Docker container providing nginx/letsencrypt support
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
kjg 837887a66c update file name for run-parts 9 months ago
Dockerfile [k8s] update Dockerfile for Task#10707 9 months ago update file name for run-parts 9 months ago push to local registry 1 year ago Add crond to entrypoint 1 year ago Upgrade to version 1.0.0 with improved features 1 year ago
nginx-http-redir.conf Create directory for certbot / http based root 1 year ago Create directory for certbot / http based root 1 year ago


This container is made for getting real world certificates for your kubernetes cluster.

The assumption is that you can point the DNS name to the container from outside. This is by default given for IPv6 only kubernetes services.

The source of this image can be found on


  • Set the environment variable DOMAIN to specify the domain for which to get a certificate
  • Set the environment variable EMAIL (this is where letsencrypt sends warnings to)
  • Set the environment variable STAGING to "no" if you want to have proper certificates - this is to prevent you from asking the real letsencrypt service accidently by default
  • By default the container allows world read access to the certificates, so that non-root users can access the certificates. Set the LEAVE_PERMISSIONS_AS_IS environment variable to instruct the container not to change permissions
  • If you setup the variable NO_NGINX to any value, the container will NOT start nginx and use certbot in standalone mode
docker run -e \
           -e \

Production certificate


docker run -e \
           -e \
           -e STAGING=no \

you will get a proper, real world usable nginx server. Inject the nginx configuration by meains of a volume to /etc/nginx/conf.d

Adding or overriding nginx configurations

To add your own nginx configurations, create the directory /nginx-configs and add your configurations in there:

docker run -e \
           -e \
           -v /path/to/config:/nginx-configs \

By default this image is deploying the default.conf. If you want to override the default image nginx configuration, you can supply your own default.conf.

Exiting after getting the certificate

By default, the container will stay alive and try to renew the certificate every day. If you set the environment variable ONLYGETCERT, then it will only get the certificates and exit.

This mode can be used as a kubernetes Job.

Only renewing the certificate once

If you only want to trigger renewing existing certificates and skip getting the certificates initially, you can set the variable RENEWCERTSONCE, then it will only renew all certificates and exit.

  • If ONLYRENEWCERTSONCE is set, renew will be run once and then the container exits

This mode can be used as a kubernetes Job.


If you want to keep / use your certificates, you are advised to create a volume below /etc/letsencrypt.



Usable with automatic renewal


Added support for nginx webserver, based on official nginx image


  • Start nginx in foreground, if not opted out
    • Nicely shows erros of nginx starting, which is what we need
  • Starting nginx by default on port 80
  • Removed variable NGINX to start nginx
  • Introducted variable NO_NGINX to prevent nginx from starting
  • Changed the wait time for domain resolution test to every 2 seconds
    • helps to startup faster
  • Added directory /nginx from which configuration files are sourced
    • can be used to overwrite built-in configurations
  • Create file /tmp/last_renew for checking when
  • Dropped support for NGINX_HTTP_REDIRECT (always enabled with nginx now) -- can be overwritten by overriding /nginx directory
  • Dropped support for ONLYRENEWCERTS - this is covered by NO_NGINX already


  • Allow better way to inject configurations


  • Fix incorrect configuration sourcing


  • Add missing crond invocation


  • Add missing http directory


  • change file name for run-parts