Skip to content

Commit 81971d2

Browse files
mistralozmistraloz
committed
Fix CI, CVEs
1 parent 2aebf23 commit 81971d2

21 files changed

+146
-84
lines changed

‎.github/workflows/workflow.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
php_version: ['8.4', '8.3','8.2','8.1']
1919
variant: ['apache','cli','fpm']
2020
# builder: [ {arch: "amd64", os: "ubuntu-latest"}, {arch: "arm64", os: "macos-latest"}]
21-
builder: [ {arch: "amd64", os: "ubuntu-latest"}, {arch: "arm64", os: "ubuntu-latest"}]
21+
builder: [ {arch: "amd64", os: "ubuntu-24.04"}, {arch: "arm64", os: "ubuntu-24.04"}]
2222
runs-on: ${{ matrix.builder.os }}
2323
name: Test ${{ matrix.php_version }}-${{ matrix.variant }} ${{ matrix.builder.arch }} only
2424
steps:
@@ -110,7 +110,7 @@ jobs:
110110
--set "*.output=type=registry" \
111111
php${PHP_VERSION//.}-${{ matrix.variant }}-all
112112
- name: Push artifacts
113-
uses: actions/upload-artifact@v3
113+
uses: actions/upload-artifact@v4
114114
with:
115115
name: ${{ matrix.php_version }}-${{ matrix.variant }}
116116
path: /tmp/tags.log

‎CHANGELOG.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# Change Log
2+
## Version 5
3+
4+
**2025-01-27**
5+
* Upgrade the base version from Ubuntu 20.04 to 24.04
6+
* Default blackfire version is now the version 2 (v1 is still available with BLACKFIRE_VERSION=1 at buildtime but with securities issues)
27

38
## Version 4
49

‎Dockerfile.apache

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"]
1414

1515
ARG TARGETOS
1616
ARG TARGETARCH
17-
ARG BLACKFIRE_VERSION=1
17+
ARG BLACKFIRE_VERSION=2
1818

1919
# |--------------------------------------------------------------------------
2020
# | Main PHP extensions

‎Dockerfile.apache.node

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
#syntax=docker/dockerfile-upstream:1
22
# DO NOT EDIT THIS FILE : Make yours changes in /utils/Dockerfile.*.blueprint)
3+
ARG PHP_VERSION="8.4"
4+
ARG GLOBAL_VERSION="v5"
35
ARG REPO="thecodingmachine/php"
46
ARG TAG_PREFIX=""
5-
ARG FROM_IMAGE="${REPO}:${TAG_PREFIX}:${PHP_VERSION}-${GLOBAL_VERSION}-apache"
7+
ARG FROM_IMAGE="${REPO}:${TAG_PREFIX}${PHP_VERSION}-${GLOBAL_VERSION}-apache"
68
FROM $FROM_IMAGE
79
LABEL authors="Julien Neuhart <[email protected]>, David Négrier <[email protected]>"
810
SHELL ["/bin/bash", "-o", "pipefail", "-c"]

‎Dockerfile.cli

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"]
1414

1515
ARG TARGETOS
1616
ARG TARGETARCH
17-
ARG BLACKFIRE_VERSION=1
17+
ARG BLACKFIRE_VERSION=2
1818

1919
# |--------------------------------------------------------------------------
2020
# | Main PHP extensions

‎Dockerfile.cli.node

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
#syntax=docker/dockerfile-upstream:1
22
# DO NOT EDIT THIS FILE : Make yours changes in /utils/Dockerfile.*.blueprint)
3+
ARG PHP_VERSION="8.4"
4+
ARG GLOBAL_VERSION="v5"
35
ARG REPO="thecodingmachine/php"
46
ARG TAG_PREFIX=""
5-
ARG FROM_IMAGE="${REPO}:${TAG_PREFIX}:${PHP_VERSION}-${GLOBAL_VERSION}-cli"
7+
ARG FROM_IMAGE="${REPO}:${TAG_PREFIX}${PHP_VERSION}-${GLOBAL_VERSION}-cli"
68
FROM $FROM_IMAGE
79
LABEL authors="Julien Neuhart <[email protected]>, David Négrier <[email protected]>"
810
SHELL ["/bin/bash", "-o", "pipefail", "-c"]

‎Dockerfile.fpm

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"]
1414

1515
ARG TARGETOS
1616
ARG TARGETARCH
17-
ARG BLACKFIRE_VERSION=1
17+
ARG BLACKFIRE_VERSION=2
1818

1919
# |--------------------------------------------------------------------------
2020
# | Main PHP extensions

‎Dockerfile.fpm.node

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
#syntax=docker/dockerfile-upstream:1
22
# DO NOT EDIT THIS FILE : Make yours changes in /utils/Dockerfile.*.blueprint)
3+
ARG PHP_VERSION="8.4"
4+
ARG GLOBAL_VERSION="v5"
35
ARG REPO="thecodingmachine/php"
46
ARG TAG_PREFIX=""
5-
ARG FROM_IMAGE="${REPO}:${TAG_PREFIX}:${PHP_VERSION}-${GLOBAL_VERSION}-fpm"
7+
ARG FROM_IMAGE="${REPO}:${TAG_PREFIX}${PHP_VERSION}-${GLOBAL_VERSION}-fpm"
68
FROM $FROM_IMAGE
79
LABEL authors="Julien Neuhart <[email protected]>, David Négrier <[email protected]>"
810
SHELL ["/bin/bash", "-o", "pipefail", "-c"]

‎Dockerfile.slim.apache

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
#syntax=docker/dockerfile-upstream:1
22
# DO NOT EDIT THIS FILE : Make yours changes in /utils/Dockerfile.*.blueprint)
3-
FROM ubuntu:24.04
3+
FROM ubuntu:24.04 as base1
44
LABEL authors="Julien Neuhart <[email protected]>, David Négrier <[email protected]>"
55
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
6+
FROM base1 as base
67

78
# Fixes some weird terminal issues such as broken clear / CTRL+L
89
#ENV TERM=linux
@@ -13,7 +14,7 @@ ENV DEBIAN_FRONTEND=noninteractive
1314
ARG PHP_VERSION
1415
ARG TARGETOS
1516
ARG TARGETARCH
16-
ARG BLACKFIRE_VERSION=1
17+
ARG BLACKFIRE_VERSION=2
1718
ONBUILD ARG TARGETOS=${TARGETOS}
1819
ONBUILD ARG TARGETARCH=${TARGETARCH}
1920
ONBUILD ARG BLACKFIRE_VERSION=${BLACKFIRE_VERSION}
@@ -32,26 +33,32 @@ ENV PHP_VERSION=${PHP_VERSION}
3233

3334
# Install php an other packages
3435
RUN apt update \
35-
&& apt install -y software-properties-common \
36+
&& apt upgrade -y \
37+
&& apt install -y software-properties-common --no-install-recommends \
3638
&& add-apt-repository ppa:ondrej/php \
39+
&& apt remove --purge -y software-properties-common \
40+
&& apt autoremove -y \
3741
&& apt install -y --no-install-recommends \
38-
git \
3942
nano \
4043
sudo \
44+
git \
4145
iproute2 \
42-
openssh-client \
4346
procps \
47+
curl \
4448
unzip \
4549
ca-certificates \
46-
curl \
50+
openssh-client \
51+
&& apt clean \
52+
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/share/doc/*
53+
RUN apt update \
54+
&& apt install -y --no-install-recommends \
4755
php${PHP_VERSION}-cli \
4856
php${PHP_VERSION}-curl \
4957
php${PHP_VERSION}-mbstring \
5058
php${PHP_VERSION}-opcache \
5159
php${PHP_VERSION}-readline \
5260
php${PHP_VERSION}-xml \
5361
php${PHP_VERSION}-zip \
54-
&& if [[ "${PHP_VERSION}" =~ ^7 ]]; then apt install -y --no-install-recommends php${PHP_VERSION}-json; fi \
5562
&& apt clean \
5663
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/share/doc/*
5764

@@ -403,3 +410,6 @@ ONBUILD RUN if [ -n "$NODE_VERSION" ]; then \
403410
sudo apt clean && \
404411
sudo rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/share/doc/*; \
405412
fi;
413+
414+
FROM base as step4
415+
FROM step4 as final

‎Dockerfile.slim.cli

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
#syntax=docker/dockerfile-upstream:1
22
# DO NOT EDIT THIS FILE : Make yours changes in /utils/Dockerfile.*.blueprint)
3-
FROM ubuntu:24.04
3+
FROM ubuntu:24.04 as base1
44
LABEL authors="Julien Neuhart <[email protected]>, David Négrier <[email protected]>"
55
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
6+
FROM base1 as base
67

78
# Fixes some weird terminal issues such as broken clear / CTRL+L
89
#ENV TERM=linux
@@ -13,7 +14,7 @@ ENV DEBIAN_FRONTEND=noninteractive
1314
ARG PHP_VERSION
1415
ARG TARGETOS
1516
ARG TARGETARCH
16-
ARG BLACKFIRE_VERSION=1
17+
ARG BLACKFIRE_VERSION=2
1718
ONBUILD ARG TARGETOS=${TARGETOS}
1819
ONBUILD ARG TARGETARCH=${TARGETARCH}
1920
ONBUILD ARG BLACKFIRE_VERSION=${BLACKFIRE_VERSION}
@@ -32,26 +33,32 @@ ENV PHP_VERSION=${PHP_VERSION}
3233

3334
# Install php an other packages
3435
RUN apt update \
35-
&& apt install -y software-properties-common \
36+
&& apt upgrade -y \
37+
&& apt install -y software-properties-common --no-install-recommends \
3638
&& add-apt-repository ppa:ondrej/php \
39+
&& apt remove --purge -y software-properties-common \
40+
&& apt autoremove -y \
3741
&& apt install -y --no-install-recommends \
38-
git \
3942
nano \
4043
sudo \
44+
git \
4145
iproute2 \
42-
openssh-client \
4346
procps \
47+
curl \
4448
unzip \
4549
ca-certificates \
46-
curl \
50+
openssh-client \
51+
&& apt clean \
52+
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/share/doc/*
53+
RUN apt update \
54+
&& apt install -y --no-install-recommends \
4755
php${PHP_VERSION}-cli \
4856
php${PHP_VERSION}-curl \
4957
php${PHP_VERSION}-mbstring \
5058
php${PHP_VERSION}-opcache \
5159
php${PHP_VERSION}-readline \
5260
php${PHP_VERSION}-xml \
5361
php${PHP_VERSION}-zip \
54-
&& if [[ "${PHP_VERSION}" =~ ^7 ]]; then apt install -y --no-install-recommends php${PHP_VERSION}-json; fi \
5562
&& apt clean \
5663
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/share/doc/*
5764

@@ -308,3 +315,6 @@ ONBUILD RUN if [ -n "$NODE_VERSION" ]; then \
308315
sudo apt clean && \
309316
sudo rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/share/doc/*; \
310317
fi;
318+
319+
FROM base as step4
320+
FROM step4 as final

‎Dockerfile.slim.fpm

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
#syntax=docker/dockerfile-upstream:1
22
# DO NOT EDIT THIS FILE : Make yours changes in /utils/Dockerfile.*.blueprint)
3-
FROM ubuntu:24.04
3+
FROM ubuntu:24.04 as base1
44
LABEL authors="Julien Neuhart <[email protected]>, David Négrier <[email protected]>"
55
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
6+
FROM base1 as base
67

78
# Fixes some weird terminal issues such as broken clear / CTRL+L
89
#ENV TERM=linux
@@ -13,7 +14,7 @@ ENV DEBIAN_FRONTEND=noninteractive
1314
ARG PHP_VERSION
1415
ARG TARGETOS
1516
ARG TARGETARCH
16-
ARG BLACKFIRE_VERSION=1
17+
ARG BLACKFIRE_VERSION=2
1718
ONBUILD ARG TARGETOS=${TARGETOS}
1819
ONBUILD ARG TARGETARCH=${TARGETARCH}
1920
ONBUILD ARG BLACKFIRE_VERSION=${BLACKFIRE_VERSION}
@@ -32,26 +33,32 @@ ENV PHP_VERSION=${PHP_VERSION}
3233

3334
# Install php an other packages
3435
RUN apt update \
35-
&& apt install -y software-properties-common \
36+
&& apt upgrade -y \
37+
&& apt install -y software-properties-common --no-install-recommends \
3638
&& add-apt-repository ppa:ondrej/php \
39+
&& apt remove --purge -y software-properties-common \
40+
&& apt autoremove -y \
3741
&& apt install -y --no-install-recommends \
38-
git \
3942
nano \
4043
sudo \
44+
git \
4145
iproute2 \
42-
openssh-client \
4346
procps \
47+
curl \
4448
unzip \
4549
ca-certificates \
46-
curl \
50+
openssh-client \
51+
&& apt clean \
52+
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/share/doc/*
53+
RUN apt update \
54+
&& apt install -y --no-install-recommends \
4755
php${PHP_VERSION}-cli \
4856
php${PHP_VERSION}-curl \
4957
php${PHP_VERSION}-mbstring \
5058
php${PHP_VERSION}-opcache \
5159
php${PHP_VERSION}-readline \
5260
php${PHP_VERSION}-xml \
5361
php${PHP_VERSION}-zip \
54-
&& if [[ "${PHP_VERSION}" =~ ^7 ]]; then apt install -y --no-install-recommends php${PHP_VERSION}-json; fi \
5562
&& apt clean \
5663
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/share/doc/*
5764

@@ -327,3 +334,6 @@ ONBUILD RUN if [ -n "$NODE_VERSION" ]; then \
327334
sudo apt clean && \
328335
sudo rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/share/doc/*; \
329336
fi;
337+
338+
FROM base as step4
339+
FROM step4 as final

‎MIGRATING.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ v5 is mostly fully compatible with v4, the main issue that may happen are relate
88
Important changes:
99
- v4 images are based on **Ubuntu 20.04**. v5 images are based on **Ubuntu 24.04**.
1010
- Removing of all unsupported version (not maintenance/security support : that is still possible to use the old tags/force manually the rebuild)
11+
- Default blackfire version is now the version 2
1112

1213
# Migrating from v3 to v4 images
1314

‎Makefile

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -69,21 +69,31 @@ clean: ## Clean dangles image after build
6969

7070
test-manual-build:
7171
docker build \
72-
--build-arg PHP_VERSION="8.4" \
73-
--build-arg VARIANT="cli" \
72+
--build-arg PHP_VERSION="8.3" \
73+
--build-arg VARIANT="apache" \
7474
--build-arg GLOBAL_VERSION="v5" \
75-
--file ./Dockerfile.slim.cli \
75+
--file ./Dockerfile.slim.apache \
7676
--tag testv5-slim \
7777
.
7878
docker --debug build \
79-
--build-arg PHP_VERSION="8.4" \
80-
--build-arg VARIANT="cli" \
79+
--build-arg PHP_VERSION="8.3" \
80+
--build-arg VARIANT="apache" \
8181
--build-arg GLOBAL_VERSION="v5" \
8282
--build-arg FROM_IMAGE="testv5-slim" \
83-
--file ./Dockerfile.cli \
83+
--file ./Dockerfile.apache \
8484
--tag testv5 \
8585
.
86-
# --target=base \
86+
docker --debug build \
87+
--build-arg PHP_VERSION="8.3" \
88+
--build-arg VARIANT="apache-node22" \
89+
--build-arg NODE_VERSION="22" \
90+
--build-arg GLOBAL_VERSION="v5" \
91+
--build-arg FROM_IMAGE="testv5" \
92+
--file ./Dockerfile.apache.node \
93+
--tag testv5-node \
94+
.
95+
docker scout cves testv5-node --only-fixed --locations
96+
#docker scout cves testv5-node --ignore-base --only-fixed --only-severity critical,high,medium,unspecified --locations
8797

8898
test-manual-exec:
8999
docker run --rm -it testv5 bash

0 commit comments

Comments
 (0)