nginx on Ubuntu is a virtual package provided by one of five packages from the official repositories (at least as of 14.04, defaulting to nginx-core, I believe):

$ apt-cache depends nginx | tail -n+2 | cut -d: -f 2 | sort -u
 nginx-core
 nginx-extras
 nginx-full
 nginx-light
 nginx-naxsi

What is the difference between these packages and what are the recommended use cases for them?

This somewhat old Debian Wiki page has a feature comparison between extras, full, light and naxsi, but no mention is made of core. How much of it has changed in 14.04?


secondary As I understand it, nginx doesn't support runtime enabling of modules like Apache does, so would installing nginx-extras impact performance?

  • 1
    Someone seems to have done a more recent version of the feature comparison chart and shared it on Google docs: docs.google.com/spreadsheet/… – Steven K Dec 3 '14 at 23:36
  • 1
    @StevenKath make a note that THAT document is solely based on Debian. It does not touch upon nginx-core, and does not include the Unstable changes which remove the naxsi flavor (because it is not trivial to maintain). – Thomas Ward Dec 4 '14 at 0:28
up vote 83 down vote accepted
+100

While Steven's answer touches on the key points and a very basic summary of what each flavor is, I'll give you a much larger description of the differences, as I work on the packaging quite a bit, and the very different sets of modules in each is absolutely critical to a good answer. The basic descriptions don't do much justice to the comparison. (Also, kudos to Steven quoting my older blog (and even referring to me as a 'maintainer'. I meant to port the nginx-is-coming-to-main post to my newer blog, but I haven't had the opportunity.)

Also note that the latest packages for the NGINX web server are available in the NGINX PPAs, maintained by myself, based almost entirely off of Debian. (Stable PPA (1.6.2 as of this post); Mainline PPA (1.7.7 as of this post, with 1.7.8 slated to land on December 4, 2014))


The Different Flavors of nginx:

The different flavors are all the same version of nginx, however the flavors were decided upon by the Debian package maintainers in order to provide different feature sets (for nginx-extras) as well as the bare minimum and the most feature-effective 'full' set of functions that web servers tend to have used in websites. The exact reason a feature was chosen over another is not known to me, however in supplementary discussion with one of the Debian maintainers on IRC, a statement was made affirming my initial assessment, that each variant was intended on being a different set of features for a different use case - light for a lightweight set of features that meets bare minimum of site hosting, full for a more full set of features without including any much-heavier extras, and extras for pretty much everything that is in the package that can be included in Ubuntu. naxsi, prior to 15.04, was the Naxsi variant specifically with only the bare minimum of modules in it, as naxsi could be fairly resource intensive.

Supposedly, according to one of the Debian maintainers of NGINX who is regularly coordinating with Upstream NGINX in a private conversation of which I cannot currently post logs, NGINX 2.x is going to have loadable module support. In which case, light, full, and extras will become metapackages which call upon the individual packages containing each module. The date this becomes the case is not known, however, nor is which modules will actually be capable of doing this.

As it currently stands, the nginx virtual package is designed to just install one of the available versions. By default, as nginx-core is in main and we would love if individuals used it more, nginx-core is the first item seen and install-attempted in the virtual package. (However, the nginx package can rely on any one of the flavors of nginx, and is mainly there to make installation a little bit easier for those who don't need any specific flavor preference)

A detailed breakdown with the specific modules available in each variant (based off of the Vivid debian/control file and the Trusty debian/control file (as the Naxsi packages have been removed in Vivid)) is available below. Note that this does not reflect the most up to date changes in Ubuntu, and you should refer to those package descriptions to make sure you have updated, accurate information:

  • nginx-core is the only flavor in the Main section of the Ubuntu Repositories, as of 14.04, and exists only in the Ubuntu repositories (and is not in the PPAs or Debian, and is not going to be included in Debian ever). It is effectively identical to the nginx-full flavor, but does not contain any third party modules. The reasoning behind using nginx-full as the base for this variant was that we wanted to provide a relatively-full-fledged set of core modules in the built binaries, while keeping third party modules out at the same time. As such, it does not contain any of the third-party modules, since the Security Team did a review of the code and found that third party modules have widely varying coding styles which aren't as nicely supported as the nginx-tarball-included modules (this is discussed more in-depth in the Main Inclusion Request/Report bug, which contains the discussion points and further review discussions as to what could be included in Ubuntu Main for nginx). A full list of the modules enabled here is in the package description, which I've nitpicked here:

    STANDARD HTTP MODULES: Core, Access, Auth Basic, Auto Index, Browser, Charset, Empty GIF, FastCGI, Geo, Gzip, Headers, Index, Limit Requests, Limit Zone, Log, Map, Memcached, Proxy, Referer, Rewrite, SCGI, Split Clients, SSI, Upstream, User ID, UWSGI.

    OPTIONAL HTTP MODULES: Addition, Debug, GeoIP, Gzip Precompression, HTTP Sub, Image Filter, IPv6, Real IP, Spdy, SSL, Stub Status, Substitution, WebDAV, XSLT.

    MAIL MODULES: Mail Core, IMAP, POP3, SMTP, SSL.

  • nginx-light is the lightest flavor of nginx available. It is in the Universe repository and you have to have that enabled to use it. It does not enable a large amount of the modules available in -core or -full. It also contains third-party modules. The modules available in it are as follows:

    STANDARD HTTP MODULES: Core, Access, Auth Basic, Auto Index, Charset, Empty GIF, FastCGI, Gzip, Headers, Index, Log, Map, Proxy, Rewrite, Upstream.

    OPTIONAL HTTP MODULES: Auth Request, Debug, Gzip Precompression, IPv6, Real Ip, SSL, Stub Status.

    THIRD PARTY MODULES: Echo.

  • nginx-full is one of the more feature-rich flavors of the nginx package. Like its light counterpart, it is in the Universe repository. It enables most of the core included modules that are standard and optional in the from-nginx source tarball, as well as several more third-party modules designed to extend the capabilities of the nginx web server. It's modules are as follows:

    STANDARD HTTP MODULES: Core, Access, Auth Basic, Auto Index, Browser, Charset, Empty GIF, FastCGI, Geo, Gzip, Headers, Index, Limit Requests, Limit Zone, Log, Map, Memcached, Proxy, Referer, Rewrite, SCGI, Split Clients, SSI, Upstream, User ID, UWSGI.

    OPTIONAL HTTP MODULES: Addition, Auth Request, Debug, GeoIP, Gzip Precompression, HTTP Sub, Image Filter, IPv6, Real IP, Spdy, SSL, Stub Status, Substitution, WebDAV, XSLT.

    MAIL MODULES: Mail Core, IMAP, POP3, SMTP, SSL.

    THIRD PARTY MODULES: Auth PAM, DAV Ext, Echo, HTTP Substitution Filter, Upstream Fair Queue.

  • nginx-extras is the most feature-rich flavor of the nginx package. And like its full and light brothers, it too is in the Universe repository. It enables all of the modules in nginx-full but also includes additional modules (such as the Perl module), and many more third-party modules designed to even further extend the capabilities of the nginx web server. Its full modules list is below:

    STANDARD HTTP MODULES: Core, Access, Auth Basic, Auto Index, Browser, Charset, Empty GIF, FastCGI, Geo, Gzip, Headers, Index, Limit Requests, Limit Zone, Log, Map, Memcached, Proxy, Referer, Rewrite, SCGI, Split Clients, SSI, Upstream, User ID, UWSGI.

    OPTIONAL HTTP MODULES: Addition, Auth Request, Debug, Embedded Perl, FLV, GeoIP, Gzip Precompression, Image Filter, IPv6, MP4, Random Index, Real IP, Secure Link, Spdy, SSL, Stub Status, Substitution, WebDAV, XSLT.

    MAIL MODULES: Mail Core, IMAP, POP3, SMTP, SSL.

    THIRD PARTY MODULES: Auth PAM, Chunkin, DAV Ext, Echo, Embedded Lua, Fancy Index, HttpHeadersMore, HTTP Substitution Filter, http push, Nginx Development Kit, Upload Progress, Upstream Fair Queue.

  • nginx-naxsi is the variant of nginx which has the Naxsi Web Application Firewall module available. It too is in Universe, however this flavor is no longer supported by Debian maintainers, and will be completely dropped from Ubuntu with the 15.04 release. In addition to the Naxsi WAF module, it also includes a much lighter set of modules than nginx-full. The full list of modules is below:

    STANDARD HTTP MODULES: Core, Access, Auth Basic, Auto Index, Browser, Charset, Core, Empty GIF, FastCGI, Geo, Gzip, Headers, Index, Limit Requests, Limit Zone, Log, Map, Memcached, Proxy, Referer, Rewrite, Split Clients, SSI, Upstream, User ID.

    OPTIONAL HTTP MODULES: Debug, IPv6, Real IP, SSL, Stub Status.

    THIRD PARTY MODULES: Naxsi, Cache Purge, Upstream Fair.


Resource Usage Among the Flavors

While I am not aware of any benchmarks that have been run on the various flavors of nginx, it is typically logical to assume that the more feature-enabled the version of nginx you use, the more resources it would use.

However, unlike Apache which can be something of a memory whore with the more modules enabled, nginx still does not eat as much memory compared to Apache when modules are enabled. (The exception to this statement is the naxsi flavor. That flavor always eats a lot more resources, as it is a Web Application Firewall as well as a web server.)

I will add benchmarks to this answer if I find them, but again, I am not aware of any existing benchmarks for the various flavors against each other. And even though the sites I run don't have heavy traffic, I haven't noticed any real performance decrease between nginx-extras, nginx-full, or nginx-light on a PHP-driven site.

  • Canonical indeed. This whole question began when I saw this line in my error.log after I installed nginx-extra: [info] 19936#0: Using 32768KiB of shared memory for push module in /etc/nginx/nginx.conf. It's shared and not RSS, but still made me wonder. Hence the performance doubts, but that's secondary. – muru Dec 4 '14 at 0:33
  • 2
    @muru the push module is well known for using a good bit of shared memory. To my knowledge (and I may be slightly wrong on this), that shared memory is used across all the sites on the web server where the push module might be used. However, that module is a third-party module, so any real issues with it should be directed towards their maintainers :) – Thomas Ward Dec 4 '14 at 0:34
  • 1
    Nah, no issues. Do any of the newer versions from your PPA get into backports? And since they are presumably built from the same source, a patch applied by the Security team to nginx-core would also be available to -full and -extra, right? – muru Dec 4 '14 at 0:38
  • 3
    @muru Unfortunately, the packaging in the versions in the PPAs are done separately from Ubuntu. Currently, it gets very tricky to backport the package to older releases - it ultimately is done in the PPA because I don't have to mess with merging Debian changes into the Ubuntu changes. Since the Main Inclusion, I have not investigated backporting, because there would be a lot of changes that would have to be dropped to match what's available in older releases. (and the naxsi package drops make backporting 15.04 versions impossible now). – Thomas Ward Dec 4 '14 at 0:49
  • 2
    @muru And yes, any patches applied as security updates (or as standard release updates) in 14.04 and later will apply to nginx-core as well as the other flavors of nginx available in that repository, as they all draw on the same code base. They just have different ./configure lines to enable or disable different modules. – Thomas Ward Dec 4 '14 at 0:50

Here's a very high-level assessment, based mainly on the descriptions in the packages. (I'm going to fall short of delivering example use cases for each, but I figured this much out to satisfy my curiosity so I may as well contribute it.)

From smallest to largest:

nginx-light: "basic version"

The minimal set of modules for basic functionality.

nginx-naxsi: "version with naxsi"

The minimal set, plus the hardened "Nginx Anti Xss & Sql Injection" configuration and its required plugins.

nginx-core: "core version"

The standard nginx deployment, less the third-party modules.

This is the first Canonical-supported nginx package. It's in the Ubuntu "main" repository instead of the community-supported "universe" repository. See the announcement "nginx-core is now in Ubuntu Trusty 14.04 Main!" on an archive of the maintainer's unofficial (older and now defunct) blog or on the copy of the old post on the maintainer's unofficial blog:

none of the already-established flavors of nginx are included in Ubuntu Main (nginx-light, nginx-full, nginx-extras, and nginx-naxsi). The Ubuntu Security Team has said that the third-party modules are wildly different in coding and therefore cannot be supported.

To that end, we created a package called nginx-core which has been included in the Main repository. This package contains only the modules that ship with the stock nginx tarball. We do not include any third-party modules with this package, just the modules that come from NGINX upstream.

nginx-full: "standard version"

The standard nginx deployment, including frequently-used third-party modules.

nginx-extras: "extended version"

The standard nginx deployment plus several infrequently-used and largish modules.

  • So if I have core, the naxsi part is covered, right? The third party/first-party distinction is enough to explain the package split, so I suppose a use-case answer would require Server Fault-level expertise. – muru Dec 3 '14 at 23:31
  • 1
    One thing: as I understand it, nginx doesn't support enabling modules like Apache does, so would installing nginx-extras might impact performance? – muru Dec 3 '14 at 23:32
  • 1
    naxsi is only included in -naxsi and -extras, not -core or -full. Using -extras will probably have performance impacts, certainly more memory consumption than a lighter package. – Steven K Dec 3 '14 at 23:46
  • 2
    This is out of date. I'll post a more complete statement on this, as I have a lot of influence with regard to the nginx package. – Thomas Ward Dec 4 '14 at 0:01
  • 1
    @StevenKath Yeppers, and I even touched on that point on my answer. I had to take the previous blog offline because of Wordpress being an evil piece of framework, but the point still stands. I'm far from the 'official maintainer' in Ubuntu, but I probably do the most maintenance on the package and am probably considered the 'unofficial maintainer'. – Thomas Ward Dec 4 '14 at 0:29

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.