Skip to content

clarify allowed upload directories #1020

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 7 commits into
base: main
Choose a base branch
from
Open

clarify allowed upload directories #1020

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
f755565
clarify allowed upload directories
rishabh-f5 Aug 22, 2025
2b15838
add missing worker-writable directories
rishabh-f5 Aug 22, 2025
89f904c
add App Protect directory to filesystem
rishabh-f5 Aug 22, 2025
ce2f4b6
Merge branch 'main' into NLB-5699-improve-docs-on-allowed-directories
rishabh-f5 Sep 8, 2025
6c81899
update filesystem restrictions
rishabh-f5 Sep 9, 2025
b444c97
refactor file system table and restrictions
rishabh-f5 Sep 15, 2025
07c34a6
Merge branch 'main' into NLB-5699-improve-docs-on-allowed-directories
rishabh-f5 Sep 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 22 additions & 10 deletions content/nginxaas-azure/getting-started/nginx-configuration/overview.md
View file
Open in desktop
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This docs says the same thing in four ways:

  1. big table
  2. bulleted list
  3. bulleted list with more words
  4. plaintext code block

I think that's a lot more confusing than what we had. If AI wrote this, please keep in mind the F5 AI policy, especially

Review outputs from approved AI Applications

How about we just stick to the table and delete the other three?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the four methods that @ryepup noted leads to inconsistencies such as https://github.com/nginx/documentation/pull/1020/files#r2334077715 .

Original file line number Diff line number Diff line change
Expand Up @@ -25,21 +25,33 @@ The topics below provide information on NGINX configuration restrictions and dir
NGINX configurations stored in GitHub can be applied to existing NGINXaaS for Azure deployments using custom GitHub Action workflows. See [NGINXaaS for Azure Deployment Action](https://github.com/nginxinc/nginx-for-azure-deploy-action) for documentation and examples on how to incorporate these workflows in your GitHub Actions CI/CD pipelines.

## NGINX filesystem restrictions
NGINXaaS for Azure places restrictions on the instance's filesystem; only a specific set of directories are allowed to be read from and written to. Below is a table describing what directories the NGINX worker process can read and write to and what directories files can be written to. These files include certificate files and any files uploaded to the deployment, excluding NGINX configuration files.

{{< table >}}
| Allowed Directory | NGINX worker process can read/write to | Files can be written to |
|------------------ | ----------------- | ----------------- |
| /etc/nginx | | &check; |
| /opt | &check; | &check; |
| /srv | &check; | &check; |
| /tmp | &check; | |
| /var/cache/nginx | &check; | |
| /var/www | &check; | &check; |
NGINXaaS for Azure places restrictions on the instance’s filesystem; only a specific set of directories are allowed to be read from and written to. Below is a table describing what directories the NGINX worker process can read and write to and what directories files can be written to. These files include certificate files and any files uploaded to the deployment, excluding NGINX configuration files.

{{< table >}}

| Directory | Master Read | Master Write | Worker Read | Worker Write | Recommended Use |
|-------------------|:-----------:|:------------:|:-----------:|:------------:|----------------------------------|
| /etc/nginx/ | ✔️ | ✔️ | ❌ | ❌ | Certificates, keys |
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

NGINX config files are recommend here

| /opt/ | ✔️ | ✔️ | ✔️ | ❌ | Application files (e.g. Lua scripts) |
| /srv/ | ✔️ | ✔️ | ✔️ | ❌ | Application files |
| /var/www/ | ✔️ | ✔️ | ✔️ | ❌ | Static files (e.g. index.html) |
| /tmp/ | ✔️ | ✔️ | ✔️ | ✔️ | Temporary files |
| /var/cache/nginx/ | ✔️ | ✔️ | ✔️ | ✔️ | Cache data |

{{< /table >}}

Attempts to access other directories will be denied and result in a `5xx` error.

```plaintext
/etc/nginx/ # Certificates, keys (master only)
/opt/ # Application files (worker read-only)
/srv/ # Application files (worker read-only)
/var/www/ # Static files (worker read-only)
/var/cache/nginx/ # Cache data (worker read/write)
/tmp/ # Temporary files (worker read/write)
```

## Disallowed configuration directives
Some directives are not supported because of specific limitations. If you include one of these directives in your NGINX configuration, you'll get an error.

Expand Down
Loading