Dockerfile: upgraded to 2.0 base

Changes:

• Upgraded to docker-base 2.0 (https://github.com/behance/docker-base/releases/tag/2.0.0), mainly impacts Alpine variant

Nginx: master process as root

Removing /dev/stdout hacks in order to make completely unprivileged nginx work. This is deemed an unnecessary precaution for its master process, which is then further mitigated with Docker's user namespaces going forward.

Works around:

• moby/moby#31243
• moby/moby#31106

Container is now verified to run in Docker 1.12+ with user namespaces enabled and selinux in enforcing mode

Chmod: swapping from S6 to standard tool

:(

Nginx: converted from full to light

Changes:

• Removes typically unused nginx extensions: https://wiki.debian.org/Nginx
• Added better Travis CI integration tests

Parent: updated to docker-base 1.6

Changed:

• Parent's alpine variant now using v3.5 (https://github.com/behance/docker-base/releases/tag/1.6.0)

Additions:

• On Alpine, now using the updated variant-specific convenience scripts
• On Alpine, removed duplicative installs (no effect)

Secure Headers: Added new defaults

Adding a new http_headers.conf file with some secure http headers, as recommended by https://securityheaders.io/

Added HTTP Headers:

• X-XSS-Protection 1; mode=block
• X-Content-Type-Options nosniff

Changed:
HTTP header include file moved to http block, so that downstream clients should not need to include it manually if they override sites-available/default

Tuning: optimized, allow further customization of nginx configs

Added:

additional environment configurations:

• SERVER_CLIENT_HEADER_BUFFER_SIZE
• SERVER_CLIENT_BODY_BUFFER_SIZE
• SERVER_LARGE_CLIENT_HEADER_BUFFERS

Changed:

• using latest docker-base upstream (1.4)
• tweaked nginx configuration for performance
• removed duplicated files from parent

Nginx: selectable worker_processes count

Allows specification of worker processes at runtime. When running in a container, Docker will see all available cores on a machine, but will be cgroup-limited to a certain time slice of them. The default setting, auto, will only be the "right" number if this is the only container on the machine.

Added parent in docker-base

• Using 16.04-based github.com/behance/docker-base
• Leveraging pre-installed goss + S6, env vars from parent
• Moved test files out of root, into /tests/nginx folder, calling parent tests too

AUFS Bugfix: permission problem in aufs driver

Works around moby/moby#20240