1- FROM php:7.4.16 -fpm-alpine3.13 AS zippy-api
1+ FROM php:8.3.20 -fpm-alpine3.20 AS zippy-api
22
33RUN apk add --no-cache --virtual .persistent-deps \
44 git \
55 gettext \
66 sqlite-dev \
77 icu-libs \
88 zlib \
9- libzip
9+ libzip \
10+ rabbitmq-c-dev
1011
11- ENV APCU_VERSION=5.1.18 \
12- XDEBUG_VERSION=2.9.4 \
12+ ENV APCU_VERSION=5.1.24 \
13+ XDEBUG_VERSION=3.4 \
14+ AMQP_VERSION=1.11.0 \
1315 APP_ENV=prod
1416
1517RUN set -eux \
@@ -18,6 +20,7 @@ RUN set -eux \
1820 icu-dev \
1921 zlib-dev \
2022 libzip-dev \
23+ linux-headers \
2124 && docker-php-ext-install \
2225 intl \
2326 zip \
@@ -27,16 +30,18 @@ RUN set -eux \
2730 pdo_sqlite \
2831 && pecl install \
2932 apcu-${APCU_VERSION} \
33+ amqp-${AMQP_VERSION} \
3034 xdebug-${XDEBUG_VERSION} \
3135 && docker-php-ext-enable --ini-name 20-apcu.ini apcu \
3236 && docker-php-ext-enable --ini-name 05-opcache.ini opcache \
37+ && docker-php-ext-enable amqp \
3338 && apk del .build-deps
3439
3540# ------------------------ add nginx ------------------------
3641# Taken from official nginx container Dockerfile
3742
38- ENV NGINX_VERSION 1.19.6
39- ENV NJS_VERSION 0.5.0
43+ ENV NGINX_VERSION 1.28.0
44+ ENV NJS_VERSION 0.8.10
4045ENV PKG_RELEASE 1
4146
4247RUN set -x \
@@ -51,23 +56,23 @@ RUN set -x \
5156 nginx-module-image-filter=${NGINX_VERSION}-r${PKG_RELEASE} \
5257 nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${PKG_RELEASE} \
5358 " \
59+ # install prerequisites for public key and pkg-oss checks
60+ && apk add --no-cache --virtual .checksum-deps \
61+ openssl \
5462 && case "$apkArch" in \
55- x86_64) \
63+ x86_64 |aarch64 ) \
5664# arches officially built by upstream
5765 set -x \
58- && KEY_SHA512="e7fa8303923d9b95db37a77ad46c68fd4755ff935d0a534d26eba83de193c76166c68bfe7f65471bf8881004ef4aa6df3e34689c305662750c0172fca5d8552a *stdin" \
59- && apk add --no-cache --virtual .cert-deps \
60- openssl \
66+ && KEY_SHA512="e09fa32f0a0eab2b879ccbbc4d0e4fb9751486eedda75e35fac65802cc9faa266425edf83e261137a2f4d16281ce2c1a5f4502930fe75154723da014214f0655" \
6167 && wget -O /tmp/nginx_signing.rsa.pub https://nginx.org/keys/nginx_signing.rsa.pub \
62- && if [ "$(openssl rsa -pubin -in /tmp/nginx_signing.rsa.pub -text -noout | openssl sha512 -r)" = "$KEY_SHA512" ] ; then \
68+ && if echo "$KEY_SHA512 * /tmp/nginx_signing.rsa.pub" | sha512sum -c - ; then \
6369 echo "key verification succeeded!" ; \
6470 mv /tmp/nginx_signing.rsa.pub /etc/apk/keys/; \
6571 else \
6672 echo "key verification failed!" ; \
6773 exit 1; \
6874 fi \
69- && apk del .cert-deps \
70- && apk add -X "https://nginx.org/packages/mainline/alpine/v$(egrep -o '^[0-9]+\. [0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \
75+ && apk add -X "https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\. [0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \
7176 ;; \
7277 *) \
7378# we're on an architecture upstream doesn't officially build for
@@ -80,67 +85,54 @@ RUN set -x \
8085 libc-dev \
8186 make \
8287 openssl-dev \
83- pcre -dev \
88+ pcre2 -dev \
8489 zlib-dev \
8590 linux-headers \
86- libxslt-dev \
87- gd-dev \
88- geoip-dev \
89- perl-dev \
90- libedit-dev \
91- mercurial \
9291 bash \
9392 alpine-sdk \
9493 findutils \
94+ curl \
9595 && su nobody -s /bin/sh -c " \
9696 export HOME=${tempDir} \
9797 && cd ${tempDir} \
98- && hg clone https://hg.nginx.org/pkg-oss \
99- && cd pkg-oss \
100- && hg up ${NGINX_VERSION}-${PKG_RELEASE} \
98+ && curl -f -L -O https://github.com/nginx/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
99+ && PKGOSSCHECKSUM=\" 517bc18954ccf4efddd51986584ca1f37966833ad342a297e1fe58fd0faf14c5a4dabcb23519dca433878a2927a95d6bea05a6749ee2fa67a33bf24cdc41b1e4 *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \
100+ && if [ \"\$ (openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$ PKGOSSCHECKSUM\" ]; then \
101+ echo \" pkg-oss tarball checksum verification succeeded!\" ; \
102+ else \
103+ echo \" pkg-oss tarball checksum verification failed!\" ; \
104+ exit 1; \
105+ fi \
106+ && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
107+ && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \
101108 && cd alpine \
102- && make all \
103- && apk index -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \
109+ && make base \
110+ && apk index --allow-untrusted - o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \
104111 && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \
105112 " \
106113 && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \
107- && apk del .build-deps \
114+ && apk del --no-network .build-deps \
108115 && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \
109116 ;; \
110- esac \
117+ esac \
118+ # remove checksum deps
119+ && apk del --no-network .checksum-deps \
111120# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
112121 && if [ -n "$tempDir" ]; then rm -rf "$tempDir" ; fi \
113122 && if [ -n "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
114123 && if [ -n "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
115- # Bring in gettext so we can get `envsubst`, then throw
116- # the rest away. To do this, we need to install `gettext`
117- # then move `envsubst` out of the way so `gettext` can
118- # be deleted completely, then move `envsubst` back.
119- && apk add --no-cache --virtual .gettext gettext \
120- && mv /usr/bin/envsubst /tmp/ \
121- \
122- && runDeps="$( \
123- scanelf --needed --nobanner /tmp/envsubst \
124- | awk '{ gsub(/,/, " \n so:", $2); print " so:" $2 }' \
125- | sort -u \
126- | xargs -r apk info --installed \
127- | sort -u \
128- )" \
129- && apk add --no-cache $runDeps \
130- && apk del .gettext \
131- && mv /tmp/envsubst /usr/local/bin/ \
124+ # Add `envsubst` for templating environment variables
125+ && apk add --no-cache gettext-envsubst \
132126# Bring in tzdata so users could set the timezones through the environment
133127# variables
134128 && apk add --no-cache tzdata \
135- # Bring in curl and ca-certificates to make registering on DNS SD easier
136- && apk add --no-cache curl ca-certificates \
137129# forward request and error logs to docker log collector
138130 && ln -sf /dev/stdout /var/log/nginx/access.log \
139131 && ln -sf /dev/stderr /var/log/nginx/error.log \
140132 && sed -i 's/user nginx;/user app;/g' /etc/nginx/nginx.conf
141133
142134
143- COPY --from=composer:2.0.3 /usr/bin/composer /usr/bin/composer
135+ COPY --from=composer:2.2.25 /usr/bin/composer /usr/bin/composer
144136
145137RUN ln -s $PHP_INI_DIR/php.ini-production $PHP_INI_DIR/php.ini \
146138 # Increase process-timeout for "composer test" which downloads phpunit
0 commit comments