shouldn't pcre_jit be enabled in the default image alpine and stable ?

[virtuman]

Documentation states that pcre_jit might significantly improve regex parsing, taken from here:
http://nginx.org/en/docs/ngx_core_module.html#pcre_jit

Enables or disables the use of “just-in-time compilation” (PCRE JIT) for the regular expressions known by the time of configuration parsing.

PCRE JIT can speed up processing of regular expressions significantly.

I see that there're some tickets that state that there was a vulnerability in the older versions of pcre on alpine, but current alpine:3.5 has a newer pcre available as default recent package, ie:

$ docker run -it --rm alpine /bin/sh
/ # apk update
fetch http://dl-cdn.alpinelinux.org/alpine/v3.5/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.5/community/x86_64/APKINDEX.tar.gz
v3.5.1-31-g83b3d6857a [http://dl-cdn.alpinelinux.org/alpine/v3.5/main]
v3.5.1-29-ga981b1f149 [http://dl-cdn.alpinelinux.org/alpine/v3.5/community]
OK: 7958 distinct packages available
/ # apk add pcre
(1/1) Installing pcre (8.39-r0)
OK: 4 MiB in 12 packages

Are there any limitations why the current image is built on top of alpine:3.4 and cannot be upgraded to be based off of 3.5?
And shouldn't then the default image be based on current version of alpine and be built with it enabled by default, ie --with-pcre-jit ?

[thresheek]

As we're not building PCRE in the official images,
--with-pcre-jit build PCRE with JIT compilation support
so this will not help.

If alpine's pcre is built with jit, it might work enabling pcre_jit on; in the nginx configuration.

See #136 re alpine:3.5.

[LeviPesin]

It seems from NGINX code that if NGINX is built with PCRE2 (I think it is the default now?) JIT is supported but still requires pcre_jit on; directive. So could it be added now?

[thresheek]

Hi @LeviPesin, the binaries we ship in those images indeed are built with PCRE2. So it's safe for anyone to use 'pcre_jit on;' in their configuration files. We don't need to add anything build-wise.

[slavdok]

It seems from NGINX code that if NGINX is built with PCRE2 (I think it is the default now?) JIT is supported but still requires pcre_jit on; directive. So could it be added now?

Will there be anything special in the logs when pcre_jit on is enabled? Or conversely, would it fail to start, or put something into logs of pcre_jit is not supported?

I've put it to on, nginx starts and runs without any mention of pcre_jit, but I can't tell if it's working or if I need a different image