christianandClaude Opus 5.5
5c661a4805
Stopgap for the PHP RCE advisories GHSA-6wmf-4rv5-p3rp and GHSA-w8hw-w9fx-j79w (2026-10-21): disable session.upload_progress (and fatal_error_backtraces on PHP 8.5). Upload progress should stay off even after patched PHP is deployed. Bump the EOL Alpine base to 3.24 so php83 receives the 8.3.36 security release. Alpine 3.24 no longer ships /usr/bin/php for php83, so add the link. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
41 lines
1.5 KiB
Docker
Executable File
41 lines
1.5 KiB
Docker
Executable File
FROM alpine:3.24
|
|
|
|
# Install PHP and necessary extensions
|
|
RUN apk add --no-cache curl php84 php84-fpm php84-opcache caddy php84-curl php84-xdebug chromium-chromedriver
|
|
|
|
RUN sed -i 's/nobody/caddy/g' /etc/php84/php-fpm.d/www.conf
|
|
RUN sed -i 's/E_ALL \& ~E_DEPRECATED \& ~E_STRICT/E_ALL \& ~E_DEPRECATED \& ~E_STRICT \& ~E_NOTICE \& ~E_WARNING/g' /etc/php84/php.ini
|
|
# log php errors to /srv/logs/php_errors.log
|
|
RUN echo "error_log = /srv/logs/php_errors.log" >> /etc/php84/php.ini
|
|
|
|
# Install additional PHP extensions
|
|
RUN apk add --no-cache php84-ctype php84-dom php84-fileinfo php84-gd php84-iconv php84-simplexml php84-xml php84-xmlreader php84-xmlwriter php84-zip php84-phar php84-openssl
|
|
RUN curl -sS https://getcomposer.org/installer | /usr/bin/php84 -- --install-dir=/usr/bin --filename=composer
|
|
|
|
# add symlink for php
|
|
RUN ln -s /usr/bin/php84 /usr/bin/php
|
|
|
|
ADD docker/start.sh /start.sh
|
|
RUN chmod +x /start.sh
|
|
|
|
# Copy the contents of the web/ directory to /srv
|
|
ADD . /srv
|
|
|
|
# Cleanup
|
|
RUN rm -rf /srv/.git
|
|
RUN rm -rf /srv/.github
|
|
RUN rm -rf /srv/.vscode
|
|
|
|
|
|
# Copy the Caddyfile to the container
|
|
COPY docker/Caddyfile /etc/caddy/Caddyfile
|
|
|
|
# Security stopgap for GHSA-6wmf-4rv5-p3rp / GHSA-w8hw-w9fx-j79w (2026-10-21).
|
|
# Keep upload progress off even after patching; fatal_error_backtraces only exists in PHP 8.5+.
|
|
RUN for d in /usr/local/etc/php/conf.d /etc/php*/conf.d; do \
|
|
[ -d "$d" ] && printf 'session.upload_progress.enabled = 0\nfatal_error_backtraces = 0\n' > "$d/zz-security.ini"; \
|
|
done; true
|
|
|
|
# Run start script
|
|
CMD ["sh", "-c", "/start.sh"]
|