docker pull nginx:1.30-alpinenginx@sha256:0e52bd054126cdc040b1276c0af347aeb02a41b9cfe305d6094767ac30e97949Size per platform
Compressed download size on Docker Hub for each architecture.
Where the bytes go
Unpacked bytes by directory in the final amd64 filesystem.
Layers
The 8 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.
Full build steps
- 3.9 MB
ADD alpine-minirootfs-3.24.3-x86_64.tar.gz / # buildkit - 1.9 MB
RUN /bin/sh -c set -x && addgroup -g 101 -S nginx && adduser -S -D -H -u 101 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx && apkArch="$(cat /etc/apk/arch)" && nginxPackages=" nginx=${NGINX_VERSION}-r${PKG_RELEASE} " && apk add --no-cache --virtual .checksum-deps openssl && case "$apkArch" in x86_64|aarch64) set -x && KEY_SHA512="e09fa32f0a0eab2b879ccbbc4d0e4fb9751486eedda75e35fac65802cc9faa266425edf83e261137a2f4d16281ce2c1a5f4502930fe75154723da014214f0655" && wget -O /tmp/nginx_signing.rsa.p - 627 B
COPY docker-entrypoint.sh / # buildkit - 964 B
COPY 10-listen-on-ipv6-by-default.sh /docker-entrypoint.d # buildkit - 403 B
COPY 15-local-resolvers.envsh /docker-entrypoint.d # buildkit - 1 kB
COPY 20-envsubst-on-templates.sh /docker-entrypoint.d # buildkit - 1 kB
COPY 30-tune-worker-processes.sh /docker-entrypoint.d # buildkit - 20 MB
RUN /bin/sh -c set -x && apkArch="$(cat /etc/apk/arch)" && nginxPackages=" nginx=${NGINX_VERSION}-r${PKG_RELEASE} nginx-module-xslt=${NGINX_VERSION}-r${DYNPKG_RELEASE} nginx-module-geoip=${NGINX_VERSION}-r${DYNPKG_RELEASE} nginx-module-image-filter=${NGINX_VERSION}-r${DYNPKG_RELEASE} nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} nginx-module-acme=${NGINX_VERSION}.${ACME_VERSION}-r${PKG_RELEASE} " && apk add --no-cache --virtual .checksum-deps openssl && case "$apkArch" in x86_64|aarch64)
Known vulnerabilities
1Critical1 with a fix
2High2 with a fix
2Medium2 with a fix
44Low44 with a fix
0Unknown0 with a fix
49 findings across 71 packages; 49 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.
| Severity | Vulnerability | Affected packages | Fixed in |
|---|---|---|---|
| Critical | CVE-2026-111497brotli: Out-of-Bounds Write in Google Brotli Decoder | brotli-libsinstalled 1.2.0-r1 | 1.2.1-r0 |
| High | CVE-2026-92392curl: curl: HTTP/2 upload Use-After-Free | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Medium | CVE-2026-92388curl: curl: FTP wildcard write callback mixup | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-107928curl: curl: info leak uploading over WebSockets with GnuTLS | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-107929curl: curl: local interface connection reuse mixup | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-86409curl: curl: stale SigV4 headers sent unintended | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-86410curl: curl: redirect to SFTP or SCP bypasses host verification | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-86411curl: curl: FTP connection reuse inherits client-certificate | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-86412curl: curl: server-set cookie erases cookie jar | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-86413curl: curl: Negotiate credentials sent to redirected origin | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-86414curl: curl: leaking host credentials to HTTP proxy | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-86415curl: curl: auto client cert connection reuse mixup | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-87861curl: curl: cross-origin reuse of a Negotiate connection | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-87862curl: curl: HSTS cache import drops longer-lived child | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-87863curl: curl: Hsts Response Erases Persisted Entries | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-87864curl: IMAP APPEND plus CRLF conversion command injection | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-87865curl: curl: knownhost callback mismatches key as missing | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-87866curl: curl: wolfSSL public-key pinning bypass | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-92386curl: curl: server-set cookie aborts cookie jar load | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-92387curl: curl: never-ending loop via server response omission | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-92389curl: curl: TFTP direction confusion | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-92390curl: curl: -J no-clobber guarantee bypassed with 103 early hints | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-92391curl: curl: curl_mime_free stack overflow by recursion | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-94265curl: curl: Authorization: Negotiate sent to foreign origin | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| Low | CVE-2026-94266curl: curl: password leak in CURLINFO_EFFECTIVE_URL | curl, libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
Packages
- Alpine packages
- 71
Image configuration
- Base OS
- Alpine Linux 3.24.3
- Default user
- root (no USER set; the entrypoint may still drop privileges)
- Entrypoint
- /docker-entrypoint.sh
- Command
- nginx -g daemon off;
- Exposed ports
- 80/tcp
- Image created
- 2026-10-21
- amd64 digest
- sha256:84ed8c0dd296c188bfc24ed506f46589e9285fb0b11cf3a04d91d524d3067e11
Other nginx tags
nginx:1.30166 MB unpacked · 64 MB downloadC 1H 58M 108L 166? 9
nginx:1.30-alpine-slim13 MB unpacked · 5.7 MB download✓ 0 known
- nginx:1.30 vs nginx:1.30-alpine
- nginx:1.30-alpine vs nginx:1.30-alpine-slim
- nginx:1.30-alpine vs httpd:2.4-alpine
- caddy:2 vs nginx:1.30-alpine
Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-26 from digest sha256:84ed8c0dd296. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.