What is the difference between the core, full, extras and light packages for nginx?

nginx on Ubuntu is a virtual package provided by one of five packages from the official repositories (at least as of 14.04, defaulting to nginx-core, I believe):

$ apt-cache depends nginx | tail -n+2 | cut -d: -f 2 | sort -u
 nginx-core
 nginx-extras
 nginx-full
 nginx-light
 nginx-naxsi

What is the difference between these packages and what are the recommended use cases for them?

This somewhat old Debian Wiki page has a feature comparison between extras, full, light and naxsi, but no mention is made of core. How much of it has changed in 14.04?

^secondary As I understand it, nginx doesn't support runtime enabling of modules like Apache does, so would installing nginx-extras impact performance?

While Steven's answer touches on the key points and a very basic summary of what each flavor is, I'll give you a much larger description of the differences, as I work on the packaging quite a bit, and the very different sets of modules in each is absolutely critical to a good answer. The basic descriptions don't do much justice to the comparison. (Also, kudos to Steven quoting my older blog (and even referring to me as a 'maintainer'. I meant to port the nginx-is-coming-to-main post to my newer blog, but I haven't had the opportunity.)

Also note that the latest packages for the NGINX web server are available in the NGINX PPAs, maintained by myself, based almost entirely off of Debian. (Stable PPA (1.6.2 as of this post); Mainline PPA (1.7.7 as of this post, with 1.7.8 slated to land on December 4, 2014))

The Different Flavors of nginx:

The different flavors are all the same version of nginx, however the flavors were decided upon by the Debian package maintainers in order to provide different feature sets (for nginx-extras) as well as the bare minimum and the most feature-effective 'full' set of functions that web servers tend to have used in websites. The exact reason a feature was chosen over another is not known to me, however in supplementary discussion with one of the Debian maintainers on IRC, a statement was made affirming my initial assessment, that each variant was intended on being a different set of features for a different use case - light for a lightweight set of features that meets bare minimum of site hosting, full for a more full set of features without including any much-heavier extras, and extras for pretty much everything that is in the package that can be included in Ubuntu. naxsi, prior to 15.04, was the Naxsi variant specifically with only the bare minimum of modules in it, as naxsi could be fairly resource intensive.

Supposedly, according to one of the Debian maintainers of NGINX who is regularly coordinating with Upstream NGINX in a private conversation of which I cannot currently post logs, NGINX 2.x is going to have loadable module support. In which case, light, full, and extras will become metapackages which call upon the individual packages containing each module. The date this becomes the case is not known, however, nor is which modules will actually be capable of doing this.

As it currently stands, the nginx virtual package is designed to just install one of the available versions. By default, as nginx-core is in main and we would love if individuals used it more, nginx-core is the first item seen and install-attempted in the virtual package. (However, the nginx package can rely on any one of the flavors of nginx, and is mainly there to make installation a little bit easier for those who don't need any specific flavor preference)

A detailed breakdown with the specific modules available in each variant (based off of the Vivid debian/control file and the Trusty debian/control file (as the Naxsi packages have been removed in Vivid)) is available below. Note that this does not reflect the most up to date changes in Ubuntu, and you should refer to those package descriptions to make sure you have updated, accurate information:

• nginx-core is the only flavor in the Main section of the Ubuntu Repositories, as of 14.04, and exists only in the Ubuntu repositories (and is not in the PPAs or Debian, and is not going to be included in Debian ever). It is effectively identical to the nginx-full flavor, but does not contain any third party modules. The reasoning behind using nginx-full as the base for this variant was that we wanted to provide a relatively-full-fledged set of core modules in the built binaries, while keeping third party modules out at the same time. As such, it does not contain any of the third-party modules, since the Security Team did a review of the code and found that third party modules have widely varying coding styles which aren't as nicely supported as the nginx-tarball-included modules (this is discussed more in-depth in the Main Inclusion Request/Report bug, which contains the discussion points and further review discussions as to what could be included in Ubuntu Main for nginx). A full list of the modules enabled here is in the package description, which I've nitpicked here:

  STANDARD HTTP MODULES: Core, Access, Auth Basic, Auto Index, Browser, Charset, Empty GIF, FastCGI, Geo, Gzip, Headers, Index, Limit Requests, Limit Zone, Log, Map, Memcached, Proxy, Referer, Rewrite, SCGI, Split Clients, SSI, Upstream, User ID, UWSGI.

  OPTIONAL HTTP MODULES: Addition, Debug, GeoIP, Gzip Precompression, HTTP Sub, Image Filter, IPv6, Real IP, Spdy, SSL, Stub Status, Substitution, WebDAV, XSLT.

  MAIL MODULES: Mail Core, IMAP, POP3, SMTP, SSL.

• nginx-light is the lightest flavor of nginx available. It is in the Universe repository and you have to have that enabled to use it. It does not enable a large amount of the modules available in -core or -full. It also contains third-party modules. The modules available in it are as follows:

  STANDARD HTTP MODULES: Core, Access, Auth Basic, Auto Index, Charset, Empty GIF, FastCGI, Gzip, Headers, Index, Log, Map, Proxy, Rewrite, Upstream.

  OPTIONAL HTTP MODULES: Auth Request, Debug, Gzip Precompression, IPv6, Real Ip, SSL, Stub Status.

  THIRD PARTY MODULES: Echo.

• nginx-full is one of the more feature-rich flavors of the nginx package. Like its light counterpart, it is in the Universe repository. It enables most of the core included modules that are standard and optional in the from-nginx source tarball, as well as several more third-party modules designed to extend the capabilities of the nginx web server. It's modules are as follows:

  STANDARD HTTP MODULES: Core, Access, Auth Basic, Auto Index, Browser, Charset, Empty GIF, FastCGI, Geo, Gzip, Headers, Index, Limit Requests, Limit Zone, Log, Map, Memcached, Proxy, Referer, Rewrite, SCGI, Split Clients, SSI, Upstream, User ID, UWSGI.

  OPTIONAL HTTP MODULES: Addition, Auth Request, Debug, GeoIP, Gzip Precompression, HTTP Sub, Image Filter, IPv6, Real IP, Spdy, SSL, Stub Status, Substitution, WebDAV, XSLT.

  MAIL MODULES: Mail Core, IMAP, POP3, SMTP, SSL.

  THIRD PARTY MODULES: Auth PAM, DAV Ext, Echo, HTTP Substitution Filter, Upstream Fair Queue.

• nginx-extras is the most feature-rich flavor of the nginx package. And like its full and light brothers, it too is in the Universe repository. It enables all of the modules in nginx-full but also includes additional modules (such as the Perl module), and many more third-party modules designed to even further extend the capabilities of the nginx web server. Its full modules list is below:

  STANDARD HTTP MODULES: Core, Access, Auth Basic, Auto Index, Browser, Charset, Empty GIF, FastCGI, Geo, Gzip, Headers, Index, Limit Requests, Limit Zone, Log, Map, Memcached, Proxy, Referer, Rewrite, SCGI, Split Clients, SSI, Upstream, User ID, UWSGI.

  OPTIONAL HTTP MODULES: Addition, Auth Request, Debug, Embedded Perl, FLV, GeoIP, Gzip Precompression, Image Filter, IPv6, MP4, Random Index, Real IP, Secure Link, Spdy, SSL, Stub Status, Substitution, WebDAV, XSLT.

  MAIL MODULES: Mail Core, IMAP, POP3, SMTP, SSL.

  THIRD PARTY MODULES: Auth PAM, Chunkin, DAV Ext, Echo, Embedded Lua, Fancy Index, HttpHeadersMore, HTTP Substitution Filter, http push, Nginx Development Kit, Upload Progress, Upstream Fair Queue.

• nginx-naxsi is the variant of nginx which has the Naxsi Web Application Firewall module available. It too is in Universe, however this flavor is no longer supported by Debian maintainers, and will be completely dropped from Ubuntu with the 15.04 release. In addition to the Naxsi WAF module, it also includes a much lighter set of modules than nginx-full. The full list of modules is below:

  STANDARD HTTP MODULES: Core, Access, Auth Basic, Auto Index, Browser, Charset, Core, Empty GIF, FastCGI, Geo, Gzip, Headers, Index, Limit Requests, Limit Zone, Log, Map, Memcached, Proxy, Referer, Rewrite, Split Clients, SSI, Upstream, User ID.

  OPTIONAL HTTP MODULES: Debug, IPv6, Real IP, SSL, Stub Status.

  THIRD PARTY MODULES: Naxsi, Cache Purge, Upstream Fair.

Resource Usage Among the Flavors

While I am not aware of any benchmarks that have been run on the various flavors of nginx, it is typically logical to assume that the more feature-enabled the version of nginx you use, the more resources it would use.

However, unlike Apache which can be something of a memory whore with the more modules enabled, nginx still does not eat as much memory compared to Apache when modules are enabled. (The exception to this statement is the naxsi flavor. That flavor always eats a lot more resources, as it is a Web Application Firewall as well as a web server.)

I will add benchmarks to this answer if I find them, but again, I am not aware of any existing benchmarks for the various flavors against each other. And even though the sites I run don't have heavy traffic, I haven't noticed any real performance decrease between nginx-extras, nginx-full, or nginx-light on a PHP-driven site.

Here's a very high-level assessment, based mainly on the descriptions in the packages. (I'm going to fall short of delivering example use cases for each, but I figured this much out to satisfy my curiosity so I may as well contribute it.)

From smallest to largest:

nginx-light: "basic version"

The minimal set of modules for basic functionality.

nginx-naxsi: "version with naxsi"

The minimal set, plus the hardened "Nginx Anti Xss & Sql Injection" configuration and its required plugins.

nginx-core: "core version"

The standard nginx deployment, less the third-party modules.

This is the first Canonical-supported nginx package. It's in the Ubuntu "main" repository instead of the community-supported "universe" repository. See the announcement "nginx-core is now in Ubuntu Trusty 14.04 Main!" on an archive of the maintainer's unofficial (older and now defunct) blog or on the copy of the old post on the maintainer's unofficial blog:

none of the already-established flavors of nginx are included in Ubuntu Main (nginx-light, nginx-full, nginx-extras, and nginx-naxsi). The Ubuntu Security Team has said that the third-party modules are wildly different in coding and therefore cannot be supported.

To that end, we created a package called nginx-core which has been included in the Main repository. This package contains only the modules that ship with the stock nginx tarball. We do not include any third-party modules with this package, just the modules that come from NGINX upstream.

nginx-full: "standard version"

The standard nginx deployment, including frequently-used third-party modules.

nginx-extras: "extended version"

The standard nginx deployment plus several infrequently-used and largish modules.

I made some tables based on the descriptions from https://salsa.debian.org/nginx-team/nginx/-/blob/master/debian/control (which, as of writing, was last updated on June 30, 2020). Given that the tables and the descriptions they're based on are hand-generated, there might be mistakes.