11=$${UNIT_VERSION}"
-
-MODULE_minimal="unit=$${UNIT_VERSION}"
+VERSION ?= $(DEFAULT_VERSION)
 
 EXPORT_DIR := $(VERSION)
 
+MODULES ?= go jsc node perl php python ruby minimal
+
+VERSION_minimal ?=
+CONTAINER_minimal ?= debian:buster-slim
+CONFIGURE_minimal ?=
+INSTALL_minimal ?=	version
+define COPY_minimal
+endef
+
+VERSION_go ?=		1.15
+CONTAINER_go ?=		golang:$(VERSION_go)
+CONFIGURE_go ?=		go --go-path=$$GOPATH
+INSTALL_go ?=		go-install-src libunit-install
+define COPY_go
+COPY --from=BUILDER /usr/lib/x86_64-linux-gnu/libunit.a /usr/lib/x86_64-linux-gnu/\n\$
+COPY --from=BUILDER /usr/include/nxt_* /usr/include/\n\$
+COPY --from=BUILDER /go/src/ /go/src/
+endef
+
+VERSION_jsc ?=		11
+CONTAINER_jsc ?=	openjdk:$(VERSION_jsc)-jdk
+CONFIGURE_jsc ?=	java --jars=/usr/share/unit-jsc-common/
+INSTALL_jsc ?=		java-shared-install java-install
+COPY_jsc =	 		COPY --from=BUILDER /usr/share/unit-jsc-common/ /usr/share/unit-jsc-common/
+
+VERSION_node ?=		15
+CONTAINER_node ?=	node:$(VERSION_node)
+CONFIGURE_node ?=	nodejs --node-gyp=/usr/local/lib/node_modules/npm/bin/node-gyp-bin/node-gyp
+INSTALL_node ?=		node node-install libunit-install
+define COPY_node
+COPY --from=BUILDER /usr/lib/x86_64-linux-gnu/libunit.a /usr/lib/x86_64-linux-gnu/\n\$
+COPY --from=BUILDER /usr/include/nxt_* /usr/include/\n\$
+COPY --from=BUILDER /usr/local/lib/node_modules/unit-http/ /usr/local/lib/node_modules/unit-http/
+endef
+
+VERSION_perl ?=		5.32
+CONTAINER_perl ?=	perl:$(VERSION_perl)
+CONFIGURE_perl ?=	perl
+INSTALL_perl ?=		perl-install
+COPY_perl =
+
+VERSION_php ?=		8.0
+CONTAINER_php ?=	php:$(VERSION_php)-cli
+CONFIGURE_php ?=	php
+INSTALL_php ?=		php-install
+COPY_php =			RUN ldconfig
+
+VERSION_python ?=	3.9
+CONTAINER_python ?=	python:$(VERSION_python)
+CONFIGURE_python ?=	python --config=/usr/local/bin/python3-config
+INSTALL_python ?=	python3-install
+COPY_python =
+
+VERSION_ruby ?=		2.7
+CONTAINER_ruby ?=	ruby:$(VERSION_ruby)
+CONFIGURE_ruby ?=	ruby
+INSTALL_ruby ?=		ruby-install
+COPY_ruby =			RUN gem install rack
+
 default:
 	@echo "valid targets: all build dockerfiles push tag export clean"
 
-dockerfiles: $(addprefix Dockerfile., $(MODULES))
-build: refresh-base $(addprefix build-,$(MODULES))
-tag: $(addprefix tag-,$(MODULES))
-push: $(addprefix push-,$(MODULES)) latest
-export: $(addsuffix .tar.gz,$(addprefix $(EXPORT_DIR)/nginx-unit-$(VERSION)-,$(MODULES))) $(addsuffix .tar.gz.sha512, $(addprefix $(EXPORT_DIR)/nginx-unit-$(VERSION)-,$(MODULES)))
+MODVERSIONS = $(foreach module,$(MODULES),$(module)$(VERSION_$(module)))
+
+modname = $(shell echo $1 | /usr/bin/tr -d '.01234567890-')
+
+dockerfiles: $(addprefix Dockerfile., $(MODVERSIONS))
+build: $(addprefix build-,$(MODVERSIONS))
+tag: $(addprefix tag-,$(MODVERSIONS))
+push: $(addprefix push-,$(MODVERSIONS))
+export: $(addsuffix .tar.gz,$(addprefix $(EXPORT_DIR)/nginx-unit-$(VERSION)-,$(MODVERSIONS))) $(addsuffix .tar.gz.sha512, $(addprefix $(EXPORT_DIR)/nginx-unit-$(VERSION)-,$(MODVERSIONS)))
 
 Dockerfile.%: ../../version
 	@echo "===> Building $@"
-	cat Dockerfile.tmpl | sed \
-			-e 's,@@UNITPACKAGES@@,$(MODULE_$*),g' \
-			-e 's,@@UNIT_VERSION@@,$(UNIT_VERSION),g' \
+	cat template.Dockerfile | sed \
+			-e 's,@@VERSION@@,$(VERSION),g' \
+			-e 's,@@CONTAINER@@,$(CONTAINER_$(call modname, $*)),g' \
+			-e 's,@@CONFIGURE@@,$(CONFIGURE_$(call modname, $*)),g' \
+			-e 's,@@INSTALL@@,$(INSTALL_$(call modname, $*)),g' \
+			-e 's,@@COPY@@,$(COPY_$(call modname, $*)),g' \
 			> $@
 
 build-%: Dockerfile.%
+	docker pull $(CONTAINER_$(call modname, $*))
 	docker build --no-cache -t unit:$(VERSION)-$* -f Dockerfile.$* .
 
 tag-%: build-%
@@ -59,13 +101,6 @@ tag-%: build-%
 push-%: tag-%
 	docker push nginx/unit:$(VERSION)-$*
 
-latest:
-	docker tag nginx/unit:$(VERSION)-full nginx/unit:latest
-	docker push nginx/unit:latest
-
-refresh-base:
-	docker pull $(shell head -n 1 Dockerfile.tmpl | cut -d' ' -f 2)
-
 $(EXPORT_DIR):
 	mkdir -p $@
 
@@ -75,10 +110,10 @@ $(EXPORT_DIR)/nginx-unit-$(VERSION)-%.tar.gz: $(EXPORT_DIR) tag-%
 $(EXPORT_DIR)/nginx-unit-$(VERSION)-%.tar.gz.sha512: $(EXPORT_DIR)/nginx-unit-$(VERSION)-%.tar.gz
 	$(SHA512SUM) $< | sed 's,$(EXPORT_DIR)/,,' > $@
 
-all: $(addprefix Dockerfile., $(MODULES))
+all: $(addprefix Dockerfile., $(MODVERSIONS))
 
 clean:
-	rm -f $(addprefix Dockerfile., $(MODULES))
+	rm -f $(addprefix Dockerfile., $(MODVERSIONS))
 	rm -rf $(EXPORT_DIR)
 
-.PHONY: default all build dockerfiles latest push tag export clean refresh-base
+.PHONY: default build dockerfiles push tag export clean
diff --git a/pkg/docker/template.Dockerfile b/pkg/docker/template.Dockerfile
new file mode 100644
index 00000000..d96d7982
--- /dev/null
+++ b/pkg/docker/template.Dockerfile
@@ -0,0 +1,73 @@
+FROM @@CONTAINER@@ as BUILDER
+
+LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
+
+RUN set -ex \
+    && apt-get update \
+    && apt-get install --no-install-recommends --no-install-suggests -y ca-certificates mercurial build-essential libssl-dev libpcre2-dev \
+    && mkdir -p /usr/lib/unit/modules /usr/lib/unit/debug-modules \
+    && hg clone https://hg.nginx.org/unit \
+    && cd unit \
+    && hg up @@VERSION@@ \
+    && NCPU="$(getconf _NPROCESSORS_ONLN)" \
+    && DEB_HOST_MULTIARCH="$(dpkg-architecture -q DEB_HOST_MULTIARCH)" \
+    && CC_OPT="$(DEB_BUILD_MAINT_OPTIONS="hardening=+all,-pie" DEB_CFLAGS_MAINT_APPEND="-Wp,-D_FORTIFY_SOURCE=2 -fPIC" dpkg-buildflags --get CFLAGS)" \
+    && LD_OPT="$(DEB_BUILD_MAINT_OPTIONS="hardening=+all,-pie" DEB_LDFLAGS_MAINT_APPEND="-Wl,--as-needed -pie" dpkg-buildflags --get LDFLAGS)" \
+    && CONFIGURE_ARGS="--prefix=/usr \
+                --state=/var/lib/unit \
+                --control=unix:/var/run/control.unit.sock \
+                --pid=/var/run/unit.pid \
+                --log=/var/log/unit.log \
+                --tmp=/var/tmp \
+                --user=unit \
+                --group=unit \
+                --openssl \
+                --libdir=/usr/lib/$DEB_HOST_MULTIARCH" \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --ld-opt="$LD_OPT" --modules=/usr/lib/unit/debug-modules --debug \
+    && make -j $NCPU unitd \
+    && install -pm755 build/unitd /usr/sbin/unitd-debug \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --ld-opt="$LD_OPT" --modules=/usr/lib/unit/modules \
+    && make -j $NCPU unitd \
+    && install -pm755 build/unitd /usr/sbin/unitd \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --modules=/usr/lib/unit/debug-modules --debug \
+    && ./configure @@CONFIGURE@@ \
+    && make -j $NCPU @@INSTALL@@ \
+    && make clean \
+    && ./configure $CONFIGURE_ARGS --cc-opt="$CC_OPT" --modules=/usr/lib/unit/modules \
+    && ./configure @@CONFIGURE@@ \
+    && make -j $NCPU @@INSTALL@@ \
+    && ldd /usr/sbin/unitd | awk '/=>/{print $(NF-1)}' | while read n; do dpkg-query -S $n; done | sed 's/^\([^:]\+\):.*$/\1/' | sort | uniq > /requirements.apt
+
+FROM @@CONTAINER@@
+COPY docker-entrypoint.sh /usr/local/bin/
+COPY --from=BUILDER /usr/sbin/unitd /usr/sbin/unitd
+COPY --from=BUILDER /usr/sbin/unitd-debug /usr/sbin/unitd-debug
+COPY --from=BUILDER /usr/lib/unit/ /usr/lib/unit/
+COPY --from=BUILDER /requirements.apt /requirements.apt
+@@COPY@@
+RUN set -x \
+    && mkdir -p /var/lib/unit/ \
+    && mkdir /docker-entrypoint.d/ \
+    && addgroup --system unit \
+    && adduser \
+         --system \
+         --disabled-login \
+         --ingroup unit \
+         --no-create-home \
+         --home /nonexistent \
+         --gecos "unit user" \
+         --shell /bin/false \
+         unit \
+    && apt update \
+    && apt --no-install-recommends --no-install-suggests -y install $(cat /requirements.apt) \
+    && apt-get clean && rm -rf /var/lib/apt/lists/* \
+    && rm -f /requirements.apt \
+    && ln -sf /dev/stdout /var/log/unit.log
+
+STOPSIGNAL SIGTERM
+
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
+
+CMD ["unitd", "--no-daemon", "--control", "unix:/var/run/control.unit.sock"]
diff --git a/pkg/rpm/Makefile b/pkg/rpm/Makefile
index 1944d58d..f0bd0cf9 100644
--- a/pkg/rpm/Makefile
+++ b/pkg/rpm/Makefile
@@ -2,9 +2,10 @@
 
 include ../../version
 
+DEFAULT_VERSION := $(NXT_VERSION)
 DEFAULT_RELEASE := 1
 
-VERSION ?= $(NXT_VERSION)
+VERSION ?= $(DEFAULT_VERSION)
 RELEASE ?= $(DEFAULT_RELEASE)
 
 ifeq ($(shell test `rpm --eval '0%{?rhel} -eq 6 -a 0%{?amzn} -eq 0'`; echo $$?), 0)
@@ -127,7 +128,9 @@ include Makefile.php
 ifeq ($(shell test `rpm --eval '0%{?fedora} -lt 32'`; echo $$?),0)
 include Makefile.python27
 endif
-ifeq ($(shell test `rpm --eval '0%{?fedora} -ge 32'`; echo $$?),0)
+ifeq ($(shell test `rpm --eval '0%{?fedora} -ge 33'`; echo $$?),0)
+include Makefile.python39
+else ifeq ($(shell test `rpm --eval '0%{?fedora} -ge 32'`; echo $$?),0)
 include Makefile.python38
 else ifeq ($(shell test `rpm --eval '0%{?fedora} -ge 29'`; echo $$?),0)
 include Makefile.python37
@@ -149,6 +152,8 @@ CONFIGURE_ARGS=\
 	--pid=/var/run/unit/unit.pid \
 	--log=/var/log/unit/unit.log \
 	--tmp=/var/tmp \
+	--user=unit \
+	--group=unit \
 	--tests \
 	--openssl
 
@@ -274,7 +279,7 @@ test: unit modules
 		test -h rpmbuild/BUILD/unit-$(VERSION)/build-nodebug/$${soname} || \
 		ln -fs `pwd`/$${so} rpmbuild/BUILD/unit-$(VERSION)/build-nodebug/$${soname} ; \
 	done ; \
-	( cd rpmbuild/BUILD/unit-$(VERSION) && rm -f build && ln -s build-nodebug build && env python3 -m pytest ) ; \
+	( cd rpmbuild/BUILD/unit-$(VERSION) && rm -f build && ln -s build-nodebug build && env python3 -m pytest --user=nobody $(PYTEST_ARGS) ) ; \
 	}
 
 test-debug: unit modules
@@ -285,7 +290,7 @@ test-debug: unit modules
 		test -h rpmbuild/BUILD/unit-$(VERSION)/build-debug/$${soname} || \
 		ln -fs `pwd`/$${so} rpmbuild/BUILD/unit-$(VERSION)/build-debug/$${soname} ; \
 	done ; \
-	( cd rpmbuild/BUILD/unit-$(VERSION) && rm -f build && ln -s build-debug build && env python3 -m pytest ) ; \
+	( cd rpmbuild/BUILD/unit-$(VERSION) && rm -f build && ln -s build-debug build && env python3 -m pytest --user=nobody $(PYTEST_ARGS) ) ; \
 	}
 
 clean:
diff --git a/pkg/rpm/Makefile.python39 b/pkg/rpm/Makefile.python39
new file mode 100644
index 00000000..8e444e56
--- /dev/null
+++ b/pkg/rpm/Makefile.python39
@@ -0,0 +1,57 @@
+MODULES+=		python39
+MODULE_SUFFIX_python39=	python3.9
+
+MODULE_SUMMARY_python39=	Python 3.9 module for NGINX Unit
+
+MODULE_VERSION_python39=	$(VERSION)
+MODULE_RELEASE_python39=	1
+
+MODULE_CONFARGS_python39=	python --config=python3.9-config
+MODULE_MAKEARGS_python39=	python3.9
+MODULE_INSTARGS_python39=	python3.9-install
+
+MODULE_SOURCES_python39=	unit.example-python-app \
+			unit.example-python39-config
+
+ifneq (,$(findstring $(OSVER),opensuse-tumbleweed sles fedora amazonlinux2))
+BUILD_DEPENDS_python39=	python3-devel
+else
+BUILD_DEPENDS_python39=	python39-devel
+endif
+
+BUILD_DEPENDS+=		$(BUILD_DEPENDS_python39)
+
+define MODULE_PREINSTALL_python39
+%{__mkdir} -p %{buildroot}%{_datadir}/doc/unit-python39/examples/python-app
+%{__install} -m 644 -p %{SOURCE100} \
+    %{buildroot}%{_datadir}/doc/unit-python39/examples/python-app/wsgi.py
+%{__install} -m 644 -p %{SOURCE101} \
+    %{buildroot}%{_datadir}/doc/unit-python39/examples/unit.config
+endef
+export MODULE_PREINSTALL_python39
+
+define MODULE_FILES_python39
+%{_libdir}/unit/modules/*
+%{_libdir}/unit/debug-modules/*
+endef
+export MODULE_FILES_python39
+
+define MODULE_POST_python39
+cat <<BANNER
+----------------------------------------------------------------------
+
+The $(MODULE_SUMMARY_python39) has been installed.
+
+To check the sample app, run these commands:
+
+ sudo service unit start
+ cd /usr/share/doc/%{name}/examples
+ sudo curl -X PUT --data-binary @unit.config --unix-socket /var/run/unit/control.sock http://localhost/config
+ curl http://localhost:8400/
+
+Online documentation is available at https://unit.nginx.org
+
+----------------------------------------------------------------------
+BANNER
+endef
+export MODULE_POST_python39
diff --git a/pkg/rpm/rpmbuild/SOURCES/unit.example-go-config b/pkg/rpm/rpmbuild/SOURCES/unit.example-go-config
index a2c91e80..8aa65939 100644
--- a/pkg/rpm/rpmbuild/SOURCES/unit.example-go-config
+++ b/pkg/rpm/rpmbuild/SOURCES/unit.example-go-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_go": {
 			"type": "external",
-			"user": "nobody",
 			"executable": "/tmp/go-app"
 		}
 	},
diff --git a/pkg/rpm/rpmbuild/SOURCES/unit.example-perl-config b/pkg/rpm/rpmbuild/SOURCES/unit.example-perl-config
index 031928ce..2182fc46 100644
--- a/pkg/rpm/rpmbuild/SOURCES/unit.example-perl-config
+++ b/pkg/rpm/rpmbuild/SOURCES/unit.example-perl-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_perl": {
 			"type": "perl",
-			"user": "nobody",
 			"processes": 1,
 			"working_directory": "/usr/share/doc/unit-perl/examples/perl-app",
 			"script": "/usr/share/doc/unit-perl/examples/perl-app/index.pl"
diff --git a/pkg/rpm/rpmbuild/SOURCES/unit.example-php-config b/pkg/rpm/rpmbuild/SOURCES/unit.example-php-config
index 8f23c984..9673385f 100644
--- a/pkg/rpm/rpmbuild/SOURCES/unit.example-php-config
+++ b/pkg/rpm/rpmbuild/SOURCES/unit.example-php-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_php": {
 			"type": "php",
-			"user": "nobody",
 			"processes": 2,
 			"root": "/usr/share/doc/unit-php/examples/phpinfo-app",
 			"index": "index.php"
diff --git a/pkg/rpm/rpmbuild/SOURCES/unit.example-python-config b/pkg/rpm/rpmbuild/SOURCES/unit.example-python-config
index d612c89d..b3d3a2e5 100644
--- a/pkg/rpm/rpmbuild/SOURCES/unit.example-python-config
+++ b/pkg/rpm/rpmbuild/SOURCES/unit.example-python-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_python": {
 			"type": "python",
-			"user": "nobody",
 			"processes": 2,
 			"path": "/usr/share/doc/unit-python/examples/python-app",
 			"module": "wsgi"
diff --git a/pkg/rpm/rpmbuild/SOURCES/unit.example-python27-config b/pkg/rpm/rpmbuild/SOURCES/unit.example-python27-config
index 7541fcb3..094e6621 100644
--- a/pkg/rpm/rpmbuild/SOURCES/unit.example-python27-config
+++ b/pkg/rpm/rpmbuild/SOURCES/unit.example-python27-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_python": {
 			"type": "python 2.7",
-			"user": "nobody",
 			"processes": 2,
 			"path": "/usr/share/doc/unit-python27/examples/python-app",
 			"module": "wsgi"
diff --git a/pkg/rpm/rpmbuild/SOURCES/unit.example-python34-config b/pkg/rpm/rpmbuild/SOURCES/unit.example-python34-config
index b64e570c..15063c5e 100644
--- a/pkg/rpm/rpmbuild/SOURCES/unit.example-python34-config
+++ b/pkg/rpm/rpmbuild/SOURCES/unit.example-python34-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_python": {
 			"type": "python 3.4",
-			"user": "nobody",
 			"processes": 2,
 			"path": "/usr/share/doc/unit-python34/examples/python-app",
 			"module": "wsgi"
diff --git a/pkg/rpm/rpmbuild/SOURCES/unit.example-python35-config b/pkg/rpm/rpmbuild/SOURCES/unit.example-python35-config
index 025f3428..f9923a49 100644
--- a/pkg/rpm/rpmbuild/SOURCES/unit.example-python35-config
+++ b/pkg/rpm/rpmbuild/SOURCES/unit.example-python35-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_python": {
 			"type": "python 3.5",
-			"user": "nobody",
 			"processes": 2,
 			"path": "/usr/share/doc/unit-python35/examples/python-app",
 			"module": "wsgi"
diff --git a/pkg/rpm/rpmbuild/SOURCES/unit.example-python36-config b/pkg/rpm/rpmbuild/SOURCES/unit.example-python36-config
index 825cabc4..ef31c781 100644
--- a/pkg/rpm/rpmbuild/SOURCES/unit.example-python36-config
+++ b/pkg/rpm/rpmbuild/SOURCES/unit.example-python36-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_python": {
 			"type": "python 3.6",
-			"user": "nobody",
 			"processes": 2,
 			"path": "/usr/share/doc/unit-python36/examples/python-app",
 			"module": "wsgi"
diff --git a/pkg/rpm/rpmbuild/SOURCES/unit.example-python37-config b/pkg/rpm/rpmbuild/SOURCES/unit.example-python37-config
index 7f5e52f1..904af440 100644
--- a/pkg/rpm/rpmbuild/SOURCES/unit.example-python37-config
+++ b/pkg/rpm/rpmbuild/SOURCES/unit.example-python37-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_python": {
 			"type": "python 3.7",
-			"user": "nobody",
 			"processes": 2,
 			"path": "/usr/share/doc/unit-python37/examples/python-app",
 			"module": "wsgi"
diff --git a/pkg/rpm/rpmbuild/SOURCES/unit.example-python38-config b/pkg/rpm/rpmbuild/SOURCES/unit.example-python38-config
index 25003869..c98d1a52 100644
--- a/pkg/rpm/rpmbuild/SOURCES/unit.example-python38-config
+++ b/pkg/rpm/rpmbuild/SOURCES/unit.example-python38-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_python": {
 			"type": "python 3.8",
-			"user": "nobody",
 			"processes": 2,
 			"path": "/usr/share/doc/unit-python38/examples/python-app",
 			"module": "wsgi"
diff --git a/pkg/rpm/rpmbuild/SOURCES/unit.example-python39-config b/pkg/rpm/rpmbuild/SOURCES/unit.example-python39-config
new file mode 100644
index 00000000..61ed8568
--- /dev/null
+++ b/pkg/rpm/rpmbuild/SOURCES/unit.example-python39-config
@@ -0,0 +1,16 @@
+{
+	"applications": {
+		"example_python": {
+			"type": "python 3.9",
+			"processes": 2,
+			"path": "/usr/share/doc/unit-python39/examples/python-app",
+			"module": "wsgi"
+		}
+	},
+
+	"listeners": {
+		"*:8400": {
+			"pass": "applications/example_python"
+		}
+	}
+}
diff --git a/pkg/rpm/rpmbuild/SOURCES/unit.example-ruby-config b/pkg/rpm/rpmbuild/SOURCES/unit.example-ruby-config
index 15a92735..930aa987 100644
--- a/pkg/rpm/rpmbuild/SOURCES/unit.example-ruby-config
+++ b/pkg/rpm/rpmbuild/SOURCES/unit.example-ruby-config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_ruby": {
 			"type": "ruby",
-			"user": "nobody",
 			"processes": 2,
 			"script": "/usr/share/doc/unit-ruby/examples/ruby-app.ru"
 		}
diff --git a/pkg/rpm/rpmbuild/SOURCES/unit.example.config b/pkg/rpm/rpmbuild/SOURCES/unit.example.config
index 6fe35e2f..4855a954 100644
--- a/pkg/rpm/rpmbuild/SOURCES/unit.example.config
+++ b/pkg/rpm/rpmbuild/SOURCES/unit.example.config
@@ -2,7 +2,6 @@
 	"applications": {
 		"example_php": {
 			"type": "php",
-			"user": "nobody",
 			"processes": 2,
 			"root": "/usr/share/doc/unit-php/examples/phpinfo-app",
 			"index": "index.php"
@@ -10,7 +9,6 @@
 
 		"example_python": {
 			"type": "python",
-			"user": "nobody",
 			"processes": 2,
 			"path": "/usr/share/doc/unit-python/examples/python-app",
 			"module": "wsgi"
@@ -18,13 +16,11 @@
 
 		"example_go": {
 			"type": "external",
-			"user": "nobody",
 			"executable": "/tmp/go-app"
 		},
 
 		"example_perl": {
 			"type": "perl",
-			"user": "nobody",
 			"processes": 1,
 			"working_directory": "/usr/share/doc/unit-perl/examples/perl-app",
 			"script": "/usr/share/doc/unit-perl/examples/perl-app/index.pl"
diff --git a/pkg/rpm/rpmbuild/SOURCES/unit.init b/pkg/rpm/rpmbuild/SOURCES/unit.init
deleted file mode 100644
index e1aacd81..00000000
--- a/pkg/rpm/rpmbuild/SOURCES/unit.init
+++ /dev/null
@@ -1,88 +0,0 @@
-#!/bin/sh
-#
-# unitd        NGINX Unit
-#
-# chkconfig:   - 86 14
-# description: NGINX Unit
-
-### BEGIN INIT INFO
-# Provides: unitd
-# Required-Start: $local_fs $network $named $syslog
-# Required-Stop: $local_fs $network $named $syslog
-# Default-Start:
-# Default-Stop: 0 1 2 3 4 5 6
-# Short-Description: NGINX Unit
-# Description:       NGINX Unit
-### END INIT INFO
-
-# Source function library.
-. /etc/rc.d/init.d/functions
-
-exec="/usr/sbin/unitd"
-prog="unitd"
-
-[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog
-
-lockfile=/var/lock/subsys/$prog
-
-start() {
-    [ -x $exec ] || exit 5
-    echo -n $"Starting $prog: "
-    daemon $exec $UNITD_OPTIONS
-    retval=$?
-    echo
-    [ $retval -eq 0 ] && touch $lockfile
-    return $retval
-}
-
-stop() {
-    echo -n $"Stopping $prog: "
-    killproc $prog
-    retval=$?
-    echo
-    [ $retval -eq 0 ] && rm -f $lockfile
-    return $retval
-}
-
-restart() {
-    stop
-    start
-}
-
-rh_status() {
-    status $prog
-}
-
-rh_status_q() {
-    rh_status &>/dev/null
-}
-
-
-case "$1" in
-    start)
-        rh_status_q && exit 0
-        $1
-        ;;
-    stop)
-        rh_status_q || exit 0
-        $1
-        ;;
-    restart)
-        $1
-        ;;
-    reload|force-reload)
-        echo "Not implemented." >&2
-        exit 1
-        ;;
-    status)
-        rh_status
-        ;;
-    condrestart|try-restart)
-        rh_status_q || exit 0
-        restart
-        ;;
-    *)
-        echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart}"
-        exit 2
-esac
-exit $?
diff --git a/pkg/rpm/rpmbuild/SOURCES/unit.sysconf b/pkg/rpm/rpmbuild/SOURCES/unit.sysconf
deleted file mode 100644
index 9146bdac..00000000
--- a/pkg/rpm/rpmbuild/SOURCES/unit.sysconf
+++ /dev/null
@@ -1 +0,0 @@
-UNITD_OPTIONS="--log /var/log/unit/unit.log --pid /var/run/unit/unit.pid"
diff --git a/pkg/rpm/unit.module.spec.in b/pkg/rpm/unit.module.spec.in
index 2ef4ff1b..39083e66 100644
--- a/pkg/rpm/unit.module.spec.in
+++ b/pkg/rpm/unit.module.spec.in
@@ -7,6 +7,15 @@
 %define dist .el7
 %endif
 
+%if 0%{?rhel}%{?fedora}
+BuildRequires: gcc
+BuildRequires: openssl-devel
+%endif
+
+%if 0%{?suse_version} >= 1315
+BuildRequires: libopenssl-devel
+%endif
+
 %define unit_version %%UNIT_VERSION%%
 %define unit_release %%UNIT_RELEASE%%%{?dist}.ngx
 
@@ -29,6 +38,8 @@ Source0: unit-%{version}.tar.gz
 
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
+BuildRequires: pcre2-devel
+
 Requires: unit == %%UNIT_VERSION%%-%%UNIT_RELEASE%%%{?dist}.ngx
 
 %description
diff --git a/pkg/rpm/unit.spec.in b/pkg/rpm/unit.spec.in
index 7fc950ec..08db73e2 100644
--- a/pkg/rpm/unit.spec.in
+++ b/pkg/rpm/unit.spec.in
@@ -1,19 +1,7 @@
 # distribution specific definitions
-%define use_systemd (0%{?rhel} >= 7 || 0%{?fedora} >= 19 || 0%{?suse_version} >= 1315)
 %define bdir %{_builddir}/%{name}-%{version}
 %define dotests 0
 
-%if ( 0%{?rhel} == 5 || 0%{?rhel} == 6 )
-Requires: initscripts >= 8.36
-%endif
-
-%if %{use_systemd}
-BuildRequires: systemd
-Requires(post):    systemd
-Requires(preun):   systemd
-Requires(postun):  systemd
-%endif
-
 %if 0%{?rhel}%{?fedora}
 BuildRequires: gcc
 BuildRequires: openssl-devel
@@ -48,12 +36,16 @@ Group: System Environment/Daemons
 
 Source0: unit-%{version}.tar.gz
 Source1: unit.service
-Source2: unit.init
-Source3: unit.sysconf
-Source4: unit.example.config
-Source5: unit.logrotate
+Source2: unit.example.config
+Source3: unit.logrotate
 
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+BuildRequires: systemd
+Requires(post):    systemd
+Requires(preun):   systemd
+Requires(postun):  systemd
+
+BuildRequires: pcre2-devel
 
 %description
 NGINX Unit is a runtime and delivery environment for modern distributed
@@ -116,17 +108,12 @@ DESTDIR=%{buildroot} make unitd-install libunit-install
 %{__mkdir} -p %{buildroot}%{_sharedstatedir}/unit
 %{__mkdir} -p %{buildroot}%{_localstatedir}/log/unit
 %{__mkdir} -p %{buildroot}%{_localstatedir}/run/unit
-%if ! %{use_systemd}
-%{__mkdir} -p %{buildroot}%{_sysconfdir}/sysconfig
-%{__install} -m 644 -p %{SOURCE3} \
-    %{buildroot}%{_sysconfdir}/sysconfig/unitd
-%endif
 %{__mkdir} -p %{buildroot}%{_sysconfdir}/logrotate.d
-%{__install} -m 644 -p %{SOURCE5} \
+%{__install} -m 644 -p %{SOURCE3} \
     %{buildroot}%{_sysconfdir}/logrotate.d/unit
 %{__mkdir} -p %{buildroot}%{_sysconfdir}/unit
 %{__mkdir} -p %{buildroot}%{_datadir}/doc/unit/examples
-%{__install} -m 644 -p %{SOURCE4} \
+%{__install} -m 644 -p %{SOURCE2} \
     %{buildroot}%{_datadir}/doc/unit/examples/example.config
 %{__install} -m 644 -p CHANGES \
     %{buildroot}%{_datadir}/doc/unit/
@@ -135,14 +122,8 @@ DESTDIR=%{buildroot} make unitd-install libunit-install
 %{__install} -m 644 -p README \
     %{buildroot}%{_datadir}/doc/unit/
 
-# init scripts
-%if %{use_systemd}
 %{__rm} -rf %{buildroot}%{_initrddir}/
 %{__install} -p -D -m 0644 %{SOURCE1} %{buildroot}%{_unitdir}/unit.service
-%else
-%{__mkdir} -p %{buildroot}%{_initrddir}
-%{__install} -p -D -m 0755 %{SOURCE2} %{buildroot}%{_initrddir}/unit
-%endif
 
 QA_SKIP_BUILD_ROOT=1
 export QA_SKIP_BUILD_ROOT
@@ -163,12 +144,12 @@ cat /dev/null > debugsourcefiles.list
 %{__rm} -rf %{buildroot}
 
 %post
+getent group unit >/dev/null || groupadd -r unit
+getent passwd unit >/dev/null || \
+    useradd -r -g unit -s /sbin/nologin \
+    -d /nonexistent -c "unit user" unit
 if [ $1 -eq 1 ]; then
-%if %{use_systemd}
     /usr/bin/systemctl preset unit.service >/dev/null 2>&1 ||:
-%else
-    /sbin/chkconfig --add unit
-%endif
     cat <<BANNER
 ----------------------------------------------------------------------
 
@@ -185,40 +166,38 @@ fi
 
 %preun
 if [ $1 -eq 0 ]; then
-%if %{use_systemd}
     /usr/bin/systemctl --no-reload disable unit.service >/dev/null 2>&1 ||:
     /usr/bin/systemctl stop unit.service >/dev/null 2>&1 ||:
-%else
-    /sbin/service unit stop >/dev/null 2>&1
-    /sbin/chkconfig --del unit
-%endif
 fi
 
 %postun
-%if %{use_systemd}
 /usr/bin/systemctl daemon-reload >/dev/null 2>&1 ||:
-%endif
 if [ $1 -ge 1 ]; then
-%if %{use_systemd}
     /usr/bin/systemctl try-restart unit.service >/dev/null 2>&1 ||:
-%else
-    /sbin/service unit condrestart >/dev/null 2>&1 ||:
-%endif
 fi
 
+%triggerpostun -- unit < 1.22.0
+cat <<BANNER
+----------------------------------------------------------------------
+
+WARNING:
+
+Since version 1.22.0, Unit's non-privileged processes run as unit:unit by
+default.  Review your system permissions and Unit configuration so apps and
+routes that relied on these processes running as nobody:nogroup stay working.
+
+More info: https://unit.nginx.org/installation/#official-packages
+
+----------------------------------------------------------------------
+BANNER
+
 %files
 %defattr(-,root,root,-)
 %attr(0755,root,root) %{_sbindir}/unitd
 %attr(0755,root,root) %{_sbindir}/unitd-debug
 %dir %{_sysconfdir}/unit
-%if %{use_systemd}
 %{_unitdir}/unit.service
 %dir %attr(0755,root,root) %ghost %{_localstatedir}/run/unit
-%else
-%config(noreplace) %{_sysconfdir}/sysconfig/unitd
-%dir %attr(0755,root,root) %{_localstatedir}/run/unit
-%{_initrddir}/unit
-%endif
 %dir %{_datadir}/doc/unit
 %{_datadir}/doc/unit/*
 %dir %{_libdir}/unit/modules