u/meanmail_dev

nginx -t does exactly what it promises. The subtle failure mode is running a valid check against something other than the artifact that reaches production.

A pipeline can test repository files with the runner's Nginx package, then deploy an image with a different build, module set, filesystem layout, generated config, user, and network. The command is the same; the thing being tested is not.

These are the parity checks I find useful:

1. Binary fingerprint Capture nginx -V from the deployable image, not just the CI runner. Version numbers are not enough when configure arguments and dynamic modules differ.

2. Rendered configuration Run the test after the normal template or envsubst step. Testing the source template proves little if the deployed file is generated later. nginx -T is useful for confirming the final include graph, but its output should be treated as sensitive when rendered values contain credentials.

3. Runtime identity and filesystem Use the same UID, mounts, working prefix, read-only paths, certificates, and generated directories as the deployment. A permissive runner can hide restrictions that only exist in the container or host.

4. Network-dependent behavior A parser check is not a request test. Resolver behavior, service discovery, upstream failures, headers, redirects, and location selection still need representative traffic in a deployment-like network.

At minimum, I want these commands to run inside the built image after its normal rendering step:

nginx -V 2>&1
nginx -t -c /etc/nginx/nginx.conf

Disclosure: I build and maintain the Nginx Configuration plugins for JetBrains IDEs. They help with directive context, includes, references, and risky patterns while editing; this deployment boundary is deliberately outside what an IDE can prove.

I wrote up the wider validation loop here:

https://meanmail.dev/posts/validate-nginx-configuration?utm_source=reddit&utm_medium=community&utm_campaign=nginx_validation_2026q3&utm_content=deployment_parity_discussion

Do you validate the built image after rendering, or is nginx -t still running against repository files earlier in CI?