Skip to content

Commit 1452f9e

Browse files
USA-RedDragonUSA-RedDragon
committed
rootless php
1 parent b7674f2 commit 1452f9e

5 files changed

Lines changed: 177 additions & 6 deletions

File tree

‎.github/workflows/docker.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,22 @@ jobs:
4040
# {{major}}-base
4141
type=semver,enable=${{ matrix.composer_version == '2' && (matrix.latest_major == 'true' || matrix.latest == 'true') }},pattern={{major}},suffix=-base,value=${{ matrix.php_version }}.0
4242
43+
- name: Docker meta (base-rootless)
44+
id: meta-base-rootless
45+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
46+
with:
47+
images: |
48+
clevyr/php
49+
ghcr.io/clevyr/php
50+
flavor: latest=false
51+
tags: |
52+
# {{major}}.{{minor}}-composer{{major}}-base-rootless
53+
type=semver,pattern={{major}}.{{minor}},suffix=-composer${{ matrix.composer_version }}-base,value=${{ matrix.php_version }}.0
54+
# {{major}}.{{minor}}-base-rootless
55+
type=semver,enable=${{ matrix.composer_version == '2' }},pattern={{major}}.{{minor}},suffix=-base-rootless,value=${{ matrix.php_version }}.0
56+
# {{major}}-base-rootless
57+
type=semver,enable=${{ matrix.composer_version == '2' && (matrix.latest_major == 'true' || matrix.latest == 'true') }},pattern={{major}},suffix=-base-rootless,value=${{ matrix.php_version }}.0
58+
4359
- name: Docker meta (onbuild)
4460
id: meta-onbuild
4561
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
@@ -66,6 +82,30 @@ jobs:
6682
# {{major}}
6783
type=semver,enable=${{ matrix.composer_version == '2' && (matrix.latest_major == 'true' || matrix.latest == 'true') }},pattern={{major}},value=${{ matrix.php_version }}.0
6884
85+
- name: Docker meta (onbuild-rootless)
86+
id: meta-onbuild-rootless
87+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
88+
with:
89+
images: |
90+
clevyr/php
91+
ghcr.io/clevyr/php
92+
flavor: latest=false
93+
tags: |
94+
# {{major}}.{{minor}}-composer{{major}}-onbuild-rootless
95+
type=semver,pattern={{major}}.{{minor}},suffix=-composer${{ matrix.composer_version }}-onbuild-rootless,value=${{ matrix.php_version }}.0
96+
# {{major}}.{{minor}}-composer{{major}}
97+
type=semver,pattern={{major}}.{{minor}},suffix=-composer${{ matrix.composer_version }},value=${{ matrix.php_version }}.0
98+
# {{major}}.{{minor}}-onbuild-rootless
99+
type=semver,enable=${{ matrix.composer_version == '2' }},pattern={{major}}.{{minor}},suffix=-onbuild-rootless,value=${{ matrix.php_version }}.0
100+
# {{major}}.{{minor}}
101+
type=semver,enable=${{ matrix.composer_version == '2' }},pattern={{major}}.{{minor}},value=${{ matrix.php_version }}.0
102+
# {{major}}-composer{{major}}
103+
type=semver,enable=${{ (matrix.latest_major == 'true' || matrix.latest == 'true') }},pattern={{major}},suffix=-composer${{ matrix.composer_version }},value=${{ matrix.php_version }}.0
104+
# {{major}}-onbuild-rootless
105+
type=semver,enable=${{ matrix.composer_version == '2' && (matrix.latest_major == 'true' || matrix.latest == 'true') }},pattern={{major}},suffix=-onbuild-rootless,value=${{ matrix.php_version }}.0
106+
# {{major}}
107+
type=semver,enable=${{ matrix.composer_version == '2' && (matrix.latest_major == 'true' || matrix.latest == 'true') }},pattern={{major}},value=${{ matrix.php_version }}.0
108+
69109
- name: Set up QEMU
70110
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
71111

@@ -121,6 +161,22 @@ jobs:
121161
cache-from: type=gha
122162
cache-to: type=gha,mode=max
123163

164+
- name: Build and Push (base-rootless)
165+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
166+
with:
167+
context: .
168+
pull: true
169+
push: ${{ github.ref_name == 'main' }}
170+
platforms: ${{ matrix.platforms }}
171+
tags: ${{ steps.meta-base-rootless.outputs.tags }}
172+
labels: ${{ steps.meta-base-rootless.outputs.labels }}
173+
build-args: |
174+
COMPOSER_VERSION=${{ matrix.composer_version }}
175+
PHP_VERSION=${{ matrix.php_version }}
176+
target: base-rootless
177+
cache-from: type=gha
178+
cache-to: type=gha,mode=max
179+
124180
- name: Build and Push (onbuild)
125181
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
126182
with:
@@ -135,3 +191,18 @@ jobs:
135191
target: onbuild
136192
cache-from: type=gha
137193
cache-to: type=gha,mode=max
194+
195+
- name: Build and Push (onbuild-rootless)
196+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
197+
with:
198+
context: .
199+
push: ${{ github.ref_name == 'main' }}
200+
platforms: ${{ matrix.platforms }}
201+
tags: ${{ steps.meta-onbuild-rootless.outputs.tags }}
202+
labels: ${{ steps.meta-onbuild-rootless.outputs.labels }}
203+
build-args: |
204+
COMPOSER_VERSION=${{ matrix.composer_version }}
205+
PHP_VERSION=${{ matrix.php_version }}
206+
target: onbuild-rootless
207+
cache-from: type=gha
208+
cache-to: type=gha,mode=max

‎Dockerfile‎

Lines changed: 76 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ ARG ALPINE_VERSION
77
FROM composer:$COMPOSER_VERSION AS local-composer
88

99
FROM php:$PHP_VERSION-fpm-alpine$ALPINE_VERSION AS base
10-
WORKDIR /app
1110

1211
COPY --from=mlocati/php-extension-installer:2.8.5 /usr/bin/install-php-extensions /usr/bin/
1312

@@ -36,7 +35,7 @@ RUN <<EOT
3635
-e 's/^;?(expose_php).*/\1 = Off/' \
3736
php.ini-production
3837
ln -s php.ini-production php.ini
39-
mkdir -p /run/nginx
38+
mkdir -p /run/nginx /var/lib/nginx/tmp /var/log/nginx
4039
sed -ri -e 's/#(tcp_nopush on;)/\1/' /etc/nginx/nginx.conf
4140
if [ -d /etc/nginx/http.d ]; then
4241
mv /etc/nginx/http.d /etc/nginx/conf.d
@@ -91,6 +90,24 @@ COPY rootfs/ /
9190

9291
CMD ["s6-svscan", "/etc/services.d"]
9392

93+
FROM base AS base-rootless
94+
95+
RUN <<EOT
96+
sed -ri \
97+
-e 's/^;(user) = .*/\1 = www-data/' \
98+
-e 's/^;(group) = .*/\1 = www-data/' \
99+
"$PHP_INI_DIR"/../php-fpm.d/www.conf
100+
sed -i 's/^user .*;/user www-data;/' /etc/nginx/nginx.conf
101+
chown -R www-data:www-data /run/nginx /var/lib/nginx /var/log/nginx
102+
EOT
103+
104+
ENV NGINX_PORT=8080
105+
106+
USER www-data:www-data
107+
WORKDIR /app
108+
109+
CMD ["s6-svscan-rootless", "/etc/services.d"]
110+
94111
FROM base AS onbuild
95112

96113
ONBUILD ARG PHP_FPM_PM_MAX_CHILDREN
@@ -128,16 +145,73 @@ ONBUILD ARG INSTALL_MYSQL
128145
ONBUILD ARG INSTALL_SQLSRV
129146
ONBUILD ARG INSTALL_XDEBUG
130147

148+
ONBUILD ARG NGINX_PORT
149+
ONBUILD ARG NGINX_ROOT
150+
ONBUILD ARG NGINX_EXPIRES
151+
152+
ONBUILD ARG COMPOSER_VERSION
153+
154+
ONBUILD ARG IPE_GD_WITHOUTAVIF=1
155+
156+
ONBUILD RUN <<EOT
157+
set -eux
158+
if [ "${SKIP_BUILD:-}" != "true" ]; then
159+
clevyr-build
160+
fi
161+
EOT
162+
163+
FROM base-rootless AS onbuild-rootless
164+
165+
ONBUILD ARG PHP_FPM_PM_MAX_CHILDREN
166+
ONBUILD ENV PHP_FPM_PM_MAX_CHILDREN=${PHP_FPM_PM_MAX_CHILDREN:-20}
167+
ONBUILD ARG PHP_FPM_PM_START_SERVERS
168+
ONBUILD ENV PHP_FPM_PM_START_SERVERS=${PHP_FPM_PM_START_SERVERS:-2}
169+
ONBUILD ARG PHP_FPM_PM_MIN_SPARE_SERVERS
170+
ONBUILD ENV PHP_FPM_PM_MIN_SPARE_SERVERS=${PHP_FPM_PM_MIN_SPARE_SERVERS:-1}
171+
ONBUILD ARG PHP_FPM_PM_MAX_SPARE_SERVERS
172+
ONBUILD ENV PHP_FPM_PM_MAX_SPARE_SERVERS=${PHP_FPM_PM_MAX_SPARE_SERVERS:-3}
173+
ONBUILD ARG PHP_FPM_PM_MAX_REQUESTS
174+
ONBUILD ENV PHP_FPM_PM_MAX_REQUESTS=${PHP_FPM_PM_MAX_REQUESTS:-0}
175+
176+
ONBUILD ARG PHP_MAX_EXECUTION_TIME
177+
ONBUILD ENV PHP_MAX_EXECUTION_TIME=${PHP_MAX_EXECUTION_TIME:-30}
178+
ONBUILD ARG PHP_MAX_INPUT_VARS
179+
ONBUILD ENV PHP_MAX_INPUT_VARS=${PHP_MAX_INPUT_VARS:-1000}
180+
ONBUILD ARG PHP_MEMORY_LIMIT
181+
ONBUILD ENV PHP_MEMORY_LIMIT=${PHP_MEMORY_LIMIT:-256M}
182+
ONBUILD ARG PHP_POST_MAX_SIZE
183+
ONBUILD ENV PHP_POST_MAX_SIZE=${PHP_POST_MAX_SIZE:-32M}
184+
ONBUILD ARG PHP_UPLOAD_MAX_FILESIZE
185+
ONBUILD ENV PHP_UPLOAD_MAX_FILESIZE=${PHP_UPLOAD_MAX_FILESIZE:-8M}
186+
ONBUILD ARG PHP_MAX_FILE_UPLOADS
187+
ONBUILD ENV PHP_MAX_FILE_UPLOADS=${PHP_MAX_FILE_UPLOADS:-20}
188+
189+
ONBUILD ARG SKIP_BUILD
190+
ONBUILD ARG DEPS
191+
ONBUILD ARG INSTALL
192+
193+
ONBUILD ARG INSTALL_GD
194+
ONBUILD ARG INSTALL_IMAGICK
195+
ONBUILD ARG INSTALL_MOSQUITTO
196+
ONBUILD ARG INSTALL_MYSQL
197+
ONBUILD ARG INSTALL_SQLSRV
198+
ONBUILD ARG INSTALL_XDEBUG
199+
200+
ONBUILD ARG NGINX_PORT
131201
ONBUILD ARG NGINX_ROOT
132202
ONBUILD ARG NGINX_EXPIRES
133203

134204
ONBUILD ARG COMPOSER_VERSION
135205

136206
ONBUILD ARG IPE_GD_WITHOUTAVIF=1
137207

208+
ONBUILD USER root
209+
138210
ONBUILD RUN <<EOT
139211
set -eux
140212
if [ "${SKIP_BUILD:-}" != "true" ]; then
141213
clevyr-build
142214
fi
143215
EOT
216+
217+
ONBUILD USER www-data:www-data

‎rootfs/etc/nginx/conf.d/default.conf.tpl‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
server {
2-
listen 80;
3-
listen [::]:80 default ipv6only=on;
2+
listen $NGINX_PORT;
3+
listen [::]:$NGINX_PORT default ipv6only=on;
44
55
server_name _;
66

‎rootfs/usr/bin/clevyr-build‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,8 +64,9 @@ install-php-extensions "${INSTALL[@]}"
6464
# Template nginx config
6565
log 'Templating nginx config'
6666
export NGINX_ROOT="${NGINX_ROOT:-/app/public}" \
67-
NGINX_EXPIRES="${NGINX_EXPIRES:-7d}"
68-
envsubst '$NGINX_ROOT $NGINX_EXPIRES' < /etc/nginx/conf.d/default.conf.tpl > /etc/nginx/conf.d/default.conf
67+
NGINX_EXPIRES="${NGINX_EXPIRES:-7d}" \
68+
NGINX_PORT="${NGINX_PORT:-80}"
69+
envsubst '$NGINX_ROOT $NGINX_EXPIRES $NGINX_PORT' < /etc/nginx/conf.d/default.conf.tpl > /etc/nginx/conf.d/default.conf
6970

7071
log 'Removing all tmp files'
7172
rm -rf /tmp/*

‎rootfs/usr/bin/s6-svscan-rootless‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/bin/sh
2+
3+
set -euo pipefail
4+
5+
# Wrapper to run s6-svscan from a writable directory
6+
# s6-svscan creates .s6-svscan in the service directory, so we need to copy services to /tmp
7+
8+
# See https://skarnet.org/software/s6/scandir.html
9+
10+
SERVICE_DIR="$1"
11+
12+
if [ -z "$SERVICE_DIR" ]; then
13+
echo "Usage: $0 <service-directory>" >&2
14+
exit 1
15+
fi
16+
17+
# Create a unique directory in /tmp for our services
18+
TEMP_SERVICE_DIR="/tmp/s6-services-$$"
19+
mkdir -p "$TEMP_SERVICE_DIR"
20+
21+
# Copy the service directory contents to /tmp
22+
cp -r "$SERVICE_DIR"/* "$TEMP_SERVICE_DIR/" 2>/dev/null || cp -r "$SERVICE_DIR"/. "$TEMP_SERVICE_DIR/"
23+
24+
# Run s6-svscan against the copied services
25+
exec s6-svscan "$TEMP_SERVICE_DIR"

0 commit comments

Comments
 (0)