VocalHyre
Sign up

Nginx · The edge of your stack

How do you run Nginx in Docker correctly?

Mediumdockercontainersnginx imageUpdated Oct 2026
Quiz this track

Short answer

Use a pinned official image, bake or mount a validated config, keep Nginx in the foreground, send logs to stdout and stderr, add a health check and run unprivileged where possible.

The official image already runs Nginx with daemon off. The main differences from a host install are config delivery, log handling, signal behavior, DNS and file permissions for an unprivileged user.

dockerfile
FROM nginx:1.28-alpine
COPY nginx.conf /etc/nginx/nginx.conf
COPY conf.d/ /etc/nginx/conf.d/
EXPOSE 8080
HEALTHCHECK CMD wget -qO- http://127.0.0.1:8080/health || exit 1
CMD ["nginx", "-g", "daemon off;"]
The config must listen on 8080 to match EXPOSE; the official image defaults to 80.

Container specifics

  • Pin an image tag or digest so a rebuild does not silently change versions
  • The image entrypoint runs scripts in /docker-entrypoint.d and can template configs
  • Validate the config in CI or an init step where backend names resolve; nginx -t at image build can fail on unavailable upstream DNS
  • Log to stdout and stderr or symlink the log files there for platform collection
  • Use SIGQUIT or docker stop with enough grace time for a graceful shutdown
  • Prefer an unprivileged image or a non-root USER with writable cache and pid paths
  • Docker's embedded DNS is 127.0.0.11; upstream names resolve at startup unless a resolver is configured
The default official image runs the master as root so it can bind port 80. If you change to a non-root user, update listen ports, pid, cache and temp paths, and test the health check under that user.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

  1. 1Why does the official image use daemon off?
  2. 2How do you handle log collection in a container?
  3. 3Why might an upstream hostname stop resolving after a container restart?
  4. 4What changes when running Nginx as a non-root user?

Say it in the interview

I use a pinned official image, copy a validated config, and keep Nginx in the foreground. Logs go to stdout and stderr, and I add a health check. For security I prefer an unprivileged image or a non-root user, which means adjusting ports and writable paths. I also remember Docker DNS: upstream hostnames resolve at startup unless I configure the embedded resolver.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Related questions

EasyWhere does Nginx keep its configuration and files after installation?EasyHow do access and error logs work in Nginx?HardWhat are Nginx production best practices?

Reading is step one

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Nginx mock interview and get scored feedback on depth, clarity and confidence.

Start a free Nginx interviewBrowse all questions