Verified (release-gate matrix)
This page covers the package installs (the nginx module). The gateway container is distro-independent: it runs on any Linux with Docker Engine (a plain docker run is enough; Compose is optional), so none of the tables below apply to it.
Before every release, the gate runs this on each distro below: with the nginx module, install → nginx -t pass → plugin load → daemon healthz=200 → challenge served (http=403), and a remove-and-reinstall. The nginx column is the version the gate ran, from the distro's own packages unless noted:
| distro | package | nginx (tested version) | status |
|---|
| AlmaLinux 10 / Rocky 10 / RHEL 10 | rpm | 1.26.3 | verified |
| AlmaLinux 9 / Rocky 9 / RHEL 9 | rpm | 1.20.1 | verified |
| AlmaLinux 8 / Rocky 8 / RHEL 8 | rpm | 1.24.0 (AppStream nginx:1.24 stream) | verified |
| CentOS 7 / RHEL 7 (EOL 2024-06) | rpm | 1.20.1 (EPEL) | verified |
| CentOS 6 / RHEL 6 (EOL 2020-11) | rpm | 1.18.0 (nginx.org) | verified |
| Debian 13 | deb | 1.26.3 | verified |
| Debian 12 | deb | 1.22.1 | verified |
| Ubuntu 26.04 | deb | 1.28.3 | verified |
| Ubuntu 24.04 | deb | 1.24.0 | verified |
| Ubuntu 22.04 | deb | 1.18.0 | verified |
| Alpine 3.x | apk | 1.28.3 (Alpine 3.23) | verified |
AlmaLinux / Rocky / RHEL 8: the default nginx module stream (1.14) is built without --with-compat and cannot load the module, so the gate first switches to the AppStream nginx:1.24 stream (dnf module reset nginx, then dnf module install nginx:1.24), as the install guide tells you to.
Same package format (install worth trying)
Derivatives that accept the same rpm / deb / apk packages will often install, but they are not in our CI, so the outcome isn't guaranteed. Reports either way are welcome on the
issue tracker:
| distro | format | notes |
|---|
| openSUSE Leap / Tumbleweed | rpm | Same package lineage. AppArmor (not SELinux) — confinement may need extra tuning. |
| Fedora | rpm | RHEL lineage. SELinux postinstall (setsebool automation) applies. |
| Linux Mint | deb | Ubuntu / Debian derivative. |
| Pop!_OS | deb | Ubuntu derivative. |
| Devuan | deb | Debian derivative without systemd. Ships sysvinit / openrc init scripts. |
| Raspbian / Raspberry Pi OS | deb (arm64) | Works on a 64-bit OS via the arm64 packages (the native plugin ships arm64 too). |
No packages yet
Distros below have no unmask package, so a package install won't work. Where Docker runs (Arch, Gentoo, NixOS, …), the gateway container is not affected by any of this:
| environment | reason |
|---|
| Arch Linux | pacman .pkg.tar.zst. No AUR package yet (contributors welcome). |
| Gentoo | portage ebuild. Same — no recipe yet. |
| NixOS | nix derivation. flake / nixpkgs entry is a future candidate. |
| FreeBSD / OpenBSD | pkg(8). The nginx ABI differs from Linux glibc; needs a separate build. |
| macOS | Not a production server target (docker run with a supported Linux image works for local dev). |
| Windows / WSL | nginx for Windows is ABI-incompatible. WSL distros work using the matching Linux instructions above. |
Architectures
unmask supports both x86_64 (amd64) and aarch64 (arm64). Every distro package (main / nginx plugin / web integration) is built for both, and verified on real Ampere arm64 hardware (the nginx module + JA4 extraction).