shadowdaoandClaude Opus 5.5
71ca114529
cac-litespeed and cac-lsphp start FROM litespeedtech/openlitespeed:1.8.4-lsphpNN, which ships lsphp85 8.5.0 / lsphp84 8.4.15 (built 2025-12). lsphp only moved forward as a side effect of installing lsphpNN-ldap. lsphp-apt-upgrade.sh now sweeps every installed lsphpNN* package (and OS packages) to the repo's current release on every build and fails the build if the repo is unreachable or the result doesn't match what CI resolved from the repo index. CI passes a per-run CACHE_BUST so the upgrade layer is never a cache hit, and images carry org.whp.php-version / org.whp.lsphp-package-version labels. Tested on .148 (2026-10-21): cac-lsphp php85/php84 and cac-litespeed php85 built from this branch report the same PHP (8.5.11 / 8.4.26), identical module lists and OLS 1.8.4 as the current registry images; with the hardening flags each serves/runs PHP as the customer uid, restarts, and stops cleanly (exit 0). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
57 lines
2.4 KiB
Docker
57 lines
2.4 KiB
Docker
FROM almalinux/10-base
|
|
ARG PHPVER=83
|
|
# Per-CI-run value: the first RUN below (dnf update) and everything after it can
|
|
# never be a layer-cache hit, so every build gets the repos' current packages.
|
|
# Local builds: --build-arg CACHE_BUST=$(date +%s) or --no-cache.
|
|
ARG CACHE_BUST=
|
|
|
|
# Install repos, update, install only needed packages, clean up in one layer
|
|
RUN dnf install -y \
|
|
https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm \
|
|
https://rpms.remirepo.net/enterprise/remi-release-10.rpm && \
|
|
dnf update -y && \
|
|
dnf install -y httpd mod_ssl openssl wget procps cronie iproute postgresql-devel microdnf less git \
|
|
nano rsync unzip zip mariadb bind-utils jq patch nc tree dos2unix && \
|
|
dnf clean all && \
|
|
rm -rf /var/cache/dnf /usr/share/doc /usr/share/man /usr/share/locale/*
|
|
|
|
# Copy scripts into the image and set permissions
|
|
COPY ./scripts/ /scripts/
|
|
RUN chmod +x /scripts/*
|
|
|
|
# Install ImageMagick from EPEL with HEIC/HEIF/AVIF support
|
|
RUN dnf install -y ImageMagick ImageMagick-libs ImageMagick-heic && \
|
|
dnf clean all
|
|
|
|
# Generate self-signed cert, create needed dirs, install PHP, clean up
|
|
RUN openssl req -newkey rsa:2048 -nodes -keyout /etc/pki/tls/private/localhost.key -x509 -days 3650 -subj "/CN=localhost" -out /etc/pki/tls/certs/localhost.crt && \
|
|
mkdir -p /run/php-fpm/ && \
|
|
/scripts/install-php$PHPVER.sh && \
|
|
echo "PHP version report:" && php -v && rpm -q php-cli php-common php-fpm && \
|
|
rm -rf /tmp/*
|
|
|
|
# Download and install wp-cli (consider pinning version for reproducibility)
|
|
RUN curl -L -o /usr/local/bin/wp https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar && \
|
|
chmod +x /usr/local/bin/wp
|
|
|
|
# Download and install Composer
|
|
RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer && \
|
|
chmod +x /usr/local/bin/composer
|
|
|
|
# Copy configs and web files
|
|
COPY ./configs/default-index.conf /etc/httpd/conf.d/
|
|
COPY ./configs/prod-php.ini /etc/php.ini
|
|
COPY ./configs/phpinfo.php /var/www/html/
|
|
COPY ./configs/mariadb.repo /etc/yum.repos.d/
|
|
COPY ./configs/index.php /var/www/html/
|
|
COPY ./configs/remote_ip.conf /etc/httpd/conf.d/
|
|
COPY ./configs/whp-security.conf /etc/httpd/conf.d/
|
|
|
|
# Set up cron job in a single layer
|
|
RUN echo "15 */12 * * * root /scripts/log-rotate.sh" >> /etc/crontab
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
|
|
CMD curl -f http://localhost/ || exit 1
|
|
|
|
ENTRYPOINT [ "/scripts/entrypoint.sh" ]
|