Skip to content

Security and core updates for PHP 8.5 and s6-overlay v3 #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
metalcated wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Security and core updates for PHP 8.5 and s6-overlay v3 #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7eaeef1
Security and core updates for PHP 8.5 and s6-overlay v3
metalcated Feb 13, 2026
7681624
Add php85-sodium extension for lcobucci/jwt
metalcated Feb 13, 2026
d70a329
Complete s6-overlay v3 migration
metalcated Feb 13, 2026
95d588d
Migrate to s6-rc.d dependency graph structure
metalcated Feb 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
82 changes: 45 additions & 37 deletions linux-amd64.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
ARG BASE_IMAGE
FROM ${BASE_IMAGE:-library/alpine:3.18}
FROM ${BASE_IMAGE:-library/alpine:3.23.2}

ENV S6_REL=2.2.0.3 S6_ARCH=amd64 S6_BEHAVIOUR_IF_STAGE2_FAILS=2 TZ=Etc/UTC
ENV S6_REL=3.2.1.0 S6_ARCH=x86_64 S6_BEHAVIOUR_IF_STAGE2_FAILS=2 TZ=Etc/UTC

LABEL base.maintainer="christronyxyocum,Roxedus"
LABEL base.maintainer="christronyxyocum,Roxedus,metalcated"
LABEL base.s6.rel=${S6_REL} base.s6.arch=${S6_ARCH}

LABEL org.label-schema.name="organizr/base" \
Expand All @@ -21,7 +21,8 @@ RUN \
apk update && \
echo "**** install build packages ****" && \
apk add --no-cache --virtual=build-dependencies \
tar && \
tar \
xz && \
echo "**** install runtime packages ****" && \
apk add --no-cache \
apache2-utils \
Expand All @@ -30,37 +31,44 @@ RUN \
coreutils \
curl \
git \
libressl3.7-libssl \
libressl4.2-libssl \
logrotate \
nano \
nginx \
openssl \
php81 \
php81-curl \
php81-fileinfo \
php81-fpm \
php81-ftp \
php81-ldap \
php81-mbstring \
php81-mysqli \
php81-openssl \
php81-pdo_sqlite \
php81-session \
php81-simplexml \
php81-sqlite3 \
php81-tokenizer \
php81-xmlwriter \
php81-xml \
php81-zip \
php85 \
php85-curl \
php85-fileinfo \
php85-fpm \
php85-ftp \
php85-ldap \
php85-mbstring \
php85-mysqli \
php85-openssl \
php85-pdo_sqlite \
php85-session \
php85-simplexml \
php85-sodium \
php85-sqlite3 \
php85-tokenizer \
php85-xmlwriter \
php85-xml \
php85-zip \
php85-phar \
php85-openssl \
php85-json \
shadow \
zlib \
tzdata && \
apk add --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing \
php81-pecl-xmlrpc && \
echo "**** add s6 overlay ****" && \
curl -o /tmp/s6-overlay.tar.gz -L \
"https://github.com/just-containers/s6-overlay/releases/download/v${S6_REL}/s6-overlay-${S6_ARCH}.tar.gz" && \
tar xfz /tmp/s6-overlay.tar.gz -C / && \
curl -o /tmp/s6-overlay-noarch.tar.xz -L \
"https://github.com/just-containers/s6-overlay/releases/download/v${S6_REL}/s6-overlay-noarch.tar.xz" && \
curl -o /tmp/s6-overlay-arch.tar.xz -L \
"https://github.com/just-containers/s6-overlay/releases/download/v${S6_REL}/s6-overlay-${S6_ARCH}.tar.xz" && \
tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz && \
tar -C / -Jxpf /tmp/s6-overlay-arch.tar.xz && \
echo "**** create php symlink ****" && \
ln -s /usr/bin/php85 /usr/bin/php && \
echo "**** create abc user and make folders ****" && \
groupmod -g 1000 users && \
useradd -u 911 -U -d /config -s /bin/false abc && \
Expand All @@ -76,17 +84,17 @@ RUN \
sed -i "s#/var/log/messages {}.*# #g" /etc/logrotate.conf && \
sed -i 's#/usr/sbin/logrotate /etc/logrotate.conf#/usr/sbin/logrotate /etc/logrotate.conf -s /config/log/logrotate.status#g' /etc/periodic/daily/logrotate && \
echo "**** enable PHP-FPM ****" && \
sed -i "s#listen = 127.0.0.1:9000#listen = '/var/run/php8-fpm.sock'#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#;listen.owner = nobody#listen.owner = abc#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#;listen.group = abc#listen.group = abc#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#;listen.mode = nobody#listen.mode = 0660#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#listen = 127.0.0.1:9000#listen = '/var/run/php85-fpm.sock'#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#;listen.owner = nobody#listen.owner = abc#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#;listen.group = abc#listen.group = abc#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#;listen.mode = nobody#listen.mode = 0660#g" /etc/php85/php-fpm.d/www.conf && \
echo "**** set our recommended defaults ****" && \
sed -i "s#pm = dynamic#pm = ondemand#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#pm.max_children = 5#pm.max_children = 4000#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#pm.start_servers = 2#;pm.start_servers = 2#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#;pm.process_idle_timeout = 10s;#pm.process_idle_timeout = 10s;#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#;pm.max_requests = 500#pm.max_requests = 0#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#zlib.output_compression = Off#zlib.output_compression = On#g" /etc/php81/php.ini && \
sed -i "s#pm = dynamic#pm = ondemand#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#pm.max_children = 5#pm.max_children = 4000#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#pm.start_servers = 2#;pm.start_servers = 2#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#;pm.process_idle_timeout = 10s;#pm.process_idle_timeout = 10s;#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#;pm.max_requests = 500#pm.max_requests = 0#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#zlib.output_compression = Off#zlib.output_compression = On#g" /etc/php85/php.ini && \
echo "**** cleanup ****" && \
apk del --purge \
build-dependencies && \
Expand Down
82 changes: 45 additions & 37 deletions linux-arm-v7.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
ARG BASE_IMAGE
FROM ${BASE_IMAGE:-library/alpine:3.18}
FROM ${BASE_IMAGE:-library/alpine:3.23.2}

ENV S6_REL=2.2.0.3 S6_ARCH=armhf S6_BEHAVIOUR_IF_STAGE2_FAILS=2 TZ=Etc/UTC
ENV S6_REL=3.2.1.0 S6_ARCH=arm S6_BEHAVIOUR_IF_STAGE2_FAILS=2 TZ=Etc/UTC

LABEL base.maintainer="christronyxyocum,Roxedus"
LABEL base.maintainer="christronyxyocum,Roxedus,metalcated"
LABEL base.s6.rel=${S6_REL} base.s6.arch=${S6_ARCH}

LABEL org.label-schema.name="organizr/base" \
Expand All @@ -21,7 +21,8 @@ RUN \
apk update && \
echo "**** install build packages ****" && \
apk add --no-cache --virtual=build-dependencies \
tar && \
tar \
xz && \
echo "**** install runtime packages ****" && \
apk add --no-cache \
apache2-utils \
Expand All @@ -30,37 +31,44 @@ RUN \
coreutils \
curl \
git \
libressl3.7-libssl \
libressl4.2-libssl \
logrotate \
nano \
nginx \
openssl \
php81 \
php81-curl \
php81-fileinfo \
php81-fpm \
php81-ftp \
php81-ldap \
php81-mbstring \
php81-mysqli \
php81-openssl \
php81-pdo_sqlite \
php81-session \
php81-simplexml \
php81-sqlite3 \
php81-tokenizer \
php81-xmlwriter \
php81-xml \
php81-zip \
php85 \
php85-curl \
php85-fileinfo \
php85-fpm \
php85-ftp \
php85-ldap \
php85-mbstring \
php85-mysqli \
php85-openssl \
php85-pdo_sqlite \
php85-session \
php85-simplexml \
php85-sodium \
php85-sqlite3 \
php85-tokenizer \
php85-xmlwriter \
php85-xml \
php85-zip \
php85-phar \
php85-openssl \
php85-json \
shadow \
zlib \
tzdata && \
apk add --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing \
php81-pecl-xmlrpc && \
echo "**** add s6 overlay ****" && \
curl -o /tmp/s6-overlay.tar.gz -L \
"https://github.com/just-containers/s6-overlay/releases/download/v${S6_REL}/s6-overlay-${S6_ARCH}.tar.gz" && \
tar xfz /tmp/s6-overlay.tar.gz -C / && \
curl -o /tmp/s6-overlay-noarch.tar.xz -L \
"https://github.com/just-containers/s6-overlay/releases/download/v${S6_REL}/s6-overlay-noarch.tar.xz" && \
curl -o /tmp/s6-overlay-arch.tar.xz -L \
"https://github.com/just-containers/s6-overlay/releases/download/v${S6_REL}/s6-overlay-${S6_ARCH}.tar.xz" && \
tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz && \
tar -C / -Jxpf /tmp/s6-overlay-arch.tar.xz && \
echo "**** create php symlink ****" && \
ln -s /usr/bin/php85 /usr/bin/php && \
echo "**** create abc user and make folders ****" && \
groupmod -g 1000 users && \
useradd -u 911 -U -d /config -s /bin/false abc && \
Expand All @@ -76,17 +84,17 @@ RUN \
sed -i "s#/var/log/messages {}.*# #g" /etc/logrotate.conf && \
sed -i 's#/usr/sbin/logrotate /etc/logrotate.conf#/usr/sbin/logrotate /etc/logrotate.conf -s /config/log/logrotate.status#g' /etc/periodic/daily/logrotate && \
echo "**** enable PHP-FPM ****" && \
sed -i "s#listen = 127.0.0.1:9000#listen = '/var/run/php8-fpm.sock'#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#;listen.owner = nobody#listen.owner = abc#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#;listen.group = abc#listen.group = abc#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#;listen.mode = nobody#listen.mode = 0660#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#listen = 127.0.0.1:9000#listen = '/var/run/php85-fpm.sock'#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#;listen.owner = nobody#listen.owner = abc#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#;listen.group = abc#listen.group = abc#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#;listen.mode = nobody#listen.mode = 0660#g" /etc/php85/php-fpm.d/www.conf && \
echo "**** set our recommended defaults ****" && \
sed -i "s#pm = dynamic#pm = ondemand#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#pm.max_children = 5#pm.max_children = 4000#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#pm.start_servers = 2#;pm.start_servers = 2#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#;pm.process_idle_timeout = 10s;#pm.process_idle_timeout = 10s;#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#;pm.max_requests = 500#pm.max_requests = 0#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#zlib.output_compression = Off#zlib.output_compression = On#g" /etc/php81/php.ini && \
sed -i "s#pm = dynamic#pm = ondemand#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#pm.max_children = 5#pm.max_children = 4000#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#pm.start_servers = 2#;pm.start_servers = 2#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#;pm.process_idle_timeout = 10s;#pm.process_idle_timeout = 10s;#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#;pm.max_requests = 500#pm.max_requests = 0#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#zlib.output_compression = Off#zlib.output_compression = On#g" /etc/php85/php.ini && \
echo "**** cleanup ****" && \
apk del --purge \
build-dependencies && \
Expand Down
82 changes: 45 additions & 37 deletions linux-arm64.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
ARG BASE_IMAGE
FROM ${BASE_IMAGE:-library/alpine:3.18}
FROM ${BASE_IMAGE:-library/alpine:3.23.2}

ENV S6_REL=2.2.0.3 S6_ARCH=aarch64 S6_BEHAVIOUR_IF_STAGE2_FAILS=2 TZ=Etc/UTC
ENV S6_REL=3.2.1.0 S6_ARCH=aarch64 S6_BEHAVIOUR_IF_STAGE2_FAILS=2 TZ=Etc/UTC

LABEL base.maintainer="christronyxyocum,Roxedus"
LABEL base.maintainer="christronyxyocum,Roxedus,metalcated"
LABEL base.s6.rel=${S6_REL} base.s6.arch=${S6_ARCH}

LABEL org.label-schema.name="organizr/base" \
Expand All @@ -21,7 +21,8 @@ RUN \
apk update && \
echo "**** install build packages ****" && \
apk add --no-cache --virtual=build-dependencies \
tar && \
tar \
xz && \
echo "**** install runtime packages ****" && \
apk add --no-cache \
apache2-utils \
Expand All @@ -30,37 +31,44 @@ RUN \
coreutils \
curl \
git \
libressl3.7-libssl \
libressl4.2-libssl \
logrotate \
nano \
nginx \
openssl \
php81 \
php81-curl \
php81-fileinfo \
php81-fpm \
php81-ftp \
php81-ldap \
php81-mbstring \
php81-mysqli \
php81-openssl \
php81-pdo_sqlite \
php81-session \
php81-simplexml \
php81-sqlite3 \
php81-tokenizer \
php81-xmlwriter \
php81-xml \
php81-zip \
php85 \
php85-curl \
php85-fileinfo \
php85-fpm \
php85-ftp \
php85-ldap \
php85-mbstring \
php85-mysqli \
php85-openssl \
php85-pdo_sqlite \
php85-session \
php85-simplexml \
php85-sodium \
php85-sqlite3 \
php85-tokenizer \
php85-xmlwriter \
php85-xml \
php85-zip \
php85-phar \
php85-openssl \
php85-json \
shadow \
zlib \
tzdata && \
apk add --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing \
php81-pecl-xmlrpc && \
echo "**** add s6 overlay ****" && \
curl -o /tmp/s6-overlay.tar.gz -L \
"https://github.com/just-containers/s6-overlay/releases/download/v${S6_REL}/s6-overlay-${S6_ARCH}.tar.gz" && \
tar xfz /tmp/s6-overlay.tar.gz -C / && \
curl -o /tmp/s6-overlay-noarch.tar.xz -L \
"https://github.com/just-containers/s6-overlay/releases/download/v${S6_REL}/s6-overlay-noarch.tar.xz" && \
curl -o /tmp/s6-overlay-arch.tar.xz -L \
"https://github.com/just-containers/s6-overlay/releases/download/v${S6_REL}/s6-overlay-${S6_ARCH}.tar.xz" && \
tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz && \
tar -C / -Jxpf /tmp/s6-overlay-arch.tar.xz && \
echo "**** create php symlink ****" && \
ln -s /usr/bin/php85 /usr/bin/php && \
echo "**** create abc user and make folders ****" && \
groupmod -g 1000 users && \
useradd -u 911 -U -d /config -s /bin/false abc && \
Expand All @@ -76,17 +84,17 @@ RUN \
sed -i "s#/var/log/messages {}.*# #g" /etc/logrotate.conf && \
sed -i 's#/usr/sbin/logrotate /etc/logrotate.conf#/usr/sbin/logrotate /etc/logrotate.conf -s /config/log/logrotate.status#g' /etc/periodic/daily/logrotate && \
echo "**** enable PHP-FPM ****" && \
sed -i "s#listen = 127.0.0.1:9000#listen = '/var/run/php8-fpm.sock'#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#;listen.owner = nobody#listen.owner = abc#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#;listen.group = abc#listen.group = abc#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#;listen.mode = nobody#listen.mode = 0660#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#listen = 127.0.0.1:9000#listen = '/var/run/php85-fpm.sock'#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#;listen.owner = nobody#listen.owner = abc#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#;listen.group = abc#listen.group = abc#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#;listen.mode = nobody#listen.mode = 0660#g" /etc/php85/php-fpm.d/www.conf && \
echo "**** set our recommended defaults ****" && \
sed -i "s#pm = dynamic#pm = ondemand#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#pm.max_children = 5#pm.max_children = 4000#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#pm.start_servers = 2#;pm.start_servers = 2#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#;pm.process_idle_timeout = 10s;#pm.process_idle_timeout = 10s;#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#;pm.max_requests = 500#pm.max_requests = 0#g" /etc/php81/php-fpm.d/www.conf && \
sed -i "s#zlib.output_compression = Off#zlib.output_compression = On#g" /etc/php81/php.ini && \
sed -i "s#pm = dynamic#pm = ondemand#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#pm.max_children = 5#pm.max_children = 4000#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#pm.start_servers = 2#;pm.start_servers = 2#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#;pm.process_idle_timeout = 10s;#pm.process_idle_timeout = 10s;#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#;pm.max_requests = 500#pm.max_requests = 0#g" /etc/php85/php-fpm.d/www.conf && \
sed -i "s#zlib.output_compression = Off#zlib.output_compression = On#g" /etc/php85/php.ini && \
echo "**** cleanup ****" && \
apk del --purge \
build-dependencies && \
Expand Down
2 changes: 1 addition & 1 deletion root/defaults/healthcheck
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ server {
location /php_status {
allow 127.0.0.1;
deny all;
fastcgi_pass unix:/var/run/php8-fpm.sock;
fastcgi_pass unix:/var/run/php85-fpm.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include /etc/nginx/fastcgi_params;
Expand Down
32 changes: 0 additions & 32 deletions root/etc/cont-init.d/20-config
View file
Open in desktop

This file was deleted.

Empty file added root/etc/s6-overlay/s6-rc.d/init-adduser/dependencies.d/base
View file
Open in desktop
Empty file.
Loading