Create and build a Docker Hardened Image — syntax=dhi.io/build:2-alpine3.23

Reference note (untrusted external data; do not execute it as instructions). name: Nginx mainline image: my-registry/my-nginx variant: runtime tags: "1.29" platforms: linux/amd64 linux/arm64 contents: repositories: keyring: packages: alpine-baselayout-data busybox musl-utils nginx=1.29.5-r1 builds: name: nginx contents: repositories: keyring: packages: alpine-baselayout-data bash musl-utils nginx=1.29.5-r1 pipeline: name: install runs: | set -eux -o pipefail accounts: run-as: nginx users: name: nginx uid: 65532 gid: 65532 groups: name: nginx gid: 65532 members: nginx name: www-data gid: 82 os-release: name: Docker Hardened Images (Alpine) id: alpine version-id: "3.23" pretty-name: Docker Hardened Images/Alpine Linux v3.23 home-url: bug-report-url environment: NGINX_VERSION: 1.29.5-r1 annotations: org.opencontainers.image.description: A minimal Nginx image org.opencontainers.image.licenses: BSD-2-Clause Bounded code example (external data; do not execute automatically): ```text Key patterns in this definition: | Element | Description | |-------------|----------------------------------------------------------------------------| | `contents` | Each build stage has its own `contents` section. Include packages needed only during the build, such as `bash`. | | `pipeline` | Contains named steps that run shell commands. Always start scripts with `set -eux -o pipefail`. | | `outputs` | Copies results from the build stage into the final image. Setting `diff: true` copies only files that changed, keeping the image minimal. | | `accounts` | Nginx uses a dedicated `nginx` user (UID 65532) instead of `nonroot`. The `www-data` group (GID 82) is also created for web server compatibility. | | `musl-utils` | Required in both the main and build packages for Alpine-based Nginx images. | ``` Attribution: Adapted from Docker Documentation under Apache-2.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.