shadowdaoandClaude Opus 5.5
b2bec5b3ee
Adds scripts/pkg-cache-repos.sh and wires it into Dockerfile, Dockerfile.fpm, Dockerfile.shared-httpd and Dockerfile.shared-ols. With --build-arg PKG_CACHE=http://192.168.1.40 (CT130 pkg-cache), dnf/apt go through the LAN cache. That cache fetches from the Remi/EPEL/AlmaLinux/ Ubuntu/LiteSpeed origins over HTTPS, with fallback tiers and stale-on-error. Without the arg the script is a no-op and builds are unchanged. - rpm: each baseurl becomes "<cache>/<prefix>/... <origin>/...", so dnf fails over to the origin if the cache dies mid-build - every RUN restores the original repo files before it ends, so no shipped layer carries the LAN address - EPEL/Remi release RPMs come from the cache when it is set - the php.net version gates are untouched Dockerfile.litespeed/.lsphp are not wired yet (see docs/pkg-cache.md). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
83 lines
4.2 KiB
Docker
83 lines
4.2 KiB
Docker
FROM almalinux/10-base
|
|
ARG PHPVER=83
|
|
# Per-CI-run value: the first RUN below (dnf update) and everything after it can
|
|
# never be a layer-cache hit, so every build gets the repos' current packages.
|
|
# Local builds: --build-arg CACHE_BUST=$(date +%s) or --no-cache.
|
|
ARG CACHE_BUST=
|
|
# php.net's current release for this branch (CI); the build fails on older PHP.
|
|
ARG EXPECT_PHP_MIN=
|
|
|
|
# OPTIONAL internal package cache, e.g. --build-arg PKG_CACHE=http://192.168.1.40
|
|
# (CT130 pkg-cache). Unset = upstream repositories exactly as before. Repo files
|
|
# are restored at the end of every RUN, so no layer keeps the cache address.
|
|
# See scripts/pkg-cache-repos.sh.
|
|
ARG PKG_CACHE=
|
|
COPY ./scripts/pkg-cache-repos.sh /usr/local/sbin/pkg-cache-repos.sh
|
|
# Install repos, update, install only needed packages (no httpd/mod_ssl), clean up in one layer
|
|
RUN /usr/local/sbin/pkg-cache-repos.sh rpm && \
|
|
dnf install -y $(/usr/local/sbin/pkg-cache-repos.sh release-urls) && \
|
|
# Use Remi's origin, not the mirrorlist: during the 2026-10-21 PHP security
|
|
# release the mirrors lagged hours behind (still 8.2.34 when 8.2.35 was out),
|
|
# so builds shipped unpatched PHP. HTTPS first; plain http only as a fallback
|
|
# because the origin's HTTPS dropped/timed out under that day's load. A
|
|
# replayed (old) http index can't ship old PHP: packages stay GPG-checked and
|
|
# the EXPECT_PHP_MIN gate below fails the build on anything older than php.net.
|
|
sed -i -e 's|^#baseurl=http://\(.*\)$|baseurl=https://\1 http://\1|' -e 's/^mirrorlist=/#mirrorlist=/' /etc/yum.repos.d/remi*.repo && \
|
|
/usr/local/sbin/pkg-cache-repos.sh rpm && \
|
|
printf 'retries=10\ntimeout=60\n' >> /etc/dnf/dnf.conf && \
|
|
dnf update -y && \
|
|
dnf install -y openssl wget procps cronie iproute postgresql-devel microdnf less git \
|
|
nano rsync unzip zip mariadb bind-utils jq patch nc tree dos2unix fcgi && \
|
|
/usr/local/sbin/pkg-cache-repos.sh restore && \
|
|
dnf clean all && \
|
|
rm -rf /var/cache/dnf /usr/share/doc /usr/share/man /usr/share/locale/*
|
|
|
|
# Copy scripts into the image and set permissions
|
|
COPY ./scripts/ /scripts/
|
|
RUN chmod +x /scripts/*
|
|
|
|
# Install ImageMagick from EPEL with HEIC/HEIF/AVIF support
|
|
RUN /usr/local/sbin/pkg-cache-repos.sh rpm && \
|
|
dnf install -y ImageMagick ImageMagick-libs ImageMagick-heic && \
|
|
/usr/local/sbin/pkg-cache-repos.sh restore && \
|
|
dnf clean all
|
|
|
|
# Create needed dirs, install PHP, clean up (no SSL cert, no httpd)
|
|
RUN mkdir -p /run/php-fpm/ && \
|
|
/usr/local/sbin/pkg-cache-repos.sh rpm && \
|
|
/scripts/install-php$PHPVER.sh && \
|
|
/usr/local/sbin/pkg-cache-repos.sh restore && \
|
|
# CI passes php.net's current release for the branch; never ship older PHP.
|
|
if [ -n "$EXPECT_PHP_MIN" ]; then \
|
|
php -r 'exit(version_compare(PHP_VERSION, getenv("EXPECT_PHP_MIN"), ">=") ? 0 : 1);' || \
|
|
{ echo "FATAL: built PHP $(php -r 'echo PHP_VERSION;') is older than php.net $EXPECT_PHP_MIN"; exit 1; }; \
|
|
else echo "WARNING: no EXPECT_PHP_MIN (local build) - PHP version not gated"; fi && \
|
|
echo "PHP version report:" && php -v && rpm -q php-cli php-common php-fpm && \
|
|
rm -rf /tmp/*
|
|
|
|
# Download and install wp-cli
|
|
RUN curl -L -o /usr/local/bin/wp https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar && \
|
|
chmod +x /usr/local/bin/wp
|
|
|
|
# Download and install Composer
|
|
RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer && \
|
|
chmod +x /usr/local/bin/composer
|
|
|
|
# Copy configs (PHP only, no Apache configs)
|
|
COPY ./configs/prod-php.ini /etc/php.ini
|
|
# php2shell mitigation (CVE-2026-109618/-109619). Named zz- so it sorts after
|
|
# every other scan-dir ini (incl. runtime-written 99-*) and wins. Remove once
|
|
# all images ship PHP >= 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12.
|
|
COPY ./configs/zz-php2shell-mitigation.ini /etc/php.d/zz-php2shell-mitigation.ini
|
|
COPY ./configs/mariadb.repo /etc/yum.repos.d/
|
|
|
|
# Set up cron job for log rotation
|
|
RUN echo "15 */12 * * * root /scripts/log-rotate.sh" >> /etc/crontab
|
|
|
|
EXPOSE 9000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
|
|
CMD SCRIPT_FILENAME=/fpm-ping SCRIPT_NAME=/fpm-ping REQUEST_METHOD=GET cgi-fcgi -bind -connect 127.0.0.1:9000 | grep -q pong || exit 1
|
|
|
|
ENTRYPOINT [ "/scripts/entrypoint-fpm.sh" ]
|