Agent skill

NGINX Ingress Controller Image Builder

Explains the multi-stage Dockerfile, the 25 image variant combinations, and the Makefile targets for building NGINX Ingress Controller images.

Apache-2.0Auto-check passedDevOps & Cloud

Install NGINX Ingress Controller Image Builder

skills CLI

$ npx skills add nginx/kubernetes-ingress --skill nic-docker-images -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install nginx/kubernetes-ingress nic-docker-images --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/nginx/kubernetes-ingress.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.github/skills/nic-docker-images .claude/skills/nic-docker-images && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "nic-docker-images" agent skill from https://github.com/nginx/kubernetes-ingress/tree/main/.github/skills/nic-docker-images into .claude/skills/nic-docker-images/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "nic-docker-images", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/nginx/kubernetes-ingress/tree/main/.github/skills/nic-docker-images

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add nginx/kubernetes-ingress --skill nic-docker-images -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install nginx/kubernetes-ingress nic-docker-images --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/nginx/kubernetes-ingress.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.github/skills/nic-docker-images .agents/skills/nic-docker-images && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "nic-docker-images" agent skill from https://github.com/nginx/kubernetes-ingress/tree/main/.github/skills/nic-docker-images into .agents/skills/nic-docker-images/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "nic-docker-images", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add nginx/kubernetes-ingress --skill nic-docker-images -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install nginx/kubernetes-ingress nic-docker-images --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/nginx/kubernetes-ingress.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.github/skills/nic-docker-images .cursor/skills/nic-docker-images && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "nic-docker-images" agent skill from https://github.com/nginx/kubernetes-ingress/tree/main/.github/skills/nic-docker-images into .cursor/skills/nic-docker-images/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "nic-docker-images", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/nginx/kubernetes-ingress.git --path .github/skills/nic-docker-images

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add nginx/kubernetes-ingress --skill nic-docker-images -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install nginx/kubernetes-ingress nic-docker-images --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/nginx/kubernetes-ingress.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.github/skills/nic-docker-images .gemini/skills/nic-docker-images && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "nic-docker-images" agent skill from https://github.com/nginx/kubernetes-ingress/tree/main/.github/skills/nic-docker-images into .gemini/skills/nic-docker-images/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "nic-docker-images", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install nginx/kubernetes-ingress nic-docker-images

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add nginx/kubernetes-ingress --skill nic-docker-images -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/nginx/kubernetes-ingress.git skills-src && mkdir -p .github/skills && cp -r skills-src/.github/skills/nic-docker-images .github/skills/nic-docker-images && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "nic-docker-images" agent skill from https://github.com/nginx/kubernetes-ingress/tree/main/.github/skills/nic-docker-images into .github/skills/nic-docker-images/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "nic-docker-images", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add nginx/kubernetes-ingress --skill nic-docker-images -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install nginx/kubernetes-ingress nic-docker-images --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/nginx/kubernetes-ingress.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.github/skills/nic-docker-images .opencode/skills/nic-docker-images && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "nic-docker-images" agent skill from https://github.com/nginx/kubernetes-ingress/tree/main/.github/skills/nic-docker-images into .opencode/skills/nic-docker-images/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "nic-docker-images", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: nic-docker-images
GitHub stars: 5.1k
Token cost: ~2.9k tokens
SKILL.md length: 1,137 words
Files: 1
Skills in repo: 9
Repo updated: Oct 10, 2026
First seen: Oct 7, 2026
Licence: Apache-2.0

At a glance

Explains the multi-stage Dockerfile, the 25 image variant combinations, and the Makefile targets for building NGINX Ingress Controller images.

Works in 3 steps: OS family: Debian 13 (trixie), Alpine… → NGINX edition: OSS or Plus, plus… → NGINX Agent version: v2 (default on NAP…
Adding a new NGINX Ingress Controller image variant
SKILL.md covers Dockerfile Architecture, Image Variants, Makefile Image Targets and Key Build Args, plus 3 more sections
Calls make and docker

What it does

This skill describes a roughly 1100-line multi-stage Dockerfile where a BUILD_OS argument picks the base-image stage and a TARGET argument picks the final stage, plus supporting images built outside that Dockerfile, such as a UBI dependency image pinned by digest in the Makefile.

make all-images builds 25 variants across three axes: OS family (Debian, Alpine, or UBI), NGINX edition (OSS, Plus, or Plus with WAF/DoS/FIPS add-ons), and NGINX Agent version (v2 or v3), with OSS and plain Plus images shipping agent v3 only while NAP WAF stages exist in matched v2/v3 pairs. NAP variants build amd64 only while OSS and Plus also build arm64.

When your agent uses it

Adding a new NGINX Ingress Controller image variant
Debugging a failed image build
Understanding which base image and NGINX edition a Dockerfile stage targets

Example prompts

“Add a new Alpine Plus FIPS variant to the build matrix.”
“Why is the debian-plus-nap-agent build failing?”
“Explain the difference between agent v2 and v3 image stages.”

Workflow steps

3 steps, taken from the first numbered list in SKILL.md.

OS family: Debian 13 (trixie), Alpine 3.24, UBI 10 minimal
NGINX edition: OSS or Plus, plus optional NAP WAF v4 / WAF v5 / DoS and FIPS on Alpine
NGINX Agent version: v2 (default on NAP variants) or v3 (-agent suffixed stages)

What it can do on your machine

Read from SKILL.md and the folder at commit 29a1a36. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- make
- docker
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use docker, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

NGINX Ingress Controller Image Builder loads about 2.9k tokens when it runs. Until then it costs about 68 tokens; SKILL.md has 1,137 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~68
When it runs · the whole SKILL.md, loaded when a task matches: ~2.9k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from nginx/kubernetes-ingress at commit 29a1a36, republished under its Apache-2.0 licence (© nginx). 1,137 words, ~2,944 tokens.

Download SKILL.mdSave it as .claude/skills/nic-docker-images/SKILL.md (or your agent's skills folder).

name: nic-docker-images
description: Docker image build system, Dockerfile structure, image variants, build scripts, and Makefile targets for NIC. Use when building container images, modifying the Dockerfile, adding new image variants, debugging image builds, or working with build scripts.

NIC Docker Image Build System

Dockerfile Architecture

Single build/Dockerfile (~1100 lines), heavily multi-stage. The BUILD_OS arg selects which base image stage is used, and TARGET selects the final stage.

text

nginx-files (scratch)           <- Repo files, signing keys, package repo definitions, scripts
  |                                (rewrites repo hosts + user-agent strings via sed)
OS-specific base stages         <- One per variant (debian, alpine, ubi, *-plus, *-nap[-v5][-fips][-agent])
  |
FROM ${BUILD_OS} AS common      <- Runs common.sh + patch-os.sh, sets permissions
  |
TARGET stages (final image)     <- local, container, goreleaser, debug, debug-container,
                                   download, aws, patched, and *-prebuilt variants

Supporting images built outside this Dockerfile:

build/dependencies/Dockerfile.ubi10 builds the UBI package image published to ghcr.io/nginx/dependencies/nginx-ubi, consumed via the UBI10_PACKAGES_IMAGE build arg (pinned by digest in the Makefile). Built by build-ubi-dependency.yml on changes to that file, or locally with make ubi10-dependency-image-local (requires rhel_license).
build/dependencies/tracking.info.default is copied in as tracking.info to attribute the install to NIC before the Plus licence reporter initialises.

Image Variants

make all-images builds 25 variants. Three axes combine:

OS family: Debian 13 (trixie), Alpine 3.24, UBI 10 minimal
NGINX edition: OSS or Plus, plus optional NAP WAF v4 / WAF v5 / DoS and FIPS on Alpine
NGINX Agent version: v2 (default on NAP variants) or v3 (-agent suffixed stages)

OS	OSS	Plus	Plus+WAF	Plus+WAFv5	Plus+DoS	Plus+WAF+DoS	Plus+FIPS	Plus+WAF+FIPS	Plus+WAFv5+FIPS
Debian	yes	yes	yes	yes	yes	yes	-	-	-
Alpine	yes	yes	-	-	-	-	yes	yes	yes
UBI 10	yes	yes	yes	yes	yes	yes	-	-	-

Architecture: amd64 + arm64 for OSS and Plus. NAP variants are amd64 only.

Agent v2 vs v3 -- easy to miss

OSS and plain Plus images ship nginx-agent v3 only (AGENT_V3_VERSION).
NAP WAF stages exist in pairs: the unsuffixed stage pins AGENT_V2_VERSION, the -agent suffixed stage pins AGENT_V3_VERSION. For example debian-plus-nap (agent v2) and debian-plus-nap-agent (agent v3).
.github/data/matrix-images-nap.json builds both halves of each pair for WAF and WAF+DoS (nap_modules: waf and nap_modules: waf,dos). DoS-only (nap_modules: dos) builds on the standard plus-nap stages (debian-plus-nap and ubi-10-plus-nap), which conditionally install Agent v3 when NAP_MODULES=dos, publishing Agent v3 under standard tags without redundant -agent image variants.
Both the local Makefile targets (debian-image-dos-plus, ubi-image-dos-plus) and the CI matrix use plus-nap (debian-plus-nap, ubi-10-plus-nap) with Agent v3 for DoS-only images.
Python e2e tests distinguish the two agents with the agentv2 / agentv3 pytest markers.
Matrix row schema and the checklist for adding an image: docs/developer/image-matrices.md.

Makefile Image Targets

All targets call $(DOCKER_CMD) = docker build --platform linux/$(ARCH) --target $(TARGET) -f build/Dockerfile.

Target	BUILD_OS	NAP_MODULES	Agent
`debian-image`	`debian`	-	v3
`alpine-image`	`alpine`	-	v3
`ubi-image`	`ubi`	-	v3
`debian-image-plus`	`debian-plus`	-	v3
`alpine-image-plus`	`alpine-plus`	-	v3
`alpine-image-plus-fips`	`alpine-plus-fips`	-	v3
`ubi-image-plus`	`ubi-10-plus`	-	v3
`alpine-image-nap-plus-fips`	`alpine-plus-nap-fips`	`waf`	v2
`alpine-image-nap-plus-fips-agent`	`alpine-plus-nap-fips-agent`	`waf`	v3
`alpine-image-nap-v5-plus-fips`	`alpine-plus-nap-v5-fips`	`waf`	v2
`alpine-image-nap-v5-plus-fips-agent`	`alpine-plus-nap-v5-fips-agent`	`waf`	v3
`debian-image-nap-plus`	`debian-plus-nap`	`waf`	v2
`debian-image-nap-plus-agent`	`debian-plus-nap-agent`	`waf`	v3
`debian-image-nap-v5-plus`	`debian-plus-nap-v5`	`waf`	v2
`debian-image-nap-v5-plus-agent`	`debian-plus-nap-v5-agent`	`waf`	v3
`debian-image-dos-plus`	`debian-plus-nap`	`dos`	v3
`debian-image-nap-dos-plus`	`debian-plus-nap`	`waf,dos`	v2
`debian-image-nap-dos-plus-agent`	`debian-plus-nap-agent`	`waf,dos`	v3
`ubi-image-nap-plus`	`ubi-10-plus-nap`	`waf`	v2
`ubi-image-nap-plus-agent`	`ubi-10-plus-nap-agent`	`waf`	v3
`ubi-image-nap-v5-plus`	`ubi-10-plus-nap-v5`	`waf`	v2
`ubi-image-nap-v5-plus-agent`	`ubi-10-plus-nap-v5-agent`	`waf`	v3
`ubi-image-dos-plus`	`ubi-10-plus-nap`	`dos`	v3
`ubi-image-nap-dos-plus`	`ubi-10-plus-nap`	`waf,dos`	v2
`ubi-image-nap-dos-plus-agent`	`ubi-10-plus-nap-agent`	`waf,dos`	v3

Other targets: all-images (all 25, prunes the builder cache first), ubi10-dependency-image-local (UBI package image), push (docker push to PREFIX:TAG), patch-os (OS patches an existing image).

Plus images receive $(PLUS_ARGS): --secret id=nginx-repo.crt --secret id=nginx-repo.key plus NGINX_PLUS_VERSION and PLUS_PACKAGE_REPO.

TARGET Variable

make build accepts only local, container, download, goreleaser, debug and errors on anything else. The remaining stages are selected by CI or by make patch-os directly.

Target	Use Case
`local`	Default -- binary pre-built on host, copied in
`container`	Binary built inside Docker (multi-arch capable)
`goreleaser`	Binary from GoReleaser `dist/` (CI builds)
`debug`	Includes delve debugger
`debug-container`	Delve build with the binary compiled inside Docker
`download`	Extracts binary from a published Docker Hub image (`DOWNLOAD_TAG`, resolved by `hack/docker.sh`)
`aws`	AWS marketplace variant
`patched`	OS patches an existing image (`IMAGE_NAME`)
`local-prebuilt`, `goreleaser-prebuilt`, `aws-prebuilt`	Same as their counterparts but layered onto `PREBUILT_BASE_IMG` instead of rebuilding the OS stage

Key Build Args

Arg	Purpose	Source of truth
`BUILD_OS`	Base image stage	`Makefile` targets + Dockerfile stages
`IC_VERSION`	Ingress controller version	`.github/data/version.txt`
`NGINX_PLUS_VERSION`	NGINX Plus version	`Makefile`
`NGINX_OSS_VERSION`	NGINX OSS version	`Makefile`
`AGENT_V2_VERSION` / `AGENT_V3_VERSION`	nginx-agent version per variant	`Makefile`
`NAP_MODULES`	App Protect modules	Any of `waf`, `dos`, or `waf,dos`
`NAP_WAF_VERSION`, `NAP_WAF_COMMON_VERSION`, `NAP_WAF_PLUGIN_VERSION`, `NAP_WAF_IPI_VERSION`	NAP WAF package pins	`Makefile`
`UBI10_PACKAGES_IMAGE`	UBI package image, digest-pinned	`Makefile` (`ghcr.io/nginx/dependencies/nginx-ubi`)
`PREBUILT_BASE_IMG`	Base for `*-prebuilt` targets	GCR image ref (set by CI)
`IMAGE_NAME`	Image to patch for `TARGET=patched`	`make patch-os` / `patch-image.yml`
`DOWNLOAD_TAG`	Published tag for `TARGET=download`	`hack/docker.sh`
`OSS_PACKAGE_REPO`	Repo host for OSS packages	`Makefile` / CI inputs (defaults to packages.nginx.org)
`AGENT_PACKAGE_REPO`	Repo host for NGINX Agent packages	`Makefile` / CI inputs (defaults to packages.nginx.org)
`PLUS_PACKAGE_REPO`	Repo host for Plus packages	`Makefile` / CI inputs (defaults to pkgs.nginx.com)
`WAF_PACKAGE_REPO`	Repo host for F5 NAP WAF packages	`Makefile` / CI inputs (defaults to pkgs.nginx.com)
`DOS_PACKAGE_REPO`	Repo host for F5 NAP DoS packages	`Makefile` / CI inputs (defaults to pkgs.nginx.com)

Do not hard-code IC_VERSION, NGINX_*_VERSION, AGENT_*_VERSION or NAP_WAF_* values in this file or in other docs as they change every release. Always reference the Makefile variables or .github/data/version.txt.

Show full SKILL.md (379 more words)Show less

Build Scripts (`build/scripts/`)

Script	Purpose
`common.sh`	Sets up directories, copies NGINX templates (v1/v2), sets file permissions (101:0), runs `setcap` on nginx binaries
`agent.sh`	Configures nginx-agent ownership; creates NMS compiler symlinks for NAP v4
`nap-waf.sh`	Creates WAF directories (`/etc/nginx/waf/nac-policies`, `/opt/app_protect/`)
`nap-dos.sh`	Creates DoS directories (`/root/app_protect_dos`, `/shared/cores`)
`ubi-setup.sh`	UBI-specific: installs shadow-utils, creates nginx user/group (101:0)
`ubi-clean.sh`	UBI-specific: removes build-time packages, cleans dnf cache

patch-os.sh is not in this repo -- the nginx-files stage fetches it from nginx/k8s-common (files/patch-os.sh). Changes to it must be made in that repository.

Package repo definitions (*.repo, *.sources, 90pkgs-nginx) are likewise fetched in nginx-files from cs.nginx.com and nginx/k8s-common, then rewritten with sed to inject the version, the *_PACKAGE_REPO host override, and the k8s-ic-<IC_VERSION> user-agent used for usage attribution.

Key Conventions

All images run as UID 101 (nginx user), with setcap cap_net_bind_service for ports 80/443
Docker BuildKit always enabled: uses --mount=type=bind, --mount=type=secret, --mount=type=cache
Plus credentials use --secret mounts, never COPY into layers
OSS builds use optional --secret mounts (required=false) for nginx-repo.crt/nginx-repo.key to authenticate against non-default repo hosts like pkgs-test.nginx.com when running authenticated CI builds.
Fixed upstream base images use pinned @sha256: digests for reproducibility; some stages intentionally use build-arg/tag-selected bases (for example BUILD_OS, UBI10_PACKAGES_IMAGE, or download/prebuilt images)
FIPS variants build on ghcr.io/nginx/alpine-fips; UBI variants build on redhat/ubi10-minimal
All images include nginx-module-otel (OpenTelemetry) and nginx-agent (usage reporting)
Plus images add njs and fips-check modules
Renovate manages base image digests and tool versions via # renovate: comments

Gotchas

Never store Plus credentials in image layers -- always use --secret mounts
Never add arm64 to NAP image matrices -- NAP is amd64 only
Always use BUILD_OS to select variants, not separate Dockerfiles
Add or change NAP WAF stages in pairs. A new foo-nap stage needs a matching foo-nap-agent stage, a Makefile target, an entry in make all-images, and both entries in .github/data/matrix-images-nap.json. DoS-only is the exception -- it builds the standard plus-nap stages with NAP_MODULES=dos, which install Agent v3, and has no -agent twin.
The common stage unifies all variants -- changes there affect every image
common.sh detects Plus via BUILD_OS containing "plus" and creates OIDC directories
patch-os.sh lives in nginx/k8s-common, not build/scripts/ -- editing it here is impossible
UBI10_PACKAGES_IMAGE is digest-pinned in the Makefile; rebuilding build/dependencies/Dockerfile.ubi10 requires bumping that digest afterwards
When adding new image dependencies, update the relevant OS-specific stage AND the common stage if needed

Files

Just SKILL.md in .github/skills/nic-docker-images of nginx/kubernetes-ingress.

Open the folder on GitHubat commit 29a1a36

Compare with similar skills

NGINX Ingress Controller Image Builder next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

NGINX Ingress Controller Image Builder compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
NGINX Ingress Controller Image Builder this skillnginx/kubernetes-ingress	5.1k	—	~2.9k	Automated safety check: Pass	Apache-2.0	today
Senior DevOps Toolkitmaslennikov-ig/claude-code-orchestrator-kit	260	6 repos	~1.1k	Automated safety check: Notes	Custom licence	7 mo ago
LangBot Deployment Guidelangbot-app/LangBot	18k	—	~1.2k	Automated safety check: Notes	Apache-2.0	today
Build Openshell Mxc WindowsNVIDIA/OpenShell	16k	—	~4.9k	Automated safety check: Pass	Apache-2.0	today
Devopsnicepkg/auto-company	195	2 repos	~814	Automated safety check: Pass	MIT	8 mo ago
.NET Crash Dump Collectiondotnet/skills	5.6k	2 repos	~1.1k	Automated safety check: Pass	MIT	today

Similar skills

Senior DevOps Toolkit
maslennikov-ig/claude-code-orchestrator-kit
Comprehensive DevOps skill for CI/CD, infrastructure automation, containerization, and cloud platforms (AWS, GCP, Azure). Includes pipeline setup…
260 GitHub starsUsed in 6 repos~1.1k tokens
DevOps & CloudAuto-check: notes
LangBot Deployment Guide
langbot-app/LangBot
Deploys and configures a LangBot instance with Docker Compose or Kubernetes, covering config.yaml, the Box sandbox runtime, the plugin runtime and the global API key.
18k GitHub stars~1.2k tokensUpdated today
DevOps & CloudAuto-check: notes
Build Openshell Mxc Windows
NVIDIA/OpenShell
Official
Maintain and validate OpenShell's build-only Windows MSVC lane for x64 and ARM64.
16k GitHub stars~4.9k tokensUpdated today
DevOps & CloudAuto-check passed
Devops
nicepkg/auto-company
Deploy to Cloudflare (Workers, R2, D1), Docker, GCP (Cloud Run, GKE), Kubernetes (kubectl, Helm).
195 GitHub starsUsed in 2 repos~814 tokens
DevOps & CloudAuto-check passed
.NET Crash Dump Collection
dotnet/skills
Official
Configures automatic crash dumps or captures dumps from running processes for modern .NET apps on Linux, macOS and Windows, including Docker and Kubernetes.
5.6k GitHub starsUsed in 2 repos~1.1k tokens
DevOps & CloudAuto-check passed
Debug Openshell Cluster
NVIDIA/OpenShell
Official
Debug why an OpenShell gateway deployment is unhealthy, unreachable, or unable to create sandboxes.
16k GitHub stars~20k tokensUpdated today
DevOps & CloudAuto-check: notes

Questions about NGINX Ingress Controller Image Builder

What does NGINX Ingress Controller Image Builder do?

Explains the multi-stage Dockerfile, the 25 image variant combinations, and the Makefile targets for building NGINX Ingress Controller images. This skill describes a roughly 1100-line multi-stage Dockerfile where a BUILD_OS argument picks the base-image stage and a TARGET argument picks the final stage, plus supporting images built outside that Dockerfile, such as a UBI dependency image pinned by digest in the Makefile.

When should I use NGINX Ingress Controller Image Builder?

NGINX Ingress Controller Image Builder fits situations like: adding a new NGINX Ingress Controller image variant; debugging a failed image build; understanding which base image and NGINX edition a Dockerfile stage targets.

How do I install NGINX Ingress Controller Image Builder in Claude Code?

Run `npx skills add nginx/kubernetes-ingress --skill nic-docker-images -a claude-code`. Or copy the skill folder (.github/skills/nic-docker-images in nginx/kubernetes-ingress) into .claude/skills/nic-docker-images in your project. Claude Code loads it when a task matches its description.

How do I install NGINX Ingress Controller Image Builder in Codex?

Run `npx skills add nginx/kubernetes-ingress --skill nic-docker-images -a codex`. Or copy the skill folder (.github/skills/nic-docker-images in nginx/kubernetes-ingress) into .agents/skills/nic-docker-images in your project. Codex loads it when a task matches its description.

Can I use NGINX Ingress Controller Image Builder in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add nginx/kubernetes-ingress --skill nic-docker-images -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/nic-docker-images, .gemini/skills/nic-docker-images, .github/skills/nic-docker-images and .opencode/skills/nic-docker-images in your project.

What does NGINX Ingress Controller Image Builder need to run?

Going by SKILL.md and its folder, NGINX Ingress Controller Image Builder needs the command-line tools its instructions call (make and docker).

Does NGINX Ingress Controller Image Builder access the network?

SKILL.md contains no URLs. Its commands use docker, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is NGINX Ingress Controller Image Builder safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does NGINX Ingress Controller Image Builder use?

NGINX Ingress Controller Image Builder is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does NGINX Ingress Controller Image Builder use?

About 2.9k tokens (SKILL.md is roughly 12k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to NGINX Ingress Controller Image Builder?

Skills that share tags, products or a category with NGINX Ingress Controller Image Builder: Senior DevOps Toolkit (maslennikov-ig/claude-code-orchestrator-kit, 260 stars), LangBot Deployment Guide (langbot-app/LangBot, 18k stars), Build Openshell Mxc Windows (NVIDIA/OpenShell, 16k stars) and Devops (nicepkg/auto-company, 195 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains NGINX Ingress Controller Image Builder?

nginx (a GitHub organization) maintains it in nginx/kubernetes-ingress, which has 5,081 GitHub stars. The repository holds 9 skills in this directory. The repository was last updated on October 10, 2026.

Source: nginx/kubernetes-ingress on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install NGINX Ingress Controller Image Builder

Facts

At a glance

What it does

When your agent uses it

Example prompts

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

NIC Docker Image Build System

Dockerfile Architecture

Image Variants

Agent v2 vs v3 -- easy to miss

Makefile Image Targets

TARGET Variable

Key Build Args

Build Scripts (build/scripts/)

Key Conventions

Gotchas

Files

Compare with similar skills

Similar skills

More from nginx/kubernetes-ingress

Related

Questions about NGINX Ingress Controller Image Builder

Build Scripts (`build/scripts/`)