commit 43c0739dfaffd1b0ae720d304dcbf60dfae3e511 Author: Bitrix Developer Date: Wed May 20 15:23:05 2026 +0300 init diff --git a/.env.example b/.env.example new file mode 100644 index 0000000..f559b23 --- /dev/null +++ b/.env.example @@ -0,0 +1,8 @@ +# +# Project unique name +# +COMPOSE_PROJECT_NAME=b24pal +# +# Timezone +# +TZ=Europe/Moscow diff --git a/.env_php b/.env_php new file mode 100644 index 0000000..079c802 --- /dev/null +++ b/.env_php @@ -0,0 +1,5 @@ +# +# VMBitrix +# +BITRIX_VA_VER=9.0.9 +BITRIX_ENV_TYPE=general diff --git a/.env_push.example b/.env_push.example new file mode 100644 index 0000000..5e73447 --- /dev/null +++ b/.env_push.example @@ -0,0 +1,4 @@ +# +# Push Server on NodeJS: Security Key +# +PUSH_SECURITY_KEY=qWWNopE43vkcTONyXgHzalhf1l5wFVUrwRjNZ1koVMt5wvJm3SmiCw6rqTrEFwZe68YVTUeNaj64uScnen2AAB3SwUOl7XOfqBjeiX4WGqCpFab1D5mIaaE013zIWWGH diff --git a/.env_push_pub b/.env_push_pub new file mode 100644 index 0000000..6bfa4a6 --- /dev/null +++ b/.env_push_pub @@ -0,0 +1,5 @@ +# +# Push Server on NodeJS: Pub +# +PUSH_PUB_PORT=9010 +PUSH_PUB_MODE=pub diff --git a/.env_push_sub b/.env_push_sub new file mode 100644 index 0000000..e34c99d --- /dev/null +++ b/.env_push_sub @@ -0,0 +1,5 @@ +# +# Push Server on NodeJS: Sub +# +PUSH_SUB_PORT=8010 +PUSH_SUB_MODE=sub diff --git a/.env_redis b/.env_redis new file mode 100644 index 0000000..1ead89c --- /dev/null +++ b/.env_redis @@ -0,0 +1,5 @@ +# +# Redis +# +REDIS_HOST=redis +REDIS_PORT=6379 diff --git a/.env_sql.example b/.env_sql.example new file mode 100644 index 0000000..6bfc2f2 --- /dev/null +++ b/.env_sql.example @@ -0,0 +1,12 @@ +# +# MySQL DB: Root Password +# +# example: lBZPsD1U}u8]HxJ +# +# CHANGE_MYSQL_ROOT_PASSWORD_HERE +# +MYSQL_ROOT_PASSWORD="lBZPsD1U}u8]HxJ" +# +# Percona Server 8.0.x or Percona Server 8.4.x: disable telemetry agent run, collect, send data +# +PERCONA_TELEMETRY_DISABLE=1 diff --git a/.env_ssl b/.env_ssl new file mode 100644 index 0000000..ca41e5b --- /dev/null +++ b/.env_ssl @@ -0,0 +1,18 @@ +# +# Root Certificate Authority and Intermediate Certificate Authority Data +# +CA_COUNTRY_NAME='RU' +CA_STATE_OR_PROVINCE_NAME='Kaliningrad Region' +CA_LOCALITY_NAME='Kaliningrad' +CA_ORGANIZATION_NAME='Dev Corporation Ltd' +CA_ORGANIZATIONAL_UNIT_NAME='Dev Corporation Ltd Unit' +CA_EMAIL_ADDRESS='info@devcorporation.ltd' +# +# Certificate Data +# +CERT_COUNTRY_NAME='RU' +CERT_STATE_OR_PROVINCE_NAME='Kaliningrad Region' +CERT_LOCALITY_NAME='Kaliningrad' +CERT_ORGANIZATION_NAME='Dev Corporation Ltd' +CERT_ORGANIZATIONAL_UNIT_NAME='Dev Corporation Ltd Unit' +CERT_EMAIL_ADDRESS='info@devcorporation.ltd' diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..79d7e80 --- /dev/null +++ b/.gitignore @@ -0,0 +1,16 @@ +# исключаем phpstorm +.idea/* + +# исключаем env и ini файлы +.env +.env_sql +.env_push +confs/php84/etc/php/conf.d/timezone.ini + +# файлы битрикс +/data/www/* +!/data/www/.gitkeep + +# БД +/data/mysql/* +!/data/mysql/.gitkeep \ No newline at end of file diff --git a/README.md b/README.md new file mode 100644 index 0000000..63f7901 --- /dev/null +++ b/README.md @@ -0,0 +1,362 @@ +# Docker-окружение для Bitrix (env-docker) + +Этот проект предназначен для быстрого развертывания локального окружения для разработки на Битрикс с использованием Docker. В основе лежит репозиторий https://github.com/bitrix-tools/env-docker + +## Директории +- [mysql](data/mysql) — файлы баз данных MySQL. Эта папка привязана к контейнеру через bind mount, поэтому данные сохраняются даже после удаления контейнеров. +- [www](data/www) — файлы проектов (скрипты Битрикс). Это основной рабочий каталог для разработки. + +## Навигация +* [Инициализация проекта](#инициализация-проекта) +* [Настройка среды разработки](#настройка-среды-разработки) +* [Настройка доступа к сайту](#настройка-доступа-к-сайту) +* [Настройка Xdebug](#настройка-xdebug) +* [Docker](#docker) +* [Управление контейнерами (Docker Compose)](#управление-контейнерами) + +## Инициализация проекта +1. Создайте директорию для вашего проекта и перейдите в неё. + +2. Склонируйте репозиторий в текущую директорию (обратите внимание на точку в конце команды): +```bash +git clone git@gitlab.vniigaz.local:internal-automation/isup/bitrix-docker.git . +``` + +3. Склонируйте подмодули проекта +Выполните в корне проекта: +```bash +git submodule update --init --recursive +``` + +4. В [www](data/www) Необходимо добавить исключенные из репозитория, проекта ИСУП, папки: +- `/bitrix` +- `/upload` + +Взять их можно из полной копии проекта (склеить и распаковать полный архив) +```bash +# Склеить архив и сразу распаковать (для не сжатых архивов): +cat *$(ls -v *tar.*) | tar xf - + +# Склеить архив и распаковать (для сжатых архивов): +cat *$(ls -v *tar.gz*) | tar xzf - +``` + +Далее перенести необходимые директории + +5. Импортируем БД +> Импорт БД должен происходить после запуска контейнеров. + +При создании полной копии проекта, средствами резервного копирования Битрикс и после переноса папки `bitrix` в [www](data/www) в `/bitrix/backup` будет находиться копия БД (2 файла). + +Необходимо скопировать SQL-файлы в контейнер mysql: + +```bash +# Создаем папку, которая не является tmpfs +docker exec dev_mysql mkdir /import +# основная БД, например b24pal.local_20260304_231417_full_2dk2oay35dm6fu8r.sql +# Формат: docker cp /путь/к/файлу.sql <имя_контейнера>:/import/файл.sql +docker cp ./data/www/bitrix/backup/{имя файла}.sql dev_mysql:/import/{имя файла}.sql + +# БД after_connect, например b24pal.local_20260304_231417_full_2dk2oay35dm6fu8r_after_connect.sql +docker cp ./data/www/bitrix/backup/{имя файла}_after_connect.sql dev_mysql:/import/{имя файла}_after_connect.sql +``` + +Зайдите в контейнер и подключитесь к MySQL. + +```bash +docker exec -it dev_mysql bash +``` + +Внутри контейнера выполните: +```bash +mysql -u root -p +``` + +Введите пароль root, пароль указан в файле `.env_sql` + +Создайте базу данных (если её нет). В командной строке MySQL выполните: + +```bash +# укажите любое имя БД, например b24local +CREATE DATABASE IF NOT EXISTS b24local; +# переключаемся на созданную БД, проверяем что выбор работает +USE b24local; +# Выходим из консоли mysql +exit; +``` + +**Загрузите дамп.** Не выходя из контейнера, выполните команду загрузки. +```bash +# укажите имя БД и имя загруженной копии БД +mysql -u root -p имя_вашей_базы < /tmp/{имя файла копии}.sql +# укажите имя БД и имя загруженной копии after_connect.sql +mysql -u root -p имя_вашей_базы < /tmp/{имя файла копии}.sql +``` + +Система снова запросит пароль root + +## Настройка среды разработки +Настройки вносятся **до первого запуска контейнеров** + +1. Скопируйте файлы +```bash +cp .env.example .env +cp .env_sql.example .env_sql +cp .env_push.example .env_push +cp confs/php84/etc/php/conf.d/timezone.ini.example confs/php84/etc/php/conf.d/timezone.ini +``` +2. Заполните их значениями для вашей среды разработки: + +**Пароль к базам данных MySQL** + +Пароль для суперпользователя `root` задается в файле `.env_sql`: + +```dotenv +MYSQL_ROOT_PASSWORD="..." +``` + +**Секретный ключ для Push-сервера** + +Ключ используется для подписи соединений между клиентом и Push-сервером. Он задается в файле `.env_push`, можно использовать уже установленное значение + +```dotenv +PUSH_SECURITY_KEY=... +``` + +**Часовой пояс (timezone)** +> Часовой пояс для контейнеров задается в двух местах + +1. Файл `.env`. (основная настройка для большинства сервисов). Значение задано как: +```dotenv +TZ=Europe/Moscow +``` + +2. Файл `confs/php84/etc/php/conf.d/timezone.ini` (настройка для PHP): +```ini +date.timezone = Europe/Moscow +``` + +После выполнения этих шагов можно переходить к запуску контейнеров. + +## Настройка доступа к сайту +Для macOS. По умолчанию сайт использует порты **8588 (HTTP)** и **8589 (HTTPS)**. Эти настройки указаны в файле `docker-compose.yml`. + +Если порты заняты, можно указать другие в `docker-compose.yml`. + +Для доступа к сайту по удобному адресу (например, http://b24.vniigaz.gazprom.local) без указания порта, нужно перенаправить трафик с 80-го порта на порт 8588. + +Ниже описаны два способа **для macOS**. + +Так как на `macOS` системный `80` порт часто занят или защищен, можно: +- использовать PF (Packet Filter) — встроенный в macOS фаервол, который перенаправит трафик. +- настроить прокси для локального Apache (рекомендованный способ) + +### Предварительная настройка (общая для обоих способов) +Как открывать сайт: +1) через `127.0.0.1:8588` +2) `b24.vniigaz.gazprom.local:8588` +3) `b24.vniigaz.gazprom.local` - без порта — см. ниже + +1. Добавьте запись в файл `/etc/hosts`. Это свяжет доменное имя с локальным компьютером. +```bash +sudo nano /etc/hosts +``` +Добавьте строку: +```text +127.0.0.1 b24.vniigaz.gazprom.local +``` + +2. **(Опционально)** Создайте тестовый файл. +Для проверки работы создайте в директории [data/www](data/www) файл `index.php` с содержимым: +```php + 127.0.0.1 port 8588 +# Для HTTPS (порт 443) раскомментируйте следующую строку, если настроите SSL: +#rdr pass on lo0 inet proto tcp from any to any port 443 -> 127.0.0.1 port 8589 +``` + +Сохраните файл. + +3. Загрузите новое правило. Эта команда включает PF с вашим правилом. +```bash +sudo pfctl -ef /etc/pf.conf +sudo pfctl -f /etc/pf.anchors/bitrix-dev +``` +После этого сайт должен открываться по адресу http://b24.vniigaz.gazprom.local. + +### Способ 2: Проксирование через локальный Apache - рекомендуется +Этот способ подойдет, если у вас уже запущен встроенный веб-сервер Apache и вы не хотите отключать его. + +**1. Найдите конфигурацию Apache** +Эта команда показывает полную конфигурацию, которую видит Apache, и в самом верху вывода будет путь к основному файлу `httpd.conf` +```bash +apachectl -t -D DUMP_INCLUDES +``` + +**2. Создайте конфигурационный файл для виртуального хоста.** +Создайте файл, например: `sudo nano /{путь к конфигу}/users/httpd-bitrix-vhost.conf` (путь может отличаться в зависимости от вашей системы) +Вставьте в него следующее содержимое: +```apacheconf + + ServerName b24.vniigaz.gazprom.local + + # Включаем проксирование + ProxyPreserveHost On + ProxyPass / http://127.0.0.1:8588/ + ProxyPassReverse / http://127.0.0.1:8588/ + + # Логи (опционально), они локальные + ErrorLog "/var/log/apache2/b24-error_log" + +``` + +**3. Включите модули прокси в Apache.** + +Откройте основной файл `httpd.conf` `/{путь к конфигу}/httpd.conf` (путь к которому вы узнали в шаге 1.). +Найдите и раскомментируйте (уберите символ `#` в начале) следующие строки, чтобы включить модули прокси:: +```apacheconf +LoadModule proxy_module libexec/apache2/mod_proxy.so +LoadModule proxy_http_module libexec/apache2/mod_proxy_http.so +``` +Сохраните файл. + +**3. Подключите созданный виртуальный хост.** +В конец того же файла `httpd.conf` добавьте строку для подключения вашего конфига: + +```apacheconf +# подключаем все кастомные конфиги +Include /{путь к конфигу}/users/* +# или подключаем один файл точечно +Include /{путь к конфигу}/users/httpd-bitrix-vhost.conf +``` +Убедитесь, что путь указан верно. + +**4. Перезапустите Apache.** +```apacheconf +sudo apachectl restart +``` +Теперь сайт должен быть доступен по адресу http://b24.vniigaz.gazprom.local. + +## Настройка Xdebug + +### Настраиваем PhpStorm +#### 1. Настройка PHP Interpreter +1. `Settings` → `PHP` → `CLI Interpreter` → `+` → `From Docker, Vagrant, WSL...` +2. Выберите `Docker Compose` +3. Укажите путь к `docker-compose.yml` и сервис `php` +4. `PhpStorm` подключится к контейнеру и проиндексирует файлы + +#### 2. Настройка Path Mappings +1. `Settings` → `PHP` → `Servers` +2. Добавьте сервер: +* Name: bitrix-docker +* Host: localhost (или ваш домен, например dev.bx) +* Port: 8588 +* Debugger: Xdebug +3. Внизу в Path mappings укажите: +```text +Local: /путь/к/data/www → Remote: /opt/www/ +``` + +#### 3. Настройка Debug +1. `Settings` → `PHP` → `Debug`: +* Debug port: 9003 +* Can accept external connections +2. `Settings` → `PHP` → `Debug` → `Xdebug`: +* Filter debug connection by IDE key +* IDE key: `PHPSTORM` + +#### 4. Создайте конфигурацию запуска +1. `Run` → `Edit Configurations` → `+` → `PHP Remote Debug` +2. Настройки: +* Name: `Bitrix Docker Debug` +* Server: выберите созданный сервер `bitrix-docker` +* IDE key: `PHPSTORM` +3. Примените и закройте + +В PhpStorm включите "Start Listening for PHP Debug Connections" (иконка 🐞 в панели) + +Поставьте брейкпоинт в коде и откройте страницу — отладка должна сработать! + +## Docker +Для удобного управления контейнерами в графическом интерфейсе рекомендуется использовать `Docker Desktop`. Он доступен для Windows, Linux и macOS. + +Документация по установке: +- `Docker Desktop on Windows`: https://docs.docker.com/desktop/setup/install/windows-install/ +- `Docker Desktop on Linux`: https://docs.docker.com/desktop/setup/install/linux/ +- `Docker Desktop on Mac`: https://docs.docker.com/desktop/setup/install/mac-install/ + +## Управление контейнерами +Для оркестрации контейнеров используется `Docker Compose`. Все команды выполняются из корневой директории проекта. + +Основная команда для пересборки и перезапуска: +```bash +docker compose down && docker compose up -d +``` + +
Полезные команды Docker + +* **Запустить все контейнеры и оставить их работать в фоне:** + +```bash +docker compose up -d +``` + +* **Отобразить список контейнеров и их статус:** +```bash +docker compose ps +``` + +* **Показать логи сразу всех контейнеров:** +```bash +docker compose logs +``` + +* **Показать лог определенного сервиса-контейнера:** +```bash +docker compose logs redis +``` + +* **Перезапустить определенный контейнер:** +```bash +docker compose restart nginx +``` + +* **Перезапустить все контейнеры:** +```bash +docker compose restart +``` + +* **Остановить все контейнеры:** +```bash +docker compose stop +``` + +* **Остановить все контейнеры, удалить их:** +```bash +docker compose down +``` + +* **Остановить все контейнеры, удалить их и удалить все тома этих контейнеров:** +```bash +docker compose down -v +``` + +* **Зайти в sh-консоль определенного контейнера, например nginx:** +```bash +docker compose exec nginx sh +``` +
diff --git a/confs/mysql/etc/my.cnf b/confs/mysql/etc/my.cnf new file mode 100644 index 0000000..df9069e --- /dev/null +++ b/confs/mysql/etc/my.cnf @@ -0,0 +1,35 @@ +# Percona Server template configuration +# +# For advice on how to change settings please see +# http://dev.mysql.com/doc/refman/8.0/en/server-configuration-defaults.html +# +[mysqld] +# +# Remove leading # and set to the amount of RAM for the most important data +# cache in MySQL. Start at 70% of total RAM for dedicated server, else 10%. +# innodb_buffer_pool_size = 128M +# +# Remove the leading "# " to disable binary logging +# Binary logging captures changes between backups and is enabled by +# default. It's default setting is log_bin=binlog +# disable_log_bin +# +# Remove leading # to set options mainly useful for reporting servers. +# The server defaults are faster for transactions and fast SELECTs. +# Adjust sizes as needed, experiment to find the optimal values. +# join_buffer_size = 128M +# sort_buffer_size = 2M +# read_rnd_buffer_size = 2M +# +# Remove leading # to revert to previous value for default_authentication_plugin, +# this will increase compatibility with older clients. For background, see: +# https://dev.mysql.com/doc/refman/8.0/en/server-system-variables.html#sysvar_default_authentication_plugin +# default-authentication-plugin=mysql_native_password +# +##datadir=/var/lib/mysql +##socket=/var/lib/mysql/mysql.sock +##log-error=/var/log/mysqld.log +##pid-file=/var/run/mysqld/mysqld.pid +# +!includedir /etc/my.cnf.d +# diff --git a/confs/mysql/etc/my.cnf.d/docker.cnf b/confs/mysql/etc/my.cnf.d/docker.cnf new file mode 100644 index 0000000..55405f3 --- /dev/null +++ b/confs/mysql/etc/my.cnf.d/docker.cnf @@ -0,0 +1,3 @@ +#[mysqld] +#host_cache_size=0 +#skip-name-resolve diff --git a/confs/mysql/etc/my.cnf.d/my.cnf b/confs/mysql/etc/my.cnf.d/my.cnf new file mode 100644 index 0000000..74c3e62 --- /dev/null +++ b/confs/mysql/etc/my.cnf.d/my.cnf @@ -0,0 +1,85 @@ +[client] +port = 3306 +default-character-set = utf8mb4 +user = mysql + +[mysqld_safe] +nice = 0 +#log-error = /var/log/mysql/error.log +user = mysql + +[mysqld] +#default-authentication-plugin = mysql_native_password # deprecated +#authentication_policy = "mysql_native_password,," # mysql_native_password deprecated 8.0.34 +authentication_policy = "*,," +user = mysql +port = 3306 +basedir = /usr +datadir = /var/lib/mysql +server-id = 101 +skip-external-locking +default-storage-engine = innodb +pid-file = /var/run/mysqld/mysqld.pid +transaction_isolation = READ-COMMITTED +max_allowed_packet = 16M +myisam-recover-options = BACKUP +explicit_defaults_for_timestamp = 1 +#expire_logs_days = 30 +#binlog_expire_logs_seconds = 2592000 +max_binlog_size = 1024M +sql_mode = "" +tmpdir = /tmp +innodb_file_per_table +innodb_buffer_pool_size = 1024M +innodb_flush_log_at_trx_commit = 2 +#innodb_log_file_size = 64M # deprecated percona 8.0.30 +innodb-redo-log-capacity = 104857600 +innodb_flush_method = O_DIRECT +innodb_strict_mode = OFF +innodb_default_row_format = DYNAMIC +character-set-server = utf8mb4 +collation-server = utf8mb4_0900_ai_ci +init-connect = "SET NAMES utf8mb4 COLLATE utf8mb4_0900_ai_ci" +#skip-character-set-client-handshake # deprecated 8.0.35 +skip-name-resolve +max_connections = 43 +table_open_cache = 8096 +thread_cache_size = 96 +thread_stack = 512K +max_heap_table_size = 128M +tmp_table_size = 128M +key_buffer_size = 48M +join_buffer_size = 8M +sort_buffer_size = 8M +bulk_insert_buffer_size = 2M +myisam_sort_buffer_size = 8M +general_log = 0 +#general_log_file = /var/log/mysql/mysql.log +#log_error = /var/log/mysql/error.log +skip-log-bin +#log_bin = /var/lib/mysql/mysql-binlog +log_bin_index = /var/lib/mysql/mysql-binlog.index +relay_log = /var/lib/mysql/mysql-relay-binlog +relay_log_index = /var/lib/mysql/mysql-relay-binlog.index +slow_query_log = 0 +#slow_query_log_file = /var/log/mysql/slow.log +sync_binlog = 0 +tls_version = TLSv1.2,TLSv1.3 +secure-log-path=/var/lib/mysql-files +percona_telemetry_disable = 1 # disable percona telemetry, from 8.0.37 and above + +[system_default_sect] +MinProtocol = TLSv1.2 + +[mysqldump] +quick +quote-names +max_allowed_packet = 16M +default-character-set = utf8mb4 +user = mysql + +[mysql] +user = mysql + +[isamchk] +key_buffer = 16M diff --git a/confs/nginx/blank/index.html b/confs/nginx/blank/index.html new file mode 100644 index 0000000..ad23e67 --- /dev/null +++ b/confs/nginx/blank/index.html @@ -0,0 +1,10 @@ + + + + + 200 OK + + +
Ping!
+ + diff --git a/confs/nginx/certs/example.com/ca-chain.pem b/confs/nginx/certs/example.com/ca-chain.pem new file mode 100644 index 0000000..0b89671 --- /dev/null +++ b/confs/nginx/certs/example.com/ca-chain.pem @@ -0,0 +1,74 @@ +-----BEGIN CERTIFICATE----- +MIIGXjCCBEagAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgcQxCzAJBgNVBAYTAlJV +MRswGQYDVQQIDBJLYWxpbmluZ3JhZCBSZWdpb24xFDASBgNVBAcMC0thbGluaW5n +cmFkMSAwHgYDVQQKDBdFeGFtcGxlIENvcnBvcmF0aW9uIEx0ZDE2MDQGA1UECwwt +RXhhbXBsZSBDb3Jwb3JhdGlvbiBMdGQgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MSgw +JgYDVQQDDB9FeGFtcGxlIENvcnBvcmF0aW9uIEx0ZCBSb290IENBMB4XDTIxMDky +NDIyMDEzN1oXDTMzMDkyMTIyMDEzN1owgbYxCzAJBgNVBAYTAlJVMRswGQYDVQQI +DBJLYWxpbmluZ3JhZCBSZWdpb24xIDAeBgNVBAoMF0V4YW1wbGUgQ29ycG9yYXRp +b24gTHRkMTYwNAYDVQQLDC1FeGFtcGxlIENvcnBvcmF0aW9uIEx0ZCBDZXJ0aWZp +Y2F0ZSBBdXRob3JpdHkxMDAuBgNVBAMMJ0V4YW1wbGUgQ29ycG9yYXRpb24gTHRk +IEludGVybWVkaWF0ZSBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB +AMHB34FLQKB1vrdXOViiK/jsoS9W9YWl5eFTelbIacFoh5JmDAP+wR3/mjDvQVUN +24qavPuCnkGsXvh23vXzofulm2ItoL8vVMwwzdrSBpdXkQhFu9yryFN6DrRdDHFi +M0ck0+IBCce0qbm3jHz+HhrTfWxcxKYWW97IOS4lmRjMsUCGNa0aL9RmNkHkOGwz +D8d9VyJA0SMrE+oOZTWKXieOC+NPGT9K6Ei5/EX64pcq5Pgefma2qaSNWJDzk3FZ +32YfTX0OyHvJLD8FthWfXouxBaaxmgGoPaTGS4EFfmA27fxEZJFZb3WBr8RJLUxq +X9NUZt23XqLyr5sJN3UvCgJNsGx5fNXPqZDHxZhYLTL+C2nAZu2D3YOqMlhL/czl +PWtSInuGkeO5DrBw+JoIVyV6yylLao7q0aEpLPIYcpbDhLH0VWLpdVWnizyBTBvB +gkahU37JSFOJHRc/B7/6NkDgsK1MJuOYsPz1k9Vl5fvocCp1Y7F2wpICpWNS8FF3 +emaXt129WLQ6647+YxOJc+L3YlBnbN2M8M/aDUk2ukha69sxvhMCYOqIrUhAey6K +eUJT4ANzJCZyrLNp1eYCbr4jEeK+7cLxRxzSf4M/8bFNSqXJ8L4ODRLvFm2zagJT +bQgpJDKcR3UwqoHUl4Cfknw++p4w03Hx7191cXH+OS1HAgMBAAGjZjBkMB0GA1Ud +DgQWBBSQxJ5QdPZszi46nfFlikou/tauwzAfBgNVHSMEGDAWgBTYsCwyeYbRwATw +UuxxekErGqVHaTASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBhjAN +BgkqhkiG9w0BAQsFAAOCAgEAn+hzVAQgjSvS49O0RuhKt5wggVXaNmx6H+QFfvLm +VMiSr0ILjVfjjTw76Ogk+q5CKpne4PsQ5Aw6YKzM7jINCA5cLQ1OVN53HxJOjXzP +B1aSeEcIRbCBQOomMBzP1yzf6lBkpTK1tpYvGBosLjCQyYwu+Ty52bT+NEbAoqYd +J0LXzEJeW5xN9AN+bWJ1IVemjCgyAa6MmWlCiYveHcO7/DkfLmi8JZj60ynPjkNZ +8CWpdSOzLFwVRSy5YMLluTcdjIgCdgYrBwFxQ4+/QX9V+iRJ7QxRKNbSM5ZZE948 +VvYWB3oZEPrRv4Rji5Geedy8xhXe9dAgPkeYY7Ra9i6MyisiLcSqScG+k0hMHmbF +5NhJiToUJaZcff1wfBUBKDoSmeCNdDzxtWODIa4ouh7T/7Jitk9Ps4OV8MBJC2zE +c0vKplgxKdCWA2luJHkFOrKWQgwN+ypdbbCZ0pcQS2pJ7w53QlVKf4Y4qlO+uJLs +pTMlem0rmV6Y8u0K+lGk0keGKz5stzLhk9LeKxiXqnh4pv0DvGUScfdOa75d9IYh +JZy7/KNgNYFdW/FgqXKzlbA1nv3NBl7dVYXQ3ICnRje1UHK0IlXcy3fY3ajKD+8o ++FtpOVp65U17XFS6yBbejSnfVsrrHi2HMHkLTot9SCn1E8LS//pFKW+992kENvVI +P5o= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGezCCBGOgAwIBAgIUJZ5ElNKY4dnFET+p9yIObZSierkwDQYJKoZIhvcNAQEL +BQAwgcQxCzAJBgNVBAYTAlJVMRswGQYDVQQIDBJLYWxpbmluZ3JhZCBSZWdpb24x +FDASBgNVBAcMC0thbGluaW5ncmFkMSAwHgYDVQQKDBdFeGFtcGxlIENvcnBvcmF0 +aW9uIEx0ZDE2MDQGA1UECwwtRXhhbXBsZSBDb3Jwb3JhdGlvbiBMdGQgQ2VydGlm +aWNhdGUgQXV0aG9yaXR5MSgwJgYDVQQDDB9FeGFtcGxlIENvcnBvcmF0aW9uIEx0 +ZCBSb290IENBMB4XDTIxMDkyNDIyMDEzN1oXDTM3MDkyMDIyMDEzN1owgcQxCzAJ +BgNVBAYTAlJVMRswGQYDVQQIDBJLYWxpbmluZ3JhZCBSZWdpb24xFDASBgNVBAcM +C0thbGluaW5ncmFkMSAwHgYDVQQKDBdFeGFtcGxlIENvcnBvcmF0aW9uIEx0ZDE2 +MDQGA1UECwwtRXhhbXBsZSBDb3Jwb3JhdGlvbiBMdGQgQ2VydGlmaWNhdGUgQXV0 +aG9yaXR5MSgwJgYDVQQDDB9FeGFtcGxlIENvcnBvcmF0aW9uIEx0ZCBSb290IENB +MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAt5LGz+dNpCBb3gk9Av4L +zzrMseZilNtJrr8afOmBgZw06TVPwutVah5PrXj3EbACE+JdO9c31WrxJiyym2CO +vZCYDtveiIN+o3U84STQ6s5tqQReqopoEHTjYXafSTkjeY5u51IM3kksic5HDYCe +g9xEwlWUXYNb7PtKUlNnZOgEhO3AK6OOPMp/0ApQX6ScDU0EjPQ7y5wFrSqRqCBB +yyYvJd9aG9vmwdckESoKxNo1HXEV0V/6SH4D3scKVKJB148e9zbjvd2U+SJ29/AQ +NsoDE7SeG+wDRc1f2jhXiaopg/mNjE63w8+whQsN98CbO+HuoI7dR5AgMZ2xDrA1 +JgWahT10gpA5OIS0V/6flTYIyMKSBURM0QfHxz887VBwHoPHYb3xc50yH6OemoMS +ZtcbGlCqIi9if/9vgaEZNYRjJZEkhHLFem9sn1n1IfeIutyR2pbUbo2sJvnldCk1 +ePzn24nbGJLQvpv8PZg01wI0HCTfFdC28VbwMPC7vsm2EfP9+qKVhQ6JCzFewo1t +0EpF49HwZqAR1oAXXxLYiP+O9/MsYzJ12RNjpL75R9PzD7bU7Dw9Qjk6r6C7FTlT +MID4gsCHfwUTUiVtMlXwc33WM5ucifhmfX/eCvM2g8fbygf+LcvKPaoUGnF3IULb +G3IELyx1Ye9wAZGJO7T1IIMCAwEAAaNjMGEwHQYDVR0OBBYEFNiwLDJ5htHABPBS +7HF6QSsapUdpMB8GA1UdIwQYMBaAFNiwLDJ5htHABPBS7HF6QSsapUdpMA8GA1Ud +EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQA/ +V8LKw2S2RoN063jX3G2Q+U9hbQsE8t6xYvxjiu+TJrJUUcU1PrlV6iNSbWaVPARr +6noY3/6zK9kxXQryvgjVK6ckPTEaaYST7iKGgBtJkYU354cACPtybt0GrXvqTEQc +Aly8/2mJ+/X6/ZadwVeJV6XswHqc8466/KEeKThm62mWHgAX26i98FMzFlQryFYs +CnQq0EIv5Zg7uFRKt0Z/pCosU8+JFX42UKnRVbsMMjZMOVxAhe8QBvMA7bkw0P1o +0GSY++mhKAORAUi0/jPCfj5Y+ot+VWpSgVHVxpo6EuefgNQl7c1KmaESur4ToW0a +va/VpxGFgbRUJJAgLg59uRAs3WvUqCCw2p9M2K6xbMiqAZYKRVoK3J6EB7REFypD +c/vaJfFXJyUmgKgW1eeWODqIOvhhkdi1tfx8YDBXNjk519Engrd0nTY06g7O3B9D +V0dajcylfSTeFxaQLa6jF5Qs6rE655wLS7I8SpmYZ4Eevqwl6nU1GffD7JnthZEl +c7G74iB68ksqQcjhpNwt+eg/LzokmybKnzK5QMnxDisttR9qhhcM+p+kIiy9XC82 +8GMUkdw6eG8VUqnkcRIADffaWuVwcH6fwWBqq4Ju9LVpVbm97jeQ/GszFYGyANba +/vu1wRYPkcWgrFXN/UlbKra5RNFmHesrQ5gcRXsR7Q== +-----END CERTIFICATE----- \ No newline at end of file diff --git a/confs/nginx/certs/example.com/cert.pem b/confs/nginx/certs/example.com/cert.pem new file mode 100644 index 0000000..8872e9e --- /dev/null +++ b/confs/nginx/certs/example.com/cert.pem @@ -0,0 +1,44 @@ +-----BEGIN CERTIFICATE----- +MIIHujCCBaKgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgbYxCzAJBgNVBAYTAlJV +MRswGQYDVQQIDBJLYWxpbmluZ3JhZCBSZWdpb24xIDAeBgNVBAoMF0V4YW1wbGUg +Q29ycG9yYXRpb24gTHRkMTYwNAYDVQQLDC1FeGFtcGxlIENvcnBvcmF0aW9uIEx0 +ZCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxMDAuBgNVBAMMJ0V4YW1wbGUgQ29ycG9y +YXRpb24gTHRkIEludGVybWVkaWF0ZSBDQTAeFw0yMTA5MjQyMjEwMjFaFw0zMTA5 +MjIyMjEwMjFaMIHNMQswCQYDVQQGEwJSVTEbMBkGA1UECAwSS2FsaW5pbmdyYWQg +UmVnaW9uMRQwEgYDVQQHDAtLYWxpbmluZ3JhZDEgMB4GA1UECgwXRXhhbXBsZSBD +b3Jwb3JhdGlvbiBMdGQxMDAuBgNVBAsMJ0V4YW1wbGUgQ29ycG9yYXRpb24gTHRk +IFFBIFdlYiBTZXJ2aWNlczEWMBQGA1UEAwwNKi5leGFtcGxlLmNvbTEfMB0GCSqG +SIb3DQEJARYQaW5mb0BleGFtcGxlLmNvbTCCAiIwDQYJKoZIhvcNAQEBBQADggIP +ADCCAgoCggIBALuhbo3Xt4ot38eGjAJpdLZfALyCqH1iqWNXuVpnaUL8JNzv+pQH +BIf9IJpe7VzLgTQTBE+WtvSgIJmaLdlUOnlLSxO4c1l+nyTBa8ckQXHtuYEAggJ2 +MqdYTs0R6O//ee+abDPYGgwa/SDR6J9ocPe2y/Ya1QIJcAgliKwHFGibNaANzDFU +r3WlukgXJU3bqHgxi/77DQWgCkUWGfnlQ1xFqDrH2Oila7CobAnim9RZmHBVDgb+ +btIXikJks9yHSzh1Ev1EVsSFSF48tFQE7ZydNI6z6KedkpHJU2CzWEJXBzsJck3o +0DxpE/AjQzctBYSVloo1uIBkJSHlkpi0g84h6DHAuYtUODaXQN/3OR1oLYCEgsUk +1DoCM9LxR7C90ocU0cyl0DXWm3R3+zLRm+nvutrZINaUeBYXVVTNsUOO1KIYxb6a +5iVSLgP62BelEqwiqaxPkijCGmFMeOa41DqsvASGdZhbjlbzQOegwLShl/t1BRY0 +/fpYgFhFe+YdnCn6JtFnKDYJlgxg+kekK5EQp1uHDLcIPBJyRQ1qzA6iJWrzL5Jk +3HzRznQE6LwW8JQR81KJskDvmZGHpgM40byOs2iLAe1udlwgGsF3Mu2qI/2dTe5k +C4k8eWsjbq166OoRIc1SDorD8emCobwrSeE0++JcChM0tJIPHYg0x4WzAgMBAAGj +ggG3MIIBszAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIGQDAzBglghkgBhvhC +AQ0EJhYkT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUgZm9yIFFBMB0GA1Ud +DgQWBBSuM/p3euZL9tN/yakfM64+AFSdWDCB8gYDVR0jBIHqMIHngBSQxJ5QdPZs +zi46nfFlikou/tauw6GByqSBxzCBxDELMAkGA1UEBhMCUlUxGzAZBgNVBAgMEkth +bGluaW5ncmFkIFJlZ2lvbjEUMBIGA1UEBwwLS2FsaW5pbmdyYWQxIDAeBgNVBAoM +F0V4YW1wbGUgQ29ycG9yYXRpb24gTHRkMTYwNAYDVQQLDC1FeGFtcGxlIENvcnBv +cmF0aW9uIEx0ZCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxKDAmBgNVBAMMH0V4YW1w +bGUgQ29ycG9yYXRpb24gTHRkIFJvb3QgQ0GCAhAAMA4GA1UdDwEB/wQEAwIF4DAT +BgNVHSUEDDAKBggrBgEFBQcDATAlBgNVHREEHjAcggtleGFtcGxlLmNvbYINKi5l +eGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOCAgEAYUq5j+SX6oL8CIEzUmyUv5Ud +fBQwMvNcPF8bAyFGip7KnjJIOyvBdgfAhiXyiDobphcAOzWgY2eAaoWzSBjW+JnB +dDB4cROeG0MJwYq3ScTCsyfkxe6uVvyjy6mLw380eo2A0phW/UqSxOOTnL1uMo6K +StzuQa0AOLkZmPekWtP/WKWmwG1HnBlrDEOTHXPhxVQWLylfCxJXJpRgh2PQwCwI +mOTX/wfWnutqWyLyWsyy37vQ8IEAUaBY7NbHQgTE93Qrfhyb1/d0FdDT8xF/XgQo +1JU/xfEeDZJMbwLUITv7Yl5zFwSXcDhjgA0d27hxJHPGEp9S/xIpyQ/FVzkimt+W +QU4I34SkITLYpble3I9PBK0QqBWQw7SRVwIWLinrGc1bb16rPlfijLutXI56JVjC +qaUV7HiTS5uL4F4Agdr1Ax+LynE1V+FRTsQSvdEe2BPFVIv9IMxMlMniYJdTeTf+ +Z4iGHLHotutklp6my57cirM08g+gKQQBJFlcs66QZj9SZ2vTMvB7QLQ3iYX0jo/6 +Hj7c2wfy+1CQ3AbbrAPSgDlconz7SCH2VON5lydY6ltPB6GnwMYK/dQq0WqpKjvR +0QG2HUbysUvtDmQAaqleVQoDz8BC5+p301gL2OhbS8eEfubjQTidYgvcu2H0NkkX +oQkUKWwNA2HY4IiO2e4= +-----END CERTIFICATE----- \ No newline at end of file diff --git a/confs/nginx/certs/example.com/chain.pem b/confs/nginx/certs/example.com/chain.pem new file mode 100644 index 0000000..d1b1d8e --- /dev/null +++ b/confs/nginx/certs/example.com/chain.pem @@ -0,0 +1,81 @@ +-----BEGIN CERTIFICATE----- +MIIHujCCBaKgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgbYxCzAJBgNVBAYTAlJV +MRswGQYDVQQIDBJLYWxpbmluZ3JhZCBSZWdpb24xIDAeBgNVBAoMF0V4YW1wbGUg +Q29ycG9yYXRpb24gTHRkMTYwNAYDVQQLDC1FeGFtcGxlIENvcnBvcmF0aW9uIEx0 +ZCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxMDAuBgNVBAMMJ0V4YW1wbGUgQ29ycG9y +YXRpb24gTHRkIEludGVybWVkaWF0ZSBDQTAeFw0yMTA5MjQyMjEwMjFaFw0zMTA5 +MjIyMjEwMjFaMIHNMQswCQYDVQQGEwJSVTEbMBkGA1UECAwSS2FsaW5pbmdyYWQg +UmVnaW9uMRQwEgYDVQQHDAtLYWxpbmluZ3JhZDEgMB4GA1UECgwXRXhhbXBsZSBD +b3Jwb3JhdGlvbiBMdGQxMDAuBgNVBAsMJ0V4YW1wbGUgQ29ycG9yYXRpb24gTHRk +IFFBIFdlYiBTZXJ2aWNlczEWMBQGA1UEAwwNKi5leGFtcGxlLmNvbTEfMB0GCSqG +SIb3DQEJARYQaW5mb0BleGFtcGxlLmNvbTCCAiIwDQYJKoZIhvcNAQEBBQADggIP +ADCCAgoCggIBALuhbo3Xt4ot38eGjAJpdLZfALyCqH1iqWNXuVpnaUL8JNzv+pQH +BIf9IJpe7VzLgTQTBE+WtvSgIJmaLdlUOnlLSxO4c1l+nyTBa8ckQXHtuYEAggJ2 +MqdYTs0R6O//ee+abDPYGgwa/SDR6J9ocPe2y/Ya1QIJcAgliKwHFGibNaANzDFU +r3WlukgXJU3bqHgxi/77DQWgCkUWGfnlQ1xFqDrH2Oila7CobAnim9RZmHBVDgb+ +btIXikJks9yHSzh1Ev1EVsSFSF48tFQE7ZydNI6z6KedkpHJU2CzWEJXBzsJck3o +0DxpE/AjQzctBYSVloo1uIBkJSHlkpi0g84h6DHAuYtUODaXQN/3OR1oLYCEgsUk +1DoCM9LxR7C90ocU0cyl0DXWm3R3+zLRm+nvutrZINaUeBYXVVTNsUOO1KIYxb6a +5iVSLgP62BelEqwiqaxPkijCGmFMeOa41DqsvASGdZhbjlbzQOegwLShl/t1BRY0 +/fpYgFhFe+YdnCn6JtFnKDYJlgxg+kekK5EQp1uHDLcIPBJyRQ1qzA6iJWrzL5Jk +3HzRznQE6LwW8JQR81KJskDvmZGHpgM40byOs2iLAe1udlwgGsF3Mu2qI/2dTe5k +C4k8eWsjbq166OoRIc1SDorD8emCobwrSeE0++JcChM0tJIPHYg0x4WzAgMBAAGj +ggG3MIIBszAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIGQDAzBglghkgBhvhC +AQ0EJhYkT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUgZm9yIFFBMB0GA1Ud +DgQWBBSuM/p3euZL9tN/yakfM64+AFSdWDCB8gYDVR0jBIHqMIHngBSQxJ5QdPZs +zi46nfFlikou/tauw6GByqSBxzCBxDELMAkGA1UEBhMCUlUxGzAZBgNVBAgMEkth +bGluaW5ncmFkIFJlZ2lvbjEUMBIGA1UEBwwLS2FsaW5pbmdyYWQxIDAeBgNVBAoM +F0V4YW1wbGUgQ29ycG9yYXRpb24gTHRkMTYwNAYDVQQLDC1FeGFtcGxlIENvcnBv +cmF0aW9uIEx0ZCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxKDAmBgNVBAMMH0V4YW1w +bGUgQ29ycG9yYXRpb24gTHRkIFJvb3QgQ0GCAhAAMA4GA1UdDwEB/wQEAwIF4DAT +BgNVHSUEDDAKBggrBgEFBQcDATAlBgNVHREEHjAcggtleGFtcGxlLmNvbYINKi5l +eGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOCAgEAYUq5j+SX6oL8CIEzUmyUv5Ud +fBQwMvNcPF8bAyFGip7KnjJIOyvBdgfAhiXyiDobphcAOzWgY2eAaoWzSBjW+JnB +dDB4cROeG0MJwYq3ScTCsyfkxe6uVvyjy6mLw380eo2A0phW/UqSxOOTnL1uMo6K +StzuQa0AOLkZmPekWtP/WKWmwG1HnBlrDEOTHXPhxVQWLylfCxJXJpRgh2PQwCwI +mOTX/wfWnutqWyLyWsyy37vQ8IEAUaBY7NbHQgTE93Qrfhyb1/d0FdDT8xF/XgQo +1JU/xfEeDZJMbwLUITv7Yl5zFwSXcDhjgA0d27hxJHPGEp9S/xIpyQ/FVzkimt+W +QU4I34SkITLYpble3I9PBK0QqBWQw7SRVwIWLinrGc1bb16rPlfijLutXI56JVjC +qaUV7HiTS5uL4F4Agdr1Ax+LynE1V+FRTsQSvdEe2BPFVIv9IMxMlMniYJdTeTf+ +Z4iGHLHotutklp6my57cirM08g+gKQQBJFlcs66QZj9SZ2vTMvB7QLQ3iYX0jo/6 +Hj7c2wfy+1CQ3AbbrAPSgDlconz7SCH2VON5lydY6ltPB6GnwMYK/dQq0WqpKjvR +0QG2HUbysUvtDmQAaqleVQoDz8BC5+p301gL2OhbS8eEfubjQTidYgvcu2H0NkkX +oQkUKWwNA2HY4IiO2e4= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGXjCCBEagAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgcQxCzAJBgNVBAYTAlJV +MRswGQYDVQQIDBJLYWxpbmluZ3JhZCBSZWdpb24xFDASBgNVBAcMC0thbGluaW5n +cmFkMSAwHgYDVQQKDBdFeGFtcGxlIENvcnBvcmF0aW9uIEx0ZDE2MDQGA1UECwwt +RXhhbXBsZSBDb3Jwb3JhdGlvbiBMdGQgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MSgw +JgYDVQQDDB9FeGFtcGxlIENvcnBvcmF0aW9uIEx0ZCBSb290IENBMB4XDTIxMDky +NDIyMDEzN1oXDTMzMDkyMTIyMDEzN1owgbYxCzAJBgNVBAYTAlJVMRswGQYDVQQI +DBJLYWxpbmluZ3JhZCBSZWdpb24xIDAeBgNVBAoMF0V4YW1wbGUgQ29ycG9yYXRp +b24gTHRkMTYwNAYDVQQLDC1FeGFtcGxlIENvcnBvcmF0aW9uIEx0ZCBDZXJ0aWZp +Y2F0ZSBBdXRob3JpdHkxMDAuBgNVBAMMJ0V4YW1wbGUgQ29ycG9yYXRpb24gTHRk +IEludGVybWVkaWF0ZSBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB +AMHB34FLQKB1vrdXOViiK/jsoS9W9YWl5eFTelbIacFoh5JmDAP+wR3/mjDvQVUN +24qavPuCnkGsXvh23vXzofulm2ItoL8vVMwwzdrSBpdXkQhFu9yryFN6DrRdDHFi +M0ck0+IBCce0qbm3jHz+HhrTfWxcxKYWW97IOS4lmRjMsUCGNa0aL9RmNkHkOGwz +D8d9VyJA0SMrE+oOZTWKXieOC+NPGT9K6Ei5/EX64pcq5Pgefma2qaSNWJDzk3FZ +32YfTX0OyHvJLD8FthWfXouxBaaxmgGoPaTGS4EFfmA27fxEZJFZb3WBr8RJLUxq +X9NUZt23XqLyr5sJN3UvCgJNsGx5fNXPqZDHxZhYLTL+C2nAZu2D3YOqMlhL/czl +PWtSInuGkeO5DrBw+JoIVyV6yylLao7q0aEpLPIYcpbDhLH0VWLpdVWnizyBTBvB +gkahU37JSFOJHRc/B7/6NkDgsK1MJuOYsPz1k9Vl5fvocCp1Y7F2wpICpWNS8FF3 +emaXt129WLQ6647+YxOJc+L3YlBnbN2M8M/aDUk2ukha69sxvhMCYOqIrUhAey6K +eUJT4ANzJCZyrLNp1eYCbr4jEeK+7cLxRxzSf4M/8bFNSqXJ8L4ODRLvFm2zagJT +bQgpJDKcR3UwqoHUl4Cfknw++p4w03Hx7191cXH+OS1HAgMBAAGjZjBkMB0GA1Ud +DgQWBBSQxJ5QdPZszi46nfFlikou/tauwzAfBgNVHSMEGDAWgBTYsCwyeYbRwATw +UuxxekErGqVHaTASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBhjAN +BgkqhkiG9w0BAQsFAAOCAgEAn+hzVAQgjSvS49O0RuhKt5wggVXaNmx6H+QFfvLm +VMiSr0ILjVfjjTw76Ogk+q5CKpne4PsQ5Aw6YKzM7jINCA5cLQ1OVN53HxJOjXzP +B1aSeEcIRbCBQOomMBzP1yzf6lBkpTK1tpYvGBosLjCQyYwu+Ty52bT+NEbAoqYd +J0LXzEJeW5xN9AN+bWJ1IVemjCgyAa6MmWlCiYveHcO7/DkfLmi8JZj60ynPjkNZ +8CWpdSOzLFwVRSy5YMLluTcdjIgCdgYrBwFxQ4+/QX9V+iRJ7QxRKNbSM5ZZE948 +VvYWB3oZEPrRv4Rji5Geedy8xhXe9dAgPkeYY7Ra9i6MyisiLcSqScG+k0hMHmbF +5NhJiToUJaZcff1wfBUBKDoSmeCNdDzxtWODIa4ouh7T/7Jitk9Ps4OV8MBJC2zE +c0vKplgxKdCWA2luJHkFOrKWQgwN+ypdbbCZ0pcQS2pJ7w53QlVKf4Y4qlO+uJLs +pTMlem0rmV6Y8u0K+lGk0keGKz5stzLhk9LeKxiXqnh4pv0DvGUScfdOa75d9IYh +JZy7/KNgNYFdW/FgqXKzlbA1nv3NBl7dVYXQ3ICnRje1UHK0IlXcy3fY3ajKD+8o ++FtpOVp65U17XFS6yBbejSnfVsrrHi2HMHkLTot9SCn1E8LS//pFKW+992kENvVI +P5o= +-----END CERTIFICATE----- \ No newline at end of file diff --git a/confs/nginx/certs/example.com/dhparam.pem b/confs/nginx/certs/example.com/dhparam.pem new file mode 100644 index 0000000..86d5186 --- /dev/null +++ b/confs/nginx/certs/example.com/dhparam.pem @@ -0,0 +1,13 @@ +-----BEGIN DH PARAMETERS----- +MIICCAKCAgEAovFUNRNIZ5euF8tx/KUe3mRMfTNYGvz9prWG3baAg5XWssM/DLaC +ci9z6A9M36R8sFZogGenp5H8VHCTF0JBe4DkmB389m8z6qY7rk5viq/S3buOxo41 +sSqVUZkDF9dnAoT0eFSgbJXieg30gVsxxtxdNfGb3A/42fjlxhzo/4tK7aShhKv8 +YXV1kCPAWPGsqmnXZeia8VVKmAnao6TLpSLbn2gEo77TsyHKKVb+qvfldwqfqgkc +jGP4IT1E6MxvAjOliDxE/99OcO1yCDvHZGVJ9GtskXFVJI2spjUvL2oRFYJvW+Cv +NrBjd2e4x6h+WINNp/bvLv3oDhZ75sPN+2PCpq6IFS2KX+yJWG9z82Gv2YDg6VpA +AwVRHOFqiltbi6s5xSdGF5sExDcUyNCb52GPC3u7UiewpC7ZRL0TsNYmx5Kdb5cs +ST8x/rCJAIsRN9czccIh9Hc96A40v1ZW0N848pGh6Rbgb/cz3EDJMFIiHOr4ZcOf +qbvA9//yU94F5Ctiv54neO9uKeIecx0LILDRpz5dPmZIy69pdkc9/2JNB2fqdL6j +8CW+3z0Dq2z0o3xOnOBwNA0fSNGHEjA4CqlolGevGkFEMIBXBYqz0xq8vSwKF6AC +Ex/W58agi8B61hH4XKFBokD/RkLlN/Ulf2LTaTQOTalcGQDQR1uHWo8CAQI= +-----END DH PARAMETERS----- diff --git a/confs/nginx/certs/example.com/fullchain.pem b/confs/nginx/certs/example.com/fullchain.pem new file mode 100644 index 0000000..2baace3 --- /dev/null +++ b/confs/nginx/certs/example.com/fullchain.pem @@ -0,0 +1,118 @@ +-----BEGIN CERTIFICATE----- +MIIHujCCBaKgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgbYxCzAJBgNVBAYTAlJV +MRswGQYDVQQIDBJLYWxpbmluZ3JhZCBSZWdpb24xIDAeBgNVBAoMF0V4YW1wbGUg +Q29ycG9yYXRpb24gTHRkMTYwNAYDVQQLDC1FeGFtcGxlIENvcnBvcmF0aW9uIEx0 +ZCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxMDAuBgNVBAMMJ0V4YW1wbGUgQ29ycG9y +YXRpb24gTHRkIEludGVybWVkaWF0ZSBDQTAeFw0yMTA5MjQyMjEwMjFaFw0zMTA5 +MjIyMjEwMjFaMIHNMQswCQYDVQQGEwJSVTEbMBkGA1UECAwSS2FsaW5pbmdyYWQg +UmVnaW9uMRQwEgYDVQQHDAtLYWxpbmluZ3JhZDEgMB4GA1UECgwXRXhhbXBsZSBD +b3Jwb3JhdGlvbiBMdGQxMDAuBgNVBAsMJ0V4YW1wbGUgQ29ycG9yYXRpb24gTHRk +IFFBIFdlYiBTZXJ2aWNlczEWMBQGA1UEAwwNKi5leGFtcGxlLmNvbTEfMB0GCSqG +SIb3DQEJARYQaW5mb0BleGFtcGxlLmNvbTCCAiIwDQYJKoZIhvcNAQEBBQADggIP +ADCCAgoCggIBALuhbo3Xt4ot38eGjAJpdLZfALyCqH1iqWNXuVpnaUL8JNzv+pQH +BIf9IJpe7VzLgTQTBE+WtvSgIJmaLdlUOnlLSxO4c1l+nyTBa8ckQXHtuYEAggJ2 +MqdYTs0R6O//ee+abDPYGgwa/SDR6J9ocPe2y/Ya1QIJcAgliKwHFGibNaANzDFU +r3WlukgXJU3bqHgxi/77DQWgCkUWGfnlQ1xFqDrH2Oila7CobAnim9RZmHBVDgb+ +btIXikJks9yHSzh1Ev1EVsSFSF48tFQE7ZydNI6z6KedkpHJU2CzWEJXBzsJck3o +0DxpE/AjQzctBYSVloo1uIBkJSHlkpi0g84h6DHAuYtUODaXQN/3OR1oLYCEgsUk +1DoCM9LxR7C90ocU0cyl0DXWm3R3+zLRm+nvutrZINaUeBYXVVTNsUOO1KIYxb6a +5iVSLgP62BelEqwiqaxPkijCGmFMeOa41DqsvASGdZhbjlbzQOegwLShl/t1BRY0 +/fpYgFhFe+YdnCn6JtFnKDYJlgxg+kekK5EQp1uHDLcIPBJyRQ1qzA6iJWrzL5Jk +3HzRznQE6LwW8JQR81KJskDvmZGHpgM40byOs2iLAe1udlwgGsF3Mu2qI/2dTe5k +C4k8eWsjbq166OoRIc1SDorD8emCobwrSeE0++JcChM0tJIPHYg0x4WzAgMBAAGj +ggG3MIIBszAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIGQDAzBglghkgBhvhC +AQ0EJhYkT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUgZm9yIFFBMB0GA1Ud +DgQWBBSuM/p3euZL9tN/yakfM64+AFSdWDCB8gYDVR0jBIHqMIHngBSQxJ5QdPZs +zi46nfFlikou/tauw6GByqSBxzCBxDELMAkGA1UEBhMCUlUxGzAZBgNVBAgMEkth +bGluaW5ncmFkIFJlZ2lvbjEUMBIGA1UEBwwLS2FsaW5pbmdyYWQxIDAeBgNVBAoM +F0V4YW1wbGUgQ29ycG9yYXRpb24gTHRkMTYwNAYDVQQLDC1FeGFtcGxlIENvcnBv +cmF0aW9uIEx0ZCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxKDAmBgNVBAMMH0V4YW1w +bGUgQ29ycG9yYXRpb24gTHRkIFJvb3QgQ0GCAhAAMA4GA1UdDwEB/wQEAwIF4DAT +BgNVHSUEDDAKBggrBgEFBQcDATAlBgNVHREEHjAcggtleGFtcGxlLmNvbYINKi5l +eGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOCAgEAYUq5j+SX6oL8CIEzUmyUv5Ud +fBQwMvNcPF8bAyFGip7KnjJIOyvBdgfAhiXyiDobphcAOzWgY2eAaoWzSBjW+JnB +dDB4cROeG0MJwYq3ScTCsyfkxe6uVvyjy6mLw380eo2A0phW/UqSxOOTnL1uMo6K +StzuQa0AOLkZmPekWtP/WKWmwG1HnBlrDEOTHXPhxVQWLylfCxJXJpRgh2PQwCwI +mOTX/wfWnutqWyLyWsyy37vQ8IEAUaBY7NbHQgTE93Qrfhyb1/d0FdDT8xF/XgQo +1JU/xfEeDZJMbwLUITv7Yl5zFwSXcDhjgA0d27hxJHPGEp9S/xIpyQ/FVzkimt+W +QU4I34SkITLYpble3I9PBK0QqBWQw7SRVwIWLinrGc1bb16rPlfijLutXI56JVjC +qaUV7HiTS5uL4F4Agdr1Ax+LynE1V+FRTsQSvdEe2BPFVIv9IMxMlMniYJdTeTf+ +Z4iGHLHotutklp6my57cirM08g+gKQQBJFlcs66QZj9SZ2vTMvB7QLQ3iYX0jo/6 +Hj7c2wfy+1CQ3AbbrAPSgDlconz7SCH2VON5lydY6ltPB6GnwMYK/dQq0WqpKjvR +0QG2HUbysUvtDmQAaqleVQoDz8BC5+p301gL2OhbS8eEfubjQTidYgvcu2H0NkkX +oQkUKWwNA2HY4IiO2e4= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGXjCCBEagAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgcQxCzAJBgNVBAYTAlJV +MRswGQYDVQQIDBJLYWxpbmluZ3JhZCBSZWdpb24xFDASBgNVBAcMC0thbGluaW5n +cmFkMSAwHgYDVQQKDBdFeGFtcGxlIENvcnBvcmF0aW9uIEx0ZDE2MDQGA1UECwwt +RXhhbXBsZSBDb3Jwb3JhdGlvbiBMdGQgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MSgw +JgYDVQQDDB9FeGFtcGxlIENvcnBvcmF0aW9uIEx0ZCBSb290IENBMB4XDTIxMDky +NDIyMDEzN1oXDTMzMDkyMTIyMDEzN1owgbYxCzAJBgNVBAYTAlJVMRswGQYDVQQI +DBJLYWxpbmluZ3JhZCBSZWdpb24xIDAeBgNVBAoMF0V4YW1wbGUgQ29ycG9yYXRp +b24gTHRkMTYwNAYDVQQLDC1FeGFtcGxlIENvcnBvcmF0aW9uIEx0ZCBDZXJ0aWZp +Y2F0ZSBBdXRob3JpdHkxMDAuBgNVBAMMJ0V4YW1wbGUgQ29ycG9yYXRpb24gTHRk +IEludGVybWVkaWF0ZSBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB +AMHB34FLQKB1vrdXOViiK/jsoS9W9YWl5eFTelbIacFoh5JmDAP+wR3/mjDvQVUN +24qavPuCnkGsXvh23vXzofulm2ItoL8vVMwwzdrSBpdXkQhFu9yryFN6DrRdDHFi +M0ck0+IBCce0qbm3jHz+HhrTfWxcxKYWW97IOS4lmRjMsUCGNa0aL9RmNkHkOGwz +D8d9VyJA0SMrE+oOZTWKXieOC+NPGT9K6Ei5/EX64pcq5Pgefma2qaSNWJDzk3FZ +32YfTX0OyHvJLD8FthWfXouxBaaxmgGoPaTGS4EFfmA27fxEZJFZb3WBr8RJLUxq +X9NUZt23XqLyr5sJN3UvCgJNsGx5fNXPqZDHxZhYLTL+C2nAZu2D3YOqMlhL/czl +PWtSInuGkeO5DrBw+JoIVyV6yylLao7q0aEpLPIYcpbDhLH0VWLpdVWnizyBTBvB +gkahU37JSFOJHRc/B7/6NkDgsK1MJuOYsPz1k9Vl5fvocCp1Y7F2wpICpWNS8FF3 +emaXt129WLQ6647+YxOJc+L3YlBnbN2M8M/aDUk2ukha69sxvhMCYOqIrUhAey6K +eUJT4ANzJCZyrLNp1eYCbr4jEeK+7cLxRxzSf4M/8bFNSqXJ8L4ODRLvFm2zagJT +bQgpJDKcR3UwqoHUl4Cfknw++p4w03Hx7191cXH+OS1HAgMBAAGjZjBkMB0GA1Ud +DgQWBBSQxJ5QdPZszi46nfFlikou/tauwzAfBgNVHSMEGDAWgBTYsCwyeYbRwATw +UuxxekErGqVHaTASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBhjAN +BgkqhkiG9w0BAQsFAAOCAgEAn+hzVAQgjSvS49O0RuhKt5wggVXaNmx6H+QFfvLm +VMiSr0ILjVfjjTw76Ogk+q5CKpne4PsQ5Aw6YKzM7jINCA5cLQ1OVN53HxJOjXzP +B1aSeEcIRbCBQOomMBzP1yzf6lBkpTK1tpYvGBosLjCQyYwu+Ty52bT+NEbAoqYd +J0LXzEJeW5xN9AN+bWJ1IVemjCgyAa6MmWlCiYveHcO7/DkfLmi8JZj60ynPjkNZ +8CWpdSOzLFwVRSy5YMLluTcdjIgCdgYrBwFxQ4+/QX9V+iRJ7QxRKNbSM5ZZE948 +VvYWB3oZEPrRv4Rji5Geedy8xhXe9dAgPkeYY7Ra9i6MyisiLcSqScG+k0hMHmbF +5NhJiToUJaZcff1wfBUBKDoSmeCNdDzxtWODIa4ouh7T/7Jitk9Ps4OV8MBJC2zE +c0vKplgxKdCWA2luJHkFOrKWQgwN+ypdbbCZ0pcQS2pJ7w53QlVKf4Y4qlO+uJLs +pTMlem0rmV6Y8u0K+lGk0keGKz5stzLhk9LeKxiXqnh4pv0DvGUScfdOa75d9IYh +JZy7/KNgNYFdW/FgqXKzlbA1nv3NBl7dVYXQ3ICnRje1UHK0IlXcy3fY3ajKD+8o ++FtpOVp65U17XFS6yBbejSnfVsrrHi2HMHkLTot9SCn1E8LS//pFKW+992kENvVI +P5o= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGezCCBGOgAwIBAgIUJZ5ElNKY4dnFET+p9yIObZSierkwDQYJKoZIhvcNAQEL +BQAwgcQxCzAJBgNVBAYTAlJVMRswGQYDVQQIDBJLYWxpbmluZ3JhZCBSZWdpb24x +FDASBgNVBAcMC0thbGluaW5ncmFkMSAwHgYDVQQKDBdFeGFtcGxlIENvcnBvcmF0 +aW9uIEx0ZDE2MDQGA1UECwwtRXhhbXBsZSBDb3Jwb3JhdGlvbiBMdGQgQ2VydGlm +aWNhdGUgQXV0aG9yaXR5MSgwJgYDVQQDDB9FeGFtcGxlIENvcnBvcmF0aW9uIEx0 +ZCBSb290IENBMB4XDTIxMDkyNDIyMDEzN1oXDTM3MDkyMDIyMDEzN1owgcQxCzAJ +BgNVBAYTAlJVMRswGQYDVQQIDBJLYWxpbmluZ3JhZCBSZWdpb24xFDASBgNVBAcM +C0thbGluaW5ncmFkMSAwHgYDVQQKDBdFeGFtcGxlIENvcnBvcmF0aW9uIEx0ZDE2 +MDQGA1UECwwtRXhhbXBsZSBDb3Jwb3JhdGlvbiBMdGQgQ2VydGlmaWNhdGUgQXV0 +aG9yaXR5MSgwJgYDVQQDDB9FeGFtcGxlIENvcnBvcmF0aW9uIEx0ZCBSb290IENB +MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAt5LGz+dNpCBb3gk9Av4L +zzrMseZilNtJrr8afOmBgZw06TVPwutVah5PrXj3EbACE+JdO9c31WrxJiyym2CO +vZCYDtveiIN+o3U84STQ6s5tqQReqopoEHTjYXafSTkjeY5u51IM3kksic5HDYCe +g9xEwlWUXYNb7PtKUlNnZOgEhO3AK6OOPMp/0ApQX6ScDU0EjPQ7y5wFrSqRqCBB +yyYvJd9aG9vmwdckESoKxNo1HXEV0V/6SH4D3scKVKJB148e9zbjvd2U+SJ29/AQ +NsoDE7SeG+wDRc1f2jhXiaopg/mNjE63w8+whQsN98CbO+HuoI7dR5AgMZ2xDrA1 +JgWahT10gpA5OIS0V/6flTYIyMKSBURM0QfHxz887VBwHoPHYb3xc50yH6OemoMS +ZtcbGlCqIi9if/9vgaEZNYRjJZEkhHLFem9sn1n1IfeIutyR2pbUbo2sJvnldCk1 +ePzn24nbGJLQvpv8PZg01wI0HCTfFdC28VbwMPC7vsm2EfP9+qKVhQ6JCzFewo1t +0EpF49HwZqAR1oAXXxLYiP+O9/MsYzJ12RNjpL75R9PzD7bU7Dw9Qjk6r6C7FTlT +MID4gsCHfwUTUiVtMlXwc33WM5ucifhmfX/eCvM2g8fbygf+LcvKPaoUGnF3IULb +G3IELyx1Ye9wAZGJO7T1IIMCAwEAAaNjMGEwHQYDVR0OBBYEFNiwLDJ5htHABPBS +7HF6QSsapUdpMB8GA1UdIwQYMBaAFNiwLDJ5htHABPBS7HF6QSsapUdpMA8GA1Ud +EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQA/ +V8LKw2S2RoN063jX3G2Q+U9hbQsE8t6xYvxjiu+TJrJUUcU1PrlV6iNSbWaVPARr +6noY3/6zK9kxXQryvgjVK6ckPTEaaYST7iKGgBtJkYU354cACPtybt0GrXvqTEQc +Aly8/2mJ+/X6/ZadwVeJV6XswHqc8466/KEeKThm62mWHgAX26i98FMzFlQryFYs +CnQq0EIv5Zg7uFRKt0Z/pCosU8+JFX42UKnRVbsMMjZMOVxAhe8QBvMA7bkw0P1o +0GSY++mhKAORAUi0/jPCfj5Y+ot+VWpSgVHVxpo6EuefgNQl7c1KmaESur4ToW0a +va/VpxGFgbRUJJAgLg59uRAs3WvUqCCw2p9M2K6xbMiqAZYKRVoK3J6EB7REFypD +c/vaJfFXJyUmgKgW1eeWODqIOvhhkdi1tfx8YDBXNjk519Engrd0nTY06g7O3B9D +V0dajcylfSTeFxaQLa6jF5Qs6rE655wLS7I8SpmYZ4Eevqwl6nU1GffD7JnthZEl +c7G74iB68ksqQcjhpNwt+eg/LzokmybKnzK5QMnxDisttR9qhhcM+p+kIiy9XC82 +8GMUkdw6eG8VUqnkcRIADffaWuVwcH6fwWBqq4Ju9LVpVbm97jeQ/GszFYGyANba +/vu1wRYPkcWgrFXN/UlbKra5RNFmHesrQ5gcRXsR7Q== +-----END CERTIFICATE----- \ No newline at end of file diff --git a/confs/nginx/certs/example.com/intermediateCA.pem b/confs/nginx/certs/example.com/intermediateCA.pem new file mode 100644 index 0000000..cb4960b --- /dev/null +++ b/confs/nginx/certs/example.com/intermediateCA.pem @@ -0,0 +1,37 @@ +-----BEGIN CERTIFICATE----- +MIIGXjCCBEagAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgcQxCzAJBgNVBAYTAlJV +MRswGQYDVQQIDBJLYWxpbmluZ3JhZCBSZWdpb24xFDASBgNVBAcMC0thbGluaW5n +cmFkMSAwHgYDVQQKDBdFeGFtcGxlIENvcnBvcmF0aW9uIEx0ZDE2MDQGA1UECwwt +RXhhbXBsZSBDb3Jwb3JhdGlvbiBMdGQgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MSgw +JgYDVQQDDB9FeGFtcGxlIENvcnBvcmF0aW9uIEx0ZCBSb290IENBMB4XDTIxMDky +NDIyMDEzN1oXDTMzMDkyMTIyMDEzN1owgbYxCzAJBgNVBAYTAlJVMRswGQYDVQQI +DBJLYWxpbmluZ3JhZCBSZWdpb24xIDAeBgNVBAoMF0V4YW1wbGUgQ29ycG9yYXRp +b24gTHRkMTYwNAYDVQQLDC1FeGFtcGxlIENvcnBvcmF0aW9uIEx0ZCBDZXJ0aWZp +Y2F0ZSBBdXRob3JpdHkxMDAuBgNVBAMMJ0V4YW1wbGUgQ29ycG9yYXRpb24gTHRk +IEludGVybWVkaWF0ZSBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB +AMHB34FLQKB1vrdXOViiK/jsoS9W9YWl5eFTelbIacFoh5JmDAP+wR3/mjDvQVUN +24qavPuCnkGsXvh23vXzofulm2ItoL8vVMwwzdrSBpdXkQhFu9yryFN6DrRdDHFi +M0ck0+IBCce0qbm3jHz+HhrTfWxcxKYWW97IOS4lmRjMsUCGNa0aL9RmNkHkOGwz +D8d9VyJA0SMrE+oOZTWKXieOC+NPGT9K6Ei5/EX64pcq5Pgefma2qaSNWJDzk3FZ +32YfTX0OyHvJLD8FthWfXouxBaaxmgGoPaTGS4EFfmA27fxEZJFZb3WBr8RJLUxq +X9NUZt23XqLyr5sJN3UvCgJNsGx5fNXPqZDHxZhYLTL+C2nAZu2D3YOqMlhL/czl +PWtSInuGkeO5DrBw+JoIVyV6yylLao7q0aEpLPIYcpbDhLH0VWLpdVWnizyBTBvB +gkahU37JSFOJHRc/B7/6NkDgsK1MJuOYsPz1k9Vl5fvocCp1Y7F2wpICpWNS8FF3 +emaXt129WLQ6647+YxOJc+L3YlBnbN2M8M/aDUk2ukha69sxvhMCYOqIrUhAey6K +eUJT4ANzJCZyrLNp1eYCbr4jEeK+7cLxRxzSf4M/8bFNSqXJ8L4ODRLvFm2zagJT +bQgpJDKcR3UwqoHUl4Cfknw++p4w03Hx7191cXH+OS1HAgMBAAGjZjBkMB0GA1Ud +DgQWBBSQxJ5QdPZszi46nfFlikou/tauwzAfBgNVHSMEGDAWgBTYsCwyeYbRwATw +UuxxekErGqVHaTASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBhjAN +BgkqhkiG9w0BAQsFAAOCAgEAn+hzVAQgjSvS49O0RuhKt5wggVXaNmx6H+QFfvLm +VMiSr0ILjVfjjTw76Ogk+q5CKpne4PsQ5Aw6YKzM7jINCA5cLQ1OVN53HxJOjXzP +B1aSeEcIRbCBQOomMBzP1yzf6lBkpTK1tpYvGBosLjCQyYwu+Ty52bT+NEbAoqYd +J0LXzEJeW5xN9AN+bWJ1IVemjCgyAa6MmWlCiYveHcO7/DkfLmi8JZj60ynPjkNZ +8CWpdSOzLFwVRSy5YMLluTcdjIgCdgYrBwFxQ4+/QX9V+iRJ7QxRKNbSM5ZZE948 +VvYWB3oZEPrRv4Rji5Geedy8xhXe9dAgPkeYY7Ra9i6MyisiLcSqScG+k0hMHmbF +5NhJiToUJaZcff1wfBUBKDoSmeCNdDzxtWODIa4ouh7T/7Jitk9Ps4OV8MBJC2zE +c0vKplgxKdCWA2luJHkFOrKWQgwN+ypdbbCZ0pcQS2pJ7w53QlVKf4Y4qlO+uJLs +pTMlem0rmV6Y8u0K+lGk0keGKz5stzLhk9LeKxiXqnh4pv0DvGUScfdOa75d9IYh +JZy7/KNgNYFdW/FgqXKzlbA1nv3NBl7dVYXQ3ICnRje1UHK0IlXcy3fY3ajKD+8o ++FtpOVp65U17XFS6yBbejSnfVsrrHi2HMHkLTot9SCn1E8LS//pFKW+992kENvVI +P5o= +-----END CERTIFICATE----- \ No newline at end of file diff --git a/confs/nginx/certs/example.com/privkey.pem b/confs/nginx/certs/example.com/privkey.pem new file mode 100644 index 0000000..dc3ed76 --- /dev/null +++ b/confs/nginx/certs/example.com/privkey.pem @@ -0,0 +1,51 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIJKAIBAAKCAgEAu6Fujde3ii3fx4aMAml0tl8AvIKofWKpY1e5WmdpQvwk3O/6 +lAcEh/0gml7tXMuBNBMET5a29KAgmZot2VQ6eUtLE7hzWX6fJMFrxyRBce25gQCC +AnYyp1hOzRHo7/9575psM9gaDBr9INHon2hw97bL9hrVAglwCCWIrAcUaJs1oA3M +MVSvdaW6SBclTduoeDGL/vsNBaAKRRYZ+eVDXEWoOsfY6KVrsKhsCeKb1FmYcFUO +Bv5u0heKQmSz3IdLOHUS/URWxIVIXjy0VATtnJ00jrPop52SkclTYLNYQlcHOwly +TejQPGkT8CNDNy0FhJWWijW4gGQlIeWSmLSDziHoMcC5i1Q4NpdA3/c5HWgtgISC +xSTUOgIz0vFHsL3ShxTRzKXQNdabdHf7MtGb6e+62tkg1pR4FhdVVM2xQ47UohjF +vprmJVIuA/rYF6USrCKprE+SKMIaYUx45rjUOqy8BIZ1mFuOVvNA56DAtKGX+3UF +FjT9+liAWEV75h2cKfom0WcoNgmWDGD6R6QrkRCnW4cMtwg8EnJFDWrMDqIlavMv +kmTcfNHOdATovBbwlBHzUomyQO+ZkYemAzjRvI6zaIsB7W52XCAawXcy7aoj/Z1N +7mQLiTx5ayNurXro6hEhzVIOisPx6YKhvCtJ4TT74lwKEzS0kg8diDTHhbMCAwEA +AQKCAgAW9gZlbUSUsFB2RkzT7rvNpYqdhw+/aFd6RL32BjmnbNvF/cgYXVN8oMlg +msVJWc4R5VHdu3/gJ8hVg7ygn+IX/dLOMwBKr2giQ1lBIXqwynqtArbmPjisqe3a +wppS5FyzqZ4cKhHl8VeQsJ9bApjwd3o2P8pZWXZQSOeUxbkFpBjH4WhfkRF3wDQv +pkV2Za8UJlwPdAF/8rnPAoljP18i55NSvioZLkUjdTjjbMvNDLnO5Vm2GWTOaPsO +bOxlzFi0K/+K5tYHbpgQkDUxIvlA9Sv9Wp7aBDpvhMejSc8/Lw8/dkR6rEbvXZyH +AomzMts+AmBNwY02iQrSPxnVfiGy3l6DcrjNSm46ka6Y88sG0fX3A6E5WlJuuUf4 +pJO+/Nu/YRssjndmGtXLmikDE/0kaMIhPjYzkr5qZ0VKzkydB65P2SGxrEAKIj3W +hT9mhbLe+Shy4k1hO3xtDELBlAcWcenTNO6PVnO28XkiLs3Dhb9rkCmMLcmRiEmU +3Z4MkMRZ7RgxR8/JsEh4TdsOXOmVLukzKVXmLA8Bvpf1/S3GDYjI6wVx5hmSzalI +UOp02KHx9+XYIWxNUImHWOCUgKsYKaagIgVJLvttCsMYnXut84/QWipcSspLSVp1 +bnrJN+AhzmmYsEInE6/NGJRH2tFNJBldi/jow/WJP8NtG96K4QKCAQEA4yVou/F9 +AIa8ibib11XOmU7+YrpFbv/l+YFsEWfuskayvsSahvy4mWdCmySwPWiZgi1lym5T +muw5dFggvbbTebNgBjiAC0hxHo3MMH8pWsxaE8TuE2KS5/OO+mJe+ZfI+8+LfoAx +IbKGTrDLUDgENzpCbMuuSF2JrZBKs7fPdgFtq6fKnAlqYaEbD97ellwwaS+5lk3a +zzOV0q5zPYPTXAT39FFu7CgLAy+Uf6hKFhXdWX/lCOC9Qt0QIw1s8xf6im4M7LkU +ALrBNahCaxpT1OzBtXRiLoTiznJHYerKKH+qwh7kQcWmArgqkIXEiSek6m8dEv1Y +/JMmY9+eaEDwRQKCAQEA03cDM6HhBlWDwmsyz7R+RhkVK1oGC4KURDzfxU3VLYy3 +Mpo64MZR4kxgVwJD2w5m1s7kxGeiOfYu79zVdsekbBn+zW1cwmDaDM/RjBsDUoeL +QhyqfASSYIvtfqelBlVDT59RXK6o0lb7gXLBR7nFoEf5puVhj787nvbIhQhT+rID +46/660MCTRtbFwhhAtTNChaoHafEB1Pje6fSEI/B3yAdlVP1ZK0Cnx7ftKkWW4va +B33E3Dlb8HGwLM1GbpipemoSsSLTa0mV3c1sxTlOJHL9yiQpmk+uW3Vd8ssEDQmP +ieQrA+/LKPAtP/NZ2UFDZYnIDTd6GIUZyLbtRM/plwKCAQAdfrgQ35S5wsUspPon +hg7jvWwu6b0mYrg8I+AiinpmT+PZ/bGLIbnewZfWiXcRIkn8q2RyWs0katQzFVZ7 +DAh93xry89c8n9WAgC0phvmZvrtbodDAV6Z31BqWzLtEcb85Y4Pbk03N8F6cTTy5 +V+zENx50/iXNY8gC75+jopSf4CObjJg0lsxnjQH0l54TrDjlD7trlwR4r1wfFWQF +ct65LjP8V66tn61+ZmlEAlhMcd5iRsc41eX9jrMPuiiRkGWKICwxeP7t8VIxY33s +ZmjIV033//rXy42f/RrjzhceFyXXOyesmrup0rxEM/qHTMyPXIpL8vXhJkJv6ZOq +OfR5AoIBAQC9GQbu7Apa7KuXdt8IKAJnUtTAYI9ZSZqmbr04JcLFKblE8fBGwnHE +6MGZ7Pea8wT5gCfIjlfedwxACH2G6z5YQOK+9tXlKFC09j4PiLRu37CjHRlDL59p +4JcvFGEZCbPYhsJuG+3xskDT4DeAmVplWxefrC2TKtH48/waInlejEO4Hs1GBjUP +mK/bJ+4AZyU3qU0Kv9QnLVgWYtsRXkxi58gsmdit/5yBiE1Js46/rI769ffNaymR +GUkOtz4NdkzPn/05E8h1f2cZ4jIrJ3R+WaojUjU1vZ1QQeMSU4M62VrXVwc0TQGi +iSwdrNKi2Z6YNR6E2yA+vv9wokwIpdffAoIBADKy2cZA3iKNUk+f0lRt3RzkqAWw +6HPmb4YrAFjxE7Qvf+QW3T0AjCwd64hFG303CnY6kXK4lknsITM6ndSg5Y+2yiNE +0pl+GEnY08rJ2qHi01F3cso1g4MbuPbnm02nVYbzjTx+a/VWKB51KREsdMVduwol +SCVd1bRGT/GgX4s+AsXWJj/IrOkOm1CBZuJ0d84UeCusQ6WUes+FCiT4DKSAMa8Z +hexjepISN1lQtNKEVEEg2dcR93cXxTkEm8Cq4muXcBAmgv5cTdpj7cZK/xsZHpbg +wnxS4snwq3cAjAmiKC01Lo47aJEIyws4mf8lI/XZaiIDI6bNJU5ctc6ScLY= +-----END RSA PRIVATE KEY----- \ No newline at end of file diff --git a/confs/nginx/certs/example.com/rootCA.pem b/confs/nginx/certs/example.com/rootCA.pem new file mode 100644 index 0000000..25a2924 --- /dev/null +++ b/confs/nginx/certs/example.com/rootCA.pem @@ -0,0 +1,37 @@ +-----BEGIN CERTIFICATE----- +MIIGezCCBGOgAwIBAgIUJZ5ElNKY4dnFET+p9yIObZSierkwDQYJKoZIhvcNAQEL +BQAwgcQxCzAJBgNVBAYTAlJVMRswGQYDVQQIDBJLYWxpbmluZ3JhZCBSZWdpb24x +FDASBgNVBAcMC0thbGluaW5ncmFkMSAwHgYDVQQKDBdFeGFtcGxlIENvcnBvcmF0 +aW9uIEx0ZDE2MDQGA1UECwwtRXhhbXBsZSBDb3Jwb3JhdGlvbiBMdGQgQ2VydGlm +aWNhdGUgQXV0aG9yaXR5MSgwJgYDVQQDDB9FeGFtcGxlIENvcnBvcmF0aW9uIEx0 +ZCBSb290IENBMB4XDTIxMDkyNDIyMDEzN1oXDTM3MDkyMDIyMDEzN1owgcQxCzAJ +BgNVBAYTAlJVMRswGQYDVQQIDBJLYWxpbmluZ3JhZCBSZWdpb24xFDASBgNVBAcM +C0thbGluaW5ncmFkMSAwHgYDVQQKDBdFeGFtcGxlIENvcnBvcmF0aW9uIEx0ZDE2 +MDQGA1UECwwtRXhhbXBsZSBDb3Jwb3JhdGlvbiBMdGQgQ2VydGlmaWNhdGUgQXV0 +aG9yaXR5MSgwJgYDVQQDDB9FeGFtcGxlIENvcnBvcmF0aW9uIEx0ZCBSb290IENB +MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAt5LGz+dNpCBb3gk9Av4L +zzrMseZilNtJrr8afOmBgZw06TVPwutVah5PrXj3EbACE+JdO9c31WrxJiyym2CO +vZCYDtveiIN+o3U84STQ6s5tqQReqopoEHTjYXafSTkjeY5u51IM3kksic5HDYCe +g9xEwlWUXYNb7PtKUlNnZOgEhO3AK6OOPMp/0ApQX6ScDU0EjPQ7y5wFrSqRqCBB +yyYvJd9aG9vmwdckESoKxNo1HXEV0V/6SH4D3scKVKJB148e9zbjvd2U+SJ29/AQ +NsoDE7SeG+wDRc1f2jhXiaopg/mNjE63w8+whQsN98CbO+HuoI7dR5AgMZ2xDrA1 +JgWahT10gpA5OIS0V/6flTYIyMKSBURM0QfHxz887VBwHoPHYb3xc50yH6OemoMS +ZtcbGlCqIi9if/9vgaEZNYRjJZEkhHLFem9sn1n1IfeIutyR2pbUbo2sJvnldCk1 +ePzn24nbGJLQvpv8PZg01wI0HCTfFdC28VbwMPC7vsm2EfP9+qKVhQ6JCzFewo1t +0EpF49HwZqAR1oAXXxLYiP+O9/MsYzJ12RNjpL75R9PzD7bU7Dw9Qjk6r6C7FTlT +MID4gsCHfwUTUiVtMlXwc33WM5ucifhmfX/eCvM2g8fbygf+LcvKPaoUGnF3IULb +G3IELyx1Ye9wAZGJO7T1IIMCAwEAAaNjMGEwHQYDVR0OBBYEFNiwLDJ5htHABPBS +7HF6QSsapUdpMB8GA1UdIwQYMBaAFNiwLDJ5htHABPBS7HF6QSsapUdpMA8GA1Ud +EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQA/ +V8LKw2S2RoN063jX3G2Q+U9hbQsE8t6xYvxjiu+TJrJUUcU1PrlV6iNSbWaVPARr +6noY3/6zK9kxXQryvgjVK6ckPTEaaYST7iKGgBtJkYU354cACPtybt0GrXvqTEQc +Aly8/2mJ+/X6/ZadwVeJV6XswHqc8466/KEeKThm62mWHgAX26i98FMzFlQryFYs +CnQq0EIv5Zg7uFRKt0Z/pCosU8+JFX42UKnRVbsMMjZMOVxAhe8QBvMA7bkw0P1o +0GSY++mhKAORAUi0/jPCfj5Y+ot+VWpSgVHVxpo6EuefgNQl7c1KmaESur4ToW0a +va/VpxGFgbRUJJAgLg59uRAs3WvUqCCw2p9M2K6xbMiqAZYKRVoK3J6EB7REFypD +c/vaJfFXJyUmgKgW1eeWODqIOvhhkdi1tfx8YDBXNjk519Engrd0nTY06g7O3B9D +V0dajcylfSTeFxaQLa6jF5Qs6rE655wLS7I8SpmYZ4Eevqwl6nU1GffD7JnthZEl +c7G74iB68ksqQcjhpNwt+eg/LzokmybKnzK5QMnxDisttR9qhhcM+p+kIiy9XC82 +8GMUkdw6eG8VUqnkcRIADffaWuVwcH6fwWBqq4Ju9LVpVbm97jeQ/GszFYGyANba +/vu1wRYPkcWgrFXN/UlbKra5RNFmHesrQ5gcRXsR7Q== +-----END CERTIFICATE----- \ No newline at end of file diff --git a/confs/nginx/conf.d/default.conf b/confs/nginx/conf.d/default.conf new file mode 100644 index 0000000..c83ec48 --- /dev/null +++ b/confs/nginx/conf.d/default.conf @@ -0,0 +1,231 @@ +# +# HTTP +# +server { + listen 80; + listen [::]:80; + server_name b24pal.local; + + real_ip_header X-Real-IP; + ###set_real_ip_from %REAL_IP_FROM%; + + #charset utf-8; + access_log /var/log/nginx/access.log; + error_log /var/log/nginx/error.log; + + index index.php; + root /opt/www; + + error_page 404 @bitrix; + error_page 405 =200 @php; + + # redirect server error pages to the static page /500.html + error_page 500 502 503 504 /500.html; + location = /500.html { + root /opt/www; + } + + # block + include /etc/nginx/inc/block.conf; + + # static files + include /etc/nginx/inc/static.conf; + + # bx temp + include /etc/nginx/inc/bx_temp.conf; + + # composite + #include /etc/nginx/inc/composite.conf; + + # push and pull + include /etc/nginx/inc/push.conf; + + # clouds storage + include /etc/nginx/inc/clouds.conf; + + # proxying + include /etc/nginx/inc/proxy.conf; + + # php files processing + location ~ \.php$ { + include fastcgi_params; + fastcgi_split_path_info ^(.+\.php)(.*)$; + fastcgi_pass php:9000; + fastcgi_index index.php; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + } + + # for CalDAV/CardDAV/GroupDAV server + include /etc/nginx/inc/dav.conf; + + # directories page processing + location / { + index index.php; + try_files $uri $uri/ @bitrix; + } + + # php processing + location @php { + include fastcgi_params; + fastcgi_split_path_info ^(.+\.php)(.*)$; + fastcgi_pass php:9000; + fastcgi_index index.php; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + } + + # bitrix rewrite + location @bitrix { + include fastcgi_params; + fastcgi_pass php:9000; + fastcgi_index index.php; + fastcgi_param SCRIPT_FILENAME $document_root/bitrix/urlrewrite.php; + #fastcgi_param SCRIPT_FILENAME $document_root/bitrix/routing_index.php; + } +} +# +# HTTPS +# +server { + listen 443 ssl; + listen [::]:443 ssl; + server_name _; + + include /etc/nginx/ssl/ssl.conf; + + real_ip_header X-Real-IP; + ###set_real_ip_from %REAL_IP_FROM%; + + #charset utf-8; + access_log /var/log/nginx/access.log; + error_log /var/log/nginx/error.log; + + index index.php; + root /opt/www; + + error_page 404 @bitrix; + error_page 405 =200 @php; + + # redirect server error pages to the static page /500.html + error_page 500 502 503 504 /500.html; + location = /500.html { + root /opt/www; + } + + # block + include /etc/nginx/inc/block.conf; + + # static files + include /etc/nginx/inc/static.conf; + + # bx temp + include /etc/nginx/inc/bx_temp.conf; + + # composite + #include /etc/nginx/inc/composite.conf; + + # push and pull secure + include /etc/nginx/inc/push_secure.conf; + + # clouds storage + include /etc/nginx/inc/clouds.conf; + + # proxying + include /etc/nginx/inc/proxy.conf; + + # php files processing + location ~ \.php$ { + include fastcgi_params; + fastcgi_split_path_info ^(.+\.php)(.*)$; + fastcgi_pass php:9000; + fastcgi_index index.php; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + } + + # for CalDAV/CardDAV/GroupDAV server + include /etc/nginx/inc/dav.conf; + + # directories page processing + location / { + index index.php; + try_files $uri $uri/ @bitrix; + } + + # php processing + location @php { + include fastcgi_params; + fastcgi_split_path_info ^(.+\.php)(.*)$; + fastcgi_pass php:9000; + fastcgi_index index.php; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + } + + # bitrix rewrite + location @bitrix { + include fastcgi_params; + fastcgi_pass php:9000; + fastcgi_index index.php; + fastcgi_param SCRIPT_FILENAME $document_root/bitrix/urlrewrite.php; + #fastcgi_param SCRIPT_FILENAME $document_root/bitrix/routing_index.php; + } +} +# +# HTTP MOBILE +# +server { + listen 8893; + listen [::]:8893; + server_name _; + + real_ip_header X-Real-IP; + ###set_real_ip_from %REAL_IP_FROM%; + + #charset utf-8; + access_log /var/log/nginx/access.log; + error_log /var/log/nginx/error.log; + + # errors pages + include /etc/nginx/inc/errors.conf; + + # block + include /etc/nginx/inc/block.conf; + + # push and pull + include /etc/nginx/inc/push.conf; + + location / { + index index.html; + root /etc/nginx/blank; + } +} +# +# HTTPS MOBILE +# +server { + listen 8894 ssl; + listen [::]:8894 ssl; + server_name _; + + include /etc/nginx/ssl/ssl.conf; + + real_ip_header X-Real-IP; + ###set_real_ip_from %REAL_IP_FROM%; + + #charset utf-8; + access_log /var/log/nginx/access.log; + error_log /var/log/nginx/error.log; + + # errors pages + include /etc/nginx/inc/errors.conf; + + # block + include /etc/nginx/inc/block.conf; + + # push and pull secure + include /etc/nginx/inc/push_secure.conf; + + location / { + index index.html; + root /etc/nginx/blank; + } +} +# diff --git a/confs/nginx/errors/403.html b/confs/nginx/errors/403.html new file mode 100644 index 0000000..16b8997 --- /dev/null +++ b/confs/nginx/errors/403.html @@ -0,0 +1,24 @@ + + + + + + 403 Forbidden + + +
+
403
+
+
403 Forbidden
+
+
Bitrix Env
+
+
+ + diff --git a/confs/nginx/errors/404.html b/confs/nginx/errors/404.html new file mode 100644 index 0000000..7521394 --- /dev/null +++ b/confs/nginx/errors/404.html @@ -0,0 +1,24 @@ + + + + + + 404 Not Found + + +
+
404
+
+
404 Not Found
+
+
Bitrix Env
+
+
+ + diff --git a/confs/nginx/errors/500.html b/confs/nginx/errors/500.html new file mode 100644 index 0000000..52ce98e --- /dev/null +++ b/confs/nginx/errors/500.html @@ -0,0 +1,24 @@ + + + + + + 500 System Error + + +
+
500
+
+
500 System Error
+
+
Bitrix Env
+
+
+ + diff --git a/confs/nginx/errors/502.html b/confs/nginx/errors/502.html new file mode 100644 index 0000000..577cd1a --- /dev/null +++ b/confs/nginx/errors/502.html @@ -0,0 +1,24 @@ + + + + + + 502 Bad Gateway + + +
+
502
+
+
502 Bad Gateway
+
+
Bitrix Env
+
+
+ + diff --git a/confs/nginx/errors/503.html b/confs/nginx/errors/503.html new file mode 100644 index 0000000..485010f --- /dev/null +++ b/confs/nginx/errors/503.html @@ -0,0 +1,24 @@ + + + + + + 503 Service Unavailable + + +
+
503
+
+
503 Service Unavailable
+
+
Bitrix Env
+
+
+ + diff --git a/confs/nginx/errors/504.html b/confs/nginx/errors/504.html new file mode 100644 index 0000000..93961b7 --- /dev/null +++ b/confs/nginx/errors/504.html @@ -0,0 +1,24 @@ + + + + + + 504 Gateway Timeout + + +
+
504
+
+
504 Gateway Timeout
+
+
Bitrix Env
+
+
+ + diff --git a/confs/nginx/fastcgi.conf b/confs/nginx/fastcgi.conf new file mode 100644 index 0000000..acd0b38 --- /dev/null +++ b/confs/nginx/fastcgi.conf @@ -0,0 +1,25 @@ +fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; +fastcgi_param QUERY_STRING $query_string; +fastcgi_param REQUEST_METHOD $request_method; +fastcgi_param CONTENT_TYPE $content_type; +fastcgi_param CONTENT_LENGTH $content_length; + +fastcgi_param SCRIPT_NAME $fastcgi_script_name; +fastcgi_param REQUEST_URI $request_uri; +fastcgi_param DOCUMENT_URI $document_uri; +fastcgi_param DOCUMENT_ROOT $document_root; +fastcgi_param SERVER_PROTOCOL $server_protocol; +fastcgi_param REQUEST_SCHEME $scheme; +fastcgi_param HTTPS $https if_not_empty; + +fastcgi_param GATEWAY_INTERFACE CGI/1.1; +fastcgi_param SERVER_SOFTWARE nginx/$nginx_version; + +fastcgi_param REMOTE_ADDR $remote_addr; +fastcgi_param REMOTE_PORT $remote_port; +fastcgi_param SERVER_ADDR $server_addr; +fastcgi_param SERVER_PORT $server_port; +fastcgi_param SERVER_NAME $server_name; + +# PHP only, required if PHP was built with --enable-force-cgi-redirect +fastcgi_param REDIRECT_STATUS 200; diff --git a/confs/nginx/fastcgi_params b/confs/nginx/fastcgi_params new file mode 100644 index 0000000..28decb9 --- /dev/null +++ b/confs/nginx/fastcgi_params @@ -0,0 +1,25 @@ + +fastcgi_param QUERY_STRING $query_string; +fastcgi_param REQUEST_METHOD $request_method; +fastcgi_param CONTENT_TYPE $content_type; +fastcgi_param CONTENT_LENGTH $content_length; + +fastcgi_param SCRIPT_NAME $fastcgi_script_name; +fastcgi_param REQUEST_URI $request_uri; +fastcgi_param DOCUMENT_URI $document_uri; +fastcgi_param DOCUMENT_ROOT $document_root; +fastcgi_param SERVER_PROTOCOL $server_protocol; +fastcgi_param REQUEST_SCHEME $scheme; +fastcgi_param HTTPS $https if_not_empty; + +fastcgi_param GATEWAY_INTERFACE CGI/1.1; +fastcgi_param SERVER_SOFTWARE nginx/$nginx_version; + +fastcgi_param REMOTE_ADDR $remote_addr; +fastcgi_param REMOTE_PORT $remote_port; +fastcgi_param SERVER_ADDR $server_addr; +fastcgi_param SERVER_PORT $server_port; +fastcgi_param SERVER_NAME $server_name; + +# PHP only, required if PHP was built with --enable-force-cgi-redirect +fastcgi_param REDIRECT_STATUS 200; diff --git a/confs/nginx/inc/block.conf b/confs/nginx/inc/block.conf new file mode 100644 index 0000000..bc7aa8b --- /dev/null +++ b/confs/nginx/inc/block.conf @@ -0,0 +1,79 @@ +# +# .ht files: .htpasswd, .htaccess +# +location ~* /\.ht { + deny all; +} +# +# repositories: .svn, .hg, .git +# +location ~* /\.(svn|hg|git) { + deny all; +} +# +# ignore files: .hgignore, .gitignore +# +location ~* /\.(hgignore|gitignore) { + deny all; +} +# +# tmp files without filename: .orig, .bak, .save, .old, .swp +# +location ~* /(\.(orig|bak|save|old|swp)) { + deny all; +} +# +# tmp files with filename: index.orig, index.bak, index.save, index.old, index.swp, index~ +# +location ~* /*(\.(orig|bak|save|old|swp)|~)$ { + deny all; +} +# +# macos and windows special files: .DS_Store, Thumbs.db +# +location ~* /(\.DS_Store|Thumbs.db) { + deny all; +} +# +#location ~* /vendor/ { +# deny all; +#} +# +location ~* /composer { + deny all; +} +# +# bitrix internal locations +# +location ~* ^/bitrix/(modules|local_cache|stack_cache|managed_cache|php_interface) { + deny all; +} +# +location ~* ^/bitrix/\.settings\.php { + deny all; +} +# +location ~* ^/bitrix/\.settings_extra\.php { + deny all; +} +# +# upload 1c files +# +location ~* ^/upload/1c_[^/]+/ { + deny all; +} +# +# use the file system to access files outside the site (cache) +# +location ~* /\.\./ { + deny all; +} +# +location ~* ^/bitrix/html_pages/\.config\.php { + deny all; +} +# +location ~* ^/bitrix/html_pages/\.enabled { + deny all; +} +# diff --git a/confs/nginx/inc/bx_temp.conf b/confs/nginx/inc/bx_temp.conf new file mode 100644 index 0000000..773eac0 --- /dev/null +++ b/confs/nginx/inc/bx_temp.conf @@ -0,0 +1,11 @@ +# +location ~* ^/bx_tmp_download/ { + internal; + rewrite /bx_tmp_download/(.+) /.bx_temp/$1 last; +} +# +location ~* ^/.bx_temp/ { + internal; + root /opt; +} +# diff --git a/confs/nginx/inc/clouds.conf b/confs/nginx/inc/clouds.conf new file mode 100644 index 0000000..bdb69ad --- /dev/null +++ b/confs/nginx/inc/clouds.conf @@ -0,0 +1,481 @@ +# +# Use nginx to return static content from cloud storage +# +location ^~ /upload/bx_cloud_upload/ { + # Amazon Simple Storage Service + location ~ ^/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.(s3|af-south-1|ap-east-1|ap-south-1|ap-south-2|ap-southeast-1|ap-southeast-2|ap-southeast-3|ap-southeast-4|ap-northeast-1|ap-northeast-2|ap-northeast-3|ca-central-1|ca-west-1|cn-north-1|cn-northwest-1|eu-central-1|eu-central-2|eu-west-1|eu-west-2|eu-west-3|eu-south-1|eu-south-2|eu-north-1|il-central-1|me-south-1|me-central-1|sa-east-1|us-east-1|us-east-2|us-west-1|us-west-2|us-gov-east-1|us-gov-west-1)\.amazonaws\.com/([^\s]+)$ { + internal; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + #proxy_max_temp_file_size 0; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + proxy_pass $1://$2.$3.amazonaws.com/$4; + } + # Google Storage + location ~ ^/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.commondatastorage\.googleapis\.com/([^\s]+)$ { + internal; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + #proxy_max_temp_file_size 0; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + proxy_pass $1://$2.commondatastorage.googleapis.com/$3; + } + # Rackspace Cloud Files + location ~ ^/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.([^/:\s]+)\.([^/:\s]+)\.rackcdn\.com/([^\s]+)$ { + internal; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + #proxy_max_temp_file_size 0; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + proxy_pass $1://$2.$3.$4.rackcdn.com/$5; + } + # Clodo.ru (old) + location ~ ^/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.clodo\.ru\:(80|443)/([^\s]+)$ { + internal; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + #proxy_max_temp_file_size 0; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + proxy_pass $1://$2.clodo.ru:$3/$4; + } + # Clodo.ru + location ~ ^/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.clodo\.ru/([^\s]+)$ { + internal; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + #proxy_max_temp_file_size 0; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + proxy_pass $1://$2.clodo.ru/$3; + } + # Selectel + location ~ ^/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.selcdn\.ru/([^\s]+)$ { + internal; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + #proxy_max_temp_file_size 0; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + proxy_pass $1://$2.selcdn.ru/$3; + } + # Selectel as S3 compatible storage + location ~ ^/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.selstorage\.ru/([^\s]+)$ { + internal; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + #proxy_max_temp_file_size 0; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + proxy_pass $1://$2.selstorage.ru/$3; + } + # HotBox + location ~ ^/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.hb\.bizmrg\.com/([^\s]+)$ { + internal; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + #proxy_max_temp_file_size 0; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + proxy_pass $1://$2.hb.bizmrg.com/$3; + } + # HotBox + location ~ ^/upload/bx_cloud_upload/(http[s]?)\.hb\.bizmrg\.com/([^\s].+)$ { + internal; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + #proxy_max_temp_file_size 0; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + proxy_pass $1://hb.bizmrg.com/$2; + } + # Yandex Object Storage + location ~ ^/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.storage\.yandexcloud\.net/([^\s]+)$ { + internal; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + #proxy_max_temp_file_size 0; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + proxy_pass $1://$2.storage.yandexcloud.net/$3; + } + # Yandex Object Storage + location ~ ^/upload/bx_cloud_upload/(http[s]?)\.storage\.yandexcloud\.net/([^\s].+)$ { + internal; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + #proxy_max_temp_file_size 0; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + proxy_pass $1://storage.yandexcloud.net/$2; + } + # S3 compatible storage + location ~ ^/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.io\.activecloud\.com/([^\s]+)$ { + internal; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + #proxy_max_temp_file_size 0; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + proxy_pass $1://$2.io.activecloud.com/$3; + } + # S3 compatible storage + location ~ ^/upload/bx_cloud_upload/(http[s]?)\.io\.activecloud\.com/([^\s].+)$ { + internal; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + #proxy_max_temp_file_size 0; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + proxy_pass $1://io.activecloud.com/$2; + } + # Timeweb.cloud S3 compatible storage + location ~ ^/upload/bx_cloud_upload/(http[s]?)\.s3\.timeweb\.cloud/([^\s].+)$ { + internal; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + #proxy_max_temp_file_size 0; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + proxy_pass $1://s3.timeweb.cloud/$2; + } + # block everything else + location ~* .*$ { + deny all; + } +} +# +# cloud resize cache +# +location ^~ /upload/resize_cache/c/upload/bx_cloud_upload/ { + # Amazon + location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.(s3|af-south-1|ap-east-1|ap-south-1|ap-south-2|ap-southeast-1|ap-southeast-2|ap-southeast-3|ap-southeast-4|ap-northeast-1|ap-northeast-2|ap-northeast-3|ca-central-1|ca-west-1|cn-north-1|cn-northwest-1|eu-central-1|eu-central-2|eu-west-1|eu-west-2|eu-west-3|eu-south-1|eu-south-2|eu-north-1|il-central-1|me-south-1|me-central-1|sa-east-1|us-east-1|us-east-2|us-west-1|us-west-2|us-gov-east-1|us-gov-west-1)\.amazonaws\.com/([^\s]+)$ { + internal; + set $new_uri $upstream_http_x_gen_src; + set $cdi $upstream_http_x_cd_info; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + if ($cdi) { + more_set_headers -s 200 'Content-Disposition: $cdi'; + } + proxy_pass $1://$2.$3.amazonaws.com/$4; + proxy_intercept_errors on; + error_page 403 404 500 502 503 504 = /$new_uri; + } + # Rackspace + location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.([^/:\s]+)\.([^/:\s]+)\.rackcdn\.com/([^\s]+)$ { + internal; + set $new_uri $upstream_http_x_gen_src; + set $cdi $upstream_http_x_cd_info; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + if ($cdi) { + more_set_headers -s 200 'Content-Disposition: $cdi'; + } + proxy_pass $1://$2.$3.$4.rackcdn.com/$5; + proxy_intercept_errors on; + error_page 403 404 500 502 503 504 = /$new_uri; + } + # Clodo + location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.clodo\.ru\:(80|443)/([^\s]+)$ { + internal; + set $new_uri $upstream_http_x_gen_src; + set $cdi $upstream_http_x_cd_info; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + if ($cdi) { + more_set_headers -s 200 'Content-Disposition: $cdi'; + } + proxy_pass $1://$2.clodo.ru:$3/$4; + proxy_intercept_errors on; + error_page 403 404 500 502 503 504 = /$new_uri; + } + # Google + location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.commondatastorage\.googleapis\.com/([^\s]+)$ { + internal; + set $new_uri $upstream_http_x_gen_src; + set $cdi $upstream_http_x_cd_info; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + if ($cdi) { + more_set_headers -s 200 'Content-Disposition: $cdi'; + } + proxy_pass $1://$2.commondatastorage.googleapis.com/$3; + proxy_intercept_errors on; + error_page 403 404 500 502 503 504 = /$new_uri; + } + # Selectel + location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.selcdn\.ru/([^\s]+)$ { + internal; + set $new_uri $upstream_http_x_gen_src; + set $cdi $upstream_http_x_cd_info; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + if ($cdi) { + more_set_headers -s 200 'Content-Disposition: $cdi'; + } + proxy_pass $1://$2.selcdn.ru/$3; + proxy_intercept_errors on; + error_page 403 404 500 502 503 504 = /$new_uri; + } + # Selectel as S3 compatible storage + location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.selstorage\.ru/([^\s]+)$ { + internal; + set $new_uri $upstream_http_x_gen_src; + set $cdi $upstream_http_x_cd_info; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + if ($cdi) { + more_set_headers -s 200 'Content-Disposition: $cdi'; + } + proxy_pass $1://$2.selstorage.ru/$3; + proxy_intercept_errors on; + error_page 403 404 500 502 503 504 = /$new_uri; + } + # Yandex + location ~* ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.storage\.yandexcloud\.net/([^\s]+)$ { + internal; + set $new_uri $upstream_http_x_gen_src; + set $cdi $upstream_http_x_cd_info; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + if ($cdi) { + more_set_headers -s 200 'Content-Disposition: $cdi'; + } + proxy_pass $1://$2.storage.yandexcloud.net/$3; + proxy_intercept_errors on; + error_page 403 404 500 502 503 504 = /$new_uri; + } + # Yandex second option + location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.storage\.yandexcloud\.net/([^\s].+)$ { + internal; + set $new_uri $upstream_http_x_gen_src; + set $cdi $upstream_http_x_cd_info; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + if ($cdi) { + more_set_headers -s 200 'Content-Disposition: $cdi'; + } + proxy_pass $1://storage.yandexcloud.net/$2; + proxy_intercept_errors on; + error_page 403 404 500 502 503 504 = /$new_uri; + } + # HotBox + location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.hb\.bizmrg\.com/([^\s]+)$ { + internal; + set $new_uri $upstream_http_x_gen_src; + set $cdi $upstream_http_x_cd_info; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + if ($cdi) { + more_set_headers -s 200 'Content-Disposition: $cdi'; + } + proxy_pass $1://$2.hb.bizmrg.com/$3; + proxy_intercept_errors on; + error_page 403 404 500 502 503 504 = /$new_uri; + } + # HotBox + location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.hb\.bizmrg\.com/([^\s].+)$ { + internal; + set $new_uri $upstream_http_x_gen_src; + set $cdi $upstream_http_x_cd_info; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + if ($cdi) { + more_set_headers -s 200 'Content-Disposition: $cdi'; + } + proxy_pass $1://hb.bizmrg.com/$2; + proxy_intercept_errors on; + error_page 403 404 500 502 503 504 = /$new_uri; + } + # Clodo.ru + location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.([^/:\s]+)\.clodo\.ru/([^\s]+)$ { + internal; + set $new_uri $upstream_http_x_gen_src; + set $cdi $upstream_http_x_cd_info; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + if ($cdi) { + more_set_headers -s 200 'Content-Disposition: $cdi'; + } + proxy_pass $1://$2.clodo.ru/$3; + proxy_intercept_errors on; + error_page 403 404 500 502 503 504 = /$new_uri; + } + # Timeweb.cloud S3 compatible storage + location ~ ^/upload/resize_cache/c/upload/bx_cloud_upload/(http[s]?)\.s3\.timeweb\.cloud/([^\s].+)$ { + internal; + set $new_uri $upstream_http_x_gen_src; + set $cdi $upstream_http_x_cd_info; + resolver 8.8.8.8 ipv6=off; + proxy_method GET; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + if ($cdi) { + more_set_headers -s 200 'Content-Disposition: $cdi'; + } + proxy_pass $1://s3.timeweb.cloud/$2; + proxy_intercept_errors on; + error_page 403 404 500 502 503 504 = /$new_uri; + } + # block everything else + location ~* .*$ { + deny all; + } +} +# diff --git a/confs/nginx/inc/composite.conf b/confs/nginx/inc/composite.conf new file mode 100644 index 0000000..f7dd541 --- /dev/null +++ b/confs/nginx/inc/composite.conf @@ -0,0 +1,8 @@ +# +location ~* @.*\.html$ { + internal; + # disable browser cache, php manage file + expires -1y; + add_header X-Bitrix-Composite "Nginx (file)"; +} +# diff --git a/confs/nginx/inc/dav.conf b/confs/nginx/inc/dav.conf new file mode 100644 index 0000000..212171c --- /dev/null +++ b/confs/nginx/inc/dav.conf @@ -0,0 +1,17 @@ +# +location ~ ^/bitrix/groupdav.php.*$ { + if ($request_method ~ ^(PROPPATCH|MKCALENDAR)$) { + add_header Allow "OPTIONS,REPORT,CHECKAUTH,PROPFIND,MKCOL,GET,POST,PUT,DELETE,COPY,MOVE,LOCK,UNLOCK,ACL,HEAD"; + return 405 "Method not allowed"; + } + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME $document_root/bitrix/groupdav.php; + fastcgi_split_path_info ^(.+\.php)(.*)$; + fastcgi_param PATH_INFO $fastcgi_path_info; + fastcgi_pass php:9000; +} +# +location ~ ^/.well-known/(caldav|carddav)$ { + rewrite ^ /bitrix/groupdav.php last; +} +# diff --git a/confs/nginx/inc/errors.conf b/confs/nginx/inc/errors.conf new file mode 100644 index 0000000..708eccd --- /dev/null +++ b/confs/nginx/inc/errors.conf @@ -0,0 +1,27 @@ +# errors pages +error_page 403 /403.html; +error_page 404 /404.html; +error_page 500 /500.html; +error_page 502 /502.html; +error_page 503 /503.html; +error_page 504 /504.html; + +# errors pages locations +location ^~ /403.html { + root /etc/nginx/errors; +} +location ^~ /404.html { + root /etc/nginx/errors; +} +location ^~ /500.html { + root /etc/nginx/errors; +} +location ^~ /502.html { + root /etc/nginx/errors; +} +location ^~ /503.html { + root /etc/nginx/errors; +} +location ^~ /504.html { + root /etc/nginx/errors; +} diff --git a/confs/nginx/inc/modules.conf b/confs/nginx/inc/modules.conf new file mode 100644 index 0000000..b3838e6 --- /dev/null +++ b/confs/nginx/inc/modules.conf @@ -0,0 +1,165 @@ +# +########################################################## +# +# nginx modules - uncomment line and restart nginx +# +########################################################## +# + +# +# nginx-module-brotli = brotli compression dynamic module +# +load_module "/usr/lib/nginx/modules/ngx_http_brotli_filter_module.so"; +load_module "/usr/lib/nginx/modules/ngx_http_brotli_static_module.so"; +# + +# +# nginx-module-headers-more = headers-more dynamic module +# +load_module "/usr/lib/nginx/modules/ngx_http_headers_more_filter_module.so"; +# + +# +# nginx-module-zip = zip on fly dynamic module +# +load_module "/usr/lib/nginx/modules/ngx_http_zip_module.so"; +# + +# +# nginx-module-njs = njs dynamic module +# +#load_module "/usr/lib/nginx/modules/ngx_http_js_module.so"; +#load_module "/usr/lib/nginx/modules/ngx_stream_js_module.so"; +# + +# +# nginx-module-geoip = geoip dynamic module +# +#load_module "/usr/lib/nginx/modules/ngx_http_geoip_module.so"; +#load_module "/usr/lib/nginx/modules/ngx_stream_geoip_module.so"; +# + +# +# nginx-module-geoip2 = geoip2 dynamic module +# +#load_module "/usr/lib/nginx/modules/ngx_http_geoip2_module.so"; +#load_module "/usr/lib/nginx/modules/ngx_stream_geoip2_module.so"; +# + +# +# nginx-module-image-filter = image filter dynamic module +# +#load_module "/usr/lib/nginx/modules/ngx_http_image_filter_module.so"; +# + +# +# nginx-module-xslt = xslt dynamic module +# +#load_module "/usr/lib/nginx/modules/ngx_http_xslt_filter_module.so"; +# + +# +# nginx-module-perl = perl dynamic module +# +#load_module "/usr/lib/nginx/modules/ngx_http_perl_module.so"; +# + +# +# nginx-module-ndk = ndk dynamic module +# +#load_module "/usr/lib/nginx/modules/ndk_http_module.so"; +# + +# +# nginx-module-lua = lua dynamic module +# ndk_http_module must be placed first! +# +#load_module "/usr/lib/nginx/modules/ndk_http_module.so"; +#load_module "/usr/lib/nginx/modules/ngx_http_lua_module.so"; +#load_module "/usr/lib/nginx/modules/ngx_stream_lua_module.so"; +# + +# +########################################################## +# +# nginx-debug modules - uncomment line and restart nginx-debug +# +########################################################## +# + +# +# nginx-module-brotli = brotli compression dynamic module (debug) +# +#load_module "/usr/lib/nginx/modules/ngx_http_brotli_filter_module-debug.so"; +#load_module "/usr/lib/nginx/modules/ngx_http_brotli_static_module-debug.so"; +# + +# +# nginx-module-headers-more = headers-more dynamic module (debug) +# +#load_module "/usr/lib/nginx/modules/ngx_http_headers_more_filter_module-debug.so"; +# + +# +# nginx-module-zip = zip on fly dynamic module (debug) +# +#load_module "/usr/lib/nginx/modules/ngx_http_zip_module-debug.so"; +# + +# +# nginx-module-njs = njs dynamic module (debug) +# +#load_module "/usr/lib/nginx/modules/ngx_http_js_module-debug.so"; +#load_module "/usr/lib/nginx/modules/ngx_stream_js_module-debug.so"; +# + +# +# nginx-module-geoip = geoip dynamic module (debug) +# +#load_module "/usr/lib/nginx/modules/ngx_http_geoip_module-debug.so"; +#load_module "/usr/lib/nginx/modules/ngx_stream_geoip_module-debug.so"; +# + +# +# nginx-module-geoip2 = geoip2 dynamic module (debug) +# +#load_module "/usr/lib/nginx/modules/ngx_http_geoip2_module-debug.so"; +#load_module "/usr/lib/nginx/modules/ngx_stream_geoip2_module-debug.so"; +# + +# +# nginx-module-image-filter = image filter dynamic module (debug) +# +#load_module "/usr/lib/nginx/modules/ngx_http_image_filter_module-debug.so"; +# + +# +# nginx-module-xslt = xslt dynamic module (debug) +# +#load_module "/usr/lib/nginx/modules/ngx_http_xslt_filter_module-debug.so"; +# + +# +# nginx-module-perl = perl dynamic module (debug) +# +#load_module "/usr/lib/nginx/modules/ngx_http_perl_module-debug.so"; +# + +# +# nginx-module-ndk = ndk dynamic module (debug) +# +#load_module "/usr/lib/nginx/modules/ndk_http_module-debug.so"; +# + +# +# nginx-module-lua = lua dynamic module (debug) +# ndk_http_module must be placed first! +# +#load_module "/usr/lib/nginx/modules/ndk_http_module-debug.so"; +#load_module "/usr/lib/nginx/modules/ngx_http_lua_module-debug.so"; +#load_module "/usr/lib/nginx/modules/ngx_stream_lua_module-debug.so"; +# + +# +########################################################## +# diff --git a/confs/nginx/inc/proxy.conf b/confs/nginx/inc/proxy.conf new file mode 100644 index 0000000..fd6975d --- /dev/null +++ b/confs/nginx/inc/proxy.conf @@ -0,0 +1,17 @@ +# +# bitrixsetup script +# +location ^~ ^(/bitrixsetup\.php)$ { + proxy_buffering off; +} +# +# pub and online + telephony and voximplant +# +#location ~* ^/(pub/|online/|services/telephony/info_receiver.php|/bitrix/tools/voximplant/) { +# add_header X-Frame-Options '' always; +# # +# location ~* ^/(pub/imconnector/|pub/imbot.php|services/telephony/info_receiver.php|bitrix/tools/voximplant/) { +# proxy_ignore_client_abort on; +# } +#} +# diff --git a/confs/nginx/inc/push.conf b/confs/nginx/inc/push.conf new file mode 100644 index 0000000..860d2f7 --- /dev/null +++ b/confs/nginx/inc/push.conf @@ -0,0 +1,31 @@ +# +location ~* ^/bitrix/subws/ { + proxy_pass http://push_sub:8010; + # http://blog.martinfjordvald.com/2013/02/websockets-in-nginx/ + # 12h+0.5 + proxy_max_temp_file_size 0; + proxy_read_timeout 43800; + proxy_http_version 1.1; + proxy_set_header Upgrade $replace_upgrade; + proxy_set_header Connection $connection_upgrade; +} +# +location ~* ^/bitrix/sub/ { + rewrite ^/bitrix/sub/(.*)$ /bitrix/subws/$1 break; + proxy_pass http://push_sub:8010; + proxy_max_temp_file_size 0; + proxy_read_timeout 43800; +} +# +location ~* ^/bitrix/rest/ { + proxy_pass http://push_pub:9010; + proxy_max_temp_file_size 0; + proxy_read_timeout 43800; +} +# +location ~* ^/bitrix/pub/ { + proxy_pass http://push_pub:9010; + proxy_max_temp_file_size 0; + proxy_read_timeout 43800; +} +# diff --git a/confs/nginx/inc/push_secure.conf b/confs/nginx/inc/push_secure.conf new file mode 100644 index 0000000..860d2f7 --- /dev/null +++ b/confs/nginx/inc/push_secure.conf @@ -0,0 +1,31 @@ +# +location ~* ^/bitrix/subws/ { + proxy_pass http://push_sub:8010; + # http://blog.martinfjordvald.com/2013/02/websockets-in-nginx/ + # 12h+0.5 + proxy_max_temp_file_size 0; + proxy_read_timeout 43800; + proxy_http_version 1.1; + proxy_set_header Upgrade $replace_upgrade; + proxy_set_header Connection $connection_upgrade; +} +# +location ~* ^/bitrix/sub/ { + rewrite ^/bitrix/sub/(.*)$ /bitrix/subws/$1 break; + proxy_pass http://push_sub:8010; + proxy_max_temp_file_size 0; + proxy_read_timeout 43800; +} +# +location ~* ^/bitrix/rest/ { + proxy_pass http://push_pub:9010; + proxy_max_temp_file_size 0; + proxy_read_timeout 43800; +} +# +location ~* ^/bitrix/pub/ { + proxy_pass http://push_pub:9010; + proxy_max_temp_file_size 0; + proxy_read_timeout 43800; +} +# diff --git a/confs/nginx/inc/static.conf b/confs/nginx/inc/static.conf new file mode 100644 index 0000000..5d97390 --- /dev/null +++ b/confs/nginx/inc/static.conf @@ -0,0 +1,92 @@ +# +# static files +# +location ~* ^.+\.(jpg|jpeg|gif|png|svg|js|css|mp3|ogg|mpe?g|avi|zip|gz|bz2?|rar|html|htm|xml|jpg|jpeg|gif|png|css|flv|js|wmv|mp4|bmp|swf|ico|txt|otf|woff|woff2|ttf|eot|map|wav|tar|7z)$ { + log_not_found off; + access_log off; + expires 30d; + add_header Cache-Control public; +} +# +# internal sources +# +location ~ (/bitrix/modules|/upload/support/not_image|/bitrix/php_interface|local/modules|local/php_interface) { + internal; +} +# +# accept access for merged css and js +# +location ~* ^/bitrix/cache/(css/.+\.css|js/.+\.js)$ { + expires 30d; +} +# +# static content +# +location ~* ^/(upload|bitrix/images|bitrix/tmp) { + set $cdi $upstream_http_x_cd_info; + if ($cdi) { + more_set_headers -s 200 'Content-Disposition:$cdi'; + } + expires 30d; +} +# +# fix xss on svg files in /upload/* +# +location ~* ^/upload/.+\.svg$ { + add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; sandbox"; +} +# +# download file from /upload/*, do not execute +# +location ~* ^/upload/.*([^/]+)\.(html|htm|php|php3|php4|php5|php6|phtml|pl|asp|aspx|cgi|dll|exe|shtm|shtml|fcg|fcgi|fpl|asmx|pht)$ { + add_header Content-Disposition "attachment"; +} +# +# upload sizes +# +location ~ /upload/ { + client_body_buffer_size 1024m; + client_max_body_size 1024m; +} +# +# local resize cache +# +location ~* ^/upload/resize_cache/x/(.+)$ { + internal; + set $new_uri $upstream_http_x_gen_src; + set $cdi $upstream_http_x_cd_info; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Server $host; + more_clear_input_headers 'Authorization'; + if ($cdi) { + more_set_headers -s 200 'Content-Disposition:$cdi'; + } + proxy_set_header "cookie" ""; + proxy_set_header "content-type" ""; + proxy_set_header "content-length" ""; + proxy_pass $scheme://$host/upload/resize_cache/$1; + proxy_intercept_errors on; + error_page 403 404 500 502 503 504 = /$new_uri; +} +# +# favicon.png +# +location = /favicon.png { + log_not_found off; + access_log off; +} +# +# robots.txt +# +location = /robots.txt { + log_not_found off; + access_log off; +} +# +# player options, disable no-sniff +# +location ~* ^/bitrix/components/bitrix/player/mediaplayer/player$ { + add_header Access-Control-Allow-Origin *; +} +# diff --git a/confs/nginx/koi-utf b/confs/nginx/koi-utf new file mode 100644 index 0000000..8ee20cf --- /dev/null +++ b/confs/nginx/koi-utf @@ -0,0 +1,108 @@ +# This map is not a full koi8-r <> utf8 map: it does not contain +# box-drawing and some other characters. Besides this map contains +# several koi8-u and Byelorussian letters which are not in koi8-r. +# If you need a full and standard map, use contrib/unicode2nginx/koi-utf +# map instead. + +charset_map koi8-r utf-8 { + + 80 E282AC ; # euro + + 95 E280A2 ; # bullet + + 9A C2A0 ; #   + + 9E C2B7 ; # · + + A3 D191 ; # small yo + A4 D194 ; # small Ukrainian ye + + A6 D196 ; # small Ukrainian i + A7 D197 ; # small Ukrainian yi + + AD D291 ; # small Ukrainian soft g + AE D19E ; # small Byelorussian short u + + B0 C2B0 ; # ° + + B3 D081 ; # capital YO + B4 D084 ; # capital Ukrainian YE + + B6 D086 ; # capital Ukrainian I + B7 D087 ; # capital Ukrainian YI + + B9 E28496 ; # numero sign + + BD D290 ; # capital Ukrainian soft G + BE D18E ; # capital Byelorussian short U + + BF C2A9 ; # (C) + + C0 D18E ; # small yu + C1 D0B0 ; # small a + C2 D0B1 ; # small b + C3 D186 ; # small ts + C4 D0B4 ; # small d + C5 D0B5 ; # small ye + C6 D184 ; # small f + C7 D0B3 ; # small g + C8 D185 ; # small kh + C9 D0B8 ; # small i + CA D0B9 ; # small j + CB D0BA ; # small k + CC D0BB ; # small l + CD D0BC ; # small m + CE D0BD ; # small n + CF D0BE ; # small o + + D0 D0BF ; # small p + D1 D18F ; # small ya + D2 D180 ; # small r + D3 D181 ; # small s + D4 D182 ; # small t + D5 D183 ; # small u + D6 D0B6 ; # small zh + D7 D0B2 ; # small v + D8 D18C ; # small soft sign + D9 D18B ; # small y + DA D0B7 ; # small z + DB D188 ; # small sh + DC D18D ; # small e + DD D189 ; # small shch + DE D187 ; # small ch + DF D18A ; # small hard sign + + E0 D0AE ; # capital YU + E1 D090 ; # capital A + E2 D091 ; # capital B + E3 D0A6 ; # capital TS + E4 D094 ; # capital D + E5 D095 ; # capital YE + E6 D0A4 ; # capital F + E7 D093 ; # capital G + E8 D0A5 ; # capital KH + E9 D098 ; # capital I + EA D099 ; # capital J + EB D09A ; # capital K + EC D09B ; # capital L + ED D09C ; # capital M + EE D09D ; # capital N + EF D09E ; # capital O + + F0 D09F ; # capital P + F1 D0AF ; # capital YA + F2 D0A0 ; # capital R + F3 D0A1 ; # capital S + F4 D0A2 ; # capital T + F5 D0A3 ; # capital U + F6 D096 ; # capital ZH + F7 D092 ; # capital V + F8 D0AC ; # capital soft sign + F9 D0AB ; # capital Y + FA D097 ; # capital Z + FB D0A8 ; # capital SH + FC D0AD ; # capital E + FD D0A9 ; # capital SHCH + FE D0A7 ; # capital CH + FF D0AA ; # capital hard sign +} diff --git a/confs/nginx/koi-win b/confs/nginx/koi-win new file mode 100644 index 0000000..2656e1a --- /dev/null +++ b/confs/nginx/koi-win @@ -0,0 +1,102 @@ +charset_map koi8-r windows-1251 { + + 80 88 ; # euro + + 95 95 ; # bullet + + 9A A0 ; #   + + 9E B7 ; # · + + A3 B8 ; # small yo + A4 BA ; # small Ukrainian ye + + A6 B3 ; # small Ukrainian i + A7 BF ; # small Ukrainian yi + + AD B4 ; # small Ukrainian soft g + AE A2 ; # small Byelorussian short u + + B0 B0 ; # ° + + B3 A8 ; # capital YO + B4 AA ; # capital Ukrainian YE + + B6 B2 ; # capital Ukrainian I + B7 AF ; # capital Ukrainian YI + + B9 B9 ; # numero sign + + BD A5 ; # capital Ukrainian soft G + BE A1 ; # capital Byelorussian short U + + BF A9 ; # (C) + + C0 FE ; # small yu + C1 E0 ; # small a + C2 E1 ; # small b + C3 F6 ; # small ts + C4 E4 ; # small d + C5 E5 ; # small ye + C6 F4 ; # small f + C7 E3 ; # small g + C8 F5 ; # small kh + C9 E8 ; # small i + CA E9 ; # small j + CB EA ; # small k + CC EB ; # small l + CD EC ; # small m + CE ED ; # small n + CF EE ; # small o + + D0 EF ; # small p + D1 FF ; # small ya + D2 F0 ; # small r + D3 F1 ; # small s + D4 F2 ; # small t + D5 F3 ; # small u + D6 E6 ; # small zh + D7 E2 ; # small v + D8 FC ; # small soft sign + D9 FB ; # small y + DA E7 ; # small z + DB F8 ; # small sh + DC FD ; # small e + DD F9 ; # small shch + DE F7 ; # small ch + DF FA ; # small hard sign + + E0 DE ; # capital YU + E1 C0 ; # capital A + E2 C1 ; # capital B + E3 D6 ; # capital TS + E4 C4 ; # capital D + E5 C5 ; # capital YE + E6 D4 ; # capital F + E7 C3 ; # capital G + E8 D5 ; # capital KH + E9 C8 ; # capital I + EA C9 ; # capital J + EB CA ; # capital K + EC CB ; # capital L + ED CC ; # capital M + EE CD ; # capital N + EF CE ; # capital O + + F0 CF ; # capital P + F1 DF ; # capital YA + F2 D0 ; # capital R + F3 D1 ; # capital S + F4 D2 ; # capital T + F5 D3 ; # capital U + F6 C6 ; # capital ZH + F7 C2 ; # capital V + F8 DC ; # capital soft sign + F9 DB ; # capital Y + FA C7 ; # capital Z + FB D8 ; # capital SH + FC DD ; # capital E + FD D9 ; # capital SHCH + FE D7 ; # capital CH + FF DA ; # capital hard sign +} diff --git a/confs/nginx/maps/im_settings.conf b/confs/nginx/maps/im_settings.conf new file mode 100644 index 0000000..5d39438 --- /dev/null +++ b/confs/nginx/maps/im_settings.conf @@ -0,0 +1,11 @@ +# +map $http_upgrade $connection_upgrade { + default upgrade; + '' 'close'; +} +# +map $http_upgrade $replace_upgrade { + default $http_upgrade; + '' 'websocket'; +} +# diff --git a/confs/nginx/mime.types b/confs/nginx/mime.types new file mode 100644 index 0000000..083c2fa --- /dev/null +++ b/confs/nginx/mime.types @@ -0,0 +1,99 @@ +types { + text/html html htm shtml; + text/css css; + text/xml xml; + image/gif gif; + image/jpeg jpeg jpg; + application/javascript js; + application/atom+xml atom; + application/rss+xml rss; + + text/mathml mml; + text/plain txt; + text/vnd.sun.j2me.app-descriptor jad; + text/vnd.wap.wml wml; + text/x-component htc; + + image/png png; + image/svg+xml svg svgz; + image/tiff tif tiff; + image/vnd.wap.wbmp wbmp; + image/webp webp; + image/x-icon ico; + image/x-jng jng; + image/x-ms-bmp bmp; + + font/woff woff; + font/woff2 woff2; + + application/x-font-ttf ttf; + application/x-font-opentype otf; + + application/java-archive jar war ear; + application/json json; + application/mac-binhex40 hqx; + application/msword doc; + application/pdf pdf; + application/postscript ps eps ai; + application/rtf rtf; + application/vnd.apple.mpegurl m3u8; + application/vnd.google-earth.kml+xml kml; + application/vnd.google-earth.kmz kmz; + application/vnd.ms-excel xls; + application/vnd.ms-fontobject eot; + application/vnd.ms-powerpoint ppt; + application/vnd.oasis.opendocument.graphics odg; + application/vnd.oasis.opendocument.presentation odp; + application/vnd.oasis.opendocument.spreadsheet ods; + application/vnd.oasis.opendocument.text odt; + application/vnd.openxmlformats-officedocument.presentationml.presentation + pptx; + application/vnd.openxmlformats-officedocument.spreadsheetml.sheet + xlsx; + application/vnd.openxmlformats-officedocument.wordprocessingml.document + docx; + application/vnd.wap.wmlc wmlc; + application/x-7z-compressed 7z; + application/x-cocoa cco; + application/x-java-archive-diff jardiff; + application/x-java-jnlp-file jnlp; + application/x-makeself run; + application/x-perl pl pm; + application/x-pilot prc pdb; + application/x-rar-compressed rar; + application/x-redhat-package-manager rpm; + application/x-sea sea; + application/x-shockwave-flash swf; + application/x-stuffit sit; + application/x-tcl tcl tk; + application/x-x509-ca-cert der pem crt; + application/x-xpinstall xpi; + application/xhtml+xml xhtml; + application/xspf+xml xspf; + application/zip zip; + + application/octet-stream bin exe dll; + application/octet-stream deb; + application/octet-stream dmg; + application/octet-stream iso img; + application/octet-stream msi msp msm; + + audio/midi mid midi kar; + audio/mpeg mp3; + audio/ogg ogg; + audio/x-m4a m4a; + audio/x-realaudio ra; + + video/3gpp 3gpp 3gp; + video/mp2t ts; + video/mp4 mp4; + video/mpeg mpeg mpg; + video/quicktime mov; + video/webm webm; + video/x-flv flv; + video/x-m4v m4v; + video/x-mng mng; + video/x-ms-asf asx asf; + video/x-ms-wmv wmv; + video/x-msvideo avi; +} diff --git a/confs/nginx/nginx.conf b/confs/nginx/nginx.conf new file mode 100644 index 0000000..e0eafd7 --- /dev/null +++ b/confs/nginx/nginx.conf @@ -0,0 +1,73 @@ +# +user bitrix; +worker_processes auto; +error_log /var/log/nginx/error.log warn; +pid /var/runs/nginx/nginx.pid; +# +include /etc/nginx/inc/modules.conf; +# +events { + worker_connections 2048; + use epoll; + multi_accept on; +} +# +http { + server_tokens off; + ###more_clear_headers Server; + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log /var/log/nginx/access.log main; + + sendfile on; + #sendfile_max_chunk 128k; + keepalive_timeout 75s; + keepalive_requests 1000; + client_body_buffer_size 512k; + client_header_buffer_size 512k; + large_client_header_buffers 4 64k; + client_max_body_size 1024m; + fastcgi_buffers 64 16k; + fastcgi_buffer_size 64k; + client_body_timeout 60s; + client_header_timeout 60s; + reset_timedout_connection on; + send_timeout 60s; + tcp_nopush on; + tcp_nodelay on; + server_names_hash_max_size 512; + server_names_hash_bucket_size 128; + types_hash_max_size 2048; + # + # gzip content compression params + # + gzip on; + gzip_vary on; + gzip_static on; + gzip_proxied any; + gzip_disable "msie6"; + gzip_min_length 1100; + gzip_buffers 64 8k; + gzip_comp_level 5; + gzip_http_version 1.1; + gzip_types text/plain text/css text/javascript text/xml application/xml application/x-javascript application/json application/xml+rss; + # + # brotli content compression params + # + brotli on; + brotli_static on; + brotli_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml; + brotli_buffers 16 8k; + brotli_comp_level 6; + brotli_window 512k; + brotli_min_length 20; + + include /etc/nginx/maps/*.conf; + include /etc/nginx/conf.d/*.conf; +} +# diff --git a/confs/nginx/scgi_params b/confs/nginx/scgi_params new file mode 100644 index 0000000..c462a05 --- /dev/null +++ b/confs/nginx/scgi_params @@ -0,0 +1,16 @@ +scgi_param REQUEST_METHOD $request_method; +scgi_param REQUEST_URI $request_uri; +scgi_param QUERY_STRING $query_string; +scgi_param CONTENT_TYPE $content_type; + +scgi_param DOCUMENT_URI $document_uri; +scgi_param DOCUMENT_ROOT $document_root; +scgi_param SCGI 1; +scgi_param SERVER_PROTOCOL $server_protocol; +scgi_param REQUEST_SCHEME $scheme; +scgi_param HTTPS $https if_not_empty; + +scgi_param REMOTE_ADDR $remote_addr; +scgi_param REMOTE_PORT $remote_port; +scgi_param SERVER_PORT $server_port; +scgi_param SERVER_NAME $server_name; diff --git a/confs/nginx/ssl/ssl.conf b/confs/nginx/ssl/ssl.conf new file mode 100644 index 0000000..d22f909 --- /dev/null +++ b/confs/nginx/ssl/ssl.conf @@ -0,0 +1,82 @@ +# +# ssl on; +# +# files +# +ssl_certificate /etc/nginx/certs/example.com/fullchain.pem; +ssl_certificate_key /etc/nginx/certs/example.com/privkey.pem; +ssl_trusted_certificate /etc/nginx/certs/example.com/chain.pem; +ssl_dhparam /etc/nginx/certs/example.com/dhparam.pem; +# +# ssl params +# +ssl_protocols TLSv1.2 TLSv1.3; +ssl_prefer_server_ciphers on; +ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256"; +ssl_ecdh_curve prime256v1:secp384r1:secp521r1:X25519; +ssl_early_data on; +# +# ssl session cache +# +ssl_session_cache shared:SSL:10m; +ssl_session_timeout 10m; +ssl_session_tickets on; +# +# ocsp +# +ssl_stapling off; +ssl_stapling_verify off; +resolver 8.8.8.8 8.8.4.4 valid=300s; +resolver_timeout 10s; +# +# csp +# +# add_header Content-Security-Policy-Report-Only ""; +# add_header X-Content-Security-Policy-Report-Only ""; +# add_header X-WebKit-CSP-Report-Only ""; +# +# headers +# +# add_header Public-Key-Pins 'pin-sha256=""; pin-sha256=""; pin-sha256=""; pin-sha256=""; pin-sha256=""; pin-sha256=""; max-age=31536000;'; +# add_header Frame-Options SAMEORIGIN; +# add_header X-Frame-Options SAMEORIGIN; +# add_header X-Content-Type-Options nosniff; +# add_header X-XSS-Protection "1; mode=block"; +add_header Strict-Transport-Security "max-age=15552000;"; # 180 days +# +# other +# +ssl_buffer_size 4k; +keepalive_timeout 70; +keepalive_requests 150; +# +# http2 +# https://nginx.org/ru/docs/http/ngx_http_v2_module.html +# +http2 on; +http2_body_preread_size 64k; +http2_chunk_size 8k; +# http2_idle_timeout 3m; -> keepalive_timeout use, obsolete 1.19.7 +# http2_max_concurrent_pushes 10; -> obsolete 1.25.1 +http2_max_concurrent_streams 128; +# http2_max_field_size 4k; -> large_client_header_buffers use, obsolete 1.19.7 +# http2_max_header_size 16k; -> large_client_header_buffers use, obsolete 1.19.7 +# http2_max_requests 1000; -> keepalive_requests use, obsolete 1.19.7 +# http2_push off; -> obsolete 1.25.1 +# http2_push_preload off; -> obsolete 1.25.1 +# http2_recv_buffer_size 256k; -> only on http available +# http2_recv_timeout 30s; -> client_header_timeout use, obsolete 1.19.7 +# +# http3 +# https://nginx.org/ru/docs/http/ngx_http_v3_module.html +# +# http3 on; +# http3_hq off; +# http3_max_concurrent_streams 128; +# http3_stream_buffer_size 64k; +# quic_active_connection_id_limit 2; +# quic_bpf off; +# quic_gso off; +# quic_host_key file; +# quic_retry off; +# diff --git a/confs/nginx/uwsgi_params b/confs/nginx/uwsgi_params new file mode 100644 index 0000000..5abf809 --- /dev/null +++ b/confs/nginx/uwsgi_params @@ -0,0 +1,16 @@ +uwsgi_param QUERY_STRING $query_string; +uwsgi_param REQUEST_METHOD $request_method; +uwsgi_param CONTENT_TYPE $content_type; +uwsgi_param CONTENT_LENGTH $content_length; + +uwsgi_param REQUEST_URI $request_uri; +uwsgi_param PATH_INFO $document_uri; +uwsgi_param DOCUMENT_ROOT $document_root; +uwsgi_param SERVER_PROTOCOL $server_protocol; +uwsgi_param REQUEST_SCHEME $scheme; +uwsgi_param HTTPS $https if_not_empty; + +uwsgi_param REMOTE_ADDR $remote_addr; +uwsgi_param REMOTE_PORT $remote_port; +uwsgi_param SERVER_PORT $server_port; +uwsgi_param SERVER_NAME $server_name; diff --git a/confs/nginx/win-utf b/confs/nginx/win-utf new file mode 100644 index 0000000..391b335 --- /dev/null +++ b/confs/nginx/win-utf @@ -0,0 +1,125 @@ +# This map is not a full windows-1251 <> utf8 map: it does not +# contain Serbian and Macedonian letters. If you need a full map, +# use contrib/unicode2nginx/win-utf map instead. + +charset_map windows-1251 utf-8 { + + 82 E2809A ; # single low-9 quotation mark + + 84 E2809E ; # double low-9 quotation mark + 85 E280A6 ; # ellipsis + 86 E280A0 ; # dagger + 87 E280A1 ; # double dagger + 88 E282AC ; # euro + 89 E280B0 ; # per mille + + 91 E28098 ; # left single quotation mark + 92 E28099 ; # right single quotation mark + 93 E2809C ; # left double quotation mark + 94 E2809D ; # right double quotation mark + 95 E280A2 ; # bullet + 96 E28093 ; # en dash + 97 E28094 ; # em dash + + 99 E284A2 ; # trade mark sign + + A0 C2A0 ; #   + A1 D18E ; # capital Byelorussian short U + A2 D19E ; # small Byelorussian short u + + A4 C2A4 ; # currency sign + A5 D290 ; # capital Ukrainian soft G + A6 C2A6 ; # borken bar + A7 C2A7 ; # section sign + A8 D081 ; # capital YO + A9 C2A9 ; # (C) + AA D084 ; # capital Ukrainian YE + AB C2AB ; # left-pointing double angle quotation mark + AC C2AC ; # not sign + AD C2AD ; # soft hypen + AE C2AE ; # (R) + AF D087 ; # capital Ukrainian YI + + B0 C2B0 ; # ° + B1 C2B1 ; # plus-minus sign + B2 D086 ; # capital Ukrainian I + B3 D196 ; # small Ukrainian i + B4 D291 ; # small Ukrainian soft g + B5 C2B5 ; # micro sign + B6 C2B6 ; # pilcrow sign + B7 C2B7 ; # · + B8 D191 ; # small yo + B9 E28496 ; # numero sign + BA D194 ; # small Ukrainian ye + BB C2BB ; # right-pointing double angle quotation mark + + BF D197 ; # small Ukrainian yi + + C0 D090 ; # capital A + C1 D091 ; # capital B + C2 D092 ; # capital V + C3 D093 ; # capital G + C4 D094 ; # capital D + C5 D095 ; # capital YE + C6 D096 ; # capital ZH + C7 D097 ; # capital Z + C8 D098 ; # capital I + C9 D099 ; # capital J + CA D09A ; # capital K + CB D09B ; # capital L + CC D09C ; # capital M + CD D09D ; # capital N + CE D09E ; # capital O + CF D09F ; # capital P + + D0 D0A0 ; # capital R + D1 D0A1 ; # capital S + D2 D0A2 ; # capital T + D3 D0A3 ; # capital U + D4 D0A4 ; # capital F + D5 D0A5 ; # capital KH + D6 D0A6 ; # capital TS + D7 D0A7 ; # capital CH + D8 D0A8 ; # capital SH + D9 D0A9 ; # capital SHCH + DA D0AA ; # capital hard sign + DB D0AB ; # capital Y + DC D0AC ; # capital soft sign + DD D0AD ; # capital E + DE D0AE ; # capital YU + DF D0AF ; # capital YA + + E0 D0B0 ; # small a + E1 D0B1 ; # small b + E2 D0B2 ; # small v + E3 D0B3 ; # small g + E4 D0B4 ; # small d + E5 D0B5 ; # small ye + E6 D0B6 ; # small zh + E7 D0B7 ; # small z + E8 D0B8 ; # small i + E9 D0B9 ; # small j + EA D0BA ; # small k + EB D0BB ; # small l + EC D0BC ; # small m + ED D0BD ; # small n + EE D0BE ; # small o + EF D0BF ; # small p + + F0 D180 ; # small r + F1 D181 ; # small s + F2 D182 ; # small t + F3 D183 ; # small u + F4 D184 ; # small f + F5 D185 ; # small kh + F6 D186 ; # small ts + F7 D187 ; # small ch + F8 D188 ; # small sh + F9 D189 ; # small shch + FA D18A ; # small hard sign + FB D18B ; # small y + FC D18C ; # small soft sign + FD D18D ; # small e + FE D18E ; # small yu + FF D18F ; # small ya +} diff --git a/confs/php84/etc/image.png b/confs/php84/etc/image.png new file mode 100644 index 0000000..0dbdaca Binary files /dev/null and b/confs/php84/etc/image.png differ diff --git a/confs/php84/etc/pear.conf b/confs/php84/etc/pear.conf new file mode 100644 index 0000000..6579d43 --- /dev/null +++ b/confs/php84/etc/pear.conf @@ -0,0 +1,2 @@ +#PEAR_Config 0.9 +a:33:{s:9:"cache_dir";s:15:"/tmp/pear/cache";s:15:"default_channel";s:12:"pear.php.net";s:16:"preferred_mirror";s:12:"pear.php.net";s:13:"remote_config";s:0:"";s:13:"auto_discover";i:0;s:13:"master_server";s:12:"pear.php.net";s:10:"http_proxy";s:0:"";s:7:"php_dir";s:18:"/usr/local/lib/php";s:7:"ext_dir";s:55:"/usr/local/lib/php/extensions/no-debug-non-zts-20240924";s:7:"doc_dir";s:22:"/usr/local/lib/php/doc";s:7:"bin_dir";s:14:"/usr/local/bin";s:8:"data_dir";s:23:"/usr/local/lib/php/data";s:7:"cfg_dir";s:22:"/usr/local/lib/php/cfg";s:7:"www_dir";s:25:"/usr/local/lib/php/htdocs";s:7:"man_dir";s:28:"/usr/local/lib/php/local/man";s:8:"test_dir";s:23:"/usr/local/lib/php/test";s:8:"temp_dir";s:14:"/tmp/pear/temp";s:12:"download_dir";s:18:"/tmp/pear/download";s:7:"php_bin";s:18:"/usr/local/bin/php";s:10:"php_prefix";s:0:"";s:10:"php_suffix";s:0:"";s:7:"php_ini";s:0:"";s:12:"metadata_dir";s:0:"";s:8:"username";s:0:"";s:8:"password";s:0:"";s:7:"verbose";i:1;s:15:"preferred_state";s:6:"stable";s:5:"umask";i:18;s:9:"cache_ttl";i:3600;s:8:"sig_type";s:3:"gpg";s:7:"sig_bin";s:18:"/usr/local/bin/gpg";s:9:"sig_keyid";s:0:"";s:10:"sig_keydir";s:23:"/usr/local/etc/pearkeys";} diff --git a/confs/php84/etc/php-fpm.conf b/confs/php84/etc/php-fpm.conf new file mode 100644 index 0000000..762350d --- /dev/null +++ b/confs/php84/etc/php-fpm.conf @@ -0,0 +1,142 @@ +;;;;;;;;;;;;;;;;;;;;; +; FPM Configuration ; +;;;;;;;;;;;;;;;;;;;;; + +; All relative paths in this configuration file are relative to PHP's install +; prefix (/usr/local). This prefix can be dynamically changed by using the +; '-p' argument from the command line. + +;;;;;;;;;;;;;;;;;; +; Global Options ; +;;;;;;;;;;;;;;;;;; + +[global] +; Pid file +; Note: the default prefix is /usr/local/var +; Default Value: none +;pid = run/php-fpm.pid + +; Error log file +; If it's set to "syslog", log is sent to syslogd instead of being written +; into a local file. +; Note: the default prefix is /usr/local/var +; Default Value: log/php-fpm.log +;error_log = log/php-fpm.log + +; syslog_facility is used to specify what type of program is logging the +; message. This lets syslogd specify that messages from different facilities +; will be handled differently. +; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON) +; Default Value: daemon +;syslog.facility = daemon + +; syslog_ident is prepended to every message. If you have multiple FPM +; instances running on the same server, you can change the default value +; which must suit common needs. +; Default Value: php-fpm +;syslog.ident = php-fpm + +; Log level +; Possible Values: alert, error, warning, notice, debug +; Default Value: notice +;log_level = notice + +; Log limit on number of characters in the single line (log entry). If the +; line is over the limit, it is wrapped on multiple lines. The limit is for +; all logged characters including message prefix and suffix if present. However +; the new line character does not count into it as it is present only when +; logging to a file descriptor. It means the new line character is not present +; when logging to syslog. +; Default Value: 1024 +;log_limit = 4096 + +; Log buffering specifies if the log line is buffered which means that the +; line is written in a single write operation. If the value is false, then the +; data is written directly into the file descriptor. It is an experimental +; option that can potentially improve logging performance and memory usage +; for some heavy logging scenarios. This option is ignored if logging to syslog +; as it has to be always buffered. +; Default value: yes +;log_buffering = no + +; If this number of child processes exit with SIGSEGV or SIGBUS within the time +; interval set by emergency_restart_interval then FPM will restart. A value +; of '0' means 'Off'. +; Default Value: 0 +;emergency_restart_threshold = 0 + +; Interval of time used by emergency_restart_interval to determine when +; a graceful restart will be initiated. This can be useful to work around +; accidental corruptions in an accelerator's shared memory. +; Available Units: s(econds), m(inutes), h(ours), or d(ays) +; Default Unit: seconds +; Default Value: 0 +;emergency_restart_interval = 0 + +; Time limit for child processes to wait for a reaction on signals from master. +; Available units: s(econds), m(inutes), h(ours), or d(ays) +; Default Unit: seconds +; Default Value: 0 +;process_control_timeout = 0 + +; The maximum number of processes FPM will fork. This has been designed to control +; the global number of processes when using dynamic PM within a lot of pools. +; Use it with caution. +; Note: A value of 0 indicates no limit +; Default Value: 0 +; process.max = 128 + +; Specify the nice(2) priority to apply to the master process (only if set) +; The value can vary from -19 (highest priority) to 20 (lowest priority) +; Note: - It will only work if the FPM master process is launched as root +; - The pool process will inherit the master process priority +; unless specified otherwise +; Default Value: no set +; process.priority = -19 + +; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging. +; Default Value: yes +;daemonize = yes + +; Set open file descriptor rlimit for the master process. +; Default Value: system defined value +;rlimit_files = 1024 + +; Set max core size rlimit for the master process. +; Possible Values: 'unlimited' or an integer greater or equal to 0 +; Default Value: system defined value +;rlimit_core = 0 + +; Specify the event mechanism FPM will use. The following is available: +; - select (any POSIX os) +; - poll (any POSIX os) +; - epoll (linux >= 2.5.44) +; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0) +; - port (Solaris >= 10) +; Default Value: not set (auto detection) +;events.mechanism = epoll + +; When FPM is built with systemd integration, specify the interval, +; in seconds, between health report notification to systemd. +; Set to 0 to disable. +; Available Units: s(econds), m(inutes), h(ours) +; Default Unit: seconds +; Default value: 10 +;systemd_interval = 10 + +;;;;;;;;;;;;;;;;;;;; +; Pool Definitions ; +;;;;;;;;;;;;;;;;;;;; + +; Multiple pools of child processes may be started with different listening +; ports and different management options. The name of the pool will be +; used in logs and stats. There is no limitation on the number of pools which +; FPM can handle. Your system will tell you anyway :) + +; Include one or more files. If glob(3) exists, it is used to include a bunch of +; files from a glob(3) pattern. This directive can be used everywhere in the +; file. +; Relative path can also be used. They will be prefixed by: +; - the global prefix if it's been set (-p argument) +; - /usr/local otherwise +include=etc/php-fpm.d/*.conf diff --git a/confs/php84/etc/php-fpm.conf.default b/confs/php84/etc/php-fpm.conf.default new file mode 100644 index 0000000..6f8dcd4 --- /dev/null +++ b/confs/php84/etc/php-fpm.conf.default @@ -0,0 +1,142 @@ +;;;;;;;;;;;;;;;;;;;;; +; FPM Configuration ; +;;;;;;;;;;;;;;;;;;;;; + +; All relative paths in this configuration file are relative to PHP's install +; prefix (/usr/local). This prefix can be dynamically changed by using the +; '-p' argument from the command line. + +;;;;;;;;;;;;;;;;;; +; Global Options ; +;;;;;;;;;;;;;;;;;; + +[global] +; Pid file +; Note: the default prefix is /usr/local/var +; Default Value: none +;pid = run/php-fpm.pid + +; Error log file +; If it's set to "syslog", log is sent to syslogd instead of being written +; into a local file. +; Note: the default prefix is /usr/local/var +; Default Value: log/php-fpm.log +;error_log = log/php-fpm.log + +; syslog_facility is used to specify what type of program is logging the +; message. This lets syslogd specify that messages from different facilities +; will be handled differently. +; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON) +; Default Value: daemon +;syslog.facility = daemon + +; syslog_ident is prepended to every message. If you have multiple FPM +; instances running on the same server, you can change the default value +; which must suit common needs. +; Default Value: php-fpm +;syslog.ident = php-fpm + +; Log level +; Possible Values: alert, error, warning, notice, debug +; Default Value: notice +;log_level = notice + +; Log limit on number of characters in the single line (log entry). If the +; line is over the limit, it is wrapped on multiple lines. The limit is for +; all logged characters including message prefix and suffix if present. However +; the new line character does not count into it as it is present only when +; logging to a file descriptor. It means the new line character is not present +; when logging to syslog. +; Default Value: 1024 +;log_limit = 4096 + +; Log buffering specifies if the log line is buffered which means that the +; line is written in a single write operation. If the value is false, then the +; data is written directly into the file descriptor. It is an experimental +; option that can potentially improve logging performance and memory usage +; for some heavy logging scenarios. This option is ignored if logging to syslog +; as it has to be always buffered. +; Default value: yes +;log_buffering = no + +; If this number of child processes exit with SIGSEGV or SIGBUS within the time +; interval set by emergency_restart_interval then FPM will restart. A value +; of '0' means 'Off'. +; Default Value: 0 +;emergency_restart_threshold = 0 + +; Interval of time used by emergency_restart_interval to determine when +; a graceful restart will be initiated. This can be useful to work around +; accidental corruptions in an accelerator's shared memory. +; Available Units: s(econds), m(inutes), h(ours), or d(ays) +; Default Unit: seconds +; Default Value: 0 +;emergency_restart_interval = 0 + +; Time limit for child processes to wait for a reaction on signals from master. +; Available units: s(econds), m(inutes), h(ours), or d(ays) +; Default Unit: seconds +; Default Value: 0 +;process_control_timeout = 0 + +; The maximum number of processes FPM will fork. This has been designed to control +; the global number of processes when using dynamic PM within a lot of pools. +; Use it with caution. +; Note: A value of 0 indicates no limit +; Default Value: 0 +; process.max = 128 + +; Specify the nice(2) priority to apply to the master process (only if set) +; The value can vary from -19 (highest priority) to 20 (lowest priority) +; Note: - It will only work if the FPM master process is launched as root +; - The pool process will inherit the master process priority +; unless specified otherwise +; Default Value: no set +; process.priority = -19 + +; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging. +; Default Value: yes +;daemonize = yes + +; Set open file descriptor rlimit for the master process. +; Default Value: system defined value +;rlimit_files = 1024 + +; Set max core size rlimit for the master process. +; Possible Values: 'unlimited' or an integer greater or equal to 0 +; Default Value: system defined value +;rlimit_core = 0 + +; Specify the event mechanism FPM will use. The following is available: +; - select (any POSIX os) +; - poll (any POSIX os) +; - epoll (linux >= 2.5.44) +; - kqueue (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0) +; - port (Solaris >= 10) +; Default Value: not set (auto detection) +;events.mechanism = epoll + +; When FPM is built with systemd integration, specify the interval, +; in seconds, between health report notification to systemd. +; Set to 0 to disable. +; Available Units: s(econds), m(inutes), h(ours) +; Default Unit: seconds +; Default value: 10 +;systemd_interval = 10 + +;;;;;;;;;;;;;;;;;;;; +; Pool Definitions ; +;;;;;;;;;;;;;;;;;;;; + +; Multiple pools of child processes may be started with different listening +; ports and different management options. The name of the pool will be +; used in logs and stats. There is no limitation on the number of pools which +; FPM can handle. Your system will tell you anyway :) + +; Include one or more files. If glob(3) exists, it is used to include a bunch of +; files from a glob(3) pattern. This directive can be used everywhere in the +; file. +; Relative path can also be used. They will be prefixed by: +; - the global prefix if it's been set (-p argument) +; - /usr/local otherwise +include=NONE/etc/php-fpm.d/*.conf diff --git a/confs/php84/etc/php-fpm.d/docker.conf b/confs/php84/etc/php-fpm.d/docker.conf new file mode 100644 index 0000000..bf993fe --- /dev/null +++ b/confs/php84/etc/php-fpm.d/docker.conf @@ -0,0 +1,16 @@ +[global] +error_log = /proc/self/fd/2 + +; https://github.com/docker-library/php/pull/725#issuecomment-443540114 +log_limit = 8192 + +[www] +; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work. +; https://bugs.php.net/bug.php?id=73886 +access.log = /proc/self/fd/2 + +clear_env = no + +; Ensure worker stdout and stderr are sent to the main error log. +catch_workers_output = yes +decorate_workers_output = no diff --git a/confs/php84/etc/php-fpm.d/www.conf b/confs/php84/etc/php-fpm.d/www.conf new file mode 100644 index 0000000..47dce6e --- /dev/null +++ b/confs/php84/etc/php-fpm.d/www.conf @@ -0,0 +1,495 @@ +; Start a new pool named 'www'. +; the variable $pool can be used in any directive and will be replaced by the +; pool name ('www' here) +[www] + +; Per pool prefix +; It only applies on the following directives: +; - 'access.log' +; - 'slowlog' +; - 'listen' (unixsocket) +; - 'chroot' +; - 'chdir' +; - 'php_values' +; - 'php_admin_values' +; When not set, the global prefix (or NONE) applies instead. +; Note: This directive can also be relative to the global prefix. +; Default Value: none +;prefix = /path/to/pools/$pool + +; Unix user/group of the child processes. This can be used only if the master +; process running user is root. It is set after the child process is created. +; The user and group can be specified either by their name or by their numeric +; IDs. +; Note: If the user is root, the executable needs to be started with +; --allow-to-run-as-root option to work. +; Default Values: The user is set to master process running user by default. +; If the group is not set, the user's group is used. +;user = www-data +;group = www-data +;user = bitrix +;group = bitrix + +; The address on which to accept FastCGI requests. +; Valid syntaxes are: +; 'ip.add.re.ss:port' - to listen on a TCP socket to a specific IPv4 address on +; a specific port; +; '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on +; a specific port; +; 'port' - to listen on a TCP socket to all addresses +; (IPv6 and IPv4-mapped) on a specific port; +; '/path/to/unix/socket' - to listen on a unix socket. +; Note: This value is mandatory. +listen = 127.0.0.1:9000 + +; Set listen(2) backlog. +; Default Value: 511 (-1 on Linux, FreeBSD and OpenBSD) +;listen.backlog = 511 + +; Set permissions for unix socket, if one is used. In Linux, read/write +; permissions must be set in order to allow connections from a web server. Many +; BSD-derived systems allow connections regardless of permissions. The owner +; and group can be specified either by name or by their numeric IDs. +; Default Values: Owner is set to the master process running user. If the group +; is not set, the owner's group is used. Mode is set to 0660. +;listen.owner = www-data +;listen.group = www-data +;listen.mode = 0660 +listen.owner = bitrix +listen.group = bitrix +listen.mode = 0660 + +; When POSIX Access Control Lists are supported you can set them using +; these options, value is a comma separated list of user/group names. +; When set, listen.owner and listen.group are ignored +;listen.acl_users = +;listen.acl_groups = + +; List of addresses (IPv4/IPv6) of FastCGI clients which are allowed to connect. +; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original +; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address +; must be separated by a comma. If this value is left blank, connections will be +; accepted from any ip address. +; Default Value: any +;listen.allowed_clients = 127.0.0.1 + +; Set the associated the route table (FIB). FreeBSD only +; Default Value: -1 +;listen.setfib = 1 + +; Specify the nice(2) priority to apply to the pool processes (only if set) +; The value can vary from -19 (highest priority) to 20 (lower priority) +; Note: - It will only work if the FPM master process is launched as root +; - The pool processes will inherit the master process priority +; unless it specified otherwise +; Default Value: no set +; process.priority = -19 + +; Set the process dumpable flag (PR_SET_DUMPABLE prctl for Linux or +; PROC_TRACE_CTL procctl for FreeBSD) even if the process user +; or group is different than the master process user. It allows to create process +; core dump and ptrace the process for the pool user. +; Default Value: no +; process.dumpable = yes + +; Choose how the process manager will control the number of child processes. +; Possible Values: +; static - a fixed number (pm.max_children) of child processes; +; dynamic - the number of child processes are set dynamically based on the +; following directives. With this process management, there will be +; always at least 1 children. +; pm.max_children - the maximum number of children that can +; be alive at the same time. +; pm.start_servers - the number of children created on startup. +; pm.min_spare_servers - the minimum number of children in 'idle' +; state (waiting to process). If the number +; of 'idle' processes is less than this +; number then some children will be created. +; pm.max_spare_servers - the maximum number of children in 'idle' +; state (waiting to process). If the number +; of 'idle' processes is greater than this +; number then some children will be killed. +; pm.max_spawn_rate - the maximum number of rate to spawn child +; processes at once. +; ondemand - no children are created at startup. Children will be forked when +; new requests will connect. The following parameter are used: +; pm.max_children - the maximum number of children that +; can be alive at the same time. +; pm.process_idle_timeout - The number of seconds after which +; an idle process will be killed. +; Note: This value is mandatory. +pm = dynamic + +; The number of child processes to be created when pm is set to 'static' and the +; maximum number of child processes when pm is set to 'dynamic' or 'ondemand'. +; This value sets the limit on the number of simultaneous requests that will be +; served. Equivalent to the ApacheMaxClients directive with mpm_prefork. +; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP +; CGI. The below defaults are based on a server without much resources. Don't +; forget to tweak pm.* to fit your needs. +; Note: Used when pm is set to 'static', 'dynamic' or 'ondemand' +; Note: This value is mandatory. +pm.max_children = 5 + +; The number of child processes created on startup. +; Note: Used only when pm is set to 'dynamic' +; Default Value: (min_spare_servers + max_spare_servers) / 2 +pm.start_servers = 2 + +; The desired minimum number of idle server processes. +; Note: Used only when pm is set to 'dynamic' +; Note: Mandatory when pm is set to 'dynamic' +pm.min_spare_servers = 1 + +; The desired maximum number of idle server processes. +; Note: Used only when pm is set to 'dynamic' +; Note: Mandatory when pm is set to 'dynamic' +pm.max_spare_servers = 3 + +; The number of rate to spawn child processes at once. +; Note: Used only when pm is set to 'dynamic' +; Note: Mandatory when pm is set to 'dynamic' +; Default Value: 32 +;pm.max_spawn_rate = 32 + +; The number of seconds after which an idle process will be killed. +; Note: Used only when pm is set to 'ondemand' +; Default Value: 10s +;pm.process_idle_timeout = 10s; + +; The number of requests each child process should execute before respawning. +; This can be useful to work around memory leaks in 3rd party libraries. For +; endless request processing specify '0'. Equivalent to PHP_FCGI_MAX_REQUESTS. +; Default Value: 0 +;pm.max_requests = 500 + +; The URI to view the FPM status page. If this value is not set, no URI will be +; recognized as a status page. It shows the following information: +; pool - the name of the pool; +; process manager - static, dynamic or ondemand; +; start time - the date and time FPM has started; +; start since - number of seconds since FPM has started; +; accepted conn - the number of request accepted by the pool; +; listen queue - the number of request in the queue of pending +; connections (see backlog in listen(2)); +; max listen queue - the maximum number of requests in the queue +; of pending connections since FPM has started; +; listen queue len - the size of the socket queue of pending connections; +; idle processes - the number of idle processes; +; active processes - the number of active processes; +; total processes - the number of idle + active processes; +; max active processes - the maximum number of active processes since FPM +; has started; +; max children reached - number of times, the process limit has been reached, +; when pm tries to start more children (works only for +; pm 'dynamic' and 'ondemand'); +; Value are updated in real time. +; Example output: +; pool: www +; process manager: static +; start time: 01/Jul/2011:17:53:49 +0200 +; start since: 62636 +; accepted conn: 190460 +; listen queue: 0 +; max listen queue: 1 +; listen queue len: 42 +; idle processes: 4 +; active processes: 11 +; total processes: 15 +; max active processes: 12 +; max children reached: 0 +; +; By default the status page output is formatted as text/plain. Passing either +; 'html', 'xml' or 'json' in the query string will return the corresponding +; output syntax. Example: +; http://www.foo.bar/status +; http://www.foo.bar/status?json +; http://www.foo.bar/status?html +; http://www.foo.bar/status?xml +; +; By default the status page only outputs short status. Passing 'full' in the +; query string will also return status for each pool process. +; Example: +; http://www.foo.bar/status?full +; http://www.foo.bar/status?json&full +; http://www.foo.bar/status?html&full +; http://www.foo.bar/status?xml&full +; The Full status returns for each process: +; pid - the PID of the process; +; state - the state of the process (Idle, Running, ...); +; start time - the date and time the process has started; +; start since - the number of seconds since the process has started; +; requests - the number of requests the process has served; +; request duration - the duration in µs of the requests; +; request method - the request method (GET, POST, ...); +; request URI - the request URI with the query string; +; content length - the content length of the request (only with POST); +; user - the user (PHP_AUTH_USER) (or '-' if not set); +; script - the main script called (or '-' if not set); +; last request cpu - the %cpu the last request consumed +; it's always 0 if the process is not in Idle state +; because CPU calculation is done when the request +; processing has terminated; +; last request memory - the max amount of memory the last request consumed +; it's always 0 if the process is not in Idle state +; because memory calculation is done when the request +; processing has terminated; +; If the process is in Idle state, then information is related to the +; last request the process has served. Otherwise information is related to +; the current request being served. +; Example output: +; ************************ +; pid: 31330 +; state: Running +; start time: 01/Jul/2011:17:53:49 +0200 +; start since: 63087 +; requests: 12808 +; request duration: 1250261 +; request method: GET +; request URI: /test_mem.php?N=10000 +; content length: 0 +; user: - +; script: /home/fat/web/docs/php/test_mem.php +; last request cpu: 0.00 +; last request memory: 0 +; +; Note: There is a real-time FPM status monitoring sample web page available +; It's available in: /usr/local/share/php/fpm/status.html +; +; Note: The value must start with a leading slash (/). The value can be +; anything, but it may not be a good idea to use the .php extension or it +; may conflict with a real PHP file. +; Default Value: not set +;pm.status_path = /status + +; The address on which to accept FastCGI status request. This creates a new +; invisible pool that can handle requests independently. This is useful +; if the main pool is busy with long running requests because it is still possible +; to get the status before finishing the long running requests. +; +; Valid syntaxes are: +; 'ip.add.re.ss:port' - to listen on a TCP socket to a specific IPv4 address on +; a specific port; +; '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on +; a specific port; +; 'port' - to listen on a TCP socket to all addresses +; (IPv6 and IPv4-mapped) on a specific port; +; '/path/to/unix/socket' - to listen on a unix socket. +; Default Value: value of the listen option +;pm.status_listen = 127.0.0.1:9001 + +; The ping URI to call the monitoring page of FPM. If this value is not set, no +; URI will be recognized as a ping page. This could be used to test from outside +; that FPM is alive and responding, or to +; - create a graph of FPM availability (rrd or such); +; - remove a server from a group if it is not responding (load balancing); +; - trigger alerts for the operating team (24/7). +; Note: The value must start with a leading slash (/). The value can be +; anything, but it may not be a good idea to use the .php extension or it +; may conflict with a real PHP file. +; Default Value: not set +;ping.path = /ping + +; This directive may be used to customize the response of a ping request. The +; response is formatted as text/plain with a 200 response code. +; Default Value: pong +;ping.response = pong + +; The access log file +; Default: not set +;access.log = log/$pool.access.log + +; The access log format. +; The following syntax is allowed +; %%: the '%' character +; %C: %CPU used by the request +; it can accept the following format: +; - %{user}C for user CPU only +; - %{system}C for system CPU only +; - %{total}C for user + system CPU (default) +; %d: time taken to serve the request +; it can accept the following format: +; - %{seconds}d (default) +; - %{milliseconds}d +; - %{milli}d +; - %{microseconds}d +; - %{micro}d +; %e: an environment variable (same as $_ENV or $_SERVER) +; it must be associated with embraces to specify the name of the env +; variable. Some examples: +; - server specifics like: %{REQUEST_METHOD}e or %{SERVER_PROTOCOL}e +; - HTTP headers like: %{HTTP_HOST}e or %{HTTP_USER_AGENT}e +; %f: script filename +; %l: content-length of the request (for POST request only) +; %m: request method +; %M: peak of memory allocated by PHP +; it can accept the following format: +; - %{bytes}M (default) +; - %{kilobytes}M +; - %{kilo}M +; - %{megabytes}M +; - %{mega}M +; %n: pool name +; %o: output header +; it must be associated with embraces to specify the name of the header: +; - %{Content-Type}o +; - %{X-Powered-By}o +; - %{Transfert-Encoding}o +; - .... +; %p: PID of the child that serviced the request +; %P: PID of the parent of the child that serviced the request +; %q: the query string +; %Q: the '?' character if query string exists +; %r: the request URI (without the query string, see %q and %Q) +; %R: remote IP address +; %s: status (response code) +; %t: server time the request was received +; it can accept a strftime(3) format: +; %d/%b/%Y:%H:%M:%S %z (default) +; The strftime(3) format must be encapsulated in a %{}t tag +; e.g. for a ISO8601 formatted timestring, use: %{%Y-%m-%dT%H:%M:%S%z}t +; %T: time the log has been written (the request has finished) +; it can accept a strftime(3) format: +; %d/%b/%Y:%H:%M:%S %z (default) +; The strftime(3) format must be encapsulated in a %{}t tag +; e.g. for a ISO8601 formatted timestring, use: %{%Y-%m-%dT%H:%M:%S%z}t +; %u: basic auth user if specified in Authorization header +; +; Default: "%R - %u %t \"%m %r\" %s" +;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{milli}d %{kilo}M %C%%" + +; A list of request_uri values which should be filtered from the access log. +; +; As a security precaution, this setting will be ignored if: +; - the request method is not GET or HEAD; or +; - there is a request body; or +; - there are query parameters; or +; - the response code is outwith the successful range of 200 to 299 +; +; Note: The paths are matched against the output of the access.format tag "%r". +; On common configurations, this may look more like SCRIPT_NAME than the +; expected pre-rewrite URI. +; +; Default Value: not set +;access.suppress_path[] = /ping +;access.suppress_path[] = /health_check.php + +; The log file for slow requests +; Default Value: not set +; Note: slowlog is mandatory if request_slowlog_timeout is set +;slowlog = log/$pool.log.slow + +; The timeout for serving a single request after which a PHP backtrace will be +; dumped to the 'slowlog' file. A value of '0s' means 'off'. +; Available units: s(econds)(default), m(inutes), h(ours), or d(ays) +; Default Value: 0 +;request_slowlog_timeout = 0 + +; Depth of slow log stack trace. +; Default Value: 20 +;request_slowlog_trace_depth = 20 + +; The timeout for serving a single request after which the worker process will +; be killed. This option should be used when the 'max_execution_time' ini option +; does not stop script execution for some reason. A value of '0' means 'off'. +; Available units: s(econds)(default), m(inutes), h(ours), or d(ays) +; Default Value: 0 +;request_terminate_timeout = 0 + +; The timeout set by 'request_terminate_timeout' ini option is not engaged after +; application calls 'fastcgi_finish_request' or when application has finished and +; shutdown functions are being called (registered via register_shutdown_function). +; This option will enable timeout limit to be applied unconditionally +; even in such cases. +; Default Value: no +;request_terminate_timeout_track_finished = no + +; Set open file descriptor rlimit. +; Default Value: system defined value +;rlimit_files = 1024 + +; Set max core size rlimit. +; Possible Values: 'unlimited' or an integer greater or equal to 0 +; Default Value: system defined value +;rlimit_core = 0 + +; Chroot to this directory at the start. This value must be defined as an +; absolute path. When this value is not set, chroot is not used. +; Note: you can prefix with '$prefix' to chroot to the pool prefix or one +; of its subdirectories. If the pool prefix is not set, the global prefix +; will be used instead. +; Note: chrooting is a great security feature and should be used whenever +; possible. However, all PHP paths will be relative to the chroot +; (error_log, sessions.save_path, ...). +; Default Value: not set +;chroot = + +; Chdir to this directory at the start. +; Note: relative path can be used. +; Default Value: current directory or / when chroot +;chdir = /var/www + +; Redirect worker stdout and stderr into main error log. If not set, stdout and +; stderr will be redirected to /dev/null according to FastCGI specs. +; Note: on highloaded environment, this can cause some delay in the page +; process time (several ms). +; Default Value: no +;catch_workers_output = yes + +; Decorate worker output with prefix and suffix containing information about +; the child that writes to the log and if stdout or stderr is used as well as +; log level and time. This options is used only if catch_workers_output is yes. +; Settings to "no" will output data as written to the stdout or stderr. +; Default value: yes +;decorate_workers_output = no + +; Clear environment in FPM workers +; Prevents arbitrary environment variables from reaching FPM worker processes +; by clearing the environment in workers before env vars specified in this +; pool configuration are added. +; Setting to "no" will make all environment variables available to PHP code +; via getenv(), $_ENV and $_SERVER. +; Default Value: yes +;clear_env = no + +; Limits the extensions of the main script FPM will allow to parse. This can +; prevent configuration mistakes on the web server side. You should only limit +; FPM to .php extensions to prevent malicious users to use other extensions to +; execute php code. +; Note: set an empty value to allow all extensions. +; Default Value: .php +;security.limit_extensions = .php .php3 .php4 .php5 .php7 + +; Pass environment variables like LD_LIBRARY_PATH. All $VARIABLEs are taken from +; the current environment. +; Default Value: clean env +;env[HOSTNAME] = $HOSTNAME +;env[PATH] = /usr/local/bin:/usr/bin:/bin +;env[TMP] = /tmp +;env[TMPDIR] = /tmp +;env[TEMP] = /tmp + +; Additional php.ini defines, specific to this pool of workers. These settings +; overwrite the values previously defined in the php.ini. The directives are the +; same as the PHP SAPI: +; php_value/php_flag - you can set classic ini defines which can +; be overwritten from PHP call 'ini_set'. +; php_admin_value/php_admin_flag - these directives won't be overwritten by +; PHP call 'ini_set' +; For php_*flag, valid values are on, off, 1, 0, true, false, yes or no. + +; Defining 'extension' will load the corresponding shared extension from +; extension_dir. Defining 'disable_functions' or 'disable_classes' will not +; overwrite previously defined php.ini values, but will append the new value +; instead. + +; Note: path INI options can be relative and will be expanded with the prefix +; (pool, global or /usr/local) + +; Default Value: nothing is defined by default except the values in php.ini and +; specified at startup with the -d argument +;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com +;php_flag[display_errors] = off +;php_admin_value[error_log] = /var/log/fpm-php.www.log +;php_admin_flag[log_errors] = on +;php_admin_value[memory_limit] = 32M diff --git a/confs/php84/etc/php-fpm.d/www.conf.default b/confs/php84/etc/php-fpm.d/www.conf.default new file mode 100644 index 0000000..47dce6e --- /dev/null +++ b/confs/php84/etc/php-fpm.d/www.conf.default @@ -0,0 +1,495 @@ +; Start a new pool named 'www'. +; the variable $pool can be used in any directive and will be replaced by the +; pool name ('www' here) +[www] + +; Per pool prefix +; It only applies on the following directives: +; - 'access.log' +; - 'slowlog' +; - 'listen' (unixsocket) +; - 'chroot' +; - 'chdir' +; - 'php_values' +; - 'php_admin_values' +; When not set, the global prefix (or NONE) applies instead. +; Note: This directive can also be relative to the global prefix. +; Default Value: none +;prefix = /path/to/pools/$pool + +; Unix user/group of the child processes. This can be used only if the master +; process running user is root. It is set after the child process is created. +; The user and group can be specified either by their name or by their numeric +; IDs. +; Note: If the user is root, the executable needs to be started with +; --allow-to-run-as-root option to work. +; Default Values: The user is set to master process running user by default. +; If the group is not set, the user's group is used. +;user = www-data +;group = www-data +;user = bitrix +;group = bitrix + +; The address on which to accept FastCGI requests. +; Valid syntaxes are: +; 'ip.add.re.ss:port' - to listen on a TCP socket to a specific IPv4 address on +; a specific port; +; '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on +; a specific port; +; 'port' - to listen on a TCP socket to all addresses +; (IPv6 and IPv4-mapped) on a specific port; +; '/path/to/unix/socket' - to listen on a unix socket. +; Note: This value is mandatory. +listen = 127.0.0.1:9000 + +; Set listen(2) backlog. +; Default Value: 511 (-1 on Linux, FreeBSD and OpenBSD) +;listen.backlog = 511 + +; Set permissions for unix socket, if one is used. In Linux, read/write +; permissions must be set in order to allow connections from a web server. Many +; BSD-derived systems allow connections regardless of permissions. The owner +; and group can be specified either by name or by their numeric IDs. +; Default Values: Owner is set to the master process running user. If the group +; is not set, the owner's group is used. Mode is set to 0660. +;listen.owner = www-data +;listen.group = www-data +;listen.mode = 0660 +listen.owner = bitrix +listen.group = bitrix +listen.mode = 0660 + +; When POSIX Access Control Lists are supported you can set them using +; these options, value is a comma separated list of user/group names. +; When set, listen.owner and listen.group are ignored +;listen.acl_users = +;listen.acl_groups = + +; List of addresses (IPv4/IPv6) of FastCGI clients which are allowed to connect. +; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original +; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address +; must be separated by a comma. If this value is left blank, connections will be +; accepted from any ip address. +; Default Value: any +;listen.allowed_clients = 127.0.0.1 + +; Set the associated the route table (FIB). FreeBSD only +; Default Value: -1 +;listen.setfib = 1 + +; Specify the nice(2) priority to apply to the pool processes (only if set) +; The value can vary from -19 (highest priority) to 20 (lower priority) +; Note: - It will only work if the FPM master process is launched as root +; - The pool processes will inherit the master process priority +; unless it specified otherwise +; Default Value: no set +; process.priority = -19 + +; Set the process dumpable flag (PR_SET_DUMPABLE prctl for Linux or +; PROC_TRACE_CTL procctl for FreeBSD) even if the process user +; or group is different than the master process user. It allows to create process +; core dump and ptrace the process for the pool user. +; Default Value: no +; process.dumpable = yes + +; Choose how the process manager will control the number of child processes. +; Possible Values: +; static - a fixed number (pm.max_children) of child processes; +; dynamic - the number of child processes are set dynamically based on the +; following directives. With this process management, there will be +; always at least 1 children. +; pm.max_children - the maximum number of children that can +; be alive at the same time. +; pm.start_servers - the number of children created on startup. +; pm.min_spare_servers - the minimum number of children in 'idle' +; state (waiting to process). If the number +; of 'idle' processes is less than this +; number then some children will be created. +; pm.max_spare_servers - the maximum number of children in 'idle' +; state (waiting to process). If the number +; of 'idle' processes is greater than this +; number then some children will be killed. +; pm.max_spawn_rate - the maximum number of rate to spawn child +; processes at once. +; ondemand - no children are created at startup. Children will be forked when +; new requests will connect. The following parameter are used: +; pm.max_children - the maximum number of children that +; can be alive at the same time. +; pm.process_idle_timeout - The number of seconds after which +; an idle process will be killed. +; Note: This value is mandatory. +pm = dynamic + +; The number of child processes to be created when pm is set to 'static' and the +; maximum number of child processes when pm is set to 'dynamic' or 'ondemand'. +; This value sets the limit on the number of simultaneous requests that will be +; served. Equivalent to the ApacheMaxClients directive with mpm_prefork. +; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP +; CGI. The below defaults are based on a server without much resources. Don't +; forget to tweak pm.* to fit your needs. +; Note: Used when pm is set to 'static', 'dynamic' or 'ondemand' +; Note: This value is mandatory. +pm.max_children = 5 + +; The number of child processes created on startup. +; Note: Used only when pm is set to 'dynamic' +; Default Value: (min_spare_servers + max_spare_servers) / 2 +pm.start_servers = 2 + +; The desired minimum number of idle server processes. +; Note: Used only when pm is set to 'dynamic' +; Note: Mandatory when pm is set to 'dynamic' +pm.min_spare_servers = 1 + +; The desired maximum number of idle server processes. +; Note: Used only when pm is set to 'dynamic' +; Note: Mandatory when pm is set to 'dynamic' +pm.max_spare_servers = 3 + +; The number of rate to spawn child processes at once. +; Note: Used only when pm is set to 'dynamic' +; Note: Mandatory when pm is set to 'dynamic' +; Default Value: 32 +;pm.max_spawn_rate = 32 + +; The number of seconds after which an idle process will be killed. +; Note: Used only when pm is set to 'ondemand' +; Default Value: 10s +;pm.process_idle_timeout = 10s; + +; The number of requests each child process should execute before respawning. +; This can be useful to work around memory leaks in 3rd party libraries. For +; endless request processing specify '0'. Equivalent to PHP_FCGI_MAX_REQUESTS. +; Default Value: 0 +;pm.max_requests = 500 + +; The URI to view the FPM status page. If this value is not set, no URI will be +; recognized as a status page. It shows the following information: +; pool - the name of the pool; +; process manager - static, dynamic or ondemand; +; start time - the date and time FPM has started; +; start since - number of seconds since FPM has started; +; accepted conn - the number of request accepted by the pool; +; listen queue - the number of request in the queue of pending +; connections (see backlog in listen(2)); +; max listen queue - the maximum number of requests in the queue +; of pending connections since FPM has started; +; listen queue len - the size of the socket queue of pending connections; +; idle processes - the number of idle processes; +; active processes - the number of active processes; +; total processes - the number of idle + active processes; +; max active processes - the maximum number of active processes since FPM +; has started; +; max children reached - number of times, the process limit has been reached, +; when pm tries to start more children (works only for +; pm 'dynamic' and 'ondemand'); +; Value are updated in real time. +; Example output: +; pool: www +; process manager: static +; start time: 01/Jul/2011:17:53:49 +0200 +; start since: 62636 +; accepted conn: 190460 +; listen queue: 0 +; max listen queue: 1 +; listen queue len: 42 +; idle processes: 4 +; active processes: 11 +; total processes: 15 +; max active processes: 12 +; max children reached: 0 +; +; By default the status page output is formatted as text/plain. Passing either +; 'html', 'xml' or 'json' in the query string will return the corresponding +; output syntax. Example: +; http://www.foo.bar/status +; http://www.foo.bar/status?json +; http://www.foo.bar/status?html +; http://www.foo.bar/status?xml +; +; By default the status page only outputs short status. Passing 'full' in the +; query string will also return status for each pool process. +; Example: +; http://www.foo.bar/status?full +; http://www.foo.bar/status?json&full +; http://www.foo.bar/status?html&full +; http://www.foo.bar/status?xml&full +; The Full status returns for each process: +; pid - the PID of the process; +; state - the state of the process (Idle, Running, ...); +; start time - the date and time the process has started; +; start since - the number of seconds since the process has started; +; requests - the number of requests the process has served; +; request duration - the duration in µs of the requests; +; request method - the request method (GET, POST, ...); +; request URI - the request URI with the query string; +; content length - the content length of the request (only with POST); +; user - the user (PHP_AUTH_USER) (or '-' if not set); +; script - the main script called (or '-' if not set); +; last request cpu - the %cpu the last request consumed +; it's always 0 if the process is not in Idle state +; because CPU calculation is done when the request +; processing has terminated; +; last request memory - the max amount of memory the last request consumed +; it's always 0 if the process is not in Idle state +; because memory calculation is done when the request +; processing has terminated; +; If the process is in Idle state, then information is related to the +; last request the process has served. Otherwise information is related to +; the current request being served. +; Example output: +; ************************ +; pid: 31330 +; state: Running +; start time: 01/Jul/2011:17:53:49 +0200 +; start since: 63087 +; requests: 12808 +; request duration: 1250261 +; request method: GET +; request URI: /test_mem.php?N=10000 +; content length: 0 +; user: - +; script: /home/fat/web/docs/php/test_mem.php +; last request cpu: 0.00 +; last request memory: 0 +; +; Note: There is a real-time FPM status monitoring sample web page available +; It's available in: /usr/local/share/php/fpm/status.html +; +; Note: The value must start with a leading slash (/). The value can be +; anything, but it may not be a good idea to use the .php extension or it +; may conflict with a real PHP file. +; Default Value: not set +;pm.status_path = /status + +; The address on which to accept FastCGI status request. This creates a new +; invisible pool that can handle requests independently. This is useful +; if the main pool is busy with long running requests because it is still possible +; to get the status before finishing the long running requests. +; +; Valid syntaxes are: +; 'ip.add.re.ss:port' - to listen on a TCP socket to a specific IPv4 address on +; a specific port; +; '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on +; a specific port; +; 'port' - to listen on a TCP socket to all addresses +; (IPv6 and IPv4-mapped) on a specific port; +; '/path/to/unix/socket' - to listen on a unix socket. +; Default Value: value of the listen option +;pm.status_listen = 127.0.0.1:9001 + +; The ping URI to call the monitoring page of FPM. If this value is not set, no +; URI will be recognized as a ping page. This could be used to test from outside +; that FPM is alive and responding, or to +; - create a graph of FPM availability (rrd or such); +; - remove a server from a group if it is not responding (load balancing); +; - trigger alerts for the operating team (24/7). +; Note: The value must start with a leading slash (/). The value can be +; anything, but it may not be a good idea to use the .php extension or it +; may conflict with a real PHP file. +; Default Value: not set +;ping.path = /ping + +; This directive may be used to customize the response of a ping request. The +; response is formatted as text/plain with a 200 response code. +; Default Value: pong +;ping.response = pong + +; The access log file +; Default: not set +;access.log = log/$pool.access.log + +; The access log format. +; The following syntax is allowed +; %%: the '%' character +; %C: %CPU used by the request +; it can accept the following format: +; - %{user}C for user CPU only +; - %{system}C for system CPU only +; - %{total}C for user + system CPU (default) +; %d: time taken to serve the request +; it can accept the following format: +; - %{seconds}d (default) +; - %{milliseconds}d +; - %{milli}d +; - %{microseconds}d +; - %{micro}d +; %e: an environment variable (same as $_ENV or $_SERVER) +; it must be associated with embraces to specify the name of the env +; variable. Some examples: +; - server specifics like: %{REQUEST_METHOD}e or %{SERVER_PROTOCOL}e +; - HTTP headers like: %{HTTP_HOST}e or %{HTTP_USER_AGENT}e +; %f: script filename +; %l: content-length of the request (for POST request only) +; %m: request method +; %M: peak of memory allocated by PHP +; it can accept the following format: +; - %{bytes}M (default) +; - %{kilobytes}M +; - %{kilo}M +; - %{megabytes}M +; - %{mega}M +; %n: pool name +; %o: output header +; it must be associated with embraces to specify the name of the header: +; - %{Content-Type}o +; - %{X-Powered-By}o +; - %{Transfert-Encoding}o +; - .... +; %p: PID of the child that serviced the request +; %P: PID of the parent of the child that serviced the request +; %q: the query string +; %Q: the '?' character if query string exists +; %r: the request URI (without the query string, see %q and %Q) +; %R: remote IP address +; %s: status (response code) +; %t: server time the request was received +; it can accept a strftime(3) format: +; %d/%b/%Y:%H:%M:%S %z (default) +; The strftime(3) format must be encapsulated in a %{}t tag +; e.g. for a ISO8601 formatted timestring, use: %{%Y-%m-%dT%H:%M:%S%z}t +; %T: time the log has been written (the request has finished) +; it can accept a strftime(3) format: +; %d/%b/%Y:%H:%M:%S %z (default) +; The strftime(3) format must be encapsulated in a %{}t tag +; e.g. for a ISO8601 formatted timestring, use: %{%Y-%m-%dT%H:%M:%S%z}t +; %u: basic auth user if specified in Authorization header +; +; Default: "%R - %u %t \"%m %r\" %s" +;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{milli}d %{kilo}M %C%%" + +; A list of request_uri values which should be filtered from the access log. +; +; As a security precaution, this setting will be ignored if: +; - the request method is not GET or HEAD; or +; - there is a request body; or +; - there are query parameters; or +; - the response code is outwith the successful range of 200 to 299 +; +; Note: The paths are matched against the output of the access.format tag "%r". +; On common configurations, this may look more like SCRIPT_NAME than the +; expected pre-rewrite URI. +; +; Default Value: not set +;access.suppress_path[] = /ping +;access.suppress_path[] = /health_check.php + +; The log file for slow requests +; Default Value: not set +; Note: slowlog is mandatory if request_slowlog_timeout is set +;slowlog = log/$pool.log.slow + +; The timeout for serving a single request after which a PHP backtrace will be +; dumped to the 'slowlog' file. A value of '0s' means 'off'. +; Available units: s(econds)(default), m(inutes), h(ours), or d(ays) +; Default Value: 0 +;request_slowlog_timeout = 0 + +; Depth of slow log stack trace. +; Default Value: 20 +;request_slowlog_trace_depth = 20 + +; The timeout for serving a single request after which the worker process will +; be killed. This option should be used when the 'max_execution_time' ini option +; does not stop script execution for some reason. A value of '0' means 'off'. +; Available units: s(econds)(default), m(inutes), h(ours), or d(ays) +; Default Value: 0 +;request_terminate_timeout = 0 + +; The timeout set by 'request_terminate_timeout' ini option is not engaged after +; application calls 'fastcgi_finish_request' or when application has finished and +; shutdown functions are being called (registered via register_shutdown_function). +; This option will enable timeout limit to be applied unconditionally +; even in such cases. +; Default Value: no +;request_terminate_timeout_track_finished = no + +; Set open file descriptor rlimit. +; Default Value: system defined value +;rlimit_files = 1024 + +; Set max core size rlimit. +; Possible Values: 'unlimited' or an integer greater or equal to 0 +; Default Value: system defined value +;rlimit_core = 0 + +; Chroot to this directory at the start. This value must be defined as an +; absolute path. When this value is not set, chroot is not used. +; Note: you can prefix with '$prefix' to chroot to the pool prefix or one +; of its subdirectories. If the pool prefix is not set, the global prefix +; will be used instead. +; Note: chrooting is a great security feature and should be used whenever +; possible. However, all PHP paths will be relative to the chroot +; (error_log, sessions.save_path, ...). +; Default Value: not set +;chroot = + +; Chdir to this directory at the start. +; Note: relative path can be used. +; Default Value: current directory or / when chroot +;chdir = /var/www + +; Redirect worker stdout and stderr into main error log. If not set, stdout and +; stderr will be redirected to /dev/null according to FastCGI specs. +; Note: on highloaded environment, this can cause some delay in the page +; process time (several ms). +; Default Value: no +;catch_workers_output = yes + +; Decorate worker output with prefix and suffix containing information about +; the child that writes to the log and if stdout or stderr is used as well as +; log level and time. This options is used only if catch_workers_output is yes. +; Settings to "no" will output data as written to the stdout or stderr. +; Default value: yes +;decorate_workers_output = no + +; Clear environment in FPM workers +; Prevents arbitrary environment variables from reaching FPM worker processes +; by clearing the environment in workers before env vars specified in this +; pool configuration are added. +; Setting to "no" will make all environment variables available to PHP code +; via getenv(), $_ENV and $_SERVER. +; Default Value: yes +;clear_env = no + +; Limits the extensions of the main script FPM will allow to parse. This can +; prevent configuration mistakes on the web server side. You should only limit +; FPM to .php extensions to prevent malicious users to use other extensions to +; execute php code. +; Note: set an empty value to allow all extensions. +; Default Value: .php +;security.limit_extensions = .php .php3 .php4 .php5 .php7 + +; Pass environment variables like LD_LIBRARY_PATH. All $VARIABLEs are taken from +; the current environment. +; Default Value: clean env +;env[HOSTNAME] = $HOSTNAME +;env[PATH] = /usr/local/bin:/usr/bin:/bin +;env[TMP] = /tmp +;env[TMPDIR] = /tmp +;env[TEMP] = /tmp + +; Additional php.ini defines, specific to this pool of workers. These settings +; overwrite the values previously defined in the php.ini. The directives are the +; same as the PHP SAPI: +; php_value/php_flag - you can set classic ini defines which can +; be overwritten from PHP call 'ini_set'. +; php_admin_value/php_admin_flag - these directives won't be overwritten by +; PHP call 'ini_set' +; For php_*flag, valid values are on, off, 1, 0, true, false, yes or no. + +; Defining 'extension' will load the corresponding shared extension from +; extension_dir. Defining 'disable_functions' or 'disable_classes' will not +; overwrite previously defined php.ini values, but will append the new value +; instead. + +; Note: path INI options can be relative and will be expanded with the prefix +; (pool, global or /usr/local) + +; Default Value: nothing is defined by default except the values in php.ini and +; specified at startup with the -d argument +;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com +;php_flag[display_errors] = off +;php_admin_value[error_log] = /var/log/fpm-php.www.log +;php_admin_flag[log_errors] = on +;php_admin_value[memory_limit] = 32M diff --git a/confs/php84/etc/php-fpm.d/zz-docker.conf b/confs/php84/etc/php-fpm.d/zz-docker.conf new file mode 100644 index 0000000..e0590d8 --- /dev/null +++ b/confs/php84/etc/php-fpm.d/zz-docker.conf @@ -0,0 +1,5 @@ +[global] +daemonize = no + +[www] +listen = 9000 diff --git a/confs/php84/etc/php/conf.d/bitrixenv.ini b/confs/php84/etc/php/conf.d/bitrixenv.ini new file mode 100644 index 0000000..7de704d --- /dev/null +++ b/confs/php84/etc/php/conf.d/bitrixenv.ini @@ -0,0 +1,32 @@ +error_reporting = E_ALL & ~E_NOTICE & ~E_WARNING +enable_dl = Off +short_open_tag = On +allow_url_fopen = On +max_input_vars = 10000 +max_file_uploads = 100 +max_execution_time = 300 +max_input_time = 60 +output_buffering = 4096 +request_order = GP +variables_order = GPCS +post_max_size = 1024M +upload_max_filesize = 1024M +pcre.backtrack_limit = 1000000 +pcre.recursion_limit = 14000 +realpath_cache_size = 4096k +mysql.default_socket = /var/lib/mysqld/mysqld.sock +mysqli.default_socket = /var/lib/mysqld/mysqld.sock +default_charset = UTF-8 +; session.entropy_length = 128 +; session.entropy_file = /dev/urandom +; session.cookie_httponly = On +; sendmail_path = /usr/sbin/sendmail -t -i +sendmail_path = msmtp -t -i +memory_limit = 512M +mail.add_x_header = Off +expose_php = Off +display_errors = Off +session.name = BITRIX_PHPSESSID +session.cookie_samesite = "Lax" +; session.save_path = "/php_sessions" +; upload_tmp_dir = "/php_uploads" diff --git a/confs/php84/etc/php/conf.d/docker-fpm.ini b/confs/php84/etc/php/conf.d/docker-fpm.ini new file mode 100644 index 0000000..69e787a --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-fpm.ini @@ -0,0 +1,2 @@ +; https://github.com/docker-library/php/issues/878#issuecomment-938595965 +fastcgi.logging = Off diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-amqp.ini b/confs/php84/etc/php/conf.d/docker-php-ext-amqp.ini new file mode 100644 index 0000000..fc2c671 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-amqp.ini @@ -0,0 +1 @@ +extension=amqp.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-apcu.ini b/confs/php84/etc/php/conf.d/docker-php-ext-apcu.ini new file mode 100644 index 0000000..8969a54 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-apcu.ini @@ -0,0 +1,62 @@ +; Enable APCu extension module +extension=apcu.so +; +; This can be set to 0 to disable APCu +; apc.enabled=1 +; +; Setting this enables APCu for the CLI version of PHP (Mostly for testing and debugging). +;apc.enable_cli=0 +; +; Sets the path to text files containing caches to load from disk upon +; initialization of APCu. preload_path should be a directory where each +; file follows $key.data where $key should be used as the entry name +; and the contents of the file contains serialized data to use as the value +; of the entry. +;apc.preload_path= +; +; The size of each shared memory segment, with M/G suffixe +;apc.shm_size=32M +; +; The number of seconds a cache entry is allowed to idle in a slot in case +; this cache entry slot is needed by another entry. +;apc.ttl=0 +; +; The number of seconds that a cache entry may remain on the +; garbage-collection list. +;apc.gc_ttl=3600 +; +; If you begin to get low on resources, an expunge of the cache +; is performed if it is less than half full. This is not always +; a suitable way of determining if an expunge of the cache +; should be per apc.smart allows you to set a runtime configuration +; value which is used to determine if an expunge should be run +; if (available_size < apc.smart * requested_size) +;apc.smart=0 +; +; A "hint" about the number variables expected in the cache. +; Set to zero or omit if you are not sure; +;apc.entries_hint=4096 +; +; The mktemp-style file_mask to pass to the mmap module +; apc.mmap_file_mask=/tmp/apc.XXXXXX +; +; On very busy servers whenever you start the server or +; modify files you can create a race of many processes +; all trying to cache the same data at the same time. +; By default, APCu attempts to prevent "slamming" of a key. +; A key is considered "slammed" if it was the last key set, +; and a context other than the current one set it ( ie. it +; was set by another process or thread ) +;apc.slam_defense=0 +; +; Defines which serializer should be used +; Default is the standard PHP serializer. +;apc.serializer='php' +; +; use the SAPI request start time for TTL +;apc.use_request_time=0 +; +; Enables APCu handling of signals, such as SIGSEGV, that write core files +; when signaled. APCu will attempt to unmap the shared memory segment in +; order to exclude it from the core file +;apc.coredump_unmap=0 diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-bz2.ini b/confs/php84/etc/php/conf.d/docker-php-ext-bz2.ini new file mode 100644 index 0000000..f9d67d2 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-bz2.ini @@ -0,0 +1 @@ +extension=bz2.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-calendar.ini b/confs/php84/etc/php/conf.d/docker-php-ext-calendar.ini new file mode 100644 index 0000000..9106f44 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-calendar.ini @@ -0,0 +1 @@ +extension=calendar.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-exif.ini b/confs/php84/etc/php/conf.d/docker-php-ext-exif.ini new file mode 100644 index 0000000..0688bbe --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-exif.ini @@ -0,0 +1 @@ +extension=exif.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-gd.ini b/confs/php84/etc/php/conf.d/docker-php-ext-gd.ini new file mode 100644 index 0000000..1941c0d --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-gd.ini @@ -0,0 +1 @@ +extension=gd.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-gettext.ini b/confs/php84/etc/php/conf.d/docker-php-ext-gettext.ini new file mode 100644 index 0000000..1b2e930 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-gettext.ini @@ -0,0 +1 @@ +extension=gettext.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-igbinary.ini b/confs/php84/etc/php/conf.d/docker-php-ext-igbinary.ini new file mode 100644 index 0000000..1666292 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-igbinary.ini @@ -0,0 +1 @@ +extension=igbinary.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-imagick.ini b/confs/php84/etc/php/conf.d/docker-php-ext-imagick.ini new file mode 100644 index 0000000..d7513f1 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-imagick.ini @@ -0,0 +1 @@ +extension=imagick.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-intl.ini b/confs/php84/etc/php/conf.d/docker-php-ext-intl.ini new file mode 100644 index 0000000..b334e92 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-intl.ini @@ -0,0 +1 @@ +extension=intl.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-ldap.ini b/confs/php84/etc/php/conf.d/docker-php-ext-ldap.ini new file mode 100644 index 0000000..00825a2 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-ldap.ini @@ -0,0 +1 @@ +extension=ldap.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-mcrypt.ini b/confs/php84/etc/php/conf.d/docker-php-ext-mcrypt.ini new file mode 100644 index 0000000..547ebdd --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-mcrypt.ini @@ -0,0 +1 @@ +extension=mcrypt.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-memcache.ini b/confs/php84/etc/php/conf.d/docker-php-ext-memcache.ini new file mode 100644 index 0000000..88cc8ba --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-memcache.ini @@ -0,0 +1,47 @@ +; Enable memcache extension module +extension=memcache.so +; +; Options for the memcache module +; see http://www.php.net/manual/en/memcache.ini.php +; +; Whether to transparently failover to other servers on errors +;memcache.allow_failover=1 +; Data will be transferred in chunks of this size +;memcache.chunk_size=32768 +; Autocompress large data +;memcache.compress_threshold=20000 +; The default TCP port number to use when connecting to the memcached server +;memcache.default_port=11211 +; Hash function {crc32, fnv} +;memcache.hash_function=crc32 +; Hash strategy {standard, consistent} +;memcache.hash_strategy=consistent +; Defines how many servers to try when setting and getting data. +;memcache.max_failover_attempts=20 +; The protocol {ascii, binary} : You need a memcached >= 1.3.0 to use the binary protocol +; The binary protocol results in less traffic and is more efficient +;memcache.protocol=ascii +; Redundancy : When enabled the client sends requests to N servers in parallel +;memcache.redundancy=1 +;memcache.session_redundancy=2 +; Lock Timeout +;memcache.lock_timeout = 15 +;memcache.prefix_host_key = 0 +;memcache.prefix_host_key_remove_www = 1 +;memcache.prefix_host_key_remove_subdomain = 0 +;memcache.prefix_static_key = '' +; +; Options to use the memcache session handler +; RPM note : save_handler and save_path are defined +; for mod_php, in /etc/httpd/conf.d/php.conf +; for php-fpm, in /etc/php-fpm.d/*conf +; Use memcache as a session handler +;session.save_handler=memcache +; Defines a comma separated of server urls to use for session storage +; Only used when memcache.session_save_path is not set +;session.save_path="tcp://localhost:11211?persistent=1&weight=1&timeout=1&retry_interval=15" +;memcache.session_prefix_host_key = 0 +;memcache.session_prefix_host_key_remove_www = 1 +;memcache.session_prefix_host_key_remove_subdomain = 0 +;memcache.session_prefix_static_key = '' +;memcache.session_save_path = '' diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-memcached.ini b/confs/php84/etc/php/conf.d/docker-php-ext-memcached.ini new file mode 100644 index 0000000..308759a --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-memcached.ini @@ -0,0 +1,186 @@ +; Enable memcached extension module +extension=memcached.so + +; ----- Options to use the memcached session handler + +; RPM note : save_handler and save_path are defined +; for mod_php, in /etc/httpd/conf.d/php.conf +; for php-fpm, in /etc/php-fpm.d/*conf + +; Use memcache as a session handler +;session.save_handler=memcached +; Defines a comma separated list of server urls to use for session storage +;session.save_path="localhost:11211" + +; ----- Configuration options +; https://php.net/manual/en/memcached.configuration.php + +[memcached] +; Use session locking +; valid values: On, Off +; the default is On +;memcached.sess_locking = On + +; The minimum time, in milliseconds, to wait between session lock attempts. +; This value is double on each lock retry until memcached.sess_lock_wait_max +; is reached, after which any further retries will take sess_lock_wait_max seconds. +; Default is 150. +;memcached.sess_lock_wait_min = 150; + +; The maximum time, in milliseconds, to wait between session lock attempts. +; Default is 150. +;memcached.sess_lock_wait_max = 150; + +; The number of times to retry locking the session lock, not including the first attempt. +; Default is 5. +;memcached.sess_lock_retries = 5; + +; The time, in seconds, before a lock should release itself. +; Setting to 0 results in the default behaviour, which is to +; use PHP's max_execution_time. +;memcached.sess_lock_expire = 0; + +; memcached session key prefix +; valid values are strings less than 219 bytes long +; the default value is "memc.sess.key." +;memcached.sess_prefix = "memc.sess.key." + +; Whether or not to re-use the memcached connections corresponding to the value(s) +; of session.save_path after the execution of the script ends. +; Don't use this if certain settings (e.g. SASL settings, sess_binary_protocol) would +; be overridden between requests. +; Default is Off. +;memcached.sess_persistent = Off + +; memcached session consistent hash mode +; if set to On, consistent hashing (libketama) is used +; for session handling. +; When consistent hashing is used, one can add or remove cache +; node(s) without messing up too much with existing keys +; default is On +;memcached.sess_consistent_hash = On + +; memcached session consistent hash type +; if set to 'ketama', consistent hashing (libketama) is used +; for session handling (default for php-memcached 3.x) +; if set to 'ketama_weighted', weighted consistent hashing (libketama) is used +; for session handling (default for php-memcached 2.x) +;memcached.sess_consistent_hash_type = "ketama" + +; Allow failed memcached server to automatically be removed. +; Default is Off. (In previous versions, this setting was called memcached.sess_remove_failed) +;memcached.sess_remove_failed_servers = Off + +; Set this value to enable the server be removed after +; configured number of continuous times connection failure. +;memcached.sess_server_failure_limit = 0 + +; Write data to a number of additional memcached servers +; This is "poor man's HA" as libmemcached calls it. +; If this value is positive and sess_remove_failed_servers is enabled +; when a memcached server fails the session will continue to be available +; from a replica. However, if the failed memcache server +; becomes available again it will read the session from there +; which could have old data or no data at all +;memcached.sess_number_of_replicas = 0 + +; Use the memcached binary protocol for memcached sessions (Instead of the text protocol) +; libmemcached replicas work only if binary mode is enabled. +; However, certain proxies (such as twemproxy) will work only if the binary protocol is disabled. +; In older versions of php-memcached, this setting was Off and was called memcached.sess_binary. +; Default is On with libmemcached 1.0.18 or newer. +; Default is Off with older version. +;memcached.sess_binary_protocol = On + +; memcached session replica read randomize +;memcached.sess_randomize_replica_read = Off + +; memcached connect timeout value +; In non-blocking mode this changes the value of the timeout +; during socket connection in milliseconds. Specifying -1 means an infinite timeout. +;memcached.sess_connect_timeout = 1000 + +; Session SASL username +; Both username and password need to be set for SASL to be enabled +;memcached.sess_sasl_username = NULL + +; Session SASL password +;memcached.sess_sasl_password = NULL + +; Set the compression type +; valid values are: fastlz, zlib +; the default is fastlz +;memcached.compression_type = "fastlz" + +; Compression factor +; Store compressed value only if the compression +; factor (saving) exceeds the set limit. +; +; store compressed if: +; plain_len > comp_len * factor +; +; the default value is 1.3 (23% space saving) +;memcached.compression_factor = "1.3" + +; The compression threshold +; +; Do not compress serialized values below this threshold. +; the default is 2000 bytes +;memcached.compression_threshold = 2000 + +; Set the default serializer for new memcached objects. +; valid values are: php, igbinary, json, json_array, msgpack +; +; json - standard php JSON encoding. This serializer +; is fast and compact but only works on UTF-8 +; encoded data and does not fully implement +; serializing. See the JSON extension. +; json_array - as json, but decodes into arrays +; php - the standard php serializer +; igbinary - a binary serializer +; msgpack - a cross-language binary serializer +; +; The default is igbinary if available, then msgpack if available, then php otherwise. +;memcached.serializer = "igbinary" + +; The amount of retries for failed store commands. +; This mechanism allows transparent fail-over to secondary servers when +; set/increment/decrement/setMulti operations fail on the desired server in a multi-server +; environment. +; the default is 0 +;memcached.store_retry_count = 0 + +; The maximum payload size in bytes that can be written. +; Writing a payload larger than the limit will result in RES_E2BIG error. +; Specifying 0 means no limit is enforced, though the server may still reject with RES_E2BIG. +; Default is 0. +;memcached.item_size_limit = 1000000 + +; Sets the default for consistent hashing for new connections. +; (To configure consistent hashing for session connections, +; use memcached.sess_consistent_hash instead) +; +; If set to On, consistent hashing (libketama) is used +; for session handling. +; When consistent hashing is used, one can add or remove cache +; node(s) without messing up too much with existing keys +; default is Off +;memcached.default_consistent_hash = Off + +; Sets the default memcached protocol for new connections. +; (To configure the memcached protocol for connections used by sessions, +; use memcached.sess_binary_protocol instead) +; +; If set to On, the memcached binary protocol is used by default. +; If set to Off, the memcached text protocol is used. +; Default is Off +;memcached.default_binary_protocol = Off + +; Sets the default memcached connection timeout for new connections. +; (To configure the memcached connection timeout for sessions, +; use memcached.sess_connect_timeout instead) +; In non-blocking mode this changes the value of the timeout. +; during socket connection in milliseconds. Specifying -1 means an infinite timeout. +; Specifying 0 means using the memcached library's default connection timeout. +; Default is 0. +;memcached.default_connect_timeout = 0 diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-msgpack.ini b/confs/php84/etc/php/conf.d/docker-php-ext-msgpack.ini new file mode 100644 index 0000000..c72b98d --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-msgpack.ini @@ -0,0 +1 @@ +extension=msgpack.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-mysqli.ini b/confs/php84/etc/php/conf.d/docker-php-ext-mysqli.ini new file mode 100644 index 0000000..9d0502f --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-mysqli.ini @@ -0,0 +1 @@ +extension=mysqli.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-opcache.ini b/confs/php84/etc/php/conf.d/docker-php-ext-opcache.ini new file mode 100644 index 0000000..a569956 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-opcache.ini @@ -0,0 +1,12 @@ +zend_extension=opcache.so +opcache.enable=1 +opcache.memory_consumption=471 +opcache.interned_strings_buffer=117 +opcache.max_accelerated_files=100000 +opcache.max_wasted_percentage=1 +opcache.validate_timestamps=1 +opcache.revalidate_freq=0 +opcache.fast_shutdown=1 +opcache.save_comments=1 +opcache.load_comments=1 +;opcache.blacklist_filename=/etc/php.d/opcache*.blacklist diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-pdo_mysql.ini b/confs/php84/etc/php/conf.d/docker-php-ext-pdo_mysql.ini new file mode 100644 index 0000000..34a7ff5 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-pdo_mysql.ini @@ -0,0 +1 @@ +extension=pdo_mysql.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-pdo_pgsql.ini b/confs/php84/etc/php/conf.d/docker-php-ext-pdo_pgsql.ini new file mode 100644 index 0000000..d1f7bf0 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-pdo_pgsql.ini @@ -0,0 +1 @@ +extension=pdo_pgsql.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-pgsql.ini b/confs/php84/etc/php/conf.d/docker-php-ext-pgsql.ini new file mode 100644 index 0000000..21be5e4 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-pgsql.ini @@ -0,0 +1 @@ +extension=pgsql.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-pspell.ini b/confs/php84/etc/php/conf.d/docker-php-ext-pspell.ini new file mode 100644 index 0000000..b4d0a8c --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-pspell.ini @@ -0,0 +1 @@ +extension=pspell.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-redis.ini b/confs/php84/etc/php/conf.d/docker-php-ext-redis.ini new file mode 100644 index 0000000..6aecae4 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-redis.ini @@ -0,0 +1 @@ +extension=redis.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-shmop.ini b/confs/php84/etc/php/conf.d/docker-php-ext-shmop.ini new file mode 100644 index 0000000..b554ad3 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-shmop.ini @@ -0,0 +1 @@ +extension=shmop.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-sockets.ini b/confs/php84/etc/php/conf.d/docker-php-ext-sockets.ini new file mode 100644 index 0000000..327228b --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-sockets.ini @@ -0,0 +1 @@ +extension=sockets.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-sodium.ini b/confs/php84/etc/php/conf.d/docker-php-ext-sodium.ini new file mode 100644 index 0000000..5ee7788 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-sodium.ini @@ -0,0 +1 @@ +extension=sodium.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-ssh2.ini b/confs/php84/etc/php/conf.d/docker-php-ext-ssh2.ini new file mode 100644 index 0000000..3422094 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-ssh2.ini @@ -0,0 +1 @@ +; extension=ssh2.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-sysvmsg.ini b/confs/php84/etc/php/conf.d/docker-php-ext-sysvmsg.ini new file mode 100644 index 0000000..639950e --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-sysvmsg.ini @@ -0,0 +1 @@ +extension=sysvmsg.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-sysvsem.ini b/confs/php84/etc/php/conf.d/docker-php-ext-sysvsem.ini new file mode 100644 index 0000000..dd2c343 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-sysvsem.ini @@ -0,0 +1 @@ +extension=sysvsem.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-sysvshm.ini b/confs/php84/etc/php/conf.d/docker-php-ext-sysvshm.ini new file mode 100644 index 0000000..4c26779 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-sysvshm.ini @@ -0,0 +1 @@ +extension=sysvshm.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-xdebug.ini b/confs/php84/etc/php/conf.d/docker-php-ext-xdebug.ini new file mode 100644 index 0000000..ba57b5d --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-xdebug.ini @@ -0,0 +1,10 @@ +zend_extension=xdebug.so + +xdebug.mode=debug +xdebug.start_with_request = trigger +xdebug.client_host=host.docker.internal +xdebug.client_port=9003 +xdebug.idekey=PHPSTORM +xdebug.discover_client_host = 1 +;xdebug.log=/tmp/xdebug.log +xdebug.log_level=7 \ No newline at end of file diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-xhprof.ini b/confs/php84/etc/php/conf.d/docker-php-ext-xhprof.ini new file mode 100644 index 0000000..b5d90e2 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-xhprof.ini @@ -0,0 +1,7 @@ +; Enable xhprof extension module +; extension=xhprof.so +; You can either pass the directory location as an argument to the constructor for XHProfRuns_Default() or set xhprof.output_dir ini param. +;xhprof.output_dir='' +;xhprof.collect_additional_info=0 +;xhprof.sampling_interval=100000 +;xhprof.sampling_depth=0x7fffffff diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-xsl.ini b/confs/php84/etc/php/conf.d/docker-php-ext-xsl.ini new file mode 100644 index 0000000..3223510 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-xsl.ini @@ -0,0 +1 @@ +extension=xsl.so diff --git a/confs/php84/etc/php/conf.d/docker-php-ext-zip.ini b/confs/php84/etc/php/conf.d/docker-php-ext-zip.ini new file mode 100644 index 0000000..bb70997 --- /dev/null +++ b/confs/php84/etc/php/conf.d/docker-php-ext-zip.ini @@ -0,0 +1 @@ +extension=zip.so diff --git a/confs/php84/etc/php/conf.d/timezone.ini.example b/confs/php84/etc/php/conf.d/timezone.ini.example new file mode 100644 index 0000000..649566c --- /dev/null +++ b/confs/php84/etc/php/conf.d/timezone.ini.example @@ -0,0 +1 @@ +date.timezone = Europe/Moscow diff --git a/confs/php84/etc/php/php.ini-development b/confs/php84/etc/php/php.ini-development new file mode 100644 index 0000000..6e5064d --- /dev/null +++ b/confs/php84/etc/php/php.ini-development @@ -0,0 +1,1848 @@ +[PHP] + +;;;;;;;;;;;;;;;;;;; +; About php.ini ; +;;;;;;;;;;;;;;;;;;; +; PHP's initialization file, generally called php.ini, is responsible for +; configuring many of the aspects of PHP's behavior. + +; PHP attempts to find and load this configuration from a number of locations. +; The following is a summary of its search order: +; 1. SAPI module specific location. +; 2. The PHPRC environment variable. +; 3. A number of predefined registry keys on Windows +; 4. Current working directory (except CLI) +; 5. The web server's directory (for SAPI modules), or directory of PHP +; (otherwise in Windows) +; 6. The directory from the --with-config-file-path compile time option, or the +; Windows directory (usually C:\windows) +; See the PHP docs for more specific information. +; https://php.net/configuration.file + +; The syntax of the file is extremely simple. Whitespace and lines +; beginning with a semicolon are silently ignored (as you probably guessed). +; Section headers (e.g. [Foo]) are also silently ignored, even though +; they might mean something in the future. + +; Directives following the section heading [PATH=/www/mysite] only +; apply to PHP files in the /www/mysite directory. Directives +; following the section heading [HOST=www.example.com] only apply to +; PHP files served from www.example.com. Directives set in these +; special sections cannot be overridden by user-defined INI files or +; at runtime. Currently, [PATH=] and [HOST=] sections only work under +; CGI/FastCGI. +; https://php.net/ini.sections + +; Directives are specified using the following syntax: +; directive = value +; Directive names are *case sensitive* - foo=bar is different from FOO=bar. +; Directives are variables used to configure PHP or PHP extensions. +; There is no name validation. If PHP can't find an expected +; directive because it is not set or is mistyped, a default value will be used. + +; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one +; of the INI constants (On, Off, True, False, Yes, No and None) or an expression +; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a +; previously set variable or directive (e.g. ${foo}) + +; Expressions in the INI file are limited to bitwise operators and parentheses: +; | bitwise OR +; ^ bitwise XOR +; & bitwise AND +; ~ bitwise NOT +; ! boolean NOT + +; Boolean flags can be turned on using the values 1, On, True or Yes. +; They can be turned off using the values 0, Off, False or No. + +; An empty string can be denoted by simply not writing anything after the equal +; sign, or by using the None keyword: + +; foo = ; sets foo to an empty string +; foo = None ; sets foo to an empty string +; foo = "None" ; sets foo to the string 'None' + +; If you use constants in your value, and these constants belong to a +; dynamically loaded extension (either a PHP extension or a Zend extension), +; you may only use these constants *after* the line that loads the extension. + +;;;;;;;;;;;;;;;;;;; +; About this file ; +;;;;;;;;;;;;;;;;;;; +; PHP comes packaged with two INI files. One that is recommended to be used +; in production environments and one that is recommended to be used in +; development environments. + +; php.ini-production contains settings which hold security, performance and +; best practices at its core. But please be aware, these settings may break +; compatibility with older or less security-conscious applications. We +; recommending using the production ini in production and testing environments. + +; php.ini-development is very similar to its production variant, except it is +; much more verbose when it comes to errors. We recommend using the +; development version only in development environments, as errors shown to +; application users can inadvertently leak otherwise secure information. + +; This is the php.ini-development INI file. + +;;;;;;;;;;;;;;;;;;; +; Quick Reference ; +;;;;;;;;;;;;;;;;;;; + +; The following are all the settings which are different in either the production +; or development versions of the INIs with respect to PHP's default behavior. +; Please see the actual settings later in the document for more details as to why +; we recommend these changes in PHP's behavior. + +; display_errors +; Default Value: On +; Development Value: On +; Production Value: Off + +; display_startup_errors +; Default Value: On +; Development Value: On +; Production Value: Off + +; error_reporting +; Default Value: E_ALL +; Development Value: E_ALL +; Production Value: E_ALL & ~E_DEPRECATED + +; log_errors +; Default Value: Off +; Development Value: On +; Production Value: On + +; max_input_time +; Default Value: -1 (Unlimited) +; Development Value: 60 (60 seconds) +; Production Value: 60 (60 seconds) + +; output_buffering +; Default Value: Off +; Development Value: 4096 +; Production Value: 4096 + +; register_argc_argv +; Default Value: On +; Development Value: Off +; Production Value: Off + +; request_order +; Default Value: None +; Development Value: "GP" +; Production Value: "GP" + +; session.gc_divisor +; Default Value: 100 +; Development Value: 1000 +; Production Value: 1000 + +; short_open_tag +; Default Value: On +; Development Value: Off +; Production Value: Off + +; variables_order +; Default Value: "EGPCS" +; Development Value: "GPCS" +; Production Value: "GPCS" + +; zend.assertions +; Default Value: 1 +; Development Value: 1 +; Production Value: -1 + +; zend.exception_ignore_args +; Default Value: Off +; Development Value: Off +; Production Value: On + +; zend.exception_string_param_max_len +; Default Value: 15 +; Development Value: 15 +; Production Value: 0 + +;;;;;;;;;;;;;;;;;;;; +; php.ini Options ; +;;;;;;;;;;;;;;;;;;;; +; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" +;user_ini.filename = ".user.ini" + +; To disable this feature set this option to an empty value +;user_ini.filename = + +; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) +;user_ini.cache_ttl = 300 + +;;;;;;;;;;;;;;;;;;;; +; Language Options ; +;;;;;;;;;;;;;;;;;;;; + +; Enable the PHP scripting language engine under Apache. +; https://php.net/engine +engine = On + +; This directive determines whether or not PHP will recognize code between +; tags as PHP source which should be processed as such. It is +; generally recommended that should be used and that this feature +; should be disabled, as enabling it may result in issues when generating XML +; documents, however this remains supported for backward compatibility reasons. +; Note that this directive does not control the would work. +; https://php.net/syntax-highlighting +;highlight.string = #DD0000 +;highlight.comment = #FF9900 +;highlight.keyword = #007700 +;highlight.default = #0000BB +;highlight.html = #000000 + +; If enabled, the request will be allowed to complete even if the user aborts +; the request. Consider enabling it if executing long requests, which may end up +; being interrupted by the user or a browser timing out. PHP's default behavior +; is to disable this feature. +; https://php.net/ignore-user-abort +;ignore_user_abort = On + +; Determines the size of the realpath cache to be used by PHP. This value should +; be increased on systems where PHP opens many files to reflect the quantity of +; the file operations performed. +; Note: if open_basedir is set, the cache is disabled +; https://php.net/realpath-cache-size +;realpath_cache_size = 4096k + +; Duration of time, in seconds for which to cache realpath information for a given +; file or directory. For systems with rarely changing files, consider increasing this +; value. +; https://php.net/realpath-cache-ttl +;realpath_cache_ttl = 120 + +; Enables or disables the circular reference collector. +; https://php.net/zend.enable-gc +zend.enable_gc = On + +; If enabled, scripts may be written in encodings that are incompatible with +; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such +; encodings. To use this feature, mbstring extension must be enabled. +;zend.multibyte = Off + +; Allows to set the default encoding for the scripts. This value will be used +; unless "declare(encoding=...)" directive appears at the top of the script. +; Only affects if zend.multibyte is set. +;zend.script_encoding = + +; Allows to include or exclude arguments from stack traces generated for exceptions. +; In production, it is recommended to turn this setting on to prohibit the output +; of sensitive information in stack traces +; Default Value: Off +; Development Value: Off +; Production Value: On +zend.exception_ignore_args = Off + +; Allows setting the maximum string length in an argument of a stringified stack trace +; to a value between 0 and 1000000. +; This has no effect when zend.exception_ignore_args is enabled. +; Default Value: 15 +; Development Value: 15 +; Production Value: 0 +zend.exception_string_param_max_len = 15 + +;;;;;;;;;;;;;;;;; +; Miscellaneous ; +;;;;;;;;;;;;;;;;; + +; Decides whether PHP may expose the fact that it is installed on the server +; (e.g. by adding its signature to the Web server header). It is no security +; threat in any way, but it makes it possible to determine whether you use PHP +; on your server or not. +; https://php.net/expose-php +expose_php = On + +;;;;;;;;;;;;;;;;;;; +; Resource Limits ; +;;;;;;;;;;;;;;;;;;; + +; Maximum execution time of each script, in seconds +; https://php.net/max-execution-time +; Note: This directive is hardcoded to 0 for the CLI SAPI +max_execution_time = 30 + +; Maximum amount of time each script may spend parsing request data. It's a good +; idea to limit this time on productions servers in order to eliminate unexpectedly +; long running scripts. +; Note: This directive is hardcoded to -1 for the CLI SAPI +; Default Value: -1 (Unlimited) +; Development Value: 60 (60 seconds) +; Production Value: 60 (60 seconds) +; https://php.net/max-input-time +max_input_time = 60 + +; Maximum input variable nesting level +; https://php.net/max-input-nesting-level +;max_input_nesting_level = 64 + +; How many GET/POST/COOKIE input variables may be accepted +;max_input_vars = 1000 + +; How many multipart body parts (combined input variable and file uploads) may +; be accepted. +; Default Value: -1 (Sum of max_input_vars and max_file_uploads) +;max_multipart_body_parts = 1500 + +; Maximum amount of memory a script may consume +; https://php.net/memory-limit +memory_limit = 128M + +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; +; Error handling and logging ; +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; + +; This directive informs PHP of which errors, warnings and notices you would like +; it to take action for. The recommended way of setting values for this +; directive is through the use of the error level constants and bitwise +; operators. The error level constants are below here for convenience as well as +; some common settings and their meanings. +; By default, PHP is set to take action on all errors, notices and warnings EXCEPT +; those related to E_NOTICE, which together cover best practices and +; recommended coding standards in PHP. For performance reasons, this is the +; recommend error reporting setting. Your production server shouldn't be wasting +; resources complaining about best practices and coding standards. That's what +; development servers and development settings are for. +; Note: The php.ini-development file has this setting as E_ALL. This +; means it pretty much reports everything which is exactly what you want during +; development and early testing. +; +; Error Level Constants: +; E_ALL - All errors and warnings +; E_ERROR - fatal run-time errors +; E_RECOVERABLE_ERROR - almost fatal run-time errors +; E_WARNING - run-time warnings (non-fatal errors) +; E_PARSE - compile-time parse errors +; E_NOTICE - run-time notices (these are warnings which often result +; from a bug in your code, but it's possible that it was +; intentional (e.g., using an uninitialized variable and +; relying on the fact it is automatically initialized to an +; empty string) +; E_CORE_ERROR - fatal errors that occur during PHP's initial startup +; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's +; initial startup +; E_COMPILE_ERROR - fatal compile-time errors +; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) +; E_USER_ERROR - user-generated error message +; E_USER_WARNING - user-generated warning message +; E_USER_NOTICE - user-generated notice message +; E_DEPRECATED - warn about code that will not work in future versions +; of PHP +; E_USER_DEPRECATED - user-generated deprecation warnings +; +; Common Values: +; E_ALL (Show all errors, warnings and notices including coding standards.) +; E_ALL & ~E_NOTICE (Show all errors, except for notices) +; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) +; Default Value: E_ALL +; Development Value: E_ALL +; Production Value: E_ALL & ~E_DEPRECATED +; https://php.net/error-reporting +error_reporting = E_ALL + +; This directive controls whether or not and where PHP will output errors, +; notices and warnings too. Error output is very useful during development, but +; it could be very dangerous in production environments. Depending on the code +; which is triggering the error, sensitive information could potentially leak +; out of your application such as database usernames and passwords or worse. +; For production environments, we recommend logging errors rather than +; sending them to STDOUT. +; Possible Values: +; Off = Do not display any errors +; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) +; On or stdout = Display errors to STDOUT +; Default Value: On +; Development Value: On +; Production Value: Off +; https://php.net/display-errors +display_errors = On + +; The display of errors which occur during PHP's startup sequence are handled +; separately from display_errors. We strongly recommend you set this to 'off' +; for production servers to avoid leaking configuration details. +; Default Value: On +; Development Value: On +; Production Value: Off +; https://php.net/display-startup-errors +display_startup_errors = On + +; Besides displaying errors, PHP can also log errors to locations such as a +; server-specific log, STDERR, or a location specified by the error_log +; directive found below. While errors should not be displayed on productions +; servers they should still be monitored and logging is a great way to do that. +; Default Value: Off +; Development Value: On +; Production Value: On +; https://php.net/log-errors +log_errors = On + +; Do not log repeated messages. Repeated errors must occur in same file on same +; line unless ignore_repeated_source is set true. +; https://php.net/ignore-repeated-errors +ignore_repeated_errors = Off + +; Ignore source of message when ignoring repeated messages. When this setting +; is On you will not log errors with repeated messages from different files or +; source lines. +; https://php.net/ignore-repeated-source +ignore_repeated_source = Off + +; If this parameter is set to Off, then memory leaks will not be shown (on +; stdout or in the log). This is only effective in a debug compile, and if +; error reporting includes E_WARNING in the allowed list +; https://php.net/report-memleaks +report_memleaks = On + +; This setting is off by default. +;report_zend_debug = 0 + +; Turn off normal error reporting and emit XML-RPC error XML +; https://php.net/xmlrpc-errors +;xmlrpc_errors = 0 + +; An XML-RPC faultCode +;xmlrpc_error_number = 0 + +; When PHP displays or logs an error, it has the capability of formatting the +; error message as HTML for easier reading. This directive controls whether +; the error message is formatted as HTML or not. +; Note: This directive is hardcoded to Off for the CLI SAPI +; https://php.net/html-errors +;html_errors = On + +; If html_errors is set to On *and* docref_root is not empty, then PHP +; produces clickable error messages that direct to a page describing the error +; or function causing the error in detail. +; You can download a copy of the PHP manual from https://php.net/docs +; and change docref_root to the base URL of your local copy including the +; leading '/'. You must also specify the file extension being used including +; the dot. PHP's default behavior is to leave these settings empty, in which +; case no links to documentation are generated. +; Note: Never use this feature for production boxes. +; https://php.net/docref-root +; Examples +;docref_root = "/phpmanual/" + +; https://php.net/docref-ext +;docref_ext = .html + +; String to output before an error message. PHP's default behavior is to leave +; this setting blank. +; https://php.net/error-prepend-string +; Example: +;error_prepend_string = "" + +; String to output after an error message. PHP's default behavior is to leave +; this setting blank. +; https://php.net/error-append-string +; Example: +;error_append_string = "" + +; Log errors to specified file. PHP's default behavior is to leave this value +; empty. +; https://php.net/error-log +; Example: +;error_log = php_errors.log +; Log errors to syslog (Event Log on Windows). +;error_log = syslog + +; The syslog ident is a string which is prepended to every message logged +; to syslog. Only used when error_log is set to syslog. +;syslog.ident = php + +; The syslog facility is used to specify what type of program is logging +; the message. Only used when error_log is set to syslog. +;syslog.facility = user + +; Set this to disable filtering control characters (the default). +; Some loggers only accept NVT-ASCII, others accept anything that's not +; control characters. If your logger accepts everything, then no filtering +; is needed at all. +; Allowed values are: +; ascii (all printable ASCII characters and NL) +; no-ctrl (all characters except control characters) +; all (all characters) +; raw (like "all", but messages are not split at newlines) +; https://php.net/syslog.filter +;syslog.filter = ascii + +;windows.show_crt_warning +; Default value: 0 +; Development value: 0 +; Production value: 0 + +;;;;;;;;;;;;;;;;; +; Data Handling ; +;;;;;;;;;;;;;;;;; + +; The separator used in PHP generated URLs to separate arguments. +; PHP's default setting is "&". +; https://php.net/arg-separator.output +; Example: +;arg_separator.output = "&" + +; List of separator(s) used by PHP to parse input URLs into variables. +; PHP's default setting is "&". +; NOTE: Every character in this directive is considered as separator! +; https://php.net/arg-separator.input +; Example: +;arg_separator.input = ";&" + +; This directive determines which super global arrays are registered when PHP +; starts up. G,P,C,E & S are abbreviations for the following respective super +; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty +; paid for the registration of these arrays and because ENV is not as commonly +; used as the others, ENV is not recommended on productions servers. You +; can still get access to the environment variables through getenv() should you +; need to. +; Default Value: "EGPCS" +; Development Value: "GPCS" +; Production Value: "GPCS"; +; https://php.net/variables-order +variables_order = "GPCS" + +; This directive determines which super global data (G,P & C) should be +; registered into the super global array REQUEST. If so, it also determines +; the order in which that data is registered. The values for this directive +; are specified in the same manner as the variables_order directive, +; EXCEPT one. Leaving this value empty will cause PHP to use the value set +; in the variables_order directive. It does not mean it will leave the super +; globals array REQUEST empty. +; Default Value: None +; Development Value: "GP" +; Production Value: "GP" +; https://php.net/request-order +request_order = "GP" + +; This directive determines whether PHP registers $argv & $argc each time it +; runs. $argv contains an array of all the arguments passed to PHP when a script +; is invoked. $argc contains an integer representing the number of arguments +; that were passed when the script was invoked. These arrays are extremely +; useful when running scripts from the command line. When this directive is +; enabled, registering these variables consumes CPU cycles and memory each time +; a script is executed. For performance reasons, this feature should be disabled +; on production servers. +; Note: This directive is hardcoded to On for the CLI SAPI +; Default Value: On +; Development Value: Off +; Production Value: Off +; https://php.net/register-argc-argv +register_argc_argv = Off + +; When enabled, the ENV, REQUEST and SERVER variables are created when they're +; first used (Just In Time) instead of when the script starts. If these +; variables are not used within a script, having this directive on will result +; in a performance gain. The PHP directive register_argc_argv must be disabled +; for this directive to have any effect. +; https://php.net/auto-globals-jit +auto_globals_jit = On + +; Whether PHP will read the POST data. +; This option is enabled by default. +; Most likely, you won't want to disable this option globally. It causes $_POST +; and $_FILES to always be empty; the only way you will be able to read the +; POST data will be through the php://input stream wrapper. This can be useful +; to proxy requests or to process the POST data in a memory efficient fashion. +; https://php.net/enable-post-data-reading +;enable_post_data_reading = Off + +; Maximum size of POST data that PHP will accept. +; Its value may be 0 to disable the limit. It is ignored if POST data reading +; is disabled through enable_post_data_reading. +; https://php.net/post-max-size +post_max_size = 8M + +; Automatically add files before PHP document. +; https://php.net/auto-prepend-file +auto_prepend_file = + +; Automatically add files after PHP document. +; https://php.net/auto-append-file +auto_append_file = + +; By default, PHP will output a media type using the Content-Type header. To +; disable this, simply set it to be empty. +; +; PHP's built-in default media type is set to text/html. +; https://php.net/default-mimetype +default_mimetype = "text/html" + +; PHP's default character set is set to UTF-8. +; https://php.net/default-charset +default_charset = "UTF-8" + +; PHP internal character encoding is set to empty. +; If empty, default_charset is used. +; https://php.net/internal-encoding +;internal_encoding = + +; PHP input character encoding is set to empty. +; If empty, default_charset is used. +; https://php.net/input-encoding +;input_encoding = + +; PHP output character encoding is set to empty. +; If empty, default_charset is used. +; See also output_buffer. +; https://php.net/output-encoding +;output_encoding = + +;;;;;;;;;;;;;;;;;;;;;;;;; +; Paths and Directories ; +;;;;;;;;;;;;;;;;;;;;;;;;; + +; UNIX: "/path1:/path2" +;include_path = ".:/php/includes" +; +; Windows: "\path1;\path2" +;include_path = ".;c:\php\includes" +; +; PHP's default setting for include_path is ".;/path/to/php/pear" +; https://php.net/include-path + +; The root of the PHP pages, used only if nonempty. +; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root +; if you are running php as a CGI under any web server (other than IIS) +; see documentation for security issues. The alternate is to use the +; cgi.force_redirect configuration below +; https://php.net/doc-root +doc_root = + +; The directory under which PHP opens the script using /~username used only +; if nonempty. +; https://php.net/user-dir +user_dir = + +; Directory in which the loadable extensions (modules) reside. +; https://php.net/extension-dir +;extension_dir = "./" +; On windows: +;extension_dir = "ext" + +; Directory where the temporary files should be placed. +; Defaults to the system default (see sys_get_temp_dir) +;sys_temp_dir = "/tmp" + +; Whether or not to enable the dl() function. The dl() function does NOT work +; properly in multithreaded servers, such as IIS or Zeus, and is automatically +; disabled on them. +; https://php.net/enable-dl +enable_dl = Off + +; cgi.force_redirect is necessary to provide security running PHP as a CGI under +; most web servers. Left undefined, PHP turns this on by default. You can +; turn it off here AT YOUR OWN RISK +; **You CAN safely turn this off for IIS, in fact, you MUST.** +; https://php.net/cgi.force-redirect +;cgi.force_redirect = 1 + +; if cgi.nph is enabled it will force cgi to always sent Status: 200 with +; every request. PHP's default behavior is to disable this feature. +;cgi.nph = 1 + +; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape +; (iPlanet) web servers, you MAY need to set an environment variable name that PHP +; will look for to know it is OK to continue execution. Setting this variable MAY +; cause security issues, KNOW WHAT YOU ARE DOING FIRST. +; https://php.net/cgi.redirect-status-env +;cgi.redirect_status_env = + +; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's +; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok +; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting +; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting +; of zero causes PHP to behave as before. Default is 1. You should fix your scripts +; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. +; https://php.net/cgi.fix-pathinfo +;cgi.fix_pathinfo=1 + +; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside +; of the web tree and people will not be able to circumvent .htaccess security. +;cgi.discard_path=1 + +; FastCGI under IIS supports the ability to impersonate +; security tokens of the calling client. This allows IIS to define the +; security context that the request runs under. mod_fastcgi under Apache +; does not currently support this feature (03/17/2002) +; Set to 1 if running under IIS. Default is zero. +; https://php.net/fastcgi.impersonate +;fastcgi.impersonate = 1 + +; Disable logging through FastCGI connection. PHP's default behavior is to enable +; this feature. +;fastcgi.logging = 0 + +; cgi.rfc2616_headers configuration option tells PHP what type of headers to +; use when sending HTTP response code. If set to 0, PHP sends Status: header that +; is supported by Apache. When this option is set to 1, PHP will send +; RFC2616 compliant header. +; Default is zero. +; https://php.net/cgi.rfc2616-headers +;cgi.rfc2616_headers = 0 + +; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! +; (shebang) at the top of the running script. This line might be needed if the +; script support running both as stand-alone script and via PHP CGI<. PHP in CGI +; mode skips this line and ignores its content if this directive is turned on. +; https://php.net/cgi.check-shebang-line +;cgi.check_shebang_line=1 + +;;;;;;;;;;;;;;;; +; File Uploads ; +;;;;;;;;;;;;;;;; + +; Whether to allow HTTP file uploads. +; https://php.net/file-uploads +file_uploads = On + +; Temporary directory for HTTP uploaded files (will use system default if not +; specified). +; https://php.net/upload-tmp-dir +;upload_tmp_dir = + +; Maximum allowed size for uploaded files. +; https://php.net/upload-max-filesize +upload_max_filesize = 2M + +; Maximum number of files that can be uploaded via a single request +max_file_uploads = 20 + +;;;;;;;;;;;;;;;;;; +; Fopen wrappers ; +;;;;;;;;;;;;;;;;;; + +; Whether to allow the treatment of URLs (like http:// or ftp://) as files. +; https://php.net/allow-url-fopen +allow_url_fopen = On + +; Whether to allow include/require to open URLs (like https:// or ftp://) as files. +; https://php.net/allow-url-include +allow_url_include = Off + +; Define the anonymous ftp password (your email address). PHP's default setting +; for this is empty. +; https://php.net/from +;from="john@doe.com" + +; Define the User-Agent string. PHP's default setting for this is empty. +; https://php.net/user-agent +;user_agent="PHP" + +; Default timeout for socket based streams (seconds) +; https://php.net/default-socket-timeout +default_socket_timeout = 60 + +; If your scripts have to deal with files from Macintosh systems, +; or you are running on a Mac and need to deal with files from +; unix or win32 systems, setting this flag will cause PHP to +; automatically detect the EOL character in those files so that +; fgets() and file() will work regardless of the source of the file. +; https://php.net/auto-detect-line-endings +;auto_detect_line_endings = Off + +;;;;;;;;;;;;;;;;;;;;;; +; Dynamic Extensions ; +;;;;;;;;;;;;;;;;;;;;;; + +; If you wish to have an extension loaded automatically, use the following +; syntax: +; +; extension=modulename +; +; For example: +; +; extension=mysqli +; +; When the extension library to load is not located in the default extension +; directory, You may specify an absolute path to the library file: +; +; extension=/path/to/extension/mysqli.so +; +; Note : The syntax used in previous PHP versions ('extension=.so' and +; 'extension='php_.dll') is supported for legacy reasons and may be +; deprecated in a future PHP major version. So, when it is possible, please +; move to the new ('extension=) syntax. +; +; Notes for Windows environments : +; +; - Many DLL files are located in the ext/ +; extension folders as well as the separate PECL DLL download. +; Be sure to appropriately set the extension_dir directive. +; +;extension=bz2 +;extension=curl +;extension=ffi +;extension=ftp +;extension=fileinfo +;extension=gd +;extension=gettext +;extension=gmp +;extension=intl +;extension=ldap +;extension=mbstring +;extension=exif ; Must be after mbstring as it depends on it +;extension=mysqli +;extension=odbc +;extension=openssl +;extension=pdo_firebird +;extension=pdo_mysql +;extension=pdo_odbc +;extension=pdo_pgsql +;extension=pdo_sqlite +;extension=pgsql +;extension=shmop + +; The MIBS data available in the PHP distribution must be installed. +; See https://www.php.net/manual/en/snmp.installation.php +;extension=snmp + +;extension=soap +;extension=sockets +;extension=sodium +;extension=sqlite3 +;extension=tidy +;extension=xsl +;extension=zip + +;zend_extension=opcache + +;;;;;;;;;;;;;;;;;;; +; Module Settings ; +;;;;;;;;;;;;;;;;;;; + +[CLI Server] +; Whether the CLI web server uses ANSI color coding in its terminal output. +cli_server.color = On + +[Date] +; Defines the default timezone used by the date functions +; https://php.net/date.timezone +;date.timezone = + +; https://php.net/date.default-latitude +;date.default_latitude = 31.7667 + +; https://php.net/date.default-longitude +;date.default_longitude = 35.2333 + +; https://php.net/date.sunrise-zenith +;date.sunrise_zenith = 90.833333 + +; https://php.net/date.sunset-zenith +;date.sunset_zenith = 90.833333 + +[filter] +; https://php.net/filter.default +;filter.default = unsafe_raw + +; https://php.net/filter.default-flags +;filter.default_flags = + +[iconv] +; Use of this INI entry is deprecated, use global input_encoding instead. +; If empty, default_charset or input_encoding or iconv.input_encoding is used. +; The precedence is: default_charset < input_encoding < iconv.input_encoding +;iconv.input_encoding = + +; Use of this INI entry is deprecated, use global internal_encoding instead. +; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. +; The precedence is: default_charset < internal_encoding < iconv.internal_encoding +;iconv.internal_encoding = + +; Use of this INI entry is deprecated, use global output_encoding instead. +; If empty, default_charset or output_encoding or iconv.output_encoding is used. +; The precedence is: default_charset < output_encoding < iconv.output_encoding +; To use an output encoding conversion, iconv's output handler must be set +; otherwise output encoding conversion cannot be performed. +;iconv.output_encoding = + +[intl] +;intl.default_locale = +; This directive allows you to produce PHP errors when some error +; happens within intl functions. The value is the level of the error produced. +; Default is 0, which does not produce any errors. +;intl.error_level = E_WARNING +;intl.use_exceptions = 0 + +[sqlite3] +; Directory pointing to SQLite3 extensions +; https://php.net/sqlite3.extension-dir +;sqlite3.extension_dir = + +; SQLite defensive mode flag (only available from SQLite 3.26+) +; When the defensive flag is enabled, language features that allow ordinary +; SQL to deliberately corrupt the database file are disabled. This forbids +; writing directly to the schema, shadow tables (eg. FTS data tables), or +; the sqlite_dbpage virtual table. +; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html +; (for older SQLite versions, this flag has no use) +;sqlite3.defensive = 1 + +[Pcre] +; PCRE library backtracking limit. +; https://php.net/pcre.backtrack-limit +;pcre.backtrack_limit=100000 + +; PCRE library recursion limit. +; Please note that if you set this value to a high number you may consume all +; the available process stack and eventually crash PHP (due to reaching the +; stack size limit imposed by the Operating System). +; https://php.net/pcre.recursion-limit +;pcre.recursion_limit=100000 + +; Enables or disables JIT compilation of patterns. This requires the PCRE +; library to be compiled with JIT support. +;pcre.jit=1 + +[Pdo] +; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" +; https://php.net/pdo-odbc.connection-pooling +;pdo_odbc.connection_pooling=strict + +[Pdo_mysql] +; Default socket name for local MySQL connects. If empty, uses the built-in +; MySQL defaults. +pdo_mysql.default_socket= + +[Phar] +; https://php.net/phar.readonly +;phar.readonly = On + +; https://php.net/phar.require-hash +;phar.require_hash = On + +;phar.cache_list = + +[mail function] +; For Win32 only. +; https://php.net/smtp +SMTP = localhost +; https://php.net/smtp-port +smtp_port = 25 + +; For Win32 only. +; https://php.net/sendmail-from +;sendmail_from = me@example.com + +; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). +; https://php.net/sendmail-path +;sendmail_path = + +; Force the addition of the specified parameters to be passed as extra parameters +; to the sendmail binary. These parameters will always replace the value of +; the 5th parameter to mail(). +;mail.force_extra_parameters = + +; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename +mail.add_x_header = Off + +; Use mixed LF and CRLF line separators to keep compatibility with some +; RFC 2822 non conformant MTA. +mail.mixed_lf_and_crlf = Off + +; The path to a log file that will log all mail() calls. Log entries include +; the full path of the script, line number, To address and headers. +;mail.log = +; Log mail to syslog (Event Log on Windows). +;mail.log = syslog + +[ODBC] +; https://php.net/odbc.default-db +;odbc.default_db = Not yet implemented + +; https://php.net/odbc.default-user +;odbc.default_user = Not yet implemented + +; https://php.net/odbc.default-pw +;odbc.default_pw = Not yet implemented + +; Controls the ODBC cursor model. +; Default: SQL_CURSOR_STATIC (default). +;odbc.default_cursortype + +; Allow or prevent persistent links. +; https://php.net/odbc.allow-persistent +odbc.allow_persistent = On + +; Check that a connection is still valid before reuse. +; https://php.net/odbc.check-persistent +odbc.check_persistent = On + +; Maximum number of persistent links. -1 means no limit. +; https://php.net/odbc.max-persistent +odbc.max_persistent = -1 + +; Maximum number of links (persistent + non-persistent). -1 means no limit. +; https://php.net/odbc.max-links +odbc.max_links = -1 + +; Handling of LONG fields. Returns number of bytes to variables. 0 means +; passthru. +; https://php.net/odbc.defaultlrl +odbc.defaultlrl = 4096 + +; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. +; See the documentation on odbc_binmode and odbc_longreadlen for an explanation +; of odbc.defaultlrl and odbc.defaultbinmode +; https://php.net/odbc.defaultbinmode +odbc.defaultbinmode = 1 + +[MySQLi] + +; Maximum number of persistent links. -1 means no limit. +; https://php.net/mysqli.max-persistent +mysqli.max_persistent = -1 + +; Allow accessing, from PHP's perspective, local files with LOAD DATA statements +; https://php.net/mysqli.allow_local_infile +;mysqli.allow_local_infile = On + +; It allows the user to specify a folder where files that can be sent via LOAD DATA +; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled. +;mysqli.local_infile_directory = + +; Allow or prevent persistent links. +; https://php.net/mysqli.allow-persistent +mysqli.allow_persistent = On + +; Maximum number of links. -1 means no limit. +; https://php.net/mysqli.max-links +mysqli.max_links = -1 + +; Default port number for mysqli_connect(). If unset, mysqli_connect() will use +; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the +; compile-time value defined MYSQL_PORT (in that order). Win32 will only look +; at MYSQL_PORT. +; https://php.net/mysqli.default-port +mysqli.default_port = 3306 + +; Default socket name for local MySQL connects. If empty, uses the built-in +; MySQL defaults. +; https://php.net/mysqli.default-socket +mysqli.default_socket = + +; Default host for mysqli_connect() (doesn't apply in safe mode). +; https://php.net/mysqli.default-host +mysqli.default_host = + +; Default user for mysqli_connect() (doesn't apply in safe mode). +; https://php.net/mysqli.default-user +mysqli.default_user = + +; Default password for mysqli_connect() (doesn't apply in safe mode). +; Note that this is generally a *bad* idea to store passwords in this file. +; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") +; and reveal this password! And of course, any users with read access to this +; file will be able to reveal the password as well. +; https://php.net/mysqli.default-pw +mysqli.default_pw = + +; If this option is enabled, closing a persistent connection will rollback +; any pending transactions of this connection, before it is put back +; into the persistent connection pool. +;mysqli.rollback_on_cached_plink = Off + +[mysqlnd] +; Enable / Disable collection of general statistics by mysqlnd which can be +; used to tune and monitor MySQL operations. +mysqlnd.collect_statistics = On + +; Enable / Disable collection of memory usage statistics by mysqlnd which can be +; used to tune and monitor MySQL operations. +mysqlnd.collect_memory_statistics = On + +; Records communication from all extensions using mysqlnd to the specified log +; file. +; https://php.net/mysqlnd.debug +;mysqlnd.debug = + +; Defines which queries will be logged. +;mysqlnd.log_mask = 0 + +; Default size of the mysqlnd memory pool, which is used by result sets. +;mysqlnd.mempool_default_size = 16000 + +; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. +;mysqlnd.net_cmd_buffer_size = 2048 + +; Size of a pre-allocated buffer used for reading data sent by the server in +; bytes. +;mysqlnd.net_read_buffer_size = 32768 + +; Timeout for network requests in seconds. +;mysqlnd.net_read_timeout = 31536000 + +; SHA-256 Authentication Plugin related. File with the MySQL server public RSA +; key. +;mysqlnd.sha256_server_public_key = + +[PostgreSQL] +; Allow or prevent persistent links. +; https://php.net/pgsql.allow-persistent +pgsql.allow_persistent = On + +; Detect broken persistent links always with pg_pconnect(). +; Auto reset feature requires a little overheads. +; https://php.net/pgsql.auto-reset-persistent +pgsql.auto_reset_persistent = Off + +; Maximum number of persistent links. -1 means no limit. +; https://php.net/pgsql.max-persistent +pgsql.max_persistent = -1 + +; Maximum number of links (persistent+non persistent). -1 means no limit. +; https://php.net/pgsql.max-links +pgsql.max_links = -1 + +; Ignore PostgreSQL backends Notice message or not. +; Notice message logging require a little overheads. +; https://php.net/pgsql.ignore-notice +pgsql.ignore_notice = 0 + +; Log PostgreSQL backends Notice message or not. +; Unless pgsql.ignore_notice=0, module cannot log notice message. +; https://php.net/pgsql.log-notice +pgsql.log_notice = 0 + +[bcmath] +; Number of decimal digits for all bcmath functions. +; https://php.net/bcmath.scale +bcmath.scale = 0 + +[browscap] +; https://php.net/browscap +;browscap = extra/browscap.ini + +[Session] +; Handler used to store/retrieve data. +; https://php.net/session.save-handler +session.save_handler = files + +; Argument passed to save_handler. In the case of files, this is the path +; where data files are stored. Note: Windows users have to change this +; variable in order to use PHP's session functions. +; +; The path can be defined as: +; +; session.save_path = "N;/path" +; +; where N is an integer. Instead of storing all the session files in +; /path, what this will do is use subdirectories N-levels deep, and +; store the session data in those directories. This is useful if +; your OS has problems with many files in one directory, and is +; a more efficient layout for servers that handle many sessions. +; +; NOTE 1: PHP will not create this directory structure automatically. +; You can use the script in the ext/session dir for that purpose. +; NOTE 2: See the section on garbage collection below if you choose to +; use subdirectories for session storage +; +; The file storage module creates files using mode 600 by default. +; You can change that by using +; +; session.save_path = "N;MODE;/path" +; +; where MODE is the octal representation of the mode. Note that this +; does not overwrite the process's umask. +; https://php.net/session.save-path +;session.save_path = "/tmp" + +; Whether to use strict session mode. +; Strict session mode does not accept an uninitialized session ID, and +; regenerates the session ID if the browser sends an uninitialized session ID. +; Strict mode protects applications from session fixation via a session adoption +; vulnerability. It is disabled by default for maximum compatibility, but +; enabling it is encouraged. +; https://wiki.php.net/rfc/strict_sessions +session.use_strict_mode = 0 + +; Whether to use cookies. +; https://php.net/session.use-cookies +session.use_cookies = 1 + +; https://php.net/session.cookie-secure +;session.cookie_secure = + +; This option forces PHP to fetch and use a cookie for storing and maintaining +; the session id. We encourage this operation as it's very helpful in combating +; session hijacking when not specifying and managing your own session id. It is +; not the be-all and end-all of session hijacking defense, but it's a good start. +; https://php.net/session.use-only-cookies +session.use_only_cookies = 1 + +; Name of the session (used as cookie name). +; https://php.net/session.name +session.name = PHPSESSID + +; Initialize session on request startup. +; https://php.net/session.auto-start +session.auto_start = 0 + +; Lifetime in seconds of cookie or, if 0, until browser is restarted. +; https://php.net/session.cookie-lifetime +session.cookie_lifetime = 0 + +; The path for which the cookie is valid. +; https://php.net/session.cookie-path +session.cookie_path = / + +; The domain for which the cookie is valid. +; https://php.net/session.cookie-domain +session.cookie_domain = + +; Whether or not to add the httpOnly flag to the cookie, which makes it +; inaccessible to browser scripting languages such as JavaScript. +; https://php.net/session.cookie-httponly +session.cookie_httponly = + +; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF) +; Current valid values are "Strict", "Lax" or "None". When using "None", +; make sure to include the quotes, as `none` is interpreted like `false` in ini files. +; https://tools.ietf.org/html/draft-west-first-party-cookies-07 +session.cookie_samesite = + +; Handler used to serialize data. php is the standard serializer of PHP. +; https://php.net/session.serialize-handler +session.serialize_handler = php + +; Defines the probability that the 'garbage collection' process is started on every +; session initialization. The probability is calculated by using gc_probability/gc_divisor, +; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. +; Default Value: 1 +; Development Value: 1 +; Production Value: 1 +; https://php.net/session.gc-probability +session.gc_probability = 1 + +; Defines the probability that the 'garbage collection' process is started on every +; session initialization. The probability is calculated by using gc_probability/gc_divisor, +; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. +; For high volume production servers, using a value of 1000 is a more efficient approach. +; Default Value: 100 +; Development Value: 1000 +; Production Value: 1000 +; https://php.net/session.gc-divisor +session.gc_divisor = 1000 + +; After this number of seconds, stored data will be seen as 'garbage' and +; cleaned up by the garbage collection process. +; https://php.net/session.gc-maxlifetime +session.gc_maxlifetime = 1440 + +; NOTE: If you are using the subdirectory option for storing session files +; (see session.save_path above), then garbage collection does *not* +; happen automatically. You will need to do your own garbage +; collection through a shell script, cron entry, or some other method. +; For example, the following script is the equivalent of setting +; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): +; find /path/to/sessions -cmin +24 -type f | xargs rm + +; Check HTTP Referer to invalidate externally stored URLs containing ids. +; HTTP_REFERER has to contain this substring for the session to be +; considered as valid. +; https://php.net/session.referer-check +session.referer_check = + +; Set to {nocache,private,public,} to determine HTTP caching aspects +; or leave this empty to avoid sending anti-caching headers. +; https://php.net/session.cache-limiter +session.cache_limiter = nocache + +; Document expires after n minutes. +; https://php.net/session.cache-expire +session.cache_expire = 180 + +; trans sid support is disabled by default. +; Use of trans sid may risk your users' security. +; Use this option with caution. +; - User may send URL contains active session ID +; to other person via. email/irc/etc. +; - URL that contains active session ID may be stored +; in publicly accessible computer. +; - User may access your site with the same session ID +; always using URL stored in browser's history or bookmarks. +; https://php.net/session.use-trans-sid +session.use_trans_sid = 0 + +; The URL rewriter will look for URLs in a defined set of HTML tags. +;
is special; if you include them here, the rewriter will +; add a hidden field with the info which is otherwise appended +; to URLs. tag's action attribute URL will not be modified +; unless it is specified. +; Note that all valid entries require a "=", even if no value follows. +; Default Value: "a=href,area=href,frame=src,form=" +; Development Value: "a=href,area=href,frame=src,form=" +; Production Value: "a=href,area=href,frame=src,form=" +; https://php.net/url-rewriter.tags +session.trans_sid_tags = "a=href,area=href,frame=src,form=" + +; URL rewriter does not rewrite absolute URLs by default. +; To enable rewrites for absolute paths, target hosts must be specified +; at RUNTIME. i.e. use ini_set() +; tags is special. PHP will check action attribute's URL regardless +; of session.trans_sid_tags setting. +; If no host is defined, HTTP_HOST will be used for allowed host. +; Example value: php.net,www.php.net,wiki.php.net +; Use "," for multiple hosts. No spaces are allowed. +; Default Value: "" +; Development Value: "" +; Production Value: "" +;session.trans_sid_hosts="" + +; Enable upload progress tracking in $_SESSION +; Default Value: On +; Development Value: On +; Production Value: On +; https://php.net/session.upload-progress.enabled +;session.upload_progress.enabled = On + +; Cleanup the progress information as soon as all POST data has been read +; (i.e. upload completed). +; Default Value: On +; Development Value: On +; Production Value: On +; https://php.net/session.upload-progress.cleanup +;session.upload_progress.cleanup = On + +; A prefix used for the upload progress key in $_SESSION +; Default Value: "upload_progress_" +; Development Value: "upload_progress_" +; Production Value: "upload_progress_" +; https://php.net/session.upload-progress.prefix +;session.upload_progress.prefix = "upload_progress_" + +; The index name (concatenated with the prefix) in $_SESSION +; containing the upload progress information +; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" +; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" +; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" +; https://php.net/session.upload-progress.name +;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" + +; How frequently the upload progress should be updated. +; Given either in percentages (per-file), or in bytes +; Default Value: "1%" +; Development Value: "1%" +; Production Value: "1%" +; https://php.net/session.upload-progress.freq +;session.upload_progress.freq = "1%" + +; The minimum delay between updates, in seconds +; Default Value: 1 +; Development Value: 1 +; Production Value: 1 +; https://php.net/session.upload-progress.min-freq +;session.upload_progress.min_freq = "1" + +; Only write session data when session data is changed. Enabled by default. +; https://php.net/session.lazy-write +;session.lazy_write = On + +[Assertion] +; Switch whether to compile assertions at all (to have no overhead at run-time) +; -1: Do not compile at all +; 0: Jump over assertion at run-time +; 1: Execute assertions +; Changing from or to a negative value is only possible in php.ini! +; (For turning assertions on and off at run-time, toggle zend.assertions between the values 1 and 0) +; Default Value: 1 +; Development Value: 1 +; Production Value: -1 +; https://php.net/zend.assertions +zend.assertions = 1 + +[COM] +; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs +; https://php.net/com.typelib-file +;com.typelib_file = + +; allow Distributed-COM calls +; https://php.net/com.allow-dcom +;com.allow_dcom = true + +; autoregister constants of a component's typelib on com_load() +; https://php.net/com.autoregister-typelib +;com.autoregister_typelib = true + +; register constants casesensitive +; https://php.net/com.autoregister-casesensitive +;com.autoregister_casesensitive = false + +; show warnings on duplicate constant registrations +; https://php.net/com.autoregister-verbose +;com.autoregister_verbose = true + +; The default character set code-page to use when passing strings to and from COM objects. +; Default: system ANSI code page +;com.code_page= + +; The version of the .NET framework to use. The value of the setting are the first three parts +; of the framework's version number, separated by dots, and prefixed with "v", e.g. "v4.0.30319". +;com.dotnet_version= + +[mbstring] +; language for internal character representation. +; This affects mb_send_mail() and mbstring.detect_order. +; https://php.net/mbstring.language +;mbstring.language = Japanese + +; Use of this INI entry is deprecated, use global internal_encoding instead. +; internal/script encoding. +; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) +; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. +; The precedence is: default_charset < internal_encoding < iconv.internal_encoding +;mbstring.internal_encoding = + +; Use of this INI entry is deprecated, use global input_encoding instead. +; http input encoding. +; mbstring.encoding_translation = On is needed to use this setting. +; If empty, default_charset or input_encoding or mbstring.input is used. +; The precedence is: default_charset < input_encoding < mbstring.http_input +; https://php.net/mbstring.http-input +;mbstring.http_input = + +; Use of this INI entry is deprecated, use global output_encoding instead. +; http output encoding. +; mb_output_handler must be registered as output buffer to function. +; If empty, default_charset or output_encoding or mbstring.http_output is used. +; The precedence is: default_charset < output_encoding < mbstring.http_output +; To use an output encoding conversion, mbstring's output handler must be set +; otherwise output encoding conversion cannot be performed. +; https://php.net/mbstring.http-output +;mbstring.http_output = + +; enable automatic encoding translation according to +; mbstring.internal_encoding setting. Input chars are +; converted to internal encoding by setting this to On. +; Note: Do _not_ use automatic encoding translation for +; portable libs/applications. +; https://php.net/mbstring.encoding-translation +;mbstring.encoding_translation = Off + +; automatic encoding detection order. +; "auto" detect order is changed according to mbstring.language +; https://php.net/mbstring.detect-order +;mbstring.detect_order = auto + +; substitute_character used when character cannot be converted +; one from another +; https://php.net/mbstring.substitute-character +;mbstring.substitute_character = none + +; Enable strict encoding detection. +;mbstring.strict_detection = Off + +; This directive specifies the regex pattern of content types for which mb_output_handler() +; is activated. +; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\+xml) +;mbstring.http_output_conv_mimetypes= + +; This directive specifies maximum stack depth for mbstring regular expressions. It is similar +; to the pcre.recursion_limit for PCRE. +;mbstring.regex_stack_limit=100000 + +; This directive specifies maximum retry count for mbstring regular expressions. It is similar +; to the pcre.backtrack_limit for PCRE. +;mbstring.regex_retry_limit=1000000 + +[gd] +; Tell the jpeg decode to ignore warnings and try to create +; a gd image. The warning will then be displayed as notices +; disabled by default +; https://php.net/gd.jpeg-ignore-warning +;gd.jpeg_ignore_warning = 1 + +[exif] +; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. +; With mbstring support this will automatically be converted into the encoding +; given by corresponding encode setting. When empty mbstring.internal_encoding +; is used. For the decode settings you can distinguish between motorola and +; intel byte order. A decode setting must not be empty. +; https://php.net/exif.encode-unicode +;exif.encode_unicode = ISO-8859-15 + +; https://php.net/exif.decode-unicode-motorola +;exif.decode_unicode_motorola = UCS-2BE + +; https://php.net/exif.decode-unicode-intel +;exif.decode_unicode_intel = UCS-2LE + +; https://php.net/exif.encode-jis +;exif.encode_jis = + +; https://php.net/exif.decode-jis-motorola +;exif.decode_jis_motorola = JIS + +; https://php.net/exif.decode-jis-intel +;exif.decode_jis_intel = JIS + +[Tidy] +; The path to a default tidy configuration file to use when using tidy +; https://php.net/tidy.default-config +;tidy.default_config = /usr/local/lib/php/default.tcfg + +; Should tidy clean and repair output automatically? +; WARNING: Do not use this option if you are generating non-html content +; such as dynamic images +; https://php.net/tidy.clean-output +tidy.clean_output = Off + +[soap] +; Enables or disables WSDL caching feature. +; https://php.net/soap.wsdl-cache-enabled +soap.wsdl_cache_enabled=1 + +; Sets the directory name where SOAP extension will put cache files. +; https://php.net/soap.wsdl-cache-dir +soap.wsdl_cache_dir="/tmp" + +; (time to live) Sets the number of second while cached file will be used +; instead of original one. +; https://php.net/soap.wsdl-cache-ttl +soap.wsdl_cache_ttl=86400 + +; Sets the size of the cache limit. (Max. number of WSDL files to cache) +soap.wsdl_cache_limit = 5 + +[sysvshm] +; A default size of the shared memory segment +;sysvshm.init_mem = 10000 + +[ldap] +; Sets the maximum number of open links or -1 for unlimited. +ldap.max_links = -1 + +[dba] +;dba.default_handler= + +[opcache] +; Determines if Zend OPCache is enabled +;opcache.enable=1 + +; Determines if Zend OPCache is enabled for the CLI version of PHP +;opcache.enable_cli=0 + +; The OPcache shared memory storage size. +;opcache.memory_consumption=128 + +; The amount of memory for interned strings in Mbytes. +;opcache.interned_strings_buffer=8 + +; The maximum number of keys (scripts) in the OPcache hash table. +; Only numbers between 200 and 1000000 are allowed. +;opcache.max_accelerated_files=10000 + +; The maximum percentage of "wasted" memory until a restart is scheduled. +;opcache.max_wasted_percentage=5 + +; When this directive is enabled, the OPcache appends the current working +; directory to the script key, thus eliminating possible collisions between +; files with the same name (basename). Disabling the directive improves +; performance, but may break existing applications. +;opcache.use_cwd=1 + +; When disabled, you must reset the OPcache manually or restart the +; webserver for changes to the filesystem to take effect. +;opcache.validate_timestamps=1 + +; How often (in seconds) to check file timestamps for changes to the shared +; memory storage allocation. ("1" means validate once per second, but only +; once per request. "0" means always validate) +;opcache.revalidate_freq=2 + +; Enables or disables file search in include_path optimization +;opcache.revalidate_path=0 + +; If disabled, all PHPDoc comments are dropped from the code to reduce the +; size of the optimized code. +;opcache.save_comments=1 + +; If enabled, compilation warnings (including notices and deprecations) will +; be recorded and replayed each time a file is included. Otherwise, compilation +; warnings will only be emitted when the file is first cached. +;opcache.record_warnings=0 + +; Allow file existence override (file_exists, etc.) performance feature. +;opcache.enable_file_override=0 + +; A bitmask, where each bit enables or disables the appropriate OPcache +; passes +;opcache.optimization_level=0x7FFFBFFF + +;opcache.dups_fix=0 + +; The location of the OPcache blacklist file (wildcards allowed). +; Each OPcache blacklist file is a text file that holds the names of files +; that should not be accelerated. The file format is to add each filename +; to a new line. The filename may be a full path or just a file prefix +; (i.e., /var/www/x blacklists all the files and directories in /var/www +; that start with 'x'). Line starting with a ; are ignored (comments). +;opcache.blacklist_filename= + +; Allows exclusion of large files from being cached. By default all files +; are cached. +;opcache.max_file_size=0 + +; How long to wait (in seconds) for a scheduled restart to begin if the cache +; is not being accessed. +;opcache.force_restart_timeout=180 + +; OPcache error_log file name. Empty string assumes "stderr". +;opcache.error_log= + +; All OPcache errors go to the Web server log. +; By default, only fatal errors (level 0) or errors (level 1) are logged. +; You can also enable warnings (level 2), info messages (level 3) or +; debug messages (level 4). +;opcache.log_verbosity_level=1 + +; Preferred Shared Memory back-end. Leave empty and let the system decide. +;opcache.preferred_memory_model= + +; Protect the shared memory from unexpected writing during script execution. +; Useful for internal debugging only. +;opcache.protect_memory=0 + +; Allows calling OPcache API functions only from PHP scripts which path is +; started from specified string. The default "" means no restriction +;opcache.restrict_api= + +; Mapping base of shared memory segments (for Windows only). All the PHP +; processes have to map shared memory into the same address space. This +; directive allows to manually fix the "Unable to reattach to base address" +; errors. +;opcache.mmap_base= + +; Facilitates multiple OPcache instances per user (for Windows only). All PHP +; processes with the same cache ID and user share an OPcache instance. +;opcache.cache_id= + +; Enables and sets the second level cache directory. +; It should improve performance when SHM memory is full, at server restart or +; SHM reset. The default "" disables file based caching. +;opcache.file_cache= + +; Enables or disables opcode caching in shared memory. +;opcache.file_cache_only=0 + +; Enables or disables checksum validation when script loaded from file cache. +;opcache.file_cache_consistency_checks=1 + +; Implies opcache.file_cache_only=1 for a certain process that failed to +; reattach to the shared memory (for Windows only). Explicitly enabled file +; cache is required. +;opcache.file_cache_fallback=1 + +; Enables or disables copying of PHP code (text segment) into HUGE PAGES. +; Under certain circumstances (if only a single global PHP process is +; started from which all others fork), this can increase performance +; by a tiny amount because TLB misses are reduced. On the other hand, this +; delays PHP startup, increases memory usage and degrades performance +; under memory pressure - use with care. +; Requires appropriate OS configuration. +;opcache.huge_code_pages=0 + +; Validate cached file permissions. +;opcache.validate_permission=0 + +; Prevent name collisions in chroot'ed environment. +;opcache.validate_root=0 + +; If specified, it produces opcode dumps for debugging different stages of +; optimizations. +;opcache.opt_debug_level=0 + +; Specifies a PHP script that is going to be compiled and executed at server +; start-up. +; https://php.net/opcache.preload +;opcache.preload= + +; Preloading code as root is not allowed for security reasons. This directive +; facilitates to let the preloading to be run as another user. +; https://php.net/opcache.preload_user +;opcache.preload_user= + +; Prevents caching files that are less than this number of seconds old. It +; protects from caching of incompletely updated files. In case all file updates +; on your site are atomic, you may increase performance by setting it to "0". +;opcache.file_update_protection=2 + +; Absolute path used to store shared lockfiles (for *nix only). +;opcache.lockfile_path=/tmp + +[curl] +; A default value for the CURLOPT_CAINFO option. This is required to be an +; absolute path. +;curl.cainfo = + +[openssl] +; The location of a Certificate Authority (CA) file on the local filesystem +; to use when verifying the identity of SSL/TLS peers. Most users should +; not specify a value for this directive as PHP will attempt to use the +; OS-managed cert stores in its absence. If specified, this value may still +; be overridden on a per-stream basis via the "cafile" SSL stream context +; option. +;openssl.cafile= + +; If openssl.cafile is not specified or if the CA file is not found, the +; directory pointed to by openssl.capath is searched for a suitable +; certificate. This value must be a correctly hashed certificate directory. +; Most users should not specify a value for this directive as PHP will +; attempt to use the OS-managed cert stores in its absence. If specified, +; this value may still be overridden on a per-stream basis via the "capath" +; SSL stream context option. +;openssl.capath= + +[ffi] +; FFI API restriction. Possible values: +; "preload" - enabled in CLI scripts and preloaded files (default) +; "false" - always disabled +; "true" - always enabled +;ffi.enable=preload + +; List of headers files to preload, wildcard patterns allowed. +;ffi.preload= diff --git a/confs/php84/etc/php/php.ini-production b/confs/php84/etc/php/php.ini-production new file mode 100644 index 0000000..c62faf5 --- /dev/null +++ b/confs/php84/etc/php/php.ini-production @@ -0,0 +1,1850 @@ +[PHP] + +;;;;;;;;;;;;;;;;;;; +; About php.ini ; +;;;;;;;;;;;;;;;;;;; +; PHP's initialization file, generally called php.ini, is responsible for +; configuring many of the aspects of PHP's behavior. + +; PHP attempts to find and load this configuration from a number of locations. +; The following is a summary of its search order: +; 1. SAPI module specific location. +; 2. The PHPRC environment variable. +; 3. A number of predefined registry keys on Windows +; 4. Current working directory (except CLI) +; 5. The web server's directory (for SAPI modules), or directory of PHP +; (otherwise in Windows) +; 6. The directory from the --with-config-file-path compile time option, or the +; Windows directory (usually C:\windows) +; See the PHP docs for more specific information. +; https://php.net/configuration.file + +; The syntax of the file is extremely simple. Whitespace and lines +; beginning with a semicolon are silently ignored (as you probably guessed). +; Section headers (e.g. [Foo]) are also silently ignored, even though +; they might mean something in the future. + +; Directives following the section heading [PATH=/www/mysite] only +; apply to PHP files in the /www/mysite directory. Directives +; following the section heading [HOST=www.example.com] only apply to +; PHP files served from www.example.com. Directives set in these +; special sections cannot be overridden by user-defined INI files or +; at runtime. Currently, [PATH=] and [HOST=] sections only work under +; CGI/FastCGI. +; https://php.net/ini.sections + +; Directives are specified using the following syntax: +; directive = value +; Directive names are *case sensitive* - foo=bar is different from FOO=bar. +; Directives are variables used to configure PHP or PHP extensions. +; There is no name validation. If PHP can't find an expected +; directive because it is not set or is mistyped, a default value will be used. + +; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one +; of the INI constants (On, Off, True, False, Yes, No and None) or an expression +; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a +; previously set variable or directive (e.g. ${foo}) + +; Expressions in the INI file are limited to bitwise operators and parentheses: +; | bitwise OR +; ^ bitwise XOR +; & bitwise AND +; ~ bitwise NOT +; ! boolean NOT + +; Boolean flags can be turned on using the values 1, On, True or Yes. +; They can be turned off using the values 0, Off, False or No. + +; An empty string can be denoted by simply not writing anything after the equal +; sign, or by using the None keyword: + +; foo = ; sets foo to an empty string +; foo = None ; sets foo to an empty string +; foo = "None" ; sets foo to the string 'None' + +; If you use constants in your value, and these constants belong to a +; dynamically loaded extension (either a PHP extension or a Zend extension), +; you may only use these constants *after* the line that loads the extension. + +;;;;;;;;;;;;;;;;;;; +; About this file ; +;;;;;;;;;;;;;;;;;;; +; PHP comes packaged with two INI files. One that is recommended to be used +; in production environments and one that is recommended to be used in +; development environments. + +; php.ini-production contains settings which hold security, performance and +; best practices at its core. But please be aware, these settings may break +; compatibility with older or less security-conscious applications. We +; recommending using the production ini in production and testing environments. + +; php.ini-development is very similar to its production variant, except it is +; much more verbose when it comes to errors. We recommend using the +; development version only in development environments, as errors shown to +; application users can inadvertently leak otherwise secure information. + +; This is the php.ini-production INI file. + +;;;;;;;;;;;;;;;;;;; +; Quick Reference ; +;;;;;;;;;;;;;;;;;;; + +; The following are all the settings which are different in either the production +; or development versions of the INIs with respect to PHP's default behavior. +; Please see the actual settings later in the document for more details as to why +; we recommend these changes in PHP's behavior. + +; display_errors +; Default Value: On +; Development Value: On +; Production Value: Off + +; display_startup_errors +; Default Value: On +; Development Value: On +; Production Value: Off + +; error_reporting +; Default Value: E_ALL +; Development Value: E_ALL +; Production Value: E_ALL & ~E_DEPRECATED + +; log_errors +; Default Value: Off +; Development Value: On +; Production Value: On + +; max_input_time +; Default Value: -1 (Unlimited) +; Development Value: 60 (60 seconds) +; Production Value: 60 (60 seconds) + +; output_buffering +; Default Value: Off +; Development Value: 4096 +; Production Value: 4096 + +; register_argc_argv +; Default Value: On +; Development Value: Off +; Production Value: Off + +; request_order +; Default Value: None +; Development Value: "GP" +; Production Value: "GP" + +; session.gc_divisor +; Default Value: 100 +; Development Value: 1000 +; Production Value: 1000 + +; short_open_tag +; Default Value: On +; Development Value: Off +; Production Value: Off + +; variables_order +; Default Value: "EGPCS" +; Development Value: "GPCS" +; Production Value: "GPCS" + +; zend.assertions +; Default Value: 1 +; Development Value: 1 +; Production Value: -1 + +; zend.exception_ignore_args +; Default Value: Off +; Development Value: Off +; Production Value: On + +; zend.exception_string_param_max_len +; Default Value: 15 +; Development Value: 15 +; Production Value: 0 + +;;;;;;;;;;;;;;;;;;;; +; php.ini Options ; +;;;;;;;;;;;;;;;;;;;; +; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" +;user_ini.filename = ".user.ini" + +; To disable this feature set this option to an empty value +;user_ini.filename = + +; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) +;user_ini.cache_ttl = 300 + +;;;;;;;;;;;;;;;;;;;; +; Language Options ; +;;;;;;;;;;;;;;;;;;;; + +; Enable the PHP scripting language engine under Apache. +; https://php.net/engine +engine = On + +; This directive determines whether or not PHP will recognize code between +; tags as PHP source which should be processed as such. It is +; generally recommended that should be used and that this feature +; should be disabled, as enabling it may result in issues when generating XML +; documents, however this remains supported for backward compatibility reasons. +; Note that this directive does not control the would work. +; https://php.net/syntax-highlighting +;highlight.string = #DD0000 +;highlight.comment = #FF9900 +;highlight.keyword = #007700 +;highlight.default = #0000BB +;highlight.html = #000000 + +; If enabled, the request will be allowed to complete even if the user aborts +; the request. Consider enabling it if executing long requests, which may end up +; being interrupted by the user or a browser timing out. PHP's default behavior +; is to disable this feature. +; https://php.net/ignore-user-abort +;ignore_user_abort = On + +; Determines the size of the realpath cache to be used by PHP. This value should +; be increased on systems where PHP opens many files to reflect the quantity of +; the file operations performed. +; Note: if open_basedir is set, the cache is disabled +; https://php.net/realpath-cache-size +;realpath_cache_size = 4096k + +; Duration of time, in seconds for which to cache realpath information for a given +; file or directory. For systems with rarely changing files, consider increasing this +; value. +; https://php.net/realpath-cache-ttl +;realpath_cache_ttl = 120 + +; Enables or disables the circular reference collector. +; https://php.net/zend.enable-gc +zend.enable_gc = On + +; If enabled, scripts may be written in encodings that are incompatible with +; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such +; encodings. To use this feature, mbstring extension must be enabled. +;zend.multibyte = Off + +; Allows to set the default encoding for the scripts. This value will be used +; unless "declare(encoding=...)" directive appears at the top of the script. +; Only affects if zend.multibyte is set. +;zend.script_encoding = + +; Allows to include or exclude arguments from stack traces generated for exceptions. +; In production, it is recommended to turn this setting on to prohibit the output +; of sensitive information in stack traces +; Default Value: Off +; Development Value: Off +; Production Value: On +zend.exception_ignore_args = On + +; Allows setting the maximum string length in an argument of a stringified stack trace +; to a value between 0 and 1000000. +; This has no effect when zend.exception_ignore_args is enabled. +; Default Value: 15 +; Development Value: 15 +; Production Value: 0 +; In production, it is recommended to set this to 0 to reduce the output +; of sensitive information in stack traces. +zend.exception_string_param_max_len = 0 + +;;;;;;;;;;;;;;;;; +; Miscellaneous ; +;;;;;;;;;;;;;;;;; + +; Decides whether PHP may expose the fact that it is installed on the server +; (e.g. by adding its signature to the Web server header). It is no security +; threat in any way, but it makes it possible to determine whether you use PHP +; on your server or not. +; https://php.net/expose-php +expose_php = On + +;;;;;;;;;;;;;;;;;;; +; Resource Limits ; +;;;;;;;;;;;;;;;;;;; + +; Maximum execution time of each script, in seconds +; https://php.net/max-execution-time +; Note: This directive is hardcoded to 0 for the CLI SAPI +max_execution_time = 30 + +; Maximum amount of time each script may spend parsing request data. It's a good +; idea to limit this time on productions servers in order to eliminate unexpectedly +; long running scripts. +; Note: This directive is hardcoded to -1 for the CLI SAPI +; Default Value: -1 (Unlimited) +; Development Value: 60 (60 seconds) +; Production Value: 60 (60 seconds) +; https://php.net/max-input-time +max_input_time = 60 + +; Maximum input variable nesting level +; https://php.net/max-input-nesting-level +;max_input_nesting_level = 64 + +; How many GET/POST/COOKIE input variables may be accepted +;max_input_vars = 1000 + +; How many multipart body parts (combined input variable and file uploads) may +; be accepted. +; Default Value: -1 (Sum of max_input_vars and max_file_uploads) +;max_multipart_body_parts = 1500 + +; Maximum amount of memory a script may consume +; https://php.net/memory-limit +memory_limit = 128M + +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; +; Error handling and logging ; +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; + +; This directive informs PHP of which errors, warnings and notices you would like +; it to take action for. The recommended way of setting values for this +; directive is through the use of the error level constants and bitwise +; operators. The error level constants are below here for convenience as well as +; some common settings and their meanings. +; By default, PHP is set to take action on all errors, notices and warnings EXCEPT +; those related to E_NOTICE, which together cover best practices and +; recommended coding standards in PHP. For performance reasons, this is the +; recommend error reporting setting. Your production server shouldn't be wasting +; resources complaining about best practices and coding standards. That's what +; development servers and development settings are for. +; Note: The php.ini-development file has this setting as E_ALL. This +; means it pretty much reports everything which is exactly what you want during +; development and early testing. +; +; Error Level Constants: +; E_ALL - All errors and warnings +; E_ERROR - fatal run-time errors +; E_RECOVERABLE_ERROR - almost fatal run-time errors +; E_WARNING - run-time warnings (non-fatal errors) +; E_PARSE - compile-time parse errors +; E_NOTICE - run-time notices (these are warnings which often result +; from a bug in your code, but it's possible that it was +; intentional (e.g., using an uninitialized variable and +; relying on the fact it is automatically initialized to an +; empty string) +; E_CORE_ERROR - fatal errors that occur during PHP's initial startup +; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's +; initial startup +; E_COMPILE_ERROR - fatal compile-time errors +; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) +; E_USER_ERROR - user-generated error message +; E_USER_WARNING - user-generated warning message +; E_USER_NOTICE - user-generated notice message +; E_DEPRECATED - warn about code that will not work in future versions +; of PHP +; E_USER_DEPRECATED - user-generated deprecation warnings +; +; Common Values: +; E_ALL (Show all errors, warnings and notices including coding standards.) +; E_ALL & ~E_NOTICE (Show all errors, except for notices) +; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) +; Default Value: E_ALL +; Development Value: E_ALL +; Production Value: E_ALL & ~E_DEPRECATED +; https://php.net/error-reporting +error_reporting = E_ALL & ~E_DEPRECATED + +; This directive controls whether or not and where PHP will output errors, +; notices and warnings too. Error output is very useful during development, but +; it could be very dangerous in production environments. Depending on the code +; which is triggering the error, sensitive information could potentially leak +; out of your application such as database usernames and passwords or worse. +; For production environments, we recommend logging errors rather than +; sending them to STDOUT. +; Possible Values: +; Off = Do not display any errors +; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) +; On or stdout = Display errors to STDOUT +; Default Value: On +; Development Value: On +; Production Value: Off +; https://php.net/display-errors +display_errors = Off + +; The display of errors which occur during PHP's startup sequence are handled +; separately from display_errors. We strongly recommend you set this to 'off' +; for production servers to avoid leaking configuration details. +; Default Value: On +; Development Value: On +; Production Value: Off +; https://php.net/display-startup-errors +display_startup_errors = Off + +; Besides displaying errors, PHP can also log errors to locations such as a +; server-specific log, STDERR, or a location specified by the error_log +; directive found below. While errors should not be displayed on productions +; servers they should still be monitored and logging is a great way to do that. +; Default Value: Off +; Development Value: On +; Production Value: On +; https://php.net/log-errors +log_errors = On + +; Do not log repeated messages. Repeated errors must occur in same file on same +; line unless ignore_repeated_source is set true. +; https://php.net/ignore-repeated-errors +ignore_repeated_errors = Off + +; Ignore source of message when ignoring repeated messages. When this setting +; is On you will not log errors with repeated messages from different files or +; source lines. +; https://php.net/ignore-repeated-source +ignore_repeated_source = Off + +; If this parameter is set to Off, then memory leaks will not be shown (on +; stdout or in the log). This is only effective in a debug compile, and if +; error reporting includes E_WARNING in the allowed list +; https://php.net/report-memleaks +report_memleaks = On + +; This setting is off by default. +;report_zend_debug = 0 + +; Turn off normal error reporting and emit XML-RPC error XML +; https://php.net/xmlrpc-errors +;xmlrpc_errors = 0 + +; An XML-RPC faultCode +;xmlrpc_error_number = 0 + +; When PHP displays or logs an error, it has the capability of formatting the +; error message as HTML for easier reading. This directive controls whether +; the error message is formatted as HTML or not. +; Note: This directive is hardcoded to Off for the CLI SAPI +; https://php.net/html-errors +;html_errors = On + +; If html_errors is set to On *and* docref_root is not empty, then PHP +; produces clickable error messages that direct to a page describing the error +; or function causing the error in detail. +; You can download a copy of the PHP manual from https://php.net/docs +; and change docref_root to the base URL of your local copy including the +; leading '/'. You must also specify the file extension being used including +; the dot. PHP's default behavior is to leave these settings empty, in which +; case no links to documentation are generated. +; Note: Never use this feature for production boxes. +; https://php.net/docref-root +; Examples +;docref_root = "/phpmanual/" + +; https://php.net/docref-ext +;docref_ext = .html + +; String to output before an error message. PHP's default behavior is to leave +; this setting blank. +; https://php.net/error-prepend-string +; Example: +;error_prepend_string = "" + +; String to output after an error message. PHP's default behavior is to leave +; this setting blank. +; https://php.net/error-append-string +; Example: +;error_append_string = "" + +; Log errors to specified file. PHP's default behavior is to leave this value +; empty. +; https://php.net/error-log +; Example: +;error_log = php_errors.log +; Log errors to syslog (Event Log on Windows). +;error_log = syslog + +; The syslog ident is a string which is prepended to every message logged +; to syslog. Only used when error_log is set to syslog. +;syslog.ident = php + +; The syslog facility is used to specify what type of program is logging +; the message. Only used when error_log is set to syslog. +;syslog.facility = user + +; Set this to disable filtering control characters (the default). +; Some loggers only accept NVT-ASCII, others accept anything that's not +; control characters. If your logger accepts everything, then no filtering +; is needed at all. +; Allowed values are: +; ascii (all printable ASCII characters and NL) +; no-ctrl (all characters except control characters) +; all (all characters) +; raw (like "all", but messages are not split at newlines) +; https://php.net/syslog.filter +;syslog.filter = ascii + +;windows.show_crt_warning +; Default value: 0 +; Development value: 0 +; Production value: 0 + +;;;;;;;;;;;;;;;;; +; Data Handling ; +;;;;;;;;;;;;;;;;; + +; The separator used in PHP generated URLs to separate arguments. +; PHP's default setting is "&". +; https://php.net/arg-separator.output +; Example: +;arg_separator.output = "&" + +; List of separator(s) used by PHP to parse input URLs into variables. +; PHP's default setting is "&". +; NOTE: Every character in this directive is considered as separator! +; https://php.net/arg-separator.input +; Example: +;arg_separator.input = ";&" + +; This directive determines which super global arrays are registered when PHP +; starts up. G,P,C,E & S are abbreviations for the following respective super +; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty +; paid for the registration of these arrays and because ENV is not as commonly +; used as the others, ENV is not recommended on productions servers. You +; can still get access to the environment variables through getenv() should you +; need to. +; Default Value: "EGPCS" +; Development Value: "GPCS" +; Production Value: "GPCS"; +; https://php.net/variables-order +variables_order = "GPCS" + +; This directive determines which super global data (G,P & C) should be +; registered into the super global array REQUEST. If so, it also determines +; the order in which that data is registered. The values for this directive +; are specified in the same manner as the variables_order directive, +; EXCEPT one. Leaving this value empty will cause PHP to use the value set +; in the variables_order directive. It does not mean it will leave the super +; globals array REQUEST empty. +; Default Value: None +; Development Value: "GP" +; Production Value: "GP" +; https://php.net/request-order +request_order = "GP" + +; This directive determines whether PHP registers $argv & $argc each time it +; runs. $argv contains an array of all the arguments passed to PHP when a script +; is invoked. $argc contains an integer representing the number of arguments +; that were passed when the script was invoked. These arrays are extremely +; useful when running scripts from the command line. When this directive is +; enabled, registering these variables consumes CPU cycles and memory each time +; a script is executed. For performance reasons, this feature should be disabled +; on production servers. +; Note: This directive is hardcoded to On for the CLI SAPI +; Default Value: On +; Development Value: Off +; Production Value: Off +; https://php.net/register-argc-argv +register_argc_argv = Off + +; When enabled, the ENV, REQUEST and SERVER variables are created when they're +; first used (Just In Time) instead of when the script starts. If these +; variables are not used within a script, having this directive on will result +; in a performance gain. The PHP directive register_argc_argv must be disabled +; for this directive to have any effect. +; https://php.net/auto-globals-jit +auto_globals_jit = On + +; Whether PHP will read the POST data. +; This option is enabled by default. +; Most likely, you won't want to disable this option globally. It causes $_POST +; and $_FILES to always be empty; the only way you will be able to read the +; POST data will be through the php://input stream wrapper. This can be useful +; to proxy requests or to process the POST data in a memory efficient fashion. +; https://php.net/enable-post-data-reading +;enable_post_data_reading = Off + +; Maximum size of POST data that PHP will accept. +; Its value may be 0 to disable the limit. It is ignored if POST data reading +; is disabled through enable_post_data_reading. +; https://php.net/post-max-size +post_max_size = 8M + +; Automatically add files before PHP document. +; https://php.net/auto-prepend-file +auto_prepend_file = + +; Automatically add files after PHP document. +; https://php.net/auto-append-file +auto_append_file = + +; By default, PHP will output a media type using the Content-Type header. To +; disable this, simply set it to be empty. +; +; PHP's built-in default media type is set to text/html. +; https://php.net/default-mimetype +default_mimetype = "text/html" + +; PHP's default character set is set to UTF-8. +; https://php.net/default-charset +default_charset = "UTF-8" + +; PHP internal character encoding is set to empty. +; If empty, default_charset is used. +; https://php.net/internal-encoding +;internal_encoding = + +; PHP input character encoding is set to empty. +; If empty, default_charset is used. +; https://php.net/input-encoding +;input_encoding = + +; PHP output character encoding is set to empty. +; If empty, default_charset is used. +; See also output_buffer. +; https://php.net/output-encoding +;output_encoding = + +;;;;;;;;;;;;;;;;;;;;;;;;; +; Paths and Directories ; +;;;;;;;;;;;;;;;;;;;;;;;;; + +; UNIX: "/path1:/path2" +;include_path = ".:/php/includes" +; +; Windows: "\path1;\path2" +;include_path = ".;c:\php\includes" +; +; PHP's default setting for include_path is ".;/path/to/php/pear" +; https://php.net/include-path + +; The root of the PHP pages, used only if nonempty. +; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root +; if you are running php as a CGI under any web server (other than IIS) +; see documentation for security issues. The alternate is to use the +; cgi.force_redirect configuration below +; https://php.net/doc-root +doc_root = + +; The directory under which PHP opens the script using /~username used only +; if nonempty. +; https://php.net/user-dir +user_dir = + +; Directory in which the loadable extensions (modules) reside. +; https://php.net/extension-dir +;extension_dir = "./" +; On windows: +;extension_dir = "ext" + +; Directory where the temporary files should be placed. +; Defaults to the system default (see sys_get_temp_dir) +;sys_temp_dir = "/tmp" + +; Whether or not to enable the dl() function. The dl() function does NOT work +; properly in multithreaded servers, such as IIS or Zeus, and is automatically +; disabled on them. +; https://php.net/enable-dl +enable_dl = Off + +; cgi.force_redirect is necessary to provide security running PHP as a CGI under +; most web servers. Left undefined, PHP turns this on by default. You can +; turn it off here AT YOUR OWN RISK +; **You CAN safely turn this off for IIS, in fact, you MUST.** +; https://php.net/cgi.force-redirect +;cgi.force_redirect = 1 + +; if cgi.nph is enabled it will force cgi to always sent Status: 200 with +; every request. PHP's default behavior is to disable this feature. +;cgi.nph = 1 + +; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape +; (iPlanet) web servers, you MAY need to set an environment variable name that PHP +; will look for to know it is OK to continue execution. Setting this variable MAY +; cause security issues, KNOW WHAT YOU ARE DOING FIRST. +; https://php.net/cgi.redirect-status-env +;cgi.redirect_status_env = + +; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's +; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok +; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting +; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting +; of zero causes PHP to behave as before. Default is 1. You should fix your scripts +; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. +; https://php.net/cgi.fix-pathinfo +;cgi.fix_pathinfo=1 + +; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside +; of the web tree and people will not be able to circumvent .htaccess security. +;cgi.discard_path=1 + +; FastCGI under IIS supports the ability to impersonate +; security tokens of the calling client. This allows IIS to define the +; security context that the request runs under. mod_fastcgi under Apache +; does not currently support this feature (03/17/2002) +; Set to 1 if running under IIS. Default is zero. +; https://php.net/fastcgi.impersonate +;fastcgi.impersonate = 1 + +; Disable logging through FastCGI connection. PHP's default behavior is to enable +; this feature. +;fastcgi.logging = 0 + +; cgi.rfc2616_headers configuration option tells PHP what type of headers to +; use when sending HTTP response code. If set to 0, PHP sends Status: header that +; is supported by Apache. When this option is set to 1, PHP will send +; RFC2616 compliant header. +; Default is zero. +; https://php.net/cgi.rfc2616-headers +;cgi.rfc2616_headers = 0 + +; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! +; (shebang) at the top of the running script. This line might be needed if the +; script support running both as stand-alone script and via PHP CGI<. PHP in CGI +; mode skips this line and ignores its content if this directive is turned on. +; https://php.net/cgi.check-shebang-line +;cgi.check_shebang_line=1 + +;;;;;;;;;;;;;;;; +; File Uploads ; +;;;;;;;;;;;;;;;; + +; Whether to allow HTTP file uploads. +; https://php.net/file-uploads +file_uploads = On + +; Temporary directory for HTTP uploaded files (will use system default if not +; specified). +; https://php.net/upload-tmp-dir +;upload_tmp_dir = + +; Maximum allowed size for uploaded files. +; https://php.net/upload-max-filesize +upload_max_filesize = 2M + +; Maximum number of files that can be uploaded via a single request +max_file_uploads = 20 + +;;;;;;;;;;;;;;;;;; +; Fopen wrappers ; +;;;;;;;;;;;;;;;;;; + +; Whether to allow the treatment of URLs (like http:// or ftp://) as files. +; https://php.net/allow-url-fopen +allow_url_fopen = On + +; Whether to allow include/require to open URLs (like https:// or ftp://) as files. +; https://php.net/allow-url-include +allow_url_include = Off + +; Define the anonymous ftp password (your email address). PHP's default setting +; for this is empty. +; https://php.net/from +;from="john@doe.com" + +; Define the User-Agent string. PHP's default setting for this is empty. +; https://php.net/user-agent +;user_agent="PHP" + +; Default timeout for socket based streams (seconds) +; https://php.net/default-socket-timeout +default_socket_timeout = 60 + +; If your scripts have to deal with files from Macintosh systems, +; or you are running on a Mac and need to deal with files from +; unix or win32 systems, setting this flag will cause PHP to +; automatically detect the EOL character in those files so that +; fgets() and file() will work regardless of the source of the file. +; https://php.net/auto-detect-line-endings +;auto_detect_line_endings = Off + +;;;;;;;;;;;;;;;;;;;;;; +; Dynamic Extensions ; +;;;;;;;;;;;;;;;;;;;;;; + +; If you wish to have an extension loaded automatically, use the following +; syntax: +; +; extension=modulename +; +; For example: +; +; extension=mysqli +; +; When the extension library to load is not located in the default extension +; directory, You may specify an absolute path to the library file: +; +; extension=/path/to/extension/mysqli.so +; +; Note : The syntax used in previous PHP versions ('extension=.so' and +; 'extension='php_.dll') is supported for legacy reasons and may be +; deprecated in a future PHP major version. So, when it is possible, please +; move to the new ('extension=) syntax. +; +; Notes for Windows environments : +; +; - Many DLL files are located in the ext/ +; extension folders as well as the separate PECL DLL download. +; Be sure to appropriately set the extension_dir directive. +; +;extension=bz2 +;extension=curl +;extension=ffi +;extension=ftp +;extension=fileinfo +;extension=gd +;extension=gettext +;extension=gmp +;extension=intl +;extension=ldap +;extension=mbstring +;extension=exif ; Must be after mbstring as it depends on it +;extension=mysqli +;extension=odbc +;extension=openssl +;extension=pdo_firebird +;extension=pdo_mysql +;extension=pdo_odbc +;extension=pdo_pgsql +;extension=pdo_sqlite +;extension=pgsql +;extension=shmop + +; The MIBS data available in the PHP distribution must be installed. +; See https://www.php.net/manual/en/snmp.installation.php +;extension=snmp + +;extension=soap +;extension=sockets +;extension=sodium +;extension=sqlite3 +;extension=tidy +;extension=xsl +;extension=zip + +;zend_extension=opcache + +;;;;;;;;;;;;;;;;;;; +; Module Settings ; +;;;;;;;;;;;;;;;;;;; + +[CLI Server] +; Whether the CLI web server uses ANSI color coding in its terminal output. +cli_server.color = On + +[Date] +; Defines the default timezone used by the date functions +; https://php.net/date.timezone +;date.timezone = + +; https://php.net/date.default-latitude +;date.default_latitude = 31.7667 + +; https://php.net/date.default-longitude +;date.default_longitude = 35.2333 + +; https://php.net/date.sunrise-zenith +;date.sunrise_zenith = 90.833333 + +; https://php.net/date.sunset-zenith +;date.sunset_zenith = 90.833333 + +[filter] +; https://php.net/filter.default +;filter.default = unsafe_raw + +; https://php.net/filter.default-flags +;filter.default_flags = + +[iconv] +; Use of this INI entry is deprecated, use global input_encoding instead. +; If empty, default_charset or input_encoding or iconv.input_encoding is used. +; The precedence is: default_charset < input_encoding < iconv.input_encoding +;iconv.input_encoding = + +; Use of this INI entry is deprecated, use global internal_encoding instead. +; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. +; The precedence is: default_charset < internal_encoding < iconv.internal_encoding +;iconv.internal_encoding = + +; Use of this INI entry is deprecated, use global output_encoding instead. +; If empty, default_charset or output_encoding or iconv.output_encoding is used. +; The precedence is: default_charset < output_encoding < iconv.output_encoding +; To use an output encoding conversion, iconv's output handler must be set +; otherwise output encoding conversion cannot be performed. +;iconv.output_encoding = + +[intl] +;intl.default_locale = +; This directive allows you to produce PHP errors when some error +; happens within intl functions. The value is the level of the error produced. +; Default is 0, which does not produce any errors. +;intl.error_level = E_WARNING +;intl.use_exceptions = 0 + +[sqlite3] +; Directory pointing to SQLite3 extensions +; https://php.net/sqlite3.extension-dir +;sqlite3.extension_dir = + +; SQLite defensive mode flag (only available from SQLite 3.26+) +; When the defensive flag is enabled, language features that allow ordinary +; SQL to deliberately corrupt the database file are disabled. This forbids +; writing directly to the schema, shadow tables (eg. FTS data tables), or +; the sqlite_dbpage virtual table. +; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html +; (for older SQLite versions, this flag has no use) +;sqlite3.defensive = 1 + +[Pcre] +; PCRE library backtracking limit. +; https://php.net/pcre.backtrack-limit +;pcre.backtrack_limit=100000 + +; PCRE library recursion limit. +; Please note that if you set this value to a high number you may consume all +; the available process stack and eventually crash PHP (due to reaching the +; stack size limit imposed by the Operating System). +; https://php.net/pcre.recursion-limit +;pcre.recursion_limit=100000 + +; Enables or disables JIT compilation of patterns. This requires the PCRE +; library to be compiled with JIT support. +;pcre.jit=1 + +[Pdo] +; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" +; https://php.net/pdo-odbc.connection-pooling +;pdo_odbc.connection_pooling=strict + +[Pdo_mysql] +; Default socket name for local MySQL connects. If empty, uses the built-in +; MySQL defaults. +pdo_mysql.default_socket= + +[Phar] +; https://php.net/phar.readonly +;phar.readonly = On + +; https://php.net/phar.require-hash +;phar.require_hash = On + +;phar.cache_list = + +[mail function] +; For Win32 only. +; https://php.net/smtp +SMTP = localhost +; https://php.net/smtp-port +smtp_port = 25 + +; For Win32 only. +; https://php.net/sendmail-from +;sendmail_from = me@example.com + +; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). +; https://php.net/sendmail-path +;sendmail_path = + +; Force the addition of the specified parameters to be passed as extra parameters +; to the sendmail binary. These parameters will always replace the value of +; the 5th parameter to mail(). +;mail.force_extra_parameters = + +; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename +mail.add_x_header = Off + +; Use mixed LF and CRLF line separators to keep compatibility with some +; RFC 2822 non conformant MTA. +mail.mixed_lf_and_crlf = Off + +; The path to a log file that will log all mail() calls. Log entries include +; the full path of the script, line number, To address and headers. +;mail.log = +; Log mail to syslog (Event Log on Windows). +;mail.log = syslog + +[ODBC] +; https://php.net/odbc.default-db +;odbc.default_db = Not yet implemented + +; https://php.net/odbc.default-user +;odbc.default_user = Not yet implemented + +; https://php.net/odbc.default-pw +;odbc.default_pw = Not yet implemented + +; Controls the ODBC cursor model. +; Default: SQL_CURSOR_STATIC (default). +;odbc.default_cursortype + +; Allow or prevent persistent links. +; https://php.net/odbc.allow-persistent +odbc.allow_persistent = On + +; Check that a connection is still valid before reuse. +; https://php.net/odbc.check-persistent +odbc.check_persistent = On + +; Maximum number of persistent links. -1 means no limit. +; https://php.net/odbc.max-persistent +odbc.max_persistent = -1 + +; Maximum number of links (persistent + non-persistent). -1 means no limit. +; https://php.net/odbc.max-links +odbc.max_links = -1 + +; Handling of LONG fields. Returns number of bytes to variables. 0 means +; passthru. +; https://php.net/odbc.defaultlrl +odbc.defaultlrl = 4096 + +; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. +; See the documentation on odbc_binmode and odbc_longreadlen for an explanation +; of odbc.defaultlrl and odbc.defaultbinmode +; https://php.net/odbc.defaultbinmode +odbc.defaultbinmode = 1 + +[MySQLi] + +; Maximum number of persistent links. -1 means no limit. +; https://php.net/mysqli.max-persistent +mysqli.max_persistent = -1 + +; Allow accessing, from PHP's perspective, local files with LOAD DATA statements +; https://php.net/mysqli.allow_local_infile +;mysqli.allow_local_infile = On + +; It allows the user to specify a folder where files that can be sent via LOAD DATA +; LOCAL can exist. It is ignored if mysqli.allow_local_infile is enabled. +;mysqli.local_infile_directory = + +; Allow or prevent persistent links. +; https://php.net/mysqli.allow-persistent +mysqli.allow_persistent = On + +; Maximum number of links. -1 means no limit. +; https://php.net/mysqli.max-links +mysqli.max_links = -1 + +; Default port number for mysqli_connect(). If unset, mysqli_connect() will use +; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the +; compile-time value defined MYSQL_PORT (in that order). Win32 will only look +; at MYSQL_PORT. +; https://php.net/mysqli.default-port +mysqli.default_port = 3306 + +; Default socket name for local MySQL connects. If empty, uses the built-in +; MySQL defaults. +; https://php.net/mysqli.default-socket +mysqli.default_socket = + +; Default host for mysqli_connect() (doesn't apply in safe mode). +; https://php.net/mysqli.default-host +mysqli.default_host = + +; Default user for mysqli_connect() (doesn't apply in safe mode). +; https://php.net/mysqli.default-user +mysqli.default_user = + +; Default password for mysqli_connect() (doesn't apply in safe mode). +; Note that this is generally a *bad* idea to store passwords in this file. +; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") +; and reveal this password! And of course, any users with read access to this +; file will be able to reveal the password as well. +; https://php.net/mysqli.default-pw +mysqli.default_pw = + +; If this option is enabled, closing a persistent connection will rollback +; any pending transactions of this connection, before it is put back +; into the persistent connection pool. +;mysqli.rollback_on_cached_plink = Off + +[mysqlnd] +; Enable / Disable collection of general statistics by mysqlnd which can be +; used to tune and monitor MySQL operations. +mysqlnd.collect_statistics = On + +; Enable / Disable collection of memory usage statistics by mysqlnd which can be +; used to tune and monitor MySQL operations. +mysqlnd.collect_memory_statistics = Off + +; Records communication from all extensions using mysqlnd to the specified log +; file. +; https://php.net/mysqlnd.debug +;mysqlnd.debug = + +; Defines which queries will be logged. +;mysqlnd.log_mask = 0 + +; Default size of the mysqlnd memory pool, which is used by result sets. +;mysqlnd.mempool_default_size = 16000 + +; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. +;mysqlnd.net_cmd_buffer_size = 2048 + +; Size of a pre-allocated buffer used for reading data sent by the server in +; bytes. +;mysqlnd.net_read_buffer_size = 32768 + +; Timeout for network requests in seconds. +;mysqlnd.net_read_timeout = 31536000 + +; SHA-256 Authentication Plugin related. File with the MySQL server public RSA +; key. +;mysqlnd.sha256_server_public_key = + +[PostgreSQL] +; Allow or prevent persistent links. +; https://php.net/pgsql.allow-persistent +pgsql.allow_persistent = On + +; Detect broken persistent links always with pg_pconnect(). +; Auto reset feature requires a little overheads. +; https://php.net/pgsql.auto-reset-persistent +pgsql.auto_reset_persistent = Off + +; Maximum number of persistent links. -1 means no limit. +; https://php.net/pgsql.max-persistent +pgsql.max_persistent = -1 + +; Maximum number of links (persistent+non persistent). -1 means no limit. +; https://php.net/pgsql.max-links +pgsql.max_links = -1 + +; Ignore PostgreSQL backends Notice message or not. +; Notice message logging require a little overheads. +; https://php.net/pgsql.ignore-notice +pgsql.ignore_notice = 0 + +; Log PostgreSQL backends Notice message or not. +; Unless pgsql.ignore_notice=0, module cannot log notice message. +; https://php.net/pgsql.log-notice +pgsql.log_notice = 0 + +[bcmath] +; Number of decimal digits for all bcmath functions. +; https://php.net/bcmath.scale +bcmath.scale = 0 + +[browscap] +; https://php.net/browscap +;browscap = extra/browscap.ini + +[Session] +; Handler used to store/retrieve data. +; https://php.net/session.save-handler +session.save_handler = files + +; Argument passed to save_handler. In the case of files, this is the path +; where data files are stored. Note: Windows users have to change this +; variable in order to use PHP's session functions. +; +; The path can be defined as: +; +; session.save_path = "N;/path" +; +; where N is an integer. Instead of storing all the session files in +; /path, what this will do is use subdirectories N-levels deep, and +; store the session data in those directories. This is useful if +; your OS has problems with many files in one directory, and is +; a more efficient layout for servers that handle many sessions. +; +; NOTE 1: PHP will not create this directory structure automatically. +; You can use the script in the ext/session dir for that purpose. +; NOTE 2: See the section on garbage collection below if you choose to +; use subdirectories for session storage +; +; The file storage module creates files using mode 600 by default. +; You can change that by using +; +; session.save_path = "N;MODE;/path" +; +; where MODE is the octal representation of the mode. Note that this +; does not overwrite the process's umask. +; https://php.net/session.save-path +;session.save_path = "/tmp" + +; Whether to use strict session mode. +; Strict session mode does not accept an uninitialized session ID, and +; regenerates the session ID if the browser sends an uninitialized session ID. +; Strict mode protects applications from session fixation via a session adoption +; vulnerability. It is disabled by default for maximum compatibility, but +; enabling it is encouraged. +; https://wiki.php.net/rfc/strict_sessions +session.use_strict_mode = 0 + +; Whether to use cookies. +; https://php.net/session.use-cookies +session.use_cookies = 1 + +; https://php.net/session.cookie-secure +;session.cookie_secure = + +; This option forces PHP to fetch and use a cookie for storing and maintaining +; the session id. We encourage this operation as it's very helpful in combating +; session hijacking when not specifying and managing your own session id. It is +; not the be-all and end-all of session hijacking defense, but it's a good start. +; https://php.net/session.use-only-cookies +session.use_only_cookies = 1 + +; Name of the session (used as cookie name). +; https://php.net/session.name +session.name = PHPSESSID + +; Initialize session on request startup. +; https://php.net/session.auto-start +session.auto_start = 0 + +; Lifetime in seconds of cookie or, if 0, until browser is restarted. +; https://php.net/session.cookie-lifetime +session.cookie_lifetime = 0 + +; The path for which the cookie is valid. +; https://php.net/session.cookie-path +session.cookie_path = / + +; The domain for which the cookie is valid. +; https://php.net/session.cookie-domain +session.cookie_domain = + +; Whether or not to add the httpOnly flag to the cookie, which makes it +; inaccessible to browser scripting languages such as JavaScript. +; https://php.net/session.cookie-httponly +session.cookie_httponly = + +; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF) +; Current valid values are "Strict", "Lax" or "None". When using "None", +; make sure to include the quotes, as `none` is interpreted like `false` in ini files. +; https://tools.ietf.org/html/draft-west-first-party-cookies-07 +session.cookie_samesite = + +; Handler used to serialize data. php is the standard serializer of PHP. +; https://php.net/session.serialize-handler +session.serialize_handler = php + +; Defines the probability that the 'garbage collection' process is started on every +; session initialization. The probability is calculated by using gc_probability/gc_divisor, +; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. +; Default Value: 1 +; Development Value: 1 +; Production Value: 1 +; https://php.net/session.gc-probability +session.gc_probability = 1 + +; Defines the probability that the 'garbage collection' process is started on every +; session initialization. The probability is calculated by using gc_probability/gc_divisor, +; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. +; For high volume production servers, using a value of 1000 is a more efficient approach. +; Default Value: 100 +; Development Value: 1000 +; Production Value: 1000 +; https://php.net/session.gc-divisor +session.gc_divisor = 1000 + +; After this number of seconds, stored data will be seen as 'garbage' and +; cleaned up by the garbage collection process. +; https://php.net/session.gc-maxlifetime +session.gc_maxlifetime = 1440 + +; NOTE: If you are using the subdirectory option for storing session files +; (see session.save_path above), then garbage collection does *not* +; happen automatically. You will need to do your own garbage +; collection through a shell script, cron entry, or some other method. +; For example, the following script is the equivalent of setting +; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): +; find /path/to/sessions -cmin +24 -type f | xargs rm + +; Check HTTP Referer to invalidate externally stored URLs containing ids. +; HTTP_REFERER has to contain this substring for the session to be +; considered as valid. +; https://php.net/session.referer-check +session.referer_check = + +; Set to {nocache,private,public,} to determine HTTP caching aspects +; or leave this empty to avoid sending anti-caching headers. +; https://php.net/session.cache-limiter +session.cache_limiter = nocache + +; Document expires after n minutes. +; https://php.net/session.cache-expire +session.cache_expire = 180 + +; trans sid support is disabled by default. +; Use of trans sid may risk your users' security. +; Use this option with caution. +; - User may send URL contains active session ID +; to other person via. email/irc/etc. +; - URL that contains active session ID may be stored +; in publicly accessible computer. +; - User may access your site with the same session ID +; always using URL stored in browser's history or bookmarks. +; https://php.net/session.use-trans-sid +session.use_trans_sid = 0 + +; The URL rewriter will look for URLs in a defined set of HTML tags. +; is special; if you include them here, the rewriter will +; add a hidden field with the info which is otherwise appended +; to URLs. tag's action attribute URL will not be modified +; unless it is specified. +; Note that all valid entries require a "=", even if no value follows. +; Default Value: "a=href,area=href,frame=src,form=" +; Development Value: "a=href,area=href,frame=src,form=" +; Production Value: "a=href,area=href,frame=src,form=" +; https://php.net/url-rewriter.tags +session.trans_sid_tags = "a=href,area=href,frame=src,form=" + +; URL rewriter does not rewrite absolute URLs by default. +; To enable rewrites for absolute paths, target hosts must be specified +; at RUNTIME. i.e. use ini_set() +; tags is special. PHP will check action attribute's URL regardless +; of session.trans_sid_tags setting. +; If no host is defined, HTTP_HOST will be used for allowed host. +; Example value: php.net,www.php.net,wiki.php.net +; Use "," for multiple hosts. No spaces are allowed. +; Default Value: "" +; Development Value: "" +; Production Value: "" +;session.trans_sid_hosts="" + +; Enable upload progress tracking in $_SESSION +; Default Value: On +; Development Value: On +; Production Value: On +; https://php.net/session.upload-progress.enabled +;session.upload_progress.enabled = On + +; Cleanup the progress information as soon as all POST data has been read +; (i.e. upload completed). +; Default Value: On +; Development Value: On +; Production Value: On +; https://php.net/session.upload-progress.cleanup +;session.upload_progress.cleanup = On + +; A prefix used for the upload progress key in $_SESSION +; Default Value: "upload_progress_" +; Development Value: "upload_progress_" +; Production Value: "upload_progress_" +; https://php.net/session.upload-progress.prefix +;session.upload_progress.prefix = "upload_progress_" + +; The index name (concatenated with the prefix) in $_SESSION +; containing the upload progress information +; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" +; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" +; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" +; https://php.net/session.upload-progress.name +;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" + +; How frequently the upload progress should be updated. +; Given either in percentages (per-file), or in bytes +; Default Value: "1%" +; Development Value: "1%" +; Production Value: "1%" +; https://php.net/session.upload-progress.freq +;session.upload_progress.freq = "1%" + +; The minimum delay between updates, in seconds +; Default Value: 1 +; Development Value: 1 +; Production Value: 1 +; https://php.net/session.upload-progress.min-freq +;session.upload_progress.min_freq = "1" + +; Only write session data when session data is changed. Enabled by default. +; https://php.net/session.lazy-write +;session.lazy_write = On + +[Assertion] +; Switch whether to compile assertions at all (to have no overhead at run-time) +; -1: Do not compile at all +; 0: Jump over assertion at run-time +; 1: Execute assertions +; Changing from or to a negative value is only possible in php.ini! +; (For turning assertions on and off at run-time, toggle zend.assertions between the values 1 and 0) +; Default Value: 1 +; Development Value: 1 +; Production Value: -1 +; https://php.net/zend.assertions +zend.assertions = -1 + +[COM] +; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs +; https://php.net/com.typelib-file +;com.typelib_file = + +; allow Distributed-COM calls +; https://php.net/com.allow-dcom +;com.allow_dcom = true + +; autoregister constants of a component's typelib on com_load() +; https://php.net/com.autoregister-typelib +;com.autoregister_typelib = true + +; register constants casesensitive +; https://php.net/com.autoregister-casesensitive +;com.autoregister_casesensitive = false + +; show warnings on duplicate constant registrations +; https://php.net/com.autoregister-verbose +;com.autoregister_verbose = true + +; The default character set code-page to use when passing strings to and from COM objects. +; Default: system ANSI code page +;com.code_page= + +; The version of the .NET framework to use. The value of the setting are the first three parts +; of the framework's version number, separated by dots, and prefixed with "v", e.g. "v4.0.30319". +;com.dotnet_version= + +[mbstring] +; language for internal character representation. +; This affects mb_send_mail() and mbstring.detect_order. +; https://php.net/mbstring.language +;mbstring.language = Japanese + +; Use of this INI entry is deprecated, use global internal_encoding instead. +; internal/script encoding. +; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) +; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. +; The precedence is: default_charset < internal_encoding < iconv.internal_encoding +;mbstring.internal_encoding = + +; Use of this INI entry is deprecated, use global input_encoding instead. +; http input encoding. +; mbstring.encoding_translation = On is needed to use this setting. +; If empty, default_charset or input_encoding or mbstring.input is used. +; The precedence is: default_charset < input_encoding < mbstring.http_input +; https://php.net/mbstring.http-input +;mbstring.http_input = + +; Use of this INI entry is deprecated, use global output_encoding instead. +; http output encoding. +; mb_output_handler must be registered as output buffer to function. +; If empty, default_charset or output_encoding or mbstring.http_output is used. +; The precedence is: default_charset < output_encoding < mbstring.http_output +; To use an output encoding conversion, mbstring's output handler must be set +; otherwise output encoding conversion cannot be performed. +; https://php.net/mbstring.http-output +;mbstring.http_output = + +; enable automatic encoding translation according to +; mbstring.internal_encoding setting. Input chars are +; converted to internal encoding by setting this to On. +; Note: Do _not_ use automatic encoding translation for +; portable libs/applications. +; https://php.net/mbstring.encoding-translation +;mbstring.encoding_translation = Off + +; automatic encoding detection order. +; "auto" detect order is changed according to mbstring.language +; https://php.net/mbstring.detect-order +;mbstring.detect_order = auto + +; substitute_character used when character cannot be converted +; one from another +; https://php.net/mbstring.substitute-character +;mbstring.substitute_character = none + +; Enable strict encoding detection. +;mbstring.strict_detection = Off + +; This directive specifies the regex pattern of content types for which mb_output_handler() +; is activated. +; Default: mbstring.http_output_conv_mimetypes=^(text/|application/xhtml\+xml) +;mbstring.http_output_conv_mimetypes= + +; This directive specifies maximum stack depth for mbstring regular expressions. It is similar +; to the pcre.recursion_limit for PCRE. +;mbstring.regex_stack_limit=100000 + +; This directive specifies maximum retry count for mbstring regular expressions. It is similar +; to the pcre.backtrack_limit for PCRE. +;mbstring.regex_retry_limit=1000000 + +[gd] +; Tell the jpeg decode to ignore warnings and try to create +; a gd image. The warning will then be displayed as notices +; disabled by default +; https://php.net/gd.jpeg-ignore-warning +;gd.jpeg_ignore_warning = 1 + +[exif] +; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. +; With mbstring support this will automatically be converted into the encoding +; given by corresponding encode setting. When empty mbstring.internal_encoding +; is used. For the decode settings you can distinguish between motorola and +; intel byte order. A decode setting must not be empty. +; https://php.net/exif.encode-unicode +;exif.encode_unicode = ISO-8859-15 + +; https://php.net/exif.decode-unicode-motorola +;exif.decode_unicode_motorola = UCS-2BE + +; https://php.net/exif.decode-unicode-intel +;exif.decode_unicode_intel = UCS-2LE + +; https://php.net/exif.encode-jis +;exif.encode_jis = + +; https://php.net/exif.decode-jis-motorola +;exif.decode_jis_motorola = JIS + +; https://php.net/exif.decode-jis-intel +;exif.decode_jis_intel = JIS + +[Tidy] +; The path to a default tidy configuration file to use when using tidy +; https://php.net/tidy.default-config +;tidy.default_config = /usr/local/lib/php/default.tcfg + +; Should tidy clean and repair output automatically? +; WARNING: Do not use this option if you are generating non-html content +; such as dynamic images +; https://php.net/tidy.clean-output +tidy.clean_output = Off + +[soap] +; Enables or disables WSDL caching feature. +; https://php.net/soap.wsdl-cache-enabled +soap.wsdl_cache_enabled=1 + +; Sets the directory name where SOAP extension will put cache files. +; https://php.net/soap.wsdl-cache-dir +soap.wsdl_cache_dir="/tmp" + +; (time to live) Sets the number of second while cached file will be used +; instead of original one. +; https://php.net/soap.wsdl-cache-ttl +soap.wsdl_cache_ttl=86400 + +; Sets the size of the cache limit. (Max. number of WSDL files to cache) +soap.wsdl_cache_limit = 5 + +[sysvshm] +; A default size of the shared memory segment +;sysvshm.init_mem = 10000 + +[ldap] +; Sets the maximum number of open links or -1 for unlimited. +ldap.max_links = -1 + +[dba] +;dba.default_handler= + +[opcache] +; Determines if Zend OPCache is enabled +;opcache.enable=1 + +; Determines if Zend OPCache is enabled for the CLI version of PHP +;opcache.enable_cli=0 + +; The OPcache shared memory storage size. +;opcache.memory_consumption=128 + +; The amount of memory for interned strings in Mbytes. +;opcache.interned_strings_buffer=8 + +; The maximum number of keys (scripts) in the OPcache hash table. +; Only numbers between 200 and 1000000 are allowed. +;opcache.max_accelerated_files=10000 + +; The maximum percentage of "wasted" memory until a restart is scheduled. +;opcache.max_wasted_percentage=5 + +; When this directive is enabled, the OPcache appends the current working +; directory to the script key, thus eliminating possible collisions between +; files with the same name (basename). Disabling the directive improves +; performance, but may break existing applications. +;opcache.use_cwd=1 + +; When disabled, you must reset the OPcache manually or restart the +; webserver for changes to the filesystem to take effect. +;opcache.validate_timestamps=1 + +; How often (in seconds) to check file timestamps for changes to the shared +; memory storage allocation. ("1" means validate once per second, but only +; once per request. "0" means always validate) +;opcache.revalidate_freq=2 + +; Enables or disables file search in include_path optimization +;opcache.revalidate_path=0 + +; If disabled, all PHPDoc comments are dropped from the code to reduce the +; size of the optimized code. +;opcache.save_comments=1 + +; If enabled, compilation warnings (including notices and deprecations) will +; be recorded and replayed each time a file is included. Otherwise, compilation +; warnings will only be emitted when the file is first cached. +;opcache.record_warnings=0 + +; Allow file existence override (file_exists, etc.) performance feature. +;opcache.enable_file_override=0 + +; A bitmask, where each bit enables or disables the appropriate OPcache +; passes +;opcache.optimization_level=0x7FFFBFFF + +;opcache.dups_fix=0 + +; The location of the OPcache blacklist file (wildcards allowed). +; Each OPcache blacklist file is a text file that holds the names of files +; that should not be accelerated. The file format is to add each filename +; to a new line. The filename may be a full path or just a file prefix +; (i.e., /var/www/x blacklists all the files and directories in /var/www +; that start with 'x'). Line starting with a ; are ignored (comments). +;opcache.blacklist_filename= + +; Allows exclusion of large files from being cached. By default all files +; are cached. +;opcache.max_file_size=0 + +; How long to wait (in seconds) for a scheduled restart to begin if the cache +; is not being accessed. +;opcache.force_restart_timeout=180 + +; OPcache error_log file name. Empty string assumes "stderr". +;opcache.error_log= + +; All OPcache errors go to the Web server log. +; By default, only fatal errors (level 0) or errors (level 1) are logged. +; You can also enable warnings (level 2), info messages (level 3) or +; debug messages (level 4). +;opcache.log_verbosity_level=1 + +; Preferred Shared Memory back-end. Leave empty and let the system decide. +;opcache.preferred_memory_model= + +; Protect the shared memory from unexpected writing during script execution. +; Useful for internal debugging only. +;opcache.protect_memory=0 + +; Allows calling OPcache API functions only from PHP scripts which path is +; started from specified string. The default "" means no restriction +;opcache.restrict_api= + +; Mapping base of shared memory segments (for Windows only). All the PHP +; processes have to map shared memory into the same address space. This +; directive allows to manually fix the "Unable to reattach to base address" +; errors. +;opcache.mmap_base= + +; Facilitates multiple OPcache instances per user (for Windows only). All PHP +; processes with the same cache ID and user share an OPcache instance. +;opcache.cache_id= + +; Enables and sets the second level cache directory. +; It should improve performance when SHM memory is full, at server restart or +; SHM reset. The default "" disables file based caching. +;opcache.file_cache= + +; Enables or disables opcode caching in shared memory. +;opcache.file_cache_only=0 + +; Enables or disables checksum validation when script loaded from file cache. +;opcache.file_cache_consistency_checks=1 + +; Implies opcache.file_cache_only=1 for a certain process that failed to +; reattach to the shared memory (for Windows only). Explicitly enabled file +; cache is required. +;opcache.file_cache_fallback=1 + +; Enables or disables copying of PHP code (text segment) into HUGE PAGES. +; Under certain circumstances (if only a single global PHP process is +; started from which all others fork), this can increase performance +; by a tiny amount because TLB misses are reduced. On the other hand, this +; delays PHP startup, increases memory usage and degrades performance +; under memory pressure - use with care. +; Requires appropriate OS configuration. +;opcache.huge_code_pages=0 + +; Validate cached file permissions. +;opcache.validate_permission=0 + +; Prevent name collisions in chroot'ed environment. +;opcache.validate_root=0 + +; If specified, it produces opcode dumps for debugging different stages of +; optimizations. +;opcache.opt_debug_level=0 + +; Specifies a PHP script that is going to be compiled and executed at server +; start-up. +; https://php.net/opcache.preload +;opcache.preload= + +; Preloading code as root is not allowed for security reasons. This directive +; facilitates to let the preloading to be run as another user. +; https://php.net/opcache.preload_user +;opcache.preload_user= + +; Prevents caching files that are less than this number of seconds old. It +; protects from caching of incompletely updated files. In case all file updates +; on your site are atomic, you may increase performance by setting it to "0". +;opcache.file_update_protection=2 + +; Absolute path used to store shared lockfiles (for *nix only). +;opcache.lockfile_path=/tmp + +[curl] +; A default value for the CURLOPT_CAINFO option. This is required to be an +; absolute path. +;curl.cainfo = + +[openssl] +; The location of a Certificate Authority (CA) file on the local filesystem +; to use when verifying the identity of SSL/TLS peers. Most users should +; not specify a value for this directive as PHP will attempt to use the +; OS-managed cert stores in its absence. If specified, this value may still +; be overridden on a per-stream basis via the "cafile" SSL stream context +; option. +;openssl.cafile= + +; If openssl.cafile is not specified or if the CA file is not found, the +; directory pointed to by openssl.capath is searched for a suitable +; certificate. This value must be a correctly hashed certificate directory. +; Most users should not specify a value for this directive as PHP will +; attempt to use the OS-managed cert stores in its absence. If specified, +; this value may still be overridden on a per-stream basis via the "capath" +; SSL stream context option. +;openssl.capath= + +[ffi] +; FFI API restriction. Possible values: +; "preload" - enabled in CLI scripts and preloaded files (default) +; "false" - always disabled +; "true" - always enabled +;ffi.enable=preload + +; List of headers files to preload, wildcard patterns allowed. +;ffi.preload= diff --git a/confs/redis/redis.conf b/confs/redis/redis.conf new file mode 100644 index 0000000..ff9804b --- /dev/null +++ b/confs/redis/redis.conf @@ -0,0 +1,57 @@ +#pidfile /var/run/redis_6379.pid +#logfile /log/redis.log +dir /data +dbfilename dump.rdb +bind 0.0.0.0 +protected-mode no +port 6379 +tcp-backlog 511 +#unixsocket /tmp/redis.sock +#unixsocketperm 770 +timeout 0 +tcp-keepalive 300 +daemonize no +supervised no +loglevel notice +databases 16 +save 86400 1 +save 7200 10 +save 3600 10000 +stop-writes-on-bgsave-error no +rdbcompression yes +rdbchecksum yes +dbfilename dump.rdb +slave-serve-stale-data yes +slave-read-only yes +repl-diskless-sync no +repl-diskless-sync-delay 5 +repl-disable-tcp-nodelay no +slave-priority 100 +appendonly no +appendfilename "appendonly.aof" +appendfsync everysec +no-appendfsync-on-rewrite no +auto-aof-rewrite-percentage 100 +auto-aof-rewrite-min-size 64mb +aof-load-truncated yes +lua-time-limit 5000 +slowlog-log-slower-than 10000 +slowlog-max-len 128 +latency-monitor-threshold 0 +notify-keyspace-events "" +hash-max-ziplist-entries 512 +hash-max-ziplist-value 64 +list-max-ziplist-size -2 +list-compress-depth 0 +set-max-intset-entries 512 +zset-max-ziplist-entries 128 +zset-max-ziplist-value 64 +hll-sparse-max-bytes 3000 +activerehashing yes +client-output-buffer-limit normal 0 0 0 +client-output-buffer-limit slave 256mb 64mb 60 +client-output-buffer-limit pubsub 32mb 8mb 60 +hz 10 +aof-rewrite-incremental-fsync yes +maxmemory 942mb +maxmemory-policy allkeys-lru diff --git a/confs/sphinx/sphinx.conf b/confs/sphinx/sphinx.conf new file mode 100644 index 0000000..81964a5 --- /dev/null +++ b/confs/sphinx/sphinx.conf @@ -0,0 +1,83 @@ +# +index bitrix +{ + # Main settings + type = rt + path = /opt/sphinx/lib/bitrix + docinfo = inline + # Choose appropriate type of morphology to use + #morphology = lemmatize_ru_all, lemmatize_en_all, lemmatize_de_all, stem_enru + morphology = stem_enru, soundex + # These settings are used by bitrix:search.title component + dict = keywords + prefix_fields = title + infix_fields = + min_prefix_len = 2 + enable_star = 1 + # All fields must be defined exactly as followed + rt_field = title + rt_field = body + rt_attr_uint = module_id + rt_attr_string = module + rt_attr_uint = item_id + rt_attr_string = item + rt_attr_uint = param1_id + rt_attr_string = param1 + rt_attr_uint = param2_id + rt_attr_string = param2 + rt_attr_timestamp = date_change + rt_attr_timestamp = date_to + rt_attr_timestamp = date_from + rt_attr_uint = custom_rank + rt_attr_multi = tags + rt_attr_multi = right + rt_attr_multi = site + rt_attr_multi = param + # Depends on settings of your site: + # for single byte (Windows-1251) use sdcs + # for multi byte (UTF-8) use utf-8 + charset_type = utf-8 +} +# +index testrt +{ + type = rt + rt_mem_limit = 128M + path = /opt/sphinx/lib/testrt + rt_field = title + rt_field = content + rt_attr_uint = gid +} +# +searchd +{ + listen = 9312 + listen = 9306:mysql41 + log = /opt/sphinx/log/searchd.log + query_log = /opt/sphinx/log/query.log + pid_file = /opt/sphinx/run/searchd.pid + binlog_path = /opt/sphinx/binlogs + read_timeout = 5 + max_children = 30 + max_matches = 1000 + seamless_rotate = 1 + preopen_indexes = 1 + unlink_old = 1 + workers = threads # for RT to work + binlog_max_log_size = 512M + # 2 - flush every transaction, sync every second. Good performance, and every committed transaction is guaranteed to be saved in case of daemon crash. + # 1 - flush and sync every transaction. Worst performance, but every committed transaction data is guaranteed to be saved + binlog_flush = 2 + rt_flush_period = 3600 +} +# +indexer +{ + lemmatizer_cache = 128M +} +# +common +{ + lemmatizer_base = /opt/sphinx/dict +} +# diff --git a/data/mysql/.gitkeep b/data/mysql/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/data/www/.gitkeep b/data/www/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..80956c2 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,278 @@ +volumes: + redis_data: + driver: local + mysql_log_data: + driver: local + mysql_lib_data: + driver: local + bxtemp_data: + driver: local + msmtp_data: + driver: local + browscap_data: + driver: local + geoip2_data: + driver: local + ssl_data: + driver: local +services: + memcached: + image: memcached:1.6.40-alpine + container_name: b24pal_memcached + restart: unless-stopped + env_file: + - .env + init: true + cgroup: private + security_opt: + - no-new-privileges + cap_drop: + - ALL + tmpfs: + - /tmp:noexec,nodev,nosuid + - /var/tmp:noexec,nodev,nosuid + - /dev/shm:noexec,nodev,nosuid + networks: + dev: + aliases: + - memcached + redis: + image: redis:8.6.0-alpine + container_name: b24pal_redis + restart: unless-stopped + command: redis-server /usr/local/etc/redis/redis.conf + env_file: + - .env + volumes: + - redis_data:/data + - ./confs/redis/redis.conf:/usr/local/etc/redis/redis.conf + init: true + cgroup: private + security_opt: + - no-new-privileges + cap_drop: + - ALL + cap_add: + - CHOWN + - SETUID + - SETGID + tmpfs: + - /tmp:noexec,nodev,nosuid + - /var/tmp:noexec,nodev,nosuid + - /dev/shm:noexec,nodev,nosuid + networks: + dev: + aliases: + - redis + mysql: + image: quay.io/bitrix24/percona-server:8.4.7-v1-rhel + container_name: b24pal_mysql + ports: + - "33061:3306" + restart: unless-stopped + env_file: + - .env + - .env_sql + volumes: + - mysql_log_data:/var/log/mysql + - ./data/mysql:/var/lib/mysql + init: true + cgroup: private + security_opt: + - no-new-privileges + cap_drop: + - ALL + cap_add: + - SYS_NICE + tmpfs: + - /tmp:noexec,nodev,nosuid + - /var/tmp:noexec,nodev,nosuid + - /dev/shm:noexec,nodev,nosuid + networks: + dev: + aliases: + - mysql + php: + image: quay.io/bitrix24/php:8.4.18-fpm-v1-alpine + container_name: b24pal_php + restart: unless-stopped + env_file: + - .env + - .env_php + extra_hosts: + - "host.docker.internal:host-gateway" + volumes: + - ./confs/php84/etc/:/usr/local/etc/ + - ./data/www/:/opt/www/:cached + - bxtemp_data:/opt/.bx_temp/ + - msmtp_data:/opt/msmtp/ + - browscap_data:/opt/browscap/ + - geoip2_data:/opt/geoip2/ + - ssl_data:/ssl/ + init: true + cgroup: private + security_opt: + - no-new-privileges + cap_drop: + - ALL + tmpfs: + - /tmp:noexec,nodev,nosuid + - /var/tmp:noexec,nodev,nosuid + - /dev/shm:noexec,nodev,nosuid + networks: + dev: + aliases: + - php + depends_on: + - mysql + environment: + PHP_IDE_CONFIG: "serverName=bitrix-docker" + nginx: + image: quay.io/bitrix24/nginx:1.28.2-v1-alpine + container_name: b24pal_nginx + restart: unless-stopped + env_file: + - .env + ports: + - "8560:80" + - "8561:443" + volumes: + - ./confs/nginx/:/etc/nginx/ + - ./data/www/:/opt/www/:cached + - bxtemp_data:/opt/.bx_temp/ + - ssl_data:/ssl/ + init: true + cgroup: private + security_opt: + - no-new-privileges + cap_drop: + - ALL + cap_add: + - CHOWN + - SETUID + - SETGID + - NET_BIND_SERVICE + tmpfs: + - /tmp:noexec,nodev,nosuid + - /var/tmp:noexec,nodev,nosuid + - /dev/shm:noexec,nodev,nosuid + networks: + dev: + aliases: + - nginx + push-sub: + image: quay.io/bitrix24/push:3.2-v1-alpine + container_name: b24pal_push_sub + restart: unless-stopped + env_file: + - .env + - .env_push + - .env_push_sub + - .env_redis + init: true + cgroup: private + security_opt: + - no-new-privileges + cap_drop: + - ALL + tmpfs: + - /tmp:noexec,nodev,nosuid + - /var/tmp:noexec,nodev,nosuid + - /dev/shm:noexec,nodev,nosuid + networks: + dev: + aliases: + - push_sub + depends_on: + - redis + push-pub: + image: quay.io/bitrix24/push:3.2-v1-alpine + container_name: b24pal_push_pub + restart: unless-stopped + env_file: + - .env + - .env_push + - .env_push_pub + - .env_redis + init: true + cgroup: private + security_opt: + - no-new-privileges + cap_drop: + - ALL + tmpfs: + - /tmp:noexec,nodev,nosuid + - /var/tmp:noexec,nodev,nosuid + - /dev/shm:noexec,nodev,nosuid + networks: + dev: + aliases: + - push_pub + depends_on: + - redis + sphinx: + image: quay.io/bitrix24/sphinx:2.2.11-v2-alpine + container_name: b24pal_sphinx + restart: unless-stopped + env_file: + - .env + volumes: + - ./confs/sphinx/sphinx.conf:/opt/sphinx/conf/sphinx.conf + init: true + cgroup: private + security_opt: + - no-new-privileges + cap_drop: + - ALL + tmpfs: + - /tmp:noexec,nodev,nosuid + - /var/tmp:noexec,nodev,nosuid + - /dev/shm:noexec,nodev,nosuid + networks: + dev: + aliases: + - sphinx + cron: + image: quay.io/bitrix24/php:8.4.18-fpm-v1-alpine + container_name: b24pal_cron + restart: unless-stopped + command: crond -f -d 8 + user: root + env_file: + - .env + - .env_php + volumes: + - ./confs/php84/etc/:/usr/local/etc/ + - ./data/www/:/opt/www/:cached + - bxtemp_data:/opt/.bx_temp/ + - msmtp_data:/opt/msmtp/ + - browscap_data:/opt/browscap/ + - geoip2_data:/opt/geoip2/ + init: true + cgroup: private + security_opt: + - no-new-privileges + cap_drop: + - ALL + cap_add: + - SETUID + - SETGID + tmpfs: + - /tmp:noexec,nodev,nosuid + - /var/tmp:noexec,nodev,nosuid + - /dev/shm:noexec,nodev,nosuid + networks: + dev: + aliases: + - cron + depends_on: + - php +networks: + dev: + driver: bridge + attachable: true + internal: false + ipam: + driver: default + config: + - subnet: 10.10.30.0/24 diff --git a/sources/bxlego4231/Dockerfile b/sources/bxlego4231/Dockerfile new file mode 100644 index 0000000..7a135f4 --- /dev/null +++ b/sources/bxlego4231/Dockerfile @@ -0,0 +1,16 @@ +FROM goacme/lego:v4.23.1 + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN apk add --no-cache curl openssl bash mc ca-certificates tzdata && \ + mkdir -p /ssl && \ + chown -R bitrix:bitrix /ssl + +#VOLUME ["/ssl"] + +USER bitrix:bitrix + +ENTRYPOINT [""] + +CMD ["tail", "-f", "/dev/null"] diff --git a/sources/bxlego4240/Dockerfile b/sources/bxlego4240/Dockerfile new file mode 100644 index 0000000..c709f21 --- /dev/null +++ b/sources/bxlego4240/Dockerfile @@ -0,0 +1,16 @@ +FROM goacme/lego:v4.24.0 + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN apk add --no-cache curl openssl bash mc ca-certificates tzdata && \ + mkdir -p /ssl && \ + chown -R bitrix:bitrix /ssl + +#VOLUME ["/ssl"] + +USER bitrix:bitrix + +ENTRYPOINT [""] + +CMD ["tail", "-f", "/dev/null"] diff --git a/sources/bxlego4251/Dockerfile b/sources/bxlego4251/Dockerfile new file mode 100644 index 0000000..b7f8c1c --- /dev/null +++ b/sources/bxlego4251/Dockerfile @@ -0,0 +1,16 @@ +FROM goacme/lego:v4.25.1 + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN apk add --no-cache curl openssl bash mc ca-certificates tzdata && \ + mkdir -p /ssl && \ + chown -R bitrix:bitrix /ssl + +#VOLUME ["/ssl"] + +USER bitrix:bitrix + +ENTRYPOINT [""] + +CMD ["tail", "-f", "/dev/null"] diff --git a/sources/bxlego4252/Dockerfile b/sources/bxlego4252/Dockerfile new file mode 100644 index 0000000..6056a5a --- /dev/null +++ b/sources/bxlego4252/Dockerfile @@ -0,0 +1,16 @@ +FROM goacme/lego:v4.25.2 + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN apk add --no-cache curl openssl bash mc ca-certificates tzdata && \ + mkdir -p /ssl && \ + chown -R bitrix:bitrix /ssl + +#VOLUME ["/ssl"] + +USER bitrix:bitrix + +ENTRYPOINT [""] + +CMD ["tail", "-f", "/dev/null"] diff --git a/sources/bxlego4260/Dockerfile b/sources/bxlego4260/Dockerfile new file mode 100644 index 0000000..9e40335 --- /dev/null +++ b/sources/bxlego4260/Dockerfile @@ -0,0 +1,16 @@ +FROM goacme/lego:v4.26.0 + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN apk add --no-cache curl openssl bash mc ca-certificates tzdata && \ + mkdir -p /ssl && \ + chown -R bitrix:bitrix /ssl + +#VOLUME ["/ssl"] + +USER bitrix:bitrix + +ENTRYPOINT [""] + +CMD ["tail", "-f", "/dev/null"] diff --git a/sources/bxlego4270/Dockerfile b/sources/bxlego4270/Dockerfile new file mode 100644 index 0000000..fe57710 --- /dev/null +++ b/sources/bxlego4270/Dockerfile @@ -0,0 +1,16 @@ +FROM goacme/lego:v4.27.0 + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN apk add --no-cache curl openssl bash mc ca-certificates tzdata && \ + mkdir -p /ssl && \ + chown -R bitrix:bitrix /ssl + +#VOLUME ["/ssl"] + +USER bitrix:bitrix + +ENTRYPOINT [""] + +CMD ["tail", "-f", "/dev/null"] diff --git a/sources/bxlego4281/Dockerfile b/sources/bxlego4281/Dockerfile new file mode 100644 index 0000000..0f05604 --- /dev/null +++ b/sources/bxlego4281/Dockerfile @@ -0,0 +1,16 @@ +FROM goacme/lego:v4.28.1 + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN apk add --no-cache curl openssl bash mc ca-certificates tzdata && \ + mkdir -p /ssl && \ + chown -R bitrix:bitrix /ssl + +#VOLUME ["/ssl"] + +USER bitrix:bitrix + +ENTRYPOINT [""] + +CMD ["tail", "-f", "/dev/null"] diff --git a/sources/bxlego4290/Dockerfile b/sources/bxlego4290/Dockerfile new file mode 100644 index 0000000..6e79289 --- /dev/null +++ b/sources/bxlego4290/Dockerfile @@ -0,0 +1,16 @@ +FROM goacme/lego:v4.29.0 + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN apk add --no-cache curl openssl bash mc ca-certificates tzdata && \ + mkdir -p /ssl && \ + chown -R bitrix:bitrix /ssl + +#VOLUME ["/ssl"] + +USER bitrix:bitrix + +ENTRYPOINT [""] + +CMD ["tail", "-f", "/dev/null"] diff --git a/sources/bxlego4301/Dockerfile b/sources/bxlego4301/Dockerfile new file mode 100644 index 0000000..f30499e --- /dev/null +++ b/sources/bxlego4301/Dockerfile @@ -0,0 +1,16 @@ +FROM goacme/lego:v4.30.1 + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN apk add --no-cache curl openssl bash mc ca-certificates tzdata && \ + mkdir -p /ssl && \ + chown -R bitrix:bitrix /ssl + +#VOLUME ["/ssl"] + +USER bitrix:bitrix + +ENTRYPOINT [""] + +CMD ["tail", "-f", "/dev/null"] diff --git a/sources/bxlego4310/Dockerfile b/sources/bxlego4310/Dockerfile new file mode 100644 index 0000000..dcc1921 --- /dev/null +++ b/sources/bxlego4310/Dockerfile @@ -0,0 +1,16 @@ +FROM goacme/lego:v4.31.0 + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN apk add --no-cache curl openssl bash mc ca-certificates tzdata && \ + mkdir -p /ssl && \ + chown -R bitrix:bitrix /ssl + +#VOLUME ["/ssl"] + +USER bitrix:bitrix + +ENTRYPOINT [""] + +CMD ["tail", "-f", "/dev/null"] diff --git a/sources/bxnginx1263/Dockerfile b/sources/bxnginx1263/Dockerfile new file mode 100644 index 0000000..4ad81b6 --- /dev/null +++ b/sources/bxnginx1263/Dockerfile @@ -0,0 +1,33 @@ +FROM nginx:1.26.3-alpine-slim + +USER root + +RUN cd /root/ && \ + apk add --no-cache git curl openssl ca-certificates tzdata && \ + git clone https://github.com/bitrix-tools/nginx-modules.git && \ + cp /root/nginx-modules/packages/1.26.3/v1/alpine/v3.20/main/$(uname -m)/abuild-key.rsa.pub /etc/apk/keys/ && \ + echo "/root/nginx-modules/packages/1.26.3/v1/alpine/v3.20/main" >> /etc/apk/repositories && \ + apk update && \ + apk add nginx-module-xslt nginx-module-geoip nginx-module-image-filter nginx-module-njs nginx-module-perl nginx-module-brotli nginx-module-geoip2 nginx-module-ndk nginx-module-lua nginx-module-headers-more nginx-module-zip && \ + apk del git && \ + sed -i "s/.*1.26.3.*//" /etc/apk/repositories && \ + rm -f /etc/apk/keys/abuild-key.rsa.pub && \ + rm -rf /root/nginx-modules + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/msmtp /opt/browscap /opt/geoip2 /ssl /var/runs/nginx && \ + chown -R bitrix:bitrix /var/log/nginx && \ + chown -R bitrix:bitrix /var/cache/nginx && \ + chown -R bitrix:bitrix /var/runs/nginx && \ + chown -R bitrix:bitrix /usr/lib/nginx/modules && \ + chown -R bitrix:bitrix /etc/nginx && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxnginx1263modules/v1/Dockerfile b/sources/bxnginx1263modules/v1/Dockerfile new file mode 100644 index 0000000..1ab2ae2 --- /dev/null +++ b/sources/bxnginx1263modules/v1/Dockerfile @@ -0,0 +1,149 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "update.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# +FROM nginx:1.26.3-alpine-slim + +ENV NJS_VERSION=0.8.9 +ENV NJS_RELEASE=1 +ENV BROTLI_VERSION=1.1.0 +ENV GEOIP2_VERSION=3.4 +ENV HEADERSMORE_VERSION=0.38 +ENV ZIP_VERSION=1.3.0 +ENV NDK_VERSION=0.3.3 +ENV LUA_VERSION=0.10.26 + +COPY brotli_makefile /tmp/brotli_makefile +COPY brotli_shasum /tmp/brotli_shasum +COPY brotli_version /tmp/brotli_version +COPY nginx-module-brotli.xml /tmp/nginx-module-brotli.xml +COPY Makefile.module-brotli /tmp/Makefile.module-brotli + +RUN chown nobody:nobody /tmp/brotli_makefile && \ + chown nobody:nobody /tmp/brotli_shasum && \ + chown nobody:nobody /tmp/brotli_version && \ + chown nobody:nobody /tmp/nginx-module-brotli.xml && \ + chown nobody:nobody /tmp/Makefile.module-brotli + +COPY headersmore_version /tmp/headersmore_version +COPY nginx-module-headers-more.xml /tmp/nginx-module-headers-more.xml + +RUN chown nobody:nobody /tmp/headersmore_version && \ + chown nobody:nobody /tmp/nginx-module-headers-more.xml + +COPY nginx-module-zip.copyright /tmp/nginx-module-zip.copyright +COPY nginx-module-zip.xml /tmp/nginx-module-zip.xml +COPY Makefile.module-zip /tmp/Makefile.module-zip +COPY mod_zip-${ZIP_VERSION}.tar.gz /tmp/mod_zip-${ZIP_VERSION}.tar.gz + +RUN chown nobody:nobody /tmp/nginx-module-zip.copyright && \ + chown nobody:nobody /tmp/nginx-module-zip.xml && \ + chown nobody:nobody /tmp/Makefile.module-zip && \ + chown nobody:nobody /tmp/mod_zip-${ZIP_VERSION}.tar.gz + +RUN set -x \ + && apkArch="$(cat /etc/apk/arch)" \ + && nginxPackages=" \ + nginx=${NGINX_VERSION}-r${PKG_RELEASE} \ + nginx-module-xslt=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-geoip=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-image-filter=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} \ + nginx-module-perl=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-brotli=${NGINX_VERSION}.${BROTLI_VERSION}-r${PKG_RELEASE} \ + nginx-module-geoip2=${NGINX_VERSION}.${GEOIP2_VERSION}-r${PKG_RELEASE} \ + nginx-module-ndk=${NGINX_VERSION}.${NDK_VERSION}-r${PKG_RELEASE} \ + nginx-module-lua=${NGINX_VERSION}.${LUA_VERSION}-r${PKG_RELEASE} \ + nginx-module-headers-more=${NGINX_VERSION}.${HEADERSMORE_VERSION}-r${PKG_RELEASE} \ + nginx-module-zip=${NGINX_VERSION}.${ZIP_VERSION}-r${PKG_RELEASE} \ + " \ +# install prerequisites for public key and pkg-oss checks + && apk add --no-cache --virtual .checksum-deps \ + openssl \ + && case "$apkArch" in \ + i386) \ +# arches officially built by upstream + apk add -X "https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \ + ;; \ + *) \ +# we're on an architecture upstream doesn't officially build for +# let's build binaries from the published packaging sources + set -x \ + && tempDir="$(mktemp -d)" \ + && chown nobody:nobody $tempDir \ + && apk add --no-cache --virtual .build-deps \ + gcc \ + libc-dev \ + make \ + openssl-dev \ + pcre2-dev \ + zlib-dev \ + linux-headers \ + libxslt-dev \ + gd-dev \ + geoip-dev \ + libedit-dev \ + bash \ + alpine-sdk \ + findutils \ + curl \ + cmake \ + wget \ + brotli-dev \ + libmaxminddb \ + libmaxminddb-dev \ + libzip-dev \ + xz \ + xz-dev \ + pcre \ + pcre-dev \ + perl-dev \ + && su nobody -s /bin/sh -c " \ + export HOME=${tempDir} \ + && cd ${tempDir} \ + && curl -f -L -O https://github.com/nginx/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && PKGOSSCHECKSUM=\"3a4e869eded0c71e92f522e94edffea7fbfb5e78886ea7e484342fa2e028c62099a67d08860c249bf93776da97b924225e0d849dbb4697b298afe5421d7d6fea *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \ + && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \ + echo \"pkg-oss tarball checksum verification succeeded!\"; \ + else \ + echo \"pkg-oss tarball checksum verification failed!\"; \ + exit 1; \ + fi \ + && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \ + && cd alpine \ + && sed -i 's/.*BASE_MODULES=.*/BASE_MODULES= geoip image-filter njs perl xslt brotli headers-more geoip2 ndk lua zip /' ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/alpine/Makefile \ + && mv -f /tmp/brotli_makefile ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/ngx_brotli/Makefile \ + && mv -f /tmp/brotli_shasum ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/ngx_brotli/SHA512SUMS \ + && mv -f /tmp/brotli_version ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/ngx_brotli/version \ + && mv -f /tmp/nginx-module-brotli.xml ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && mv -f /tmp/Makefile.module-brotli ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/alpine/Makefile.module-brotli \ + && mv -f /tmp/headersmore_version ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/headers-more-nginx-module/version \ + && mv -f /tmp/nginx-module-headers-more.xml ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && mv /tmp/Makefile.module-zip ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/alpine/ \ + && mv /tmp/mod_zip-${ZIP_VERSION}.tar.gz ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/tarballs/ \ + && mv /tmp/nginx-module-zip.copyright ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && mv /tmp/nginx-module-zip.xml ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && make module-geoip module-image-filter module-njs module-perl module-xslt module-brotli module-headers-more module-geoip2 module-ndk module-lua module-zip \ + && apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \ + && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \ + " \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \ + && apk del --no-network .build-deps \ + && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \ + && mkdir -p /root/packages/ \ + && cp -R ${tempDir}/packages/alpine/* /root/packages/ \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /root/packages/${apkArch} \ + ;; \ + esac \ +# remove checksum deps + && apk del --no-network .checksum-deps \ +# if we have leftovers from building, let's purge them (including extra, unnecessary build deps) + && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \ + && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \ +# Bring in curl and ca-certificates to make registering on DNS SD easier + && apk add --no-cache tzdata curl ca-certificates openssl \ + && rm -rf /tmp/* + +VOLUME ["/root/packages/"] diff --git a/sources/bxnginx1263modules/v1/Dockerfile.origin b/sources/bxnginx1263modules/v1/Dockerfile.origin new file mode 100644 index 0000000..ec1007e --- /dev/null +++ b/sources/bxnginx1263modules/v1/Dockerfile.origin @@ -0,0 +1,79 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "update.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# +FROM nginx:1.26.3-alpine-slim + +ENV NJS_VERSION 0.8.9 +ENV NJS_RELEASE 1 + +RUN set -x \ + && apkArch="$(cat /etc/apk/arch)" \ + && nginxPackages=" \ + nginx=${NGINX_VERSION}-r${PKG_RELEASE} \ + nginx-module-xslt=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-geoip=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-image-filter=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} \ + " \ +# install prerequisites for public key and pkg-oss checks + && apk add --no-cache --virtual .checksum-deps \ + openssl \ + && case "$apkArch" in \ + x86_64|aarch64) \ +# arches officially built by upstream + apk add -X "https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \ + ;; \ + *) \ +# we're on an architecture upstream doesn't officially build for +# let's build binaries from the published packaging sources + set -x \ + && tempDir="$(mktemp -d)" \ + && chown nobody:nobody $tempDir \ + && apk add --no-cache --virtual .build-deps \ + gcc \ + libc-dev \ + make \ + openssl-dev \ + pcre2-dev \ + zlib-dev \ + linux-headers \ + libxslt-dev \ + gd-dev \ + geoip-dev \ + libedit-dev \ + bash \ + alpine-sdk \ + findutils \ + curl \ + && su nobody -s /bin/sh -c " \ + export HOME=${tempDir} \ + && cd ${tempDir} \ + && curl -f -L -O https://github.com/nginx/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && PKGOSSCHECKSUM=\"3a4e869eded0c71e92f522e94edffea7fbfb5e78886ea7e484342fa2e028c62099a67d08860c249bf93776da97b924225e0d849dbb4697b298afe5421d7d6fea *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \ + && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \ + echo \"pkg-oss tarball checksum verification succeeded!\"; \ + else \ + echo \"pkg-oss tarball checksum verification failed!\"; \ + exit 1; \ + fi \ + && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \ + && cd alpine \ + && make module-geoip module-image-filter module-njs module-xslt \ + && apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \ + && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \ + " \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \ + && apk del --no-network .build-deps \ + && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \ + ;; \ + esac \ +# remove checksum deps + && apk del --no-network .checksum-deps \ +# if we have leftovers from building, let's purge them (including extra, unnecessary build deps) + && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \ + && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \ +# Bring in curl and ca-certificates to make registering on DNS SD easier + && apk add --no-cache curl ca-certificates diff --git a/sources/bxnginx1263modules/v1/Makefile.module-brotli b/sources/bxnginx1263modules/v1/Makefile.module-brotli new file mode 100644 index 0000000..ff177d2 --- /dev/null +++ b/sources/bxnginx1263modules/v1/Makefile.module-brotli @@ -0,0 +1,63 @@ +MODULES+= brotli + +MODULE_SUMMARY_brotli= 3rd-party brotli compression dynamic modules + +include $(CONTRIB)/src/ngx_brotli/version + +MODULE_VERSION_brotli= $(NGX_BROTLI_VERSION) +MODULE_RELEASE_brotli= 1 + +MODULE_VERSION_PREFIX_brotli=$(MODULE_TARGET_PREFIX) + +MODULE_SOURCES_brotli= ngx_brotli-$(NGX_BROTLI_VERSION).tar.gz + +MODULE_CONFARGS_brotli= --add-dynamic-module=$(MODSRC_PREFIX)ngx_brotli-$(NGX_BROTLI_VERSION) + +.deps-module-brotli: + cd $(CONTRIB) && make .sum-ngx_brotli + touch $@ + +prerequisites-for-module-brotli: + +MODULE_BUILD_DEPENDS_brotli=brotli-dev cmake + +define MODULE_PREBUILD_brotli +cd $$builddir/../ngx_brotli-$(NGX_BROTLI_VERSION)/deps \&\& \ + rm -rf brotli \&\& \ + wget https://github.com/cyrax13/brotli/archive/refs/tags/v$(NGX_BROTLI_VERSION).tar.gz \&\& \ + tar -xvzf v$(NGX_BROTLI_VERSION).tar.gz \&\& \ + mv brotli-$(NGX_BROTLI_VERSION) brotli \&\& \ + rm -f v$(NGX_BROTLI_VERSION).tar.gz \&\& \ + cd brotli \&\& \ + mkdir out \&\& cd out \&\& \ + cmake \ + -DCMAKE_BUILD_TYPE=Release \ + -DBUILD_SHARED_LIBS=OFF \ + -DCMAKE_C_FLAGS="-Ofast -m64 -march=native -mtune=native -flto -funroll-loops -ffunction-sections -fdata-sections -Wl,--gc-sections" \ + -DCMAKE_CXX_FLAGS="-Ofast -m64 -march=native -mtune=native -flto -funroll-loops -ffunction-sections -fdata-sections -Wl,--gc-sections" \ + -DCMAKE_INSTALL_PREFIX=./installed \ + ../ \&\& \ + cmake --build . --config Release --target brotlienc \&\& \ + cd ../../../.. \ +exit 1 +endef +export MODULE_PREBUILD_brotli + +define MODULE_POST_brotli +cat < + + + + + + + + + +base version updated to 1.26.3-1 + + + + + + + + + +base version updated to 1.26.2-1 + + + + + + + + + +base version updated to 1.26.1-2 + + + + + + + + + +base version updated to 1.26.0-1 + + + + + + + + + +base version updated to 1.25.5-1 + + + + + + + + + +base version updated to 1.25.4-1 + + + + + + + + + +base version updated to 1.25.3-1 + + + + + + + + + +base version updated to 1.25.2-1 + + + + + + + + + +base version updated to 1.25.1-1 + + + + + + + + + +base version updated to 1.25.0-1 + + + + + + + + + +base version updated to 1.24.0-1 + + + + + + + + + +base version updated to 1.23.3-1 + + + + + + + + + +base version updated to 1.23.2-1 + + + + + + + + + +base version updated to 1.23.1-1 + + + + + + + + + +base version updated to 1.23.0-1 + + + + + + + + + +base version updated to 1.21.6-1 + + + + + + + + + +base version updated to 1.21.5-1 + + + + + + + + + +base version updated to 1.21.4-1 + + + + + + + + + +base version updated to 1.21.3-1 + + + + + + + + + +base version updated to 1.21.2-1 + + + + + + + + + +base version updated to 1.21.1-1 + + + + + + + + + +base version updated to 1.21.0-1 + + + + + + + + + +base version updated to 1.19.10-1 + + + + + + + + + +base version updated to 1.19.9-1 + + + + + + + + + +base version updated to 1.19.8-1 + + + + + + + + + +base version updated to 1.19.7-1 + + + + + + + + + + +Initial release of brotli nginx module package. + + + + + + + diff --git a/sources/bxnginx1263modules/v1/nginx-module-headers-more.xml b/sources/bxnginx1263modules/v1/nginx-module-headers-more.xml new file mode 100644 index 0000000..f116aed --- /dev/null +++ b/sources/bxnginx1263modules/v1/nginx-module-headers-more.xml @@ -0,0 +1,371 @@ + + + + + + + + + + +base version updated to 1.26.3-1 + + + + + + + + + +base version updated to 1.26.2-1 + + + + + + + + + +base version updated to 1.26.1-2 + + + + + + + + + +base version updated to 1.26.0-1 + + + + + + + + + +base version updated to 1.25.5-1 + + + + + + + + + +base version updated to 1.25.4-1 + + + + + + + + + +Updated headers-more module to 0.35 release. + + + + + + + + + +base version updated to 1.25.3-1 + + + + + + + + + +base version updated to 1.25.2-1 + + + + + + + + + +base version updated to 1.25.1-1 + + + + + + + + + +base version updated to 1.25.0-1 + + + + + + + + + +base version updated to 1.23.4-1 + + + + + + + + + +base version updated to 1.23.3-1 + + + + + + + + + +Updated headers-more to git hash bea1be3bbf6af28f6aa8cf0c01c07ee1637e2bd0 +which is version 0.34 + + + + + + + + + +base version updated to 1.23.2-1 + + + + + + + + + +base version updated to 1.23.1-1 + + + + + + + + + +Updated headers-more to git hash d502e41996d24a382bd9c632e3ae3efa0a5fca66 +This fixes FTBFS with nginx 1.23.0+. + + + + + + + + + +base version updated to 1.23.0-1 + + + + + + + + + +base version updated to 1.21.6-1 + + + + + + + + + +base version updated to 1.21.5-1 + + + + + + + + + +base version updated to 1.21.4-1 + + + + + + + + + +base version updated to 1.21.3-1 + + + + + + + + + +base version updated to 1.21.2-1 + + + + + + + + + +base version updated to 1.21.1-1 + + + + + + + + + +base version updated to 1.21.0-1 + + + + + + + + + +base version updated to 1.19.10-1 + + + + + + + + + +base version updated to 1.19.9-1 + + + + + + + + + +base version updated to 1.19.8-1 + + + + + + + + + +base version updated to 1.19.7-1 + + + + + + + + + + +Initial release of headers more nginx module package. + + + + + + + diff --git a/sources/bxnginx1263modules/v1/nginx-module-zip.copyright b/sources/bxnginx1263modules/v1/nginx-module-zip.copyright new file mode 100644 index 0000000..5ffbca8 --- /dev/null +++ b/sources/bxnginx1263modules/v1/nginx-module-zip.copyright @@ -0,0 +1,28 @@ +/* + * Copyright 2007-2020 Evan Miller and contributors + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, this + * list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * 3. Neither the name of the copyright holder nor the names of its contributors + * may be used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER + * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ diff --git a/sources/bxnginx1263modules/v1/nginx-module-zip.xml b/sources/bxnginx1263modules/v1/nginx-module-zip.xml new file mode 100644 index 0000000..e76bd38 --- /dev/null +++ b/sources/bxnginx1263modules/v1/nginx-module-zip.xml @@ -0,0 +1,38 @@ + + + + + + + + +base version updated to 1.3.0-1 + + + + + + + +base version updated to 1.2.2-1 + + + + + + + +base version updated to 1.2.1-1 + + + + + + + +base version updated to 1.2.0-1 + + + + + diff --git a/sources/bxnginx1280/Dockerfile b/sources/bxnginx1280/Dockerfile new file mode 100644 index 0000000..693dd97 --- /dev/null +++ b/sources/bxnginx1280/Dockerfile @@ -0,0 +1,33 @@ +FROM nginx:1.28.0-alpine-slim + +USER root + +RUN cd /root/ && \ + apk add --no-cache git curl openssl ca-certificates tzdata && \ + git clone https://github.com/bitrix-tools/nginx-modules.git && \ + cp /root/nginx-modules/packages/1.28.0/v3/alpine/v3.21/main/$(uname -m)/abuild-key.rsa.pub /etc/apk/keys/ && \ + echo "/root/nginx-modules/packages/1.28.0/v3/alpine/v3.21/main" >> /etc/apk/repositories && \ + apk update && \ + apk add nginx-module-xslt nginx-module-geoip nginx-module-image-filter nginx-module-njs nginx-module-perl nginx-module-brotli nginx-module-geoip2 nginx-module-ndk nginx-module-lua nginx-module-headers-more nginx-module-zip && \ + apk del git && \ + sed -i "s/.*1.28.0.*//" /etc/apk/repositories && \ + rm -f /etc/apk/keys/abuild-key.rsa.pub && \ + rm -rf /root/nginx-modules + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/msmtp /opt/browscap /opt/geoip2 /ssl /var/runs/nginx && \ + chown -R bitrix:bitrix /var/log/nginx && \ + chown -R bitrix:bitrix /var/cache/nginx && \ + chown -R bitrix:bitrix /var/runs/nginx && \ + chown -R bitrix:bitrix /usr/lib/nginx/modules && \ + chown -R bitrix:bitrix /etc/nginx && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxnginx1280modules/v1/Dockerfile b/sources/bxnginx1280modules/v1/Dockerfile new file mode 100644 index 0000000..fdb709c --- /dev/null +++ b/sources/bxnginx1280modules/v1/Dockerfile @@ -0,0 +1,152 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "update.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# +FROM nginx:1.28.0-alpine-slim + +ENV NJS_VERSION=0.8.10 +ENV NJS_RELEASE=1 +ENV BROTLI_VERSION=1.1.0 +ENV GEOIP2_VERSION=3.4 +ENV HEADERSMORE_VERSION=0.38 +ENV ZIP_VERSION=1.3.0 +ENV NDK_VERSION=0.3.3 +ENV LUA_VERSION=0.10.28 + +COPY brotli_makefile /tmp/brotli_makefile +COPY brotli_shasum /tmp/brotli_shasum +COPY brotli_version /tmp/brotli_version +COPY nginx-module-brotli.xml /tmp/nginx-module-brotli.xml +COPY Makefile.module-brotli /tmp/Makefile.module-brotli + +RUN chown nobody:nobody /tmp/brotli_makefile && \ + chown nobody:nobody /tmp/brotli_shasum && \ + chown nobody:nobody /tmp/brotli_version && \ + chown nobody:nobody /tmp/nginx-module-brotli.xml && \ + chown nobody:nobody /tmp/Makefile.module-brotli + +COPY headersmore_shasum /tmp/headersmore_shasum +COPY headersmore_version /tmp/headersmore_version +COPY nginx-module-headers-more.xml /tmp/nginx-module-headers-more.xml + +RUN chown nobody:nobody /tmp/headersmore_shasum && \ + chown nobody:nobody /tmp/headersmore_version && \ + chown nobody:nobody /tmp/nginx-module-headers-more.xml + +COPY nginx-module-zip.copyright /tmp/nginx-module-zip.copyright +COPY nginx-module-zip.xml /tmp/nginx-module-zip.xml +COPY Makefile.module-zip /tmp/Makefile.module-zip +COPY mod_zip-${ZIP_VERSION}.tar.gz /tmp/mod_zip-${ZIP_VERSION}.tar.gz + +RUN chown nobody:nobody /tmp/nginx-module-zip.copyright && \ + chown nobody:nobody /tmp/nginx-module-zip.xml && \ + chown nobody:nobody /tmp/Makefile.module-zip && \ + chown nobody:nobody /tmp/mod_zip-${ZIP_VERSION}.tar.gz + +RUN set -x \ + && apkArch="$(cat /etc/apk/arch)" \ + && nginxPackages=" \ + nginx=${NGINX_VERSION}-r${PKG_RELEASE} \ + nginx-module-xslt=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-geoip=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-image-filter=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} \ + nginx-module-perl=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-brotli=${NGINX_VERSION}.${BROTLI_VERSION}-r${PKG_RELEASE} \ + nginx-module-geoip2=${NGINX_VERSION}.${GEOIP2_VERSION}-r${PKG_RELEASE} \ + nginx-module-ndk=${NGINX_VERSION}.${NDK_VERSION}-r${PKG_RELEASE} \ + nginx-module-lua=${NGINX_VERSION}.${LUA_VERSION}-r${PKG_RELEASE} \ + nginx-module-headers-more=${NGINX_VERSION}.${HEADERSMORE_VERSION}-r${PKG_RELEASE} \ + nginx-module-zip=${NGINX_VERSION}.${ZIP_VERSION}-r${PKG_RELEASE} \ + " \ +# install prerequisites for public key and pkg-oss checks + && apk add --no-cache --virtual .checksum-deps \ + openssl \ + && case "$apkArch" in \ + i386) \ +# arches officially built by upstream + apk add -X "https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \ + ;; \ + *) \ +# we're on an architecture upstream doesn't officially build for +# let's build binaries from the published packaging sources + set -x \ + && tempDir="$(mktemp -d)" \ + && chown nobody:nobody $tempDir \ + && apk add --no-cache --virtual .build-deps \ + gcc \ + libc-dev \ + make \ + openssl-dev \ + pcre2-dev \ + zlib-dev \ + linux-headers \ + libxslt-dev \ + gd-dev \ + geoip-dev \ + libedit-dev \ + bash \ + alpine-sdk \ + findutils \ + curl \ + cmake \ + wget \ + brotli-dev \ + libmaxminddb \ + libmaxminddb-dev \ + libzip-dev \ + xz \ + xz-dev \ + pcre \ + pcre-dev \ + perl-dev \ + && su nobody -s /bin/sh -c " \ + export HOME=${tempDir} \ + && cd ${tempDir} \ + && curl -f -L -O https://github.com/nginx/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && PKGOSSCHECKSUM=\"517bc18954ccf4efddd51986584ca1f37966833ad342a297e1fe58fd0faf14c5a4dabcb23519dca433878a2927a95d6bea05a6749ee2fa67a33bf24cdc41b1e4 *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \ + && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \ + echo \"pkg-oss tarball checksum verification succeeded!\"; \ + else \ + echo \"pkg-oss tarball checksum verification failed!\"; \ + exit 1; \ + fi \ + && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \ + && cd alpine \ + && sed -i 's/.*BASE_MODULES=.*/BASE_MODULES= geoip image-filter njs perl xslt brotli headers-more geoip2 ndk lua zip /' ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/alpine/Makefile \ + && mv -f /tmp/brotli_makefile ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/ngx_brotli/Makefile \ + && mv -f /tmp/brotli_shasum ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/ngx_brotli/SHA512SUMS \ + && mv -f /tmp/brotli_version ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/ngx_brotli/version \ + && mv -f /tmp/nginx-module-brotli.xml ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && mv -f /tmp/Makefile.module-brotli ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/alpine/Makefile.module-brotli \ + && mv -f /tmp/headersmore_shasum ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/headers-more-nginx-module/SHA512SUMS \ + && mv -f /tmp/headersmore_version ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/headers-more-nginx-module/version \ + && mv -f /tmp/nginx-module-headers-more.xml ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && mv /tmp/Makefile.module-zip ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/alpine/ \ + && mv /tmp/mod_zip-${ZIP_VERSION}.tar.gz ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/tarballs/ \ + && mv /tmp/nginx-module-zip.copyright ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && mv /tmp/nginx-module-zip.xml ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && make module-geoip module-image-filter module-njs module-perl module-xslt module-brotli module-headers-more module-geoip2 module-ndk module-lua module-zip \ + && apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \ + && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \ + " \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \ + && apk del --no-network .build-deps \ + && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \ + && mkdir -p /root/packages/ \ + && cp -R ${tempDir}/packages/alpine/* /root/packages/ \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /root/packages/${apkArch} \ + ;; \ + esac \ +# remove checksum deps + && apk del --no-network .checksum-deps \ +# if we have leftovers from building, let's purge them (including extra, unnecessary build deps) + && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \ + && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \ +# Bring in curl and ca-certificates to make registering on DNS SD easier + && apk add --no-cache tzdata curl ca-certificates openssl \ + && rm -rf /tmp/* + +VOLUME ["/root/packages/"] diff --git a/sources/bxnginx1280modules/v1/Dockerfile.origin b/sources/bxnginx1280modules/v1/Dockerfile.origin new file mode 100644 index 0000000..fb0c900 --- /dev/null +++ b/sources/bxnginx1280modules/v1/Dockerfile.origin @@ -0,0 +1,79 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "update.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# +FROM nginx:1.28.0-alpine-slim + +ENV NJS_VERSION 0.8.10 +ENV NJS_RELEASE 1 + +RUN set -x \ + && apkArch="$(cat /etc/apk/arch)" \ + && nginxPackages=" \ + nginx=${NGINX_VERSION}-r${PKG_RELEASE} \ + nginx-module-xslt=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-geoip=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-image-filter=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} \ + " \ +# install prerequisites for public key and pkg-oss checks + && apk add --no-cache --virtual .checksum-deps \ + openssl \ + && case "$apkArch" in \ + x86_64|aarch64) \ +# arches officially built by upstream + apk add -X "https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \ + ;; \ + *) \ +# we're on an architecture upstream doesn't officially build for +# let's build binaries from the published packaging sources + set -x \ + && tempDir="$(mktemp -d)" \ + && chown nobody:nobody $tempDir \ + && apk add --no-cache --virtual .build-deps \ + gcc \ + libc-dev \ + make \ + openssl-dev \ + pcre2-dev \ + zlib-dev \ + linux-headers \ + libxslt-dev \ + gd-dev \ + geoip-dev \ + libedit-dev \ + bash \ + alpine-sdk \ + findutils \ + curl \ + && su nobody -s /bin/sh -c " \ + export HOME=${tempDir} \ + && cd ${tempDir} \ + && curl -f -L -O https://github.com/nginx/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && PKGOSSCHECKSUM=\"517bc18954ccf4efddd51986584ca1f37966833ad342a297e1fe58fd0faf14c5a4dabcb23519dca433878a2927a95d6bea05a6749ee2fa67a33bf24cdc41b1e4 *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \ + && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \ + echo \"pkg-oss tarball checksum verification succeeded!\"; \ + else \ + echo \"pkg-oss tarball checksum verification failed!\"; \ + exit 1; \ + fi \ + && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \ + && cd alpine \ + && make module-geoip module-image-filter module-njs module-xslt \ + && apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \ + && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \ + " \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \ + && apk del --no-network .build-deps \ + && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \ + ;; \ + esac \ +# remove checksum deps + && apk del --no-network .checksum-deps \ +# if we have leftovers from building, let's purge them (including extra, unnecessary build deps) + && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \ + && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \ +# Bring in curl and ca-certificates to make registering on DNS SD easier + && apk add --no-cache curl ca-certificates diff --git a/sources/bxnginx1280modules/v1/Makefile.module-brotli b/sources/bxnginx1280modules/v1/Makefile.module-brotli new file mode 100644 index 0000000..ff177d2 --- /dev/null +++ b/sources/bxnginx1280modules/v1/Makefile.module-brotli @@ -0,0 +1,63 @@ +MODULES+= brotli + +MODULE_SUMMARY_brotli= 3rd-party brotli compression dynamic modules + +include $(CONTRIB)/src/ngx_brotli/version + +MODULE_VERSION_brotli= $(NGX_BROTLI_VERSION) +MODULE_RELEASE_brotli= 1 + +MODULE_VERSION_PREFIX_brotli=$(MODULE_TARGET_PREFIX) + +MODULE_SOURCES_brotli= ngx_brotli-$(NGX_BROTLI_VERSION).tar.gz + +MODULE_CONFARGS_brotli= --add-dynamic-module=$(MODSRC_PREFIX)ngx_brotli-$(NGX_BROTLI_VERSION) + +.deps-module-brotli: + cd $(CONTRIB) && make .sum-ngx_brotli + touch $@ + +prerequisites-for-module-brotli: + +MODULE_BUILD_DEPENDS_brotli=brotli-dev cmake + +define MODULE_PREBUILD_brotli +cd $$builddir/../ngx_brotli-$(NGX_BROTLI_VERSION)/deps \&\& \ + rm -rf brotli \&\& \ + wget https://github.com/cyrax13/brotli/archive/refs/tags/v$(NGX_BROTLI_VERSION).tar.gz \&\& \ + tar -xvzf v$(NGX_BROTLI_VERSION).tar.gz \&\& \ + mv brotli-$(NGX_BROTLI_VERSION) brotli \&\& \ + rm -f v$(NGX_BROTLI_VERSION).tar.gz \&\& \ + cd brotli \&\& \ + mkdir out \&\& cd out \&\& \ + cmake \ + -DCMAKE_BUILD_TYPE=Release \ + -DBUILD_SHARED_LIBS=OFF \ + -DCMAKE_C_FLAGS="-Ofast -m64 -march=native -mtune=native -flto -funroll-loops -ffunction-sections -fdata-sections -Wl,--gc-sections" \ + -DCMAKE_CXX_FLAGS="-Ofast -m64 -march=native -mtune=native -flto -funroll-loops -ffunction-sections -fdata-sections -Wl,--gc-sections" \ + -DCMAKE_INSTALL_PREFIX=./installed \ + ../ \&\& \ + cmake --build . --config Release --target brotlienc \&\& \ + cd ../../../.. \ +exit 1 +endef +export MODULE_PREBUILD_brotli + +define MODULE_POST_brotli +cat < + + + + + + + + + +base version updated to 1.28.0-1 + + + + + + + + + +base version updated to 1.27.5-1 + + + + + + + + + +base version updated to 1.27.4-1 + + + + + + + + + +base version updated to 1.27.3-1 + + + + + + + + + +Updated headers-more module to 0.37 release. + + + + + + + + +base version updated to 1.27.2-1 + + + + + + + + + +base version updated to 1.27.1-1 + + + + + + + + + +base version updated to 1.27.0-2 + + + + + + + + + +base version updated to 1.27.0-1 + + + + + + + + + +base version updated to 1.25.5-1 + + + + + + + + + +base version updated to 1.25.4-1 + + + + + + + + + +Updated headers-more module to 0.35 release. + + + + + + + + + +base version updated to 1.25.3-1 + + + + + + + + + +base version updated to 1.25.2-1 + + + + + + + + + +base version updated to 1.25.1-1 + + + + + + + + + +base version updated to 1.25.0-1 + + + + + + + + + +base version updated to 1.23.4-1 + + + + + + + + + +base version updated to 1.23.3-1 + + + + + + + + + +Updated headers-more to git hash bea1be3bbf6af28f6aa8cf0c01c07ee1637e2bd0 +which is version 0.34 + + + + + + + + + +base version updated to 1.23.2-1 + + + + + + + + + +base version updated to 1.23.1-1 + + + + + + + + + +Updated headers-more to git hash d502e41996d24a382bd9c632e3ae3efa0a5fca66 +This fixes FTBFS with nginx 1.23.0+. + + + + + + + + + +base version updated to 1.23.0-1 + + + + + + + + + +base version updated to 1.21.6-1 + + + + + + + + + +base version updated to 1.21.5-1 + + + + + + + + + +base version updated to 1.21.4-1 + + + + + + + + + +base version updated to 1.21.3-1 + + + + + + + + + +base version updated to 1.21.2-1 + + + + + + + + + +base version updated to 1.21.1-1 + + + + + + + + + +base version updated to 1.21.0-1 + + + + + + + + + +base version updated to 1.19.10-1 + + + + + + + + + +base version updated to 1.19.9-1 + + + + + + + + + +base version updated to 1.19.8-1 + + + + + + + + + +base version updated to 1.19.7-1 + + + + + + + + + + +Initial release of headers more nginx module package. + + + + + + + diff --git a/sources/bxnginx1280modules/v1/nginx-module-headers-more.xml b/sources/bxnginx1280modules/v1/nginx-module-headers-more.xml new file mode 100644 index 0000000..f116aed --- /dev/null +++ b/sources/bxnginx1280modules/v1/nginx-module-headers-more.xml @@ -0,0 +1,371 @@ + + + + + + + + + + +base version updated to 1.26.3-1 + + + + + + + + + +base version updated to 1.26.2-1 + + + + + + + + + +base version updated to 1.26.1-2 + + + + + + + + + +base version updated to 1.26.0-1 + + + + + + + + + +base version updated to 1.25.5-1 + + + + + + + + + +base version updated to 1.25.4-1 + + + + + + + + + +Updated headers-more module to 0.35 release. + + + + + + + + + +base version updated to 1.25.3-1 + + + + + + + + + +base version updated to 1.25.2-1 + + + + + + + + + +base version updated to 1.25.1-1 + + + + + + + + + +base version updated to 1.25.0-1 + + + + + + + + + +base version updated to 1.23.4-1 + + + + + + + + + +base version updated to 1.23.3-1 + + + + + + + + + +Updated headers-more to git hash bea1be3bbf6af28f6aa8cf0c01c07ee1637e2bd0 +which is version 0.34 + + + + + + + + + +base version updated to 1.23.2-1 + + + + + + + + + +base version updated to 1.23.1-1 + + + + + + + + + +Updated headers-more to git hash d502e41996d24a382bd9c632e3ae3efa0a5fca66 +This fixes FTBFS with nginx 1.23.0+. + + + + + + + + + +base version updated to 1.23.0-1 + + + + + + + + + +base version updated to 1.21.6-1 + + + + + + + + + +base version updated to 1.21.5-1 + + + + + + + + + +base version updated to 1.21.4-1 + + + + + + + + + +base version updated to 1.21.3-1 + + + + + + + + + +base version updated to 1.21.2-1 + + + + + + + + + +base version updated to 1.21.1-1 + + + + + + + + + +base version updated to 1.21.0-1 + + + + + + + + + +base version updated to 1.19.10-1 + + + + + + + + + +base version updated to 1.19.9-1 + + + + + + + + + +base version updated to 1.19.8-1 + + + + + + + + + +base version updated to 1.19.7-1 + + + + + + + + + + +Initial release of headers more nginx module package. + + + + + + + diff --git a/sources/bxnginx1280modules/v1/nginx-module-zip.copyright b/sources/bxnginx1280modules/v1/nginx-module-zip.copyright new file mode 100644 index 0000000..5ffbca8 --- /dev/null +++ b/sources/bxnginx1280modules/v1/nginx-module-zip.copyright @@ -0,0 +1,28 @@ +/* + * Copyright 2007-2020 Evan Miller and contributors + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, this + * list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * 3. Neither the name of the copyright holder nor the names of its contributors + * may be used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER + * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ diff --git a/sources/bxnginx1280modules/v1/nginx-module-zip.xml b/sources/bxnginx1280modules/v1/nginx-module-zip.xml new file mode 100644 index 0000000..e76bd38 --- /dev/null +++ b/sources/bxnginx1280modules/v1/nginx-module-zip.xml @@ -0,0 +1,38 @@ + + + + + + + + +base version updated to 1.3.0-1 + + + + + + + +base version updated to 1.2.2-1 + + + + + + + +base version updated to 1.2.1-1 + + + + + + + +base version updated to 1.2.0-1 + + + + + diff --git a/sources/bxnginx1280modules/v2/Dockerfile b/sources/bxnginx1280modules/v2/Dockerfile new file mode 100644 index 0000000..200a923 --- /dev/null +++ b/sources/bxnginx1280modules/v2/Dockerfile @@ -0,0 +1,152 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "update.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# +FROM nginx:1.28.0-alpine-slim + +ENV NJS_VERSION=0.8.10 +ENV NJS_RELEASE=1 +ENV BROTLI_VERSION=1.0.9 +ENV GEOIP2_VERSION=3.4 +ENV HEADERSMORE_VERSION=0.39 +ENV ZIP_VERSION=1.3.0 +ENV NDK_VERSION=0.3.3 +ENV LUA_VERSION=0.10.28 + +COPY brotli_makefile /tmp/brotli_makefile +COPY brotli_shasum /tmp/brotli_shasum +COPY brotli_version /tmp/brotli_version +COPY nginx-module-brotli.xml /tmp/nginx-module-brotli.xml +COPY Makefile.module-brotli /tmp/Makefile.module-brotli + +RUN chown nobody:nobody /tmp/brotli_makefile && \ + chown nobody:nobody /tmp/brotli_shasum && \ + chown nobody:nobody /tmp/brotli_version && \ + chown nobody:nobody /tmp/nginx-module-brotli.xml && \ + chown nobody:nobody /tmp/Makefile.module-brotli + +COPY headersmore_shasum /tmp/headersmore_shasum +COPY headersmore_version /tmp/headersmore_version +COPY nginx-module-headers-more.xml /tmp/nginx-module-headers-more.xml + +RUN chown nobody:nobody /tmp/headersmore_shasum && \ + chown nobody:nobody /tmp/headersmore_version && \ + chown nobody:nobody /tmp/nginx-module-headers-more.xml + +COPY nginx-module-zip.copyright /tmp/nginx-module-zip.copyright +COPY nginx-module-zip.xml /tmp/nginx-module-zip.xml +COPY Makefile.module-zip /tmp/Makefile.module-zip +COPY mod_zip-${ZIP_VERSION}.tar.gz /tmp/mod_zip-${ZIP_VERSION}.tar.gz + +RUN chown nobody:nobody /tmp/nginx-module-zip.copyright && \ + chown nobody:nobody /tmp/nginx-module-zip.xml && \ + chown nobody:nobody /tmp/Makefile.module-zip && \ + chown nobody:nobody /tmp/mod_zip-${ZIP_VERSION}.tar.gz + +RUN set -x \ + && apkArch="$(cat /etc/apk/arch)" \ + && nginxPackages=" \ + nginx=${NGINX_VERSION}-r${PKG_RELEASE} \ + nginx-module-xslt=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-geoip=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-image-filter=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} \ + nginx-module-perl=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-brotli=${NGINX_VERSION}.${BROTLI_VERSION}-r${PKG_RELEASE} \ + nginx-module-geoip2=${NGINX_VERSION}.${GEOIP2_VERSION}-r${PKG_RELEASE} \ + nginx-module-ndk=${NGINX_VERSION}.${NDK_VERSION}-r${PKG_RELEASE} \ + nginx-module-lua=${NGINX_VERSION}.${LUA_VERSION}-r${PKG_RELEASE} \ + nginx-module-headers-more=${NGINX_VERSION}.${HEADERSMORE_VERSION}-r${PKG_RELEASE} \ + nginx-module-zip=${NGINX_VERSION}.${ZIP_VERSION}-r${PKG_RELEASE} \ + " \ +# install prerequisites for public key and pkg-oss checks + && apk add --no-cache --virtual .checksum-deps \ + openssl \ + && case "$apkArch" in \ + i386) \ +# arches officially built by upstream + apk add -X "https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \ + ;; \ + *) \ +# we're on an architecture upstream doesn't officially build for +# let's build binaries from the published packaging sources + set -x \ + && tempDir="$(mktemp -d)" \ + && chown nobody:nobody $tempDir \ + && apk add --no-cache --virtual .build-deps \ + gcc \ + libc-dev \ + make \ + openssl-dev \ + pcre2-dev \ + zlib-dev \ + linux-headers \ + libxslt-dev \ + gd-dev \ + geoip-dev \ + libedit-dev \ + bash \ + alpine-sdk \ + findutils \ + curl \ + cmake \ + wget \ + brotli-dev \ + libmaxminddb \ + libmaxminddb-dev \ + libzip-dev \ + xz \ + xz-dev \ + pcre \ + pcre-dev \ + perl-dev \ + && su nobody -s /bin/sh -c " \ + export HOME=${tempDir} \ + && cd ${tempDir} \ + && curl -f -L -O https://github.com/nginx/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && PKGOSSCHECKSUM=\"517bc18954ccf4efddd51986584ca1f37966833ad342a297e1fe58fd0faf14c5a4dabcb23519dca433878a2927a95d6bea05a6749ee2fa67a33bf24cdc41b1e4 *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \ + && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \ + echo \"pkg-oss tarball checksum verification succeeded!\"; \ + else \ + echo \"pkg-oss tarball checksum verification failed!\"; \ + exit 1; \ + fi \ + && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \ + && cd alpine \ + && sed -i 's/.*BASE_MODULES=.*/BASE_MODULES= geoip image-filter njs perl xslt brotli headers-more geoip2 ndk lua zip /' ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/alpine/Makefile \ + && mv -f /tmp/brotli_makefile ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/ngx_brotli/Makefile \ + && mv -f /tmp/brotli_shasum ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/ngx_brotli/SHA512SUMS \ + && mv -f /tmp/brotli_version ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/ngx_brotli/version \ + && mv -f /tmp/nginx-module-brotli.xml ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && mv -f /tmp/Makefile.module-brotli ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/alpine/Makefile.module-brotli \ + && mv -f /tmp/headersmore_shasum ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/headers-more-nginx-module/SHA512SUMS \ + && mv -f /tmp/headersmore_version ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/headers-more-nginx-module/version \ + && mv -f /tmp/nginx-module-headers-more.xml ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && mv /tmp/Makefile.module-zip ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/alpine/ \ + && mv /tmp/mod_zip-${ZIP_VERSION}.tar.gz ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/tarballs/ \ + && mv /tmp/nginx-module-zip.copyright ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && mv /tmp/nginx-module-zip.xml ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && make module-geoip module-image-filter module-njs module-perl module-xslt module-brotli module-headers-more module-geoip2 module-ndk module-lua module-zip \ + && apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \ + && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \ + " \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \ + && apk del --no-network .build-deps \ + && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \ + && mkdir -p /root/packages/ \ + && cp -R ${tempDir}/packages/alpine/* /root/packages/ \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /root/packages/${apkArch} \ + ;; \ + esac \ +# remove checksum deps + && apk del --no-network .checksum-deps \ +# if we have leftovers from building, let's purge them (including extra, unnecessary build deps) + && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \ + && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \ +# Bring in curl and ca-certificates to make registering on DNS SD easier + && apk add --no-cache tzdata curl ca-certificates openssl \ + && rm -rf /tmp/* + +VOLUME ["/root/packages/"] diff --git a/sources/bxnginx1280modules/v2/Dockerfile.origin b/sources/bxnginx1280modules/v2/Dockerfile.origin new file mode 100644 index 0000000..fb0c900 --- /dev/null +++ b/sources/bxnginx1280modules/v2/Dockerfile.origin @@ -0,0 +1,79 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "update.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# +FROM nginx:1.28.0-alpine-slim + +ENV NJS_VERSION 0.8.10 +ENV NJS_RELEASE 1 + +RUN set -x \ + && apkArch="$(cat /etc/apk/arch)" \ + && nginxPackages=" \ + nginx=${NGINX_VERSION}-r${PKG_RELEASE} \ + nginx-module-xslt=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-geoip=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-image-filter=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} \ + " \ +# install prerequisites for public key and pkg-oss checks + && apk add --no-cache --virtual .checksum-deps \ + openssl \ + && case "$apkArch" in \ + x86_64|aarch64) \ +# arches officially built by upstream + apk add -X "https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \ + ;; \ + *) \ +# we're on an architecture upstream doesn't officially build for +# let's build binaries from the published packaging sources + set -x \ + && tempDir="$(mktemp -d)" \ + && chown nobody:nobody $tempDir \ + && apk add --no-cache --virtual .build-deps \ + gcc \ + libc-dev \ + make \ + openssl-dev \ + pcre2-dev \ + zlib-dev \ + linux-headers \ + libxslt-dev \ + gd-dev \ + geoip-dev \ + libedit-dev \ + bash \ + alpine-sdk \ + findutils \ + curl \ + && su nobody -s /bin/sh -c " \ + export HOME=${tempDir} \ + && cd ${tempDir} \ + && curl -f -L -O https://github.com/nginx/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && PKGOSSCHECKSUM=\"517bc18954ccf4efddd51986584ca1f37966833ad342a297e1fe58fd0faf14c5a4dabcb23519dca433878a2927a95d6bea05a6749ee2fa67a33bf24cdc41b1e4 *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \ + && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \ + echo \"pkg-oss tarball checksum verification succeeded!\"; \ + else \ + echo \"pkg-oss tarball checksum verification failed!\"; \ + exit 1; \ + fi \ + && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \ + && cd alpine \ + && make module-geoip module-image-filter module-njs module-xslt \ + && apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \ + && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \ + " \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \ + && apk del --no-network .build-deps \ + && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \ + ;; \ + esac \ +# remove checksum deps + && apk del --no-network .checksum-deps \ +# if we have leftovers from building, let's purge them (including extra, unnecessary build deps) + && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \ + && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \ +# Bring in curl and ca-certificates to make registering on DNS SD easier + && apk add --no-cache curl ca-certificates diff --git a/sources/bxnginx1280modules/v2/Makefile.module-brotli b/sources/bxnginx1280modules/v2/Makefile.module-brotli new file mode 100644 index 0000000..d2f69b1 --- /dev/null +++ b/sources/bxnginx1280modules/v2/Makefile.module-brotli @@ -0,0 +1,39 @@ +MODULES+= brotli + +MODULE_SUMMARY_brotli= 3rd-party brotli compression dynamic modules + +include $(CONTRIB)/src/ngx_brotli/version + +MODULE_VERSION_brotli= $(NGX_BROTLI_VERSION) +MODULE_RELEASE_brotli= 1 + +MODULE_VERSION_PREFIX_brotli=$(MODULE_TARGET_PREFIX) + +MODULE_SOURCES_brotli= ngx_brotli-$(NGX_BROTLI_VERSION).tar.gz + +MODULE_CONFARGS_brotli= --add-dynamic-module=$(MODSRC_PREFIX)ngx_brotli-$(NGX_BROTLI_VERSION) + +.deps-module-brotli: + cd $(CONTRIB) && make .sum-ngx_brotli + touch $@ + +MODULE_BUILD_DEPENDS_brotli=brotli-dev + +define MODULE_POST_brotli +cat < + + + + + + + + + +base version updated to 1.28.0-1 + + + + + + + + + +base version updated to 1.27.5-1 + + + + + + + + + +base version updated to 1.27.4-1 + + + + + + + + + +base version updated to 1.27.3-1 + + + + + + + + + +base version updated to 1.27.2-1 + + + + + + + + + +base version updated to 1.27.1-1 + + + + + + + + + +base version updated to 1.27.0-2 + + + + + + + + + +base version updated to 1.27.0-1 + + + + + + + + + +base version updated to 1.25.5-1 + + + + + + + + + +base version updated to 1.25.4-1 + + + + + + + + + +base version updated to 1.25.3-1 + + + + + + + + + +base version updated to 1.25.2-1 + + + + + + + + + +base version updated to 1.25.1-1 + + + + + + + + + +base version updated to 1.25.0-1 + + + + + + + + + +base version updated to 1.23.4-1 + + + + + + + + + +base version updated to 1.23.3-1 + + + + + + + + + +base version updated to 1.23.2-1 + + + + + + + + + +base version updated to 1.23.1-1 + + + + + + + + + +base version updated to 1.23.0-1 + + + + + + + + + +base version updated to 1.21.6-1 + + + + + + + + + +base version updated to 1.21.5-1 + + + + + + + + + +base version updated to 1.21.4-1 + + + + + + + + + +base version updated to 1.21.3-1 + + + + + + + + + +base version updated to 1.21.2-1 + + + + + + + + + +base version updated to 1.21.1-1 + + + + + + + + + +base version updated to 1.21.0-1 + + + + + + + + + +base version updated to 1.19.10-1 + + + + + + + + + +base version updated to 1.19.9-1 + + + + + + + + + +base version updated to 1.19.8-1 + + + + + + + + + +base version updated to 1.19.7-1 + + + + + + + + + + +Initial release of brotli nginx module package. + + + + + + + diff --git a/sources/bxnginx1280modules/v2/nginx-module-headers-more.xml b/sources/bxnginx1280modules/v2/nginx-module-headers-more.xml new file mode 100644 index 0000000..ca7affb --- /dev/null +++ b/sources/bxnginx1280modules/v2/nginx-module-headers-more.xml @@ -0,0 +1,430 @@ + + + + + + + + + + +base version updated to 1.28.0-1 + + + + + + + + + +base version updated to 1.27.5-1 + + + + + + + + + +base version updated to 1.27.4-1 + + + + + + + + + +base version updated to 1.27.3-1 + + + + + + + + + +Updated headers-more module to 0.37 release. + + + + + + + + +base version updated to 1.27.2-1 + + + + + + + + + +base version updated to 1.27.1-1 + + + + + + + + + +base version updated to 1.27.0-2 + + + + + + + + + +base version updated to 1.27.0-1 + + + + + + + + + +base version updated to 1.25.5-1 + + + + + + + + + +base version updated to 1.25.4-1 + + + + + + + + + +Updated headers-more module to 0.35 release. + + + + + + + + + +base version updated to 1.25.3-1 + + + + + + + + + +base version updated to 1.25.2-1 + + + + + + + + + +base version updated to 1.25.1-1 + + + + + + + + + +base version updated to 1.25.0-1 + + + + + + + + + +base version updated to 1.23.4-1 + + + + + + + + + +base version updated to 1.23.3-1 + + + + + + + + + +Updated headers-more to git hash bea1be3bbf6af28f6aa8cf0c01c07ee1637e2bd0 +which is version 0.34 + + + + + + + + + +base version updated to 1.23.2-1 + + + + + + + + + +base version updated to 1.23.1-1 + + + + + + + + + +Updated headers-more to git hash d502e41996d24a382bd9c632e3ae3efa0a5fca66 +This fixes FTBFS with nginx 1.23.0+. + + + + + + + + + +base version updated to 1.23.0-1 + + + + + + + + + +base version updated to 1.21.6-1 + + + + + + + + + +base version updated to 1.21.5-1 + + + + + + + + + +base version updated to 1.21.4-1 + + + + + + + + + +base version updated to 1.21.3-1 + + + + + + + + + +base version updated to 1.21.2-1 + + + + + + + + + +base version updated to 1.21.1-1 + + + + + + + + + +base version updated to 1.21.0-1 + + + + + + + + + +base version updated to 1.19.10-1 + + + + + + + + + +base version updated to 1.19.9-1 + + + + + + + + + +base version updated to 1.19.8-1 + + + + + + + + + +base version updated to 1.19.7-1 + + + + + + + + + + +Initial release of headers more nginx module package. + + + + + + + diff --git a/sources/bxnginx1280modules/v2/nginx-module-zip.copyright b/sources/bxnginx1280modules/v2/nginx-module-zip.copyright new file mode 100644 index 0000000..5ffbca8 --- /dev/null +++ b/sources/bxnginx1280modules/v2/nginx-module-zip.copyright @@ -0,0 +1,28 @@ +/* + * Copyright 2007-2020 Evan Miller and contributors + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, this + * list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * 3. Neither the name of the copyright holder nor the names of its contributors + * may be used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER + * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ diff --git a/sources/bxnginx1280modules/v2/nginx-module-zip.xml b/sources/bxnginx1280modules/v2/nginx-module-zip.xml new file mode 100644 index 0000000..e76bd38 --- /dev/null +++ b/sources/bxnginx1280modules/v2/nginx-module-zip.xml @@ -0,0 +1,38 @@ + + + + + + + + +base version updated to 1.3.0-1 + + + + + + + +base version updated to 1.2.2-1 + + + + + + + +base version updated to 1.2.1-1 + + + + + + + +base version updated to 1.2.0-1 + + + + + diff --git a/sources/bxnginx1280modules/v3/Dockerfile b/sources/bxnginx1280modules/v3/Dockerfile new file mode 100644 index 0000000..200a923 --- /dev/null +++ b/sources/bxnginx1280modules/v3/Dockerfile @@ -0,0 +1,152 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "update.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# +FROM nginx:1.28.0-alpine-slim + +ENV NJS_VERSION=0.8.10 +ENV NJS_RELEASE=1 +ENV BROTLI_VERSION=1.0.9 +ENV GEOIP2_VERSION=3.4 +ENV HEADERSMORE_VERSION=0.39 +ENV ZIP_VERSION=1.3.0 +ENV NDK_VERSION=0.3.3 +ENV LUA_VERSION=0.10.28 + +COPY brotli_makefile /tmp/brotli_makefile +COPY brotli_shasum /tmp/brotli_shasum +COPY brotli_version /tmp/brotli_version +COPY nginx-module-brotli.xml /tmp/nginx-module-brotli.xml +COPY Makefile.module-brotli /tmp/Makefile.module-brotli + +RUN chown nobody:nobody /tmp/brotli_makefile && \ + chown nobody:nobody /tmp/brotli_shasum && \ + chown nobody:nobody /tmp/brotli_version && \ + chown nobody:nobody /tmp/nginx-module-brotli.xml && \ + chown nobody:nobody /tmp/Makefile.module-brotli + +COPY headersmore_shasum /tmp/headersmore_shasum +COPY headersmore_version /tmp/headersmore_version +COPY nginx-module-headers-more.xml /tmp/nginx-module-headers-more.xml + +RUN chown nobody:nobody /tmp/headersmore_shasum && \ + chown nobody:nobody /tmp/headersmore_version && \ + chown nobody:nobody /tmp/nginx-module-headers-more.xml + +COPY nginx-module-zip.copyright /tmp/nginx-module-zip.copyright +COPY nginx-module-zip.xml /tmp/nginx-module-zip.xml +COPY Makefile.module-zip /tmp/Makefile.module-zip +COPY mod_zip-${ZIP_VERSION}.tar.gz /tmp/mod_zip-${ZIP_VERSION}.tar.gz + +RUN chown nobody:nobody /tmp/nginx-module-zip.copyright && \ + chown nobody:nobody /tmp/nginx-module-zip.xml && \ + chown nobody:nobody /tmp/Makefile.module-zip && \ + chown nobody:nobody /tmp/mod_zip-${ZIP_VERSION}.tar.gz + +RUN set -x \ + && apkArch="$(cat /etc/apk/arch)" \ + && nginxPackages=" \ + nginx=${NGINX_VERSION}-r${PKG_RELEASE} \ + nginx-module-xslt=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-geoip=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-image-filter=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} \ + nginx-module-perl=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-brotli=${NGINX_VERSION}.${BROTLI_VERSION}-r${PKG_RELEASE} \ + nginx-module-geoip2=${NGINX_VERSION}.${GEOIP2_VERSION}-r${PKG_RELEASE} \ + nginx-module-ndk=${NGINX_VERSION}.${NDK_VERSION}-r${PKG_RELEASE} \ + nginx-module-lua=${NGINX_VERSION}.${LUA_VERSION}-r${PKG_RELEASE} \ + nginx-module-headers-more=${NGINX_VERSION}.${HEADERSMORE_VERSION}-r${PKG_RELEASE} \ + nginx-module-zip=${NGINX_VERSION}.${ZIP_VERSION}-r${PKG_RELEASE} \ + " \ +# install prerequisites for public key and pkg-oss checks + && apk add --no-cache --virtual .checksum-deps \ + openssl \ + && case "$apkArch" in \ + i386) \ +# arches officially built by upstream + apk add -X "https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \ + ;; \ + *) \ +# we're on an architecture upstream doesn't officially build for +# let's build binaries from the published packaging sources + set -x \ + && tempDir="$(mktemp -d)" \ + && chown nobody:nobody $tempDir \ + && apk add --no-cache --virtual .build-deps \ + gcc \ + libc-dev \ + make \ + openssl-dev \ + pcre2-dev \ + zlib-dev \ + linux-headers \ + libxslt-dev \ + gd-dev \ + geoip-dev \ + libedit-dev \ + bash \ + alpine-sdk \ + findutils \ + curl \ + cmake \ + wget \ + brotli-dev \ + libmaxminddb \ + libmaxminddb-dev \ + libzip-dev \ + xz \ + xz-dev \ + pcre \ + pcre-dev \ + perl-dev \ + && su nobody -s /bin/sh -c " \ + export HOME=${tempDir} \ + && cd ${tempDir} \ + && curl -f -L -O https://github.com/nginx/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && PKGOSSCHECKSUM=\"517bc18954ccf4efddd51986584ca1f37966833ad342a297e1fe58fd0faf14c5a4dabcb23519dca433878a2927a95d6bea05a6749ee2fa67a33bf24cdc41b1e4 *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \ + && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \ + echo \"pkg-oss tarball checksum verification succeeded!\"; \ + else \ + echo \"pkg-oss tarball checksum verification failed!\"; \ + exit 1; \ + fi \ + && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \ + && cd alpine \ + && sed -i 's/.*BASE_MODULES=.*/BASE_MODULES= geoip image-filter njs perl xslt brotli headers-more geoip2 ndk lua zip /' ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/alpine/Makefile \ + && mv -f /tmp/brotli_makefile ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/ngx_brotli/Makefile \ + && mv -f /tmp/brotli_shasum ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/ngx_brotli/SHA512SUMS \ + && mv -f /tmp/brotli_version ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/ngx_brotli/version \ + && mv -f /tmp/nginx-module-brotli.xml ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && mv -f /tmp/Makefile.module-brotli ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/alpine/Makefile.module-brotli \ + && mv -f /tmp/headersmore_shasum ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/headers-more-nginx-module/SHA512SUMS \ + && mv -f /tmp/headersmore_version ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/headers-more-nginx-module/version \ + && mv -f /tmp/nginx-module-headers-more.xml ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && mv /tmp/Makefile.module-zip ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/alpine/ \ + && mv /tmp/mod_zip-${ZIP_VERSION}.tar.gz ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/tarballs/ \ + && mv /tmp/nginx-module-zip.copyright ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && mv /tmp/nginx-module-zip.xml ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && make module-geoip module-image-filter module-njs module-perl module-xslt module-brotli module-headers-more module-geoip2 module-ndk module-lua module-zip \ + && apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \ + && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \ + " \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \ + && apk del --no-network .build-deps \ + && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \ + && mkdir -p /root/packages/ \ + && cp -R ${tempDir}/packages/alpine/* /root/packages/ \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /root/packages/${apkArch} \ + ;; \ + esac \ +# remove checksum deps + && apk del --no-network .checksum-deps \ +# if we have leftovers from building, let's purge them (including extra, unnecessary build deps) + && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \ + && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \ +# Bring in curl and ca-certificates to make registering on DNS SD easier + && apk add --no-cache tzdata curl ca-certificates openssl \ + && rm -rf /tmp/* + +VOLUME ["/root/packages/"] diff --git a/sources/bxnginx1280modules/v3/Dockerfile.origin b/sources/bxnginx1280modules/v3/Dockerfile.origin new file mode 100644 index 0000000..fb0c900 --- /dev/null +++ b/sources/bxnginx1280modules/v3/Dockerfile.origin @@ -0,0 +1,79 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "update.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# +FROM nginx:1.28.0-alpine-slim + +ENV NJS_VERSION 0.8.10 +ENV NJS_RELEASE 1 + +RUN set -x \ + && apkArch="$(cat /etc/apk/arch)" \ + && nginxPackages=" \ + nginx=${NGINX_VERSION}-r${PKG_RELEASE} \ + nginx-module-xslt=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-geoip=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-image-filter=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} \ + " \ +# install prerequisites for public key and pkg-oss checks + && apk add --no-cache --virtual .checksum-deps \ + openssl \ + && case "$apkArch" in \ + x86_64|aarch64) \ +# arches officially built by upstream + apk add -X "https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \ + ;; \ + *) \ +# we're on an architecture upstream doesn't officially build for +# let's build binaries from the published packaging sources + set -x \ + && tempDir="$(mktemp -d)" \ + && chown nobody:nobody $tempDir \ + && apk add --no-cache --virtual .build-deps \ + gcc \ + libc-dev \ + make \ + openssl-dev \ + pcre2-dev \ + zlib-dev \ + linux-headers \ + libxslt-dev \ + gd-dev \ + geoip-dev \ + libedit-dev \ + bash \ + alpine-sdk \ + findutils \ + curl \ + && su nobody -s /bin/sh -c " \ + export HOME=${tempDir} \ + && cd ${tempDir} \ + && curl -f -L -O https://github.com/nginx/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && PKGOSSCHECKSUM=\"517bc18954ccf4efddd51986584ca1f37966833ad342a297e1fe58fd0faf14c5a4dabcb23519dca433878a2927a95d6bea05a6749ee2fa67a33bf24cdc41b1e4 *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \ + && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \ + echo \"pkg-oss tarball checksum verification succeeded!\"; \ + else \ + echo \"pkg-oss tarball checksum verification failed!\"; \ + exit 1; \ + fi \ + && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \ + && cd alpine \ + && make module-geoip module-image-filter module-njs module-xslt \ + && apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \ + && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \ + " \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \ + && apk del --no-network .build-deps \ + && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \ + ;; \ + esac \ +# remove checksum deps + && apk del --no-network .checksum-deps \ +# if we have leftovers from building, let's purge them (including extra, unnecessary build deps) + && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \ + && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \ +# Bring in curl and ca-certificates to make registering on DNS SD easier + && apk add --no-cache curl ca-certificates diff --git a/sources/bxnginx1280modules/v3/Makefile.module-brotli b/sources/bxnginx1280modules/v3/Makefile.module-brotli new file mode 100644 index 0000000..d2f69b1 --- /dev/null +++ b/sources/bxnginx1280modules/v3/Makefile.module-brotli @@ -0,0 +1,39 @@ +MODULES+= brotli + +MODULE_SUMMARY_brotli= 3rd-party brotli compression dynamic modules + +include $(CONTRIB)/src/ngx_brotli/version + +MODULE_VERSION_brotli= $(NGX_BROTLI_VERSION) +MODULE_RELEASE_brotli= 1 + +MODULE_VERSION_PREFIX_brotli=$(MODULE_TARGET_PREFIX) + +MODULE_SOURCES_brotli= ngx_brotli-$(NGX_BROTLI_VERSION).tar.gz + +MODULE_CONFARGS_brotli= --add-dynamic-module=$(MODSRC_PREFIX)ngx_brotli-$(NGX_BROTLI_VERSION) + +.deps-module-brotli: + cd $(CONTRIB) && make .sum-ngx_brotli + touch $@ + +MODULE_BUILD_DEPENDS_brotli=brotli-dev + +define MODULE_POST_brotli +cat < + + + + + + + + + +base version updated to 1.28.0-1 + + + + + + + + + +base version updated to 1.27.5-1 + + + + + + + + + +base version updated to 1.27.4-1 + + + + + + + + + +base version updated to 1.27.3-1 + + + + + + + + + +base version updated to 1.27.2-1 + + + + + + + + + +base version updated to 1.27.1-1 + + + + + + + + + +base version updated to 1.27.0-2 + + + + + + + + + +base version updated to 1.27.0-1 + + + + + + + + + +base version updated to 1.25.5-1 + + + + + + + + + +base version updated to 1.25.4-1 + + + + + + + + + +base version updated to 1.25.3-1 + + + + + + + + + +base version updated to 1.25.2-1 + + + + + + + + + +base version updated to 1.25.1-1 + + + + + + + + + +base version updated to 1.25.0-1 + + + + + + + + + +base version updated to 1.23.4-1 + + + + + + + + + +base version updated to 1.23.3-1 + + + + + + + + + +base version updated to 1.23.2-1 + + + + + + + + + +base version updated to 1.23.1-1 + + + + + + + + + +base version updated to 1.23.0-1 + + + + + + + + + +base version updated to 1.21.6-1 + + + + + + + + + +base version updated to 1.21.5-1 + + + + + + + + + +base version updated to 1.21.4-1 + + + + + + + + + +base version updated to 1.21.3-1 + + + + + + + + + +base version updated to 1.21.2-1 + + + + + + + + + +base version updated to 1.21.1-1 + + + + + + + + + +base version updated to 1.21.0-1 + + + + + + + + + +base version updated to 1.19.10-1 + + + + + + + + + +base version updated to 1.19.9-1 + + + + + + + + + +base version updated to 1.19.8-1 + + + + + + + + + +base version updated to 1.19.7-1 + + + + + + + + + + +Initial release of brotli nginx module package. + + + + + + + diff --git a/sources/bxnginx1280modules/v3/nginx-module-headers-more.xml b/sources/bxnginx1280modules/v3/nginx-module-headers-more.xml new file mode 100644 index 0000000..ca7affb --- /dev/null +++ b/sources/bxnginx1280modules/v3/nginx-module-headers-more.xml @@ -0,0 +1,430 @@ + + + + + + + + + + +base version updated to 1.28.0-1 + + + + + + + + + +base version updated to 1.27.5-1 + + + + + + + + + +base version updated to 1.27.4-1 + + + + + + + + + +base version updated to 1.27.3-1 + + + + + + + + + +Updated headers-more module to 0.37 release. + + + + + + + + +base version updated to 1.27.2-1 + + + + + + + + + +base version updated to 1.27.1-1 + + + + + + + + + +base version updated to 1.27.0-2 + + + + + + + + + +base version updated to 1.27.0-1 + + + + + + + + + +base version updated to 1.25.5-1 + + + + + + + + + +base version updated to 1.25.4-1 + + + + + + + + + +Updated headers-more module to 0.35 release. + + + + + + + + + +base version updated to 1.25.3-1 + + + + + + + + + +base version updated to 1.25.2-1 + + + + + + + + + +base version updated to 1.25.1-1 + + + + + + + + + +base version updated to 1.25.0-1 + + + + + + + + + +base version updated to 1.23.4-1 + + + + + + + + + +base version updated to 1.23.3-1 + + + + + + + + + +Updated headers-more to git hash bea1be3bbf6af28f6aa8cf0c01c07ee1637e2bd0 +which is version 0.34 + + + + + + + + + +base version updated to 1.23.2-1 + + + + + + + + + +base version updated to 1.23.1-1 + + + + + + + + + +Updated headers-more to git hash d502e41996d24a382bd9c632e3ae3efa0a5fca66 +This fixes FTBFS with nginx 1.23.0+. + + + + + + + + + +base version updated to 1.23.0-1 + + + + + + + + + +base version updated to 1.21.6-1 + + + + + + + + + +base version updated to 1.21.5-1 + + + + + + + + + +base version updated to 1.21.4-1 + + + + + + + + + +base version updated to 1.21.3-1 + + + + + + + + + +base version updated to 1.21.2-1 + + + + + + + + + +base version updated to 1.21.1-1 + + + + + + + + + +base version updated to 1.21.0-1 + + + + + + + + + +base version updated to 1.19.10-1 + + + + + + + + + +base version updated to 1.19.9-1 + + + + + + + + + +base version updated to 1.19.8-1 + + + + + + + + + +base version updated to 1.19.7-1 + + + + + + + + + + +Initial release of headers more nginx module package. + + + + + + + diff --git a/sources/bxnginx1280modules/v3/nginx-module-zip.copyright b/sources/bxnginx1280modules/v3/nginx-module-zip.copyright new file mode 100644 index 0000000..5ffbca8 --- /dev/null +++ b/sources/bxnginx1280modules/v3/nginx-module-zip.copyright @@ -0,0 +1,28 @@ +/* + * Copyright 2007-2020 Evan Miller and contributors + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, this + * list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * 3. Neither the name of the copyright holder nor the names of its contributors + * may be used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER + * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ diff --git a/sources/bxnginx1280modules/v3/nginx-module-zip.xml b/sources/bxnginx1280modules/v3/nginx-module-zip.xml new file mode 100644 index 0000000..e76bd38 --- /dev/null +++ b/sources/bxnginx1280modules/v3/nginx-module-zip.xml @@ -0,0 +1,38 @@ + + + + + + + + +base version updated to 1.3.0-1 + + + + + + + +base version updated to 1.2.2-1 + + + + + + + +base version updated to 1.2.1-1 + + + + + + + +base version updated to 1.2.0-1 + + + + + diff --git a/sources/bxnginx1281/Dockerfile b/sources/bxnginx1281/Dockerfile new file mode 100644 index 0000000..67ee152 --- /dev/null +++ b/sources/bxnginx1281/Dockerfile @@ -0,0 +1,33 @@ +FROM nginx:1.28.1-alpine-slim + +USER root + +RUN cd /root/ && \ + apk add --no-cache git curl openssl ca-certificates tzdata && \ + git clone https://github.com/bitrix-tools/nginx-modules.git && \ + cp /root/nginx-modules/packages/1.28.1/v1/alpine/v3.23/main/$(uname -m)/abuild-key.rsa.pub /etc/apk/keys/ && \ + echo "/root/nginx-modules/packages/1.28.1/v1/alpine/v3.23/main" >> /etc/apk/repositories && \ + apk update && \ + apk add nginx-module-xslt nginx-module-geoip nginx-module-image-filter nginx-module-njs nginx-module-perl nginx-module-brotli nginx-module-geoip2 nginx-module-ndk nginx-module-lua nginx-module-headers-more nginx-module-zip && \ + apk del git && \ + sed -i "s/.*1.28.1.*//" /etc/apk/repositories && \ + rm -f /etc/apk/keys/abuild-key.rsa.pub && \ + rm -rf /root/nginx-modules + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/msmtp /opt/browscap /opt/geoip2 /ssl /var/runs/nginx && \ + chown -R bitrix:bitrix /var/log/nginx && \ + chown -R bitrix:bitrix /var/cache/nginx && \ + chown -R bitrix:bitrix /var/runs/nginx && \ + chown -R bitrix:bitrix /usr/lib/nginx/modules && \ + chown -R bitrix:bitrix /etc/nginx && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxnginx1281modules/v1/Dockerfile b/sources/bxnginx1281modules/v1/Dockerfile new file mode 100644 index 0000000..124b92d --- /dev/null +++ b/sources/bxnginx1281modules/v1/Dockerfile @@ -0,0 +1,153 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "update.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# +FROM nginx:1.28.1-alpine-slim + +ENV NJS_VERSION=0.9.4 +ENV NJS_RELEASE=1 +ENV BROTLI_VERSION=1.0.9 +ENV GEOIP2_VERSION=3.4 +ENV HEADERSMORE_VERSION=0.39 +ENV ZIP_VERSION=1.3.0 +ENV NDK_VERSION=0.3.3 +ENV LUA_VERSION=0.10.28 + +COPY brotli_makefile /tmp/brotli_makefile +COPY brotli_shasum /tmp/brotli_shasum +COPY brotli_version /tmp/brotli_version +COPY nginx-module-brotli.xml /tmp/nginx-module-brotli.xml +COPY Makefile.module-brotli /tmp/Makefile.module-brotli + +RUN chown nobody:nobody /tmp/brotli_makefile && \ + chown nobody:nobody /tmp/brotli_shasum && \ + chown nobody:nobody /tmp/brotli_version && \ + chown nobody:nobody /tmp/nginx-module-brotli.xml && \ + chown nobody:nobody /tmp/Makefile.module-brotli + +COPY headersmore_shasum /tmp/headersmore_shasum +COPY headersmore_version /tmp/headersmore_version +COPY nginx-module-headers-more.xml /tmp/nginx-module-headers-more.xml + +RUN chown nobody:nobody /tmp/headersmore_shasum && \ + chown nobody:nobody /tmp/headersmore_version && \ + chown nobody:nobody /tmp/nginx-module-headers-more.xml + +COPY nginx-module-zip.copyright /tmp/nginx-module-zip.copyright +COPY nginx-module-zip.xml /tmp/nginx-module-zip.xml +COPY Makefile.module-zip /tmp/Makefile.module-zip +COPY mod_zip-${ZIP_VERSION}.tar.gz /tmp/mod_zip-${ZIP_VERSION}.tar.gz + +RUN chown nobody:nobody /tmp/nginx-module-zip.copyright && \ + chown nobody:nobody /tmp/nginx-module-zip.xml && \ + chown nobody:nobody /tmp/Makefile.module-zip && \ + chown nobody:nobody /tmp/mod_zip-${ZIP_VERSION}.tar.gz + +RUN set -x \ + && apkArch="$(cat /etc/apk/arch)" \ + && nginxPackages=" \ + nginx=${NGINX_VERSION}-r${PKG_RELEASE} \ + nginx-module-xslt=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-geoip=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-image-filter=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} \ + nginx-module-perl=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-brotli=${NGINX_VERSION}.${BROTLI_VERSION}-r${PKG_RELEASE} \ + nginx-module-geoip2=${NGINX_VERSION}.${GEOIP2_VERSION}-r${PKG_RELEASE} \ + nginx-module-ndk=${NGINX_VERSION}.${NDK_VERSION}-r${PKG_RELEASE} \ + nginx-module-lua=${NGINX_VERSION}.${LUA_VERSION}-r${PKG_RELEASE} \ + nginx-module-headers-more=${NGINX_VERSION}.${HEADERSMORE_VERSION}-r${PKG_RELEASE} \ + nginx-module-zip=${NGINX_VERSION}.${ZIP_VERSION}-r${PKG_RELEASE} \ + " \ +# install prerequisites for public key and pkg-oss checks + && apk add --no-cache --virtual .checksum-deps \ + openssl \ + && case "$apkArch" in \ + i386) \ +# arches officially built by upstream + apk add -X "https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \ + ;; \ + *) \ +# we're on an architecture upstream doesn't officially build for +# let's build binaries from the published packaging sources + set -x \ + && tempDir="$(mktemp -d)" \ + && chown nobody:nobody $tempDir \ + && apk add --no-cache --virtual .build-deps \ + gcc \ + libc-dev \ + make \ + openssl-dev \ + pcre2 \ + pcre2-dev \ + zlib-dev \ + linux-headers \ + libxslt-dev \ + gd-dev \ + geoip-dev \ + libedit-dev \ + bash \ + alpine-sdk \ + findutils \ + curl \ + cmake \ + wget \ + brotli-dev \ + libmaxminddb \ + libmaxminddb-dev \ + libzip-dev \ + xz \ + xz-dev \ + pcre \ + pcre-dev \ + perl-dev \ + && su nobody -s /bin/sh -c " \ + export HOME=${tempDir} \ + && cd ${tempDir} \ + && curl -f -L -O https://github.com/nginx/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && PKGOSSCHECKSUM=\"4d43d5eadf39a2428e91a4e6fde0188f1cfb76354598d818d2ef2f8ff5cfa8d65993248b19a2d7ae663798d2362905e63ebd5dca6ca82cabc2831631d0e079ea *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \ + && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \ + echo \"pkg-oss tarball checksum verification succeeded!\"; \ + else \ + echo \"pkg-oss tarball checksum verification failed!\"; \ + exit 1; \ + fi \ + && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \ + && cd alpine \ + && sed -i 's/.*BASE_MODULES=.*/BASE_MODULES= geoip image-filter njs perl xslt brotli headers-more geoip2 ndk lua zip /' ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/alpine/Makefile \ + && mv -f /tmp/brotli_makefile ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/ngx_brotli/Makefile \ + && mv -f /tmp/brotli_shasum ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/ngx_brotli/SHA512SUMS \ + && mv -f /tmp/brotli_version ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/ngx_brotli/version \ + && mv -f /tmp/nginx-module-brotli.xml ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && mv -f /tmp/Makefile.module-brotli ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/alpine/Makefile.module-brotli \ + && mv -f /tmp/headersmore_shasum ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/headers-more-nginx-module/SHA512SUMS \ + && mv -f /tmp/headersmore_version ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/headers-more-nginx-module/version \ + && mv -f /tmp/nginx-module-headers-more.xml ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && mv /tmp/Makefile.module-zip ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/alpine/ \ + && mv /tmp/mod_zip-${ZIP_VERSION}.tar.gz ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/tarballs/ \ + && mv /tmp/nginx-module-zip.copyright ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && mv /tmp/nginx-module-zip.xml ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && make module-geoip module-image-filter module-njs module-perl module-xslt module-brotli module-headers-more module-geoip2 module-ndk module-lua module-zip \ + && apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \ + && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \ + " \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \ + && apk del --no-network .build-deps \ + && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \ + && mkdir -p /root/packages/ \ + && cp -R ${tempDir}/packages/alpine/* /root/packages/ \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /root/packages/${apkArch} \ + ;; \ + esac \ +# remove checksum deps + && apk del --no-network .checksum-deps \ +# if we have leftovers from building, let's purge them (including extra, unnecessary build deps) + && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \ + && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \ +# Bring in curl and ca-certificates to make registering on DNS SD easier + && apk add --no-cache tzdata curl ca-certificates openssl \ + && rm -rf /tmp/* + +VOLUME ["/root/packages/"] diff --git a/sources/bxnginx1281modules/v1/Dockerfile.origin b/sources/bxnginx1281modules/v1/Dockerfile.origin new file mode 100644 index 0000000..74510b8 --- /dev/null +++ b/sources/bxnginx1281modules/v1/Dockerfile.origin @@ -0,0 +1,79 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "update.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# +FROM nginx:1.28.1-alpine-slim + +ENV NJS_VERSION 0.9.4 +ENV NJS_RELEASE 1 + +RUN set -x \ + && apkArch="$(cat /etc/apk/arch)" \ + && nginxPackages=" \ + nginx=${NGINX_VERSION}-r${PKG_RELEASE} \ + nginx-module-xslt=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-geoip=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-image-filter=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} \ + " \ +# install prerequisites for public key and pkg-oss checks + && apk add --no-cache --virtual .checksum-deps \ + openssl \ + && case "$apkArch" in \ + x86_64|aarch64) \ +# arches officially built by upstream + apk add -X "https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \ + ;; \ + *) \ +# we're on an architecture upstream doesn't officially build for +# let's build binaries from the published packaging sources + set -x \ + && tempDir="$(mktemp -d)" \ + && chown nobody:nobody $tempDir \ + && apk add --no-cache --virtual .build-deps \ + gcc \ + libc-dev \ + make \ + openssl-dev \ + pcre2-dev \ + zlib-dev \ + linux-headers \ + libxslt-dev \ + gd-dev \ + geoip-dev \ + libedit-dev \ + bash \ + alpine-sdk \ + findutils \ + curl \ + && su nobody -s /bin/sh -c " \ + export HOME=${tempDir} \ + && cd ${tempDir} \ + && curl -f -L -O https://github.com/nginx/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && PKGOSSCHECKSUM=\"4d43d5eadf39a2428e91a4e6fde0188f1cfb76354598d818d2ef2f8ff5cfa8d65993248b19a2d7ae663798d2362905e63ebd5dca6ca82cabc2831631d0e079ea *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \ + && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \ + echo \"pkg-oss tarball checksum verification succeeded!\"; \ + else \ + echo \"pkg-oss tarball checksum verification failed!\"; \ + exit 1; \ + fi \ + && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \ + && cd alpine \ + && make module-geoip module-image-filter module-njs module-xslt \ + && apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \ + && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \ + " \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \ + && apk del --no-network .build-deps \ + && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \ + ;; \ + esac \ +# remove checksum deps + && apk del --no-network .checksum-deps \ +# if we have leftovers from building, let's purge them (including extra, unnecessary build deps) + && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \ + && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \ +# Bring in curl and ca-certificates to make registering on DNS SD easier + && apk add --no-cache curl ca-certificates diff --git a/sources/bxnginx1281modules/v1/Makefile.module-brotli b/sources/bxnginx1281modules/v1/Makefile.module-brotli new file mode 100644 index 0000000..d2f69b1 --- /dev/null +++ b/sources/bxnginx1281modules/v1/Makefile.module-brotli @@ -0,0 +1,39 @@ +MODULES+= brotli + +MODULE_SUMMARY_brotli= 3rd-party brotli compression dynamic modules + +include $(CONTRIB)/src/ngx_brotli/version + +MODULE_VERSION_brotli= $(NGX_BROTLI_VERSION) +MODULE_RELEASE_brotli= 1 + +MODULE_VERSION_PREFIX_brotli=$(MODULE_TARGET_PREFIX) + +MODULE_SOURCES_brotli= ngx_brotli-$(NGX_BROTLI_VERSION).tar.gz + +MODULE_CONFARGS_brotli= --add-dynamic-module=$(MODSRC_PREFIX)ngx_brotli-$(NGX_BROTLI_VERSION) + +.deps-module-brotli: + cd $(CONTRIB) && make .sum-ngx_brotli + touch $@ + +MODULE_BUILD_DEPENDS_brotli=brotli-dev + +define MODULE_POST_brotli +cat < + + + + + + + + + +base version updated to 1.28.0-1 + + + + + + + + + +base version updated to 1.27.5-1 + + + + + + + + + +base version updated to 1.27.4-1 + + + + + + + + + +base version updated to 1.27.3-1 + + + + + + + + + +base version updated to 1.27.2-1 + + + + + + + + + +base version updated to 1.27.1-1 + + + + + + + + + +base version updated to 1.27.0-2 + + + + + + + + + +base version updated to 1.27.0-1 + + + + + + + + + +base version updated to 1.25.5-1 + + + + + + + + + +base version updated to 1.25.4-1 + + + + + + + + + +base version updated to 1.25.3-1 + + + + + + + + + +base version updated to 1.25.2-1 + + + + + + + + + +base version updated to 1.25.1-1 + + + + + + + + + +base version updated to 1.25.0-1 + + + + + + + + + +base version updated to 1.23.4-1 + + + + + + + + + +base version updated to 1.23.3-1 + + + + + + + + + +base version updated to 1.23.2-1 + + + + + + + + + +base version updated to 1.23.1-1 + + + + + + + + + +base version updated to 1.23.0-1 + + + + + + + + + +base version updated to 1.21.6-1 + + + + + + + + + +base version updated to 1.21.5-1 + + + + + + + + + +base version updated to 1.21.4-1 + + + + + + + + + +base version updated to 1.21.3-1 + + + + + + + + + +base version updated to 1.21.2-1 + + + + + + + + + +base version updated to 1.21.1-1 + + + + + + + + + +base version updated to 1.21.0-1 + + + + + + + + + +base version updated to 1.19.10-1 + + + + + + + + + +base version updated to 1.19.9-1 + + + + + + + + + +base version updated to 1.19.8-1 + + + + + + + + + +base version updated to 1.19.7-1 + + + + + + + + + + +Initial release of brotli nginx module package. + + + + + + + diff --git a/sources/bxnginx1281modules/v1/nginx-module-headers-more.xml b/sources/bxnginx1281modules/v1/nginx-module-headers-more.xml new file mode 100644 index 0000000..ca7affb --- /dev/null +++ b/sources/bxnginx1281modules/v1/nginx-module-headers-more.xml @@ -0,0 +1,430 @@ + + + + + + + + + + +base version updated to 1.28.0-1 + + + + + + + + + +base version updated to 1.27.5-1 + + + + + + + + + +base version updated to 1.27.4-1 + + + + + + + + + +base version updated to 1.27.3-1 + + + + + + + + + +Updated headers-more module to 0.37 release. + + + + + + + + +base version updated to 1.27.2-1 + + + + + + + + + +base version updated to 1.27.1-1 + + + + + + + + + +base version updated to 1.27.0-2 + + + + + + + + + +base version updated to 1.27.0-1 + + + + + + + + + +base version updated to 1.25.5-1 + + + + + + + + + +base version updated to 1.25.4-1 + + + + + + + + + +Updated headers-more module to 0.35 release. + + + + + + + + + +base version updated to 1.25.3-1 + + + + + + + + + +base version updated to 1.25.2-1 + + + + + + + + + +base version updated to 1.25.1-1 + + + + + + + + + +base version updated to 1.25.0-1 + + + + + + + + + +base version updated to 1.23.4-1 + + + + + + + + + +base version updated to 1.23.3-1 + + + + + + + + + +Updated headers-more to git hash bea1be3bbf6af28f6aa8cf0c01c07ee1637e2bd0 +which is version 0.34 + + + + + + + + + +base version updated to 1.23.2-1 + + + + + + + + + +base version updated to 1.23.1-1 + + + + + + + + + +Updated headers-more to git hash d502e41996d24a382bd9c632e3ae3efa0a5fca66 +This fixes FTBFS with nginx 1.23.0+. + + + + + + + + + +base version updated to 1.23.0-1 + + + + + + + + + +base version updated to 1.21.6-1 + + + + + + + + + +base version updated to 1.21.5-1 + + + + + + + + + +base version updated to 1.21.4-1 + + + + + + + + + +base version updated to 1.21.3-1 + + + + + + + + + +base version updated to 1.21.2-1 + + + + + + + + + +base version updated to 1.21.1-1 + + + + + + + + + +base version updated to 1.21.0-1 + + + + + + + + + +base version updated to 1.19.10-1 + + + + + + + + + +base version updated to 1.19.9-1 + + + + + + + + + +base version updated to 1.19.8-1 + + + + + + + + + +base version updated to 1.19.7-1 + + + + + + + + + + +Initial release of headers more nginx module package. + + + + + + + diff --git a/sources/bxnginx1281modules/v1/nginx-module-zip.copyright b/sources/bxnginx1281modules/v1/nginx-module-zip.copyright new file mode 100644 index 0000000..5ffbca8 --- /dev/null +++ b/sources/bxnginx1281modules/v1/nginx-module-zip.copyright @@ -0,0 +1,28 @@ +/* + * Copyright 2007-2020 Evan Miller and contributors + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, this + * list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * 3. Neither the name of the copyright holder nor the names of its contributors + * may be used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER + * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ diff --git a/sources/bxnginx1281modules/v1/nginx-module-zip.xml b/sources/bxnginx1281modules/v1/nginx-module-zip.xml new file mode 100644 index 0000000..e76bd38 --- /dev/null +++ b/sources/bxnginx1281modules/v1/nginx-module-zip.xml @@ -0,0 +1,38 @@ + + + + + + + + +base version updated to 1.3.0-1 + + + + + + + +base version updated to 1.2.2-1 + + + + + + + +base version updated to 1.2.1-1 + + + + + + + +base version updated to 1.2.0-1 + + + + + diff --git a/sources/bxnginx1282/Dockerfile b/sources/bxnginx1282/Dockerfile new file mode 100644 index 0000000..4285016 --- /dev/null +++ b/sources/bxnginx1282/Dockerfile @@ -0,0 +1,33 @@ +FROM nginx:1.28.2-alpine-slim + +USER root + +RUN cd /root/ && \ + apk add --no-cache git curl openssl ca-certificates tzdata && \ + git clone https://github.com/bitrix-tools/nginx-modules.git && \ + cp /root/nginx-modules/packages/1.28.2/v1/alpine/v3.23/main/$(uname -m)/abuild-key.rsa.pub /etc/apk/keys/ && \ + echo "/root/nginx-modules/packages/1.28.2/v1/alpine/v3.23/main" >> /etc/apk/repositories && \ + apk update && \ + apk add nginx-module-xslt nginx-module-geoip nginx-module-image-filter nginx-module-njs nginx-module-acme nginx-module-perl nginx-module-brotli nginx-module-geoip2 nginx-module-ndk nginx-module-lua nginx-module-headers-more nginx-module-zip && \ + apk del git && \ + sed -i "s/.*1.28.2.*//" /etc/apk/repositories && \ + rm -f /etc/apk/keys/abuild-key.rsa.pub && \ + rm -rf /root/nginx-modules + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/msmtp /opt/browscap /opt/geoip2 /ssl /var/runs/nginx && \ + chown -R bitrix:bitrix /var/log/nginx && \ + chown -R bitrix:bitrix /var/cache/nginx && \ + chown -R bitrix:bitrix /var/runs/nginx && \ + chown -R bitrix:bitrix /usr/lib/nginx/modules && \ + chown -R bitrix:bitrix /etc/nginx && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxnginx1282modules/v1/Dockerfile b/sources/bxnginx1282modules/v1/Dockerfile new file mode 100644 index 0000000..3a83591 --- /dev/null +++ b/sources/bxnginx1282modules/v1/Dockerfile @@ -0,0 +1,160 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "update.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# +FROM nginx:1.28.2-alpine-slim + +ENV NJS_VERSION=0.9.5 +ENV NJS_RELEASE=1 +ENV ACME_VERSION=0.3.1 +ENV BROTLI_VERSION=1.0.9 +ENV GEOIP2_VERSION=3.4 +ENV HEADERSMORE_VERSION=0.39 +ENV ZIP_VERSION=1.3.0 +ENV NDK_VERSION=0.3.3 +ENV LUA_VERSION=0.10.28 + +COPY brotli_makefile /tmp/brotli_makefile +COPY brotli_shasum /tmp/brotli_shasum +COPY brotli_version /tmp/brotli_version +COPY nginx-module-brotli.xml /tmp/nginx-module-brotli.xml +COPY Makefile.module-brotli /tmp/Makefile.module-brotli + +RUN chown nobody:nobody /tmp/brotli_makefile && \ + chown nobody:nobody /tmp/brotli_shasum && \ + chown nobody:nobody /tmp/brotli_version && \ + chown nobody:nobody /tmp/nginx-module-brotli.xml && \ + chown nobody:nobody /tmp/Makefile.module-brotli + +COPY headersmore_shasum /tmp/headersmore_shasum +COPY headersmore_version /tmp/headersmore_version +COPY nginx-module-headers-more.xml /tmp/nginx-module-headers-more.xml + +RUN chown nobody:nobody /tmp/headersmore_shasum && \ + chown nobody:nobody /tmp/headersmore_version && \ + chown nobody:nobody /tmp/nginx-module-headers-more.xml + +COPY nginx-module-zip.copyright /tmp/nginx-module-zip.copyright +COPY nginx-module-zip.xml /tmp/nginx-module-zip.xml +COPY Makefile.module-zip /tmp/Makefile.module-zip +COPY mod_zip-${ZIP_VERSION}.tar.gz /tmp/mod_zip-${ZIP_VERSION}.tar.gz + +RUN chown nobody:nobody /tmp/nginx-module-zip.copyright && \ + chown nobody:nobody /tmp/nginx-module-zip.xml && \ + chown nobody:nobody /tmp/Makefile.module-zip && \ + chown nobody:nobody /tmp/mod_zip-${ZIP_VERSION}.tar.gz + +RUN set -x \ + && apkArch="$(cat /etc/apk/arch)" \ + && nginxPackages=" \ + nginx=${NGINX_VERSION}-r${PKG_RELEASE} \ + nginx-module-xslt=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-geoip=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-image-filter=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} \ + nginx-module-acme=${NGINX_VERSION}.${ACME_VERSION}-r${PKG_RELEASE} \ + nginx-module-perl=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-brotli=${NGINX_VERSION}.${BROTLI_VERSION}-r${PKG_RELEASE} \ + nginx-module-geoip2=${NGINX_VERSION}.${GEOIP2_VERSION}-r${PKG_RELEASE} \ + nginx-module-ndk=${NGINX_VERSION}.${NDK_VERSION}-r${PKG_RELEASE} \ + nginx-module-lua=${NGINX_VERSION}.${LUA_VERSION}-r${PKG_RELEASE} \ + nginx-module-headers-more=${NGINX_VERSION}.${HEADERSMORE_VERSION}-r${PKG_RELEASE} \ + nginx-module-zip=${NGINX_VERSION}.${ZIP_VERSION}-r${PKG_RELEASE} \ + " \ +# install prerequisites for public key and pkg-oss checks + && apk add --no-cache --virtual .checksum-deps \ + openssl \ + && case "$apkArch" in \ + i386) \ +# arches officially built by upstream + apk add -X "https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \ + ;; \ + *) \ +# we're on an architecture upstream doesn't officially build for +# let's build binaries from the published packaging sources + set -x \ + && tempDir="$(mktemp -d)" \ + && chown nobody:nobody $tempDir \ + && apk add --no-cache --virtual .build-deps \ + gcc \ + libc-dev \ + make \ + openssl-dev \ + pcre2 \ + pcre2-dev \ + zlib-dev \ + linux-headers \ + libxslt-dev \ + gd-dev \ + geoip-dev \ + libedit-dev \ + bash \ + alpine-sdk \ + findutils \ + curl \ + cargo \ + clang-libclang \ + cmake \ + wget \ + brotli-dev \ + libmaxminddb \ + libmaxminddb-dev \ + libzip-dev \ + xz \ + xz-dev \ + pcre \ + pcre-dev \ + perl-dev \ + && su nobody -s /bin/sh -c " \ + export HOME=${tempDir} \ + && cd ${tempDir} \ + && curl -f -L -O https://github.com/nginx/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && PKGOSSCHECKSUM=\"ef4545c05b1632a056482e3dbb47bb5d7393238318db3491e8bb308218cdb5f32dbb2ac73509097ac2426fd73270bc97836843a8b1846a396fd94e60826f7e3f *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \ + && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \ + echo \"pkg-oss tarball checksum verification succeeded!\"; \ + else \ + echo \"pkg-oss tarball checksum verification failed!\"; \ + exit 1; \ + fi \ + && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \ + && cd alpine \ + && sed -i 's/.*BASE_MODULES=.*/BASE_MODULES= geoip image-filter njs perl xslt brotli headers-more geoip2 ndk lua zip /' ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/alpine/Makefile \ + && mv -f /tmp/brotli_makefile ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/ngx_brotli/Makefile \ + && mv -f /tmp/brotli_shasum ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/ngx_brotli/SHA512SUMS \ + && mv -f /tmp/brotli_version ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/ngx_brotli/version \ + && mv -f /tmp/nginx-module-brotli.xml ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && mv -f /tmp/Makefile.module-brotli ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/alpine/Makefile.module-brotli \ + && mv -f /tmp/headersmore_shasum ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/headers-more-nginx-module/SHA512SUMS \ + && mv -f /tmp/headersmore_version ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/src/headers-more-nginx-module/version \ + && mv -f /tmp/nginx-module-headers-more.xml ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && mv /tmp/Makefile.module-zip ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/alpine/ \ + && mv /tmp/mod_zip-${ZIP_VERSION}.tar.gz ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/contrib/tarballs/ \ + && mv /tmp/nginx-module-zip.copyright ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && mv /tmp/nginx-module-zip.xml ${tempDir}/pkg-oss-${NGINX_VERSION}-${PKG_RELEASE}/docs/ \ + && export BUILDTARGET=\"module-geoip module-image-filter module-njs module-acme module-perl module-xslt module-brotli module-headers-more module-geoip2 module-ndk module-lua module-zip\" \ + && if [ \"\$(apk --print-arch)\" = \"armhf\" ]; then BUILDTARGET=\"\$( echo \$BUILDTARGET | sed 's,module-acme,,' )\"; fi \ + && make \$BUILDTARGET \ + && apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \ + && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \ + " \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \ + && apk del --no-network .build-deps \ + && if [ "$apkArch" = "armhf" ]; then nginxPackages="$( echo $nginxPackages | sed 's,nginx-module-acme=.*,,')"; fi \ + && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \ + && mkdir -p /root/packages/ \ + && cp -R ${tempDir}/packages/alpine/* /root/packages/ \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /root/packages/${apkArch} \ + ;; \ + esac \ +# remove checksum deps + && apk del --no-network .checksum-deps \ +# if we have leftovers from building, let's purge them (including extra, unnecessary build deps) + && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \ + && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \ +# Bring in curl and ca-certificates to make registering on DNS SD easier + && apk add --no-cache tzdata curl ca-certificates openssl \ + && rm -rf /tmp/* + +VOLUME ["/root/packages/"] diff --git a/sources/bxnginx1282modules/v1/Dockerfile.origin b/sources/bxnginx1282modules/v1/Dockerfile.origin new file mode 100644 index 0000000..a78880d --- /dev/null +++ b/sources/bxnginx1282modules/v1/Dockerfile.origin @@ -0,0 +1,86 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "update.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# +FROM nginx:1.28.2-alpine-slim + +ENV NJS_VERSION 0.9.5 +ENV NJS_RELEASE 1 +ENV ACME_VERSION 0.3.1 + +RUN set -x \ + && apkArch="$(cat /etc/apk/arch)" \ + && nginxPackages=" \ + nginx=${NGINX_VERSION}-r${PKG_RELEASE} \ + nginx-module-xslt=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-geoip=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-image-filter=${NGINX_VERSION}-r${DYNPKG_RELEASE} \ + nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} \ + nginx-module-acme=${NGINX_VERSION}.${ACME_VERSION}-r${PKG_RELEASE} \ + " \ +# install prerequisites for public key and pkg-oss checks + && apk add --no-cache --virtual .checksum-deps \ + openssl \ + && case "$apkArch" in \ + x86_64|aarch64) \ +# arches officially built by upstream + apk add -X "https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \ + ;; \ + *) \ +# we're on an architecture upstream doesn't officially build for +# let's build binaries from the published packaging sources + set -x \ + && tempDir="$(mktemp -d)" \ + && chown nobody:nobody $tempDir \ + && apk add --no-cache --virtual .build-deps \ + gcc \ + libc-dev \ + make \ + openssl-dev \ + pcre2-dev \ + zlib-dev \ + linux-headers \ + libxslt-dev \ + gd-dev \ + geoip-dev \ + libedit-dev \ + bash \ + alpine-sdk \ + findutils \ + curl \ + cargo \ + clang-libclang \ + && su nobody -s /bin/sh -c " \ + export HOME=${tempDir} \ + && cd ${tempDir} \ + && curl -f -L -O https://github.com/nginx/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && PKGOSSCHECKSUM=\"ef4545c05b1632a056482e3dbb47bb5d7393238318db3491e8bb308218cdb5f32dbb2ac73509097ac2426fd73270bc97836843a8b1846a396fd94e60826f7e3f *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \ + && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \ + echo \"pkg-oss tarball checksum verification succeeded!\"; \ + else \ + echo \"pkg-oss tarball checksum verification failed!\"; \ + exit 1; \ + fi \ + && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \ + && cd alpine \ + && export BUILDTARGET=\"module-geoip module-image-filter module-njs module-xslt module-acme\" \ + && if [ \"\$(apk --print-arch)\" = \"armhf\" ]; then BUILDTARGET=\"\$( echo \$BUILDTARGET | sed 's,module-acme,,' )\"; fi \ + && make \$BUILDTARGET \ + && apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \ + && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \ + " \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \ + && apk del --no-network .build-deps \ + && if [ "$apkArch" = "armhf" ]; then nginxPackages="$( echo $nginxPackages | sed 's,nginx-module-acme=.*,,')"; fi \ + && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \ + ;; \ + esac \ +# remove checksum deps + && apk del --no-network .checksum-deps \ +# if we have leftovers from building, let's purge them (including extra, unnecessary build deps) + && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \ + && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \ +# Bring in curl and ca-certificates to make registering on DNS SD easier + && apk add --no-cache curl ca-certificates diff --git a/sources/bxnginx1282modules/v1/Makefile.module-brotli b/sources/bxnginx1282modules/v1/Makefile.module-brotli new file mode 100644 index 0000000..d2f69b1 --- /dev/null +++ b/sources/bxnginx1282modules/v1/Makefile.module-brotli @@ -0,0 +1,39 @@ +MODULES+= brotli + +MODULE_SUMMARY_brotli= 3rd-party brotli compression dynamic modules + +include $(CONTRIB)/src/ngx_brotli/version + +MODULE_VERSION_brotli= $(NGX_BROTLI_VERSION) +MODULE_RELEASE_brotli= 1 + +MODULE_VERSION_PREFIX_brotli=$(MODULE_TARGET_PREFIX) + +MODULE_SOURCES_brotli= ngx_brotli-$(NGX_BROTLI_VERSION).tar.gz + +MODULE_CONFARGS_brotli= --add-dynamic-module=$(MODSRC_PREFIX)ngx_brotli-$(NGX_BROTLI_VERSION) + +.deps-module-brotli: + cd $(CONTRIB) && make .sum-ngx_brotli + touch $@ + +MODULE_BUILD_DEPENDS_brotli=brotli-dev + +define MODULE_POST_brotli +cat < + + + + + + + + + +base version updated to 1.28.2-1 + + + + + + + + + +base version updated to 1.28.1-1 + + + + + + + + + +base version updated to 1.28.0-1 + + + + + + + + + +base version updated to 1.27.5-1 + + + + + + + + + +base version updated to 1.27.4-1 + + + + + + + + + +base version updated to 1.27.3-1 + + + + + + + + + +base version updated to 1.27.2-1 + + + + + + + + + +base version updated to 1.27.1-1 + + + + + + + + + +base version updated to 1.27.0-2 + + + + + + + + + +base version updated to 1.27.0-1 + + + + + + + + + +base version updated to 1.25.5-1 + + + + + + + + + +base version updated to 1.25.4-1 + + + + + + + + + +base version updated to 1.25.3-1 + + + + + + + + + +base version updated to 1.25.2-1 + + + + + + + + + +base version updated to 1.25.1-1 + + + + + + + + + +base version updated to 1.25.0-1 + + + + + + + + + +base version updated to 1.23.4-1 + + + + + + + + + +base version updated to 1.23.3-1 + + + + + + + + + +base version updated to 1.23.2-1 + + + + + + + + + +base version updated to 1.23.1-1 + + + + + + + + + +base version updated to 1.23.0-1 + + + + + + + + + +base version updated to 1.21.6-1 + + + + + + + + + +base version updated to 1.21.5-1 + + + + + + + + + +base version updated to 1.21.4-1 + + + + + + + + + +base version updated to 1.21.3-1 + + + + + + + + + +base version updated to 1.21.2-1 + + + + + + + + + +base version updated to 1.21.1-1 + + + + + + + + + +base version updated to 1.21.0-1 + + + + + + + + + +base version updated to 1.19.10-1 + + + + + + + + + +base version updated to 1.19.9-1 + + + + + + + + + +base version updated to 1.19.8-1 + + + + + + + + + +base version updated to 1.19.7-1 + + + + + + + + + + +Initial release of brotli nginx module package. + + + + + + + diff --git a/sources/bxnginx1282modules/v1/nginx-module-headers-more.xml b/sources/bxnginx1282modules/v1/nginx-module-headers-more.xml new file mode 100644 index 0000000..1414987 --- /dev/null +++ b/sources/bxnginx1282modules/v1/nginx-module-headers-more.xml @@ -0,0 +1,454 @@ + + + + + + + + + + +base version updated to 1.28.2-1 + + + + + + + + + +base version updated to 1.28.1-1 + + + + + + + + + +base version updated to 1.28.0-1 + + + + + + + + + +base version updated to 1.27.5-1 + + + + + + + + + +base version updated to 1.27.4-1 + + + + + + + + + +base version updated to 1.27.3-1 + + + + + + + + + +Updated headers-more module to 0.37 release. + + + + + + + + +base version updated to 1.27.2-1 + + + + + + + + + +base version updated to 1.27.1-1 + + + + + + + + + +base version updated to 1.27.0-2 + + + + + + + + + +base version updated to 1.27.0-1 + + + + + + + + + +base version updated to 1.25.5-1 + + + + + + + + + +base version updated to 1.25.4-1 + + + + + + + + + +Updated headers-more module to 0.35 release. + + + + + + + + + +base version updated to 1.25.3-1 + + + + + + + + + +base version updated to 1.25.2-1 + + + + + + + + + +base version updated to 1.25.1-1 + + + + + + + + + +base version updated to 1.25.0-1 + + + + + + + + + +base version updated to 1.23.4-1 + + + + + + + + + +base version updated to 1.23.3-1 + + + + + + + + + +Updated headers-more to git hash bea1be3bbf6af28f6aa8cf0c01c07ee1637e2bd0 +which is version 0.34 + + + + + + + + + +base version updated to 1.23.2-1 + + + + + + + + + +base version updated to 1.23.1-1 + + + + + + + + + +Updated headers-more to git hash d502e41996d24a382bd9c632e3ae3efa0a5fca66 +This fixes FTBFS with nginx 1.23.0+. + + + + + + + + + +base version updated to 1.23.0-1 + + + + + + + + + +base version updated to 1.21.6-1 + + + + + + + + + +base version updated to 1.21.5-1 + + + + + + + + + +base version updated to 1.21.4-1 + + + + + + + + + +base version updated to 1.21.3-1 + + + + + + + + + +base version updated to 1.21.2-1 + + + + + + + + + +base version updated to 1.21.1-1 + + + + + + + + + +base version updated to 1.21.0-1 + + + + + + + + + +base version updated to 1.19.10-1 + + + + + + + + + +base version updated to 1.19.9-1 + + + + + + + + + +base version updated to 1.19.8-1 + + + + + + + + + +base version updated to 1.19.7-1 + + + + + + + + + + +Initial release of headers more nginx module package. + + + + + + + diff --git a/sources/bxnginx1282modules/v1/nginx-module-zip.copyright b/sources/bxnginx1282modules/v1/nginx-module-zip.copyright new file mode 100644 index 0000000..5ffbca8 --- /dev/null +++ b/sources/bxnginx1282modules/v1/nginx-module-zip.copyright @@ -0,0 +1,28 @@ +/* + * Copyright 2007-2020 Evan Miller and contributors + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, this + * list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * 3. Neither the name of the copyright holder nor the names of its contributors + * may be used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER + * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ diff --git a/sources/bxnginx1282modules/v1/nginx-module-zip.xml b/sources/bxnginx1282modules/v1/nginx-module-zip.xml new file mode 100644 index 0000000..e76bd38 --- /dev/null +++ b/sources/bxnginx1282modules/v1/nginx-module-zip.xml @@ -0,0 +1,38 @@ + + + + + + + + +base version updated to 1.3.0-1 + + + + + + + +base version updated to 1.2.2-1 + + + + + + + +base version updated to 1.2.1-1 + + + + + + + +base version updated to 1.2.0-1 + + + + + diff --git a/sources/bxpercona8040/Dockerfile b/sources/bxpercona8040/Dockerfile new file mode 100644 index 0000000..eec5488 --- /dev/null +++ b/sources/bxpercona8040/Dockerfile @@ -0,0 +1,12 @@ +FROM percona/percona-server:8.0.40 + +USER root + +COPY etc_my.cnf /etc/my.cnf +COPY etc_mycnfd_docker.cnf /etc/my.cnf.d/docker.cnf +COPY etc_mycnfd_my.cnf /etc/my.cnf.d/my.cnf + +RUN chown -R mysql:root /etc/my.cnf /etc/my.cnf.d && \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +USER mysql:mysql diff --git a/sources/bxpercona8040/etc_my.cnf b/sources/bxpercona8040/etc_my.cnf new file mode 100644 index 0000000..df9069e --- /dev/null +++ b/sources/bxpercona8040/etc_my.cnf @@ -0,0 +1,35 @@ +# Percona Server template configuration +# +# For advice on how to change settings please see +# http://dev.mysql.com/doc/refman/8.0/en/server-configuration-defaults.html +# +[mysqld] +# +# Remove leading # and set to the amount of RAM for the most important data +# cache in MySQL. Start at 70% of total RAM for dedicated server, else 10%. +# innodb_buffer_pool_size = 128M +# +# Remove the leading "# " to disable binary logging +# Binary logging captures changes between backups and is enabled by +# default. It's default setting is log_bin=binlog +# disable_log_bin +# +# Remove leading # to set options mainly useful for reporting servers. +# The server defaults are faster for transactions and fast SELECTs. +# Adjust sizes as needed, experiment to find the optimal values. +# join_buffer_size = 128M +# sort_buffer_size = 2M +# read_rnd_buffer_size = 2M +# +# Remove leading # to revert to previous value for default_authentication_plugin, +# this will increase compatibility with older clients. For background, see: +# https://dev.mysql.com/doc/refman/8.0/en/server-system-variables.html#sysvar_default_authentication_plugin +# default-authentication-plugin=mysql_native_password +# +##datadir=/var/lib/mysql +##socket=/var/lib/mysql/mysql.sock +##log-error=/var/log/mysqld.log +##pid-file=/var/run/mysqld/mysqld.pid +# +!includedir /etc/my.cnf.d +# diff --git a/sources/bxpercona8040/etc_mycnfd_docker.cnf b/sources/bxpercona8040/etc_mycnfd_docker.cnf new file mode 100644 index 0000000..55405f3 --- /dev/null +++ b/sources/bxpercona8040/etc_mycnfd_docker.cnf @@ -0,0 +1,3 @@ +#[mysqld] +#host_cache_size=0 +#skip-name-resolve diff --git a/sources/bxpercona8040/etc_mycnfd_my.cnf b/sources/bxpercona8040/etc_mycnfd_my.cnf new file mode 100644 index 0000000..74c3e62 --- /dev/null +++ b/sources/bxpercona8040/etc_mycnfd_my.cnf @@ -0,0 +1,85 @@ +[client] +port = 3306 +default-character-set = utf8mb4 +user = mysql + +[mysqld_safe] +nice = 0 +#log-error = /var/log/mysql/error.log +user = mysql + +[mysqld] +#default-authentication-plugin = mysql_native_password # deprecated +#authentication_policy = "mysql_native_password,," # mysql_native_password deprecated 8.0.34 +authentication_policy = "*,," +user = mysql +port = 3306 +basedir = /usr +datadir = /var/lib/mysql +server-id = 101 +skip-external-locking +default-storage-engine = innodb +pid-file = /var/run/mysqld/mysqld.pid +transaction_isolation = READ-COMMITTED +max_allowed_packet = 16M +myisam-recover-options = BACKUP +explicit_defaults_for_timestamp = 1 +#expire_logs_days = 30 +#binlog_expire_logs_seconds = 2592000 +max_binlog_size = 1024M +sql_mode = "" +tmpdir = /tmp +innodb_file_per_table +innodb_buffer_pool_size = 1024M +innodb_flush_log_at_trx_commit = 2 +#innodb_log_file_size = 64M # deprecated percona 8.0.30 +innodb-redo-log-capacity = 104857600 +innodb_flush_method = O_DIRECT +innodb_strict_mode = OFF +innodb_default_row_format = DYNAMIC +character-set-server = utf8mb4 +collation-server = utf8mb4_0900_ai_ci +init-connect = "SET NAMES utf8mb4 COLLATE utf8mb4_0900_ai_ci" +#skip-character-set-client-handshake # deprecated 8.0.35 +skip-name-resolve +max_connections = 43 +table_open_cache = 8096 +thread_cache_size = 96 +thread_stack = 512K +max_heap_table_size = 128M +tmp_table_size = 128M +key_buffer_size = 48M +join_buffer_size = 8M +sort_buffer_size = 8M +bulk_insert_buffer_size = 2M +myisam_sort_buffer_size = 8M +general_log = 0 +#general_log_file = /var/log/mysql/mysql.log +#log_error = /var/log/mysql/error.log +skip-log-bin +#log_bin = /var/lib/mysql/mysql-binlog +log_bin_index = /var/lib/mysql/mysql-binlog.index +relay_log = /var/lib/mysql/mysql-relay-binlog +relay_log_index = /var/lib/mysql/mysql-relay-binlog.index +slow_query_log = 0 +#slow_query_log_file = /var/log/mysql/slow.log +sync_binlog = 0 +tls_version = TLSv1.2,TLSv1.3 +secure-log-path=/var/lib/mysql-files +percona_telemetry_disable = 1 # disable percona telemetry, from 8.0.37 and above + +[system_default_sect] +MinProtocol = TLSv1.2 + +[mysqldump] +quick +quote-names +max_allowed_packet = 16M +default-character-set = utf8mb4 +user = mysql + +[mysql] +user = mysql + +[isamchk] +key_buffer = 16M diff --git a/sources/bxpercona8041/Dockerfile b/sources/bxpercona8041/Dockerfile new file mode 100644 index 0000000..59f16b5 --- /dev/null +++ b/sources/bxpercona8041/Dockerfile @@ -0,0 +1,12 @@ +FROM percona/percona-server:8.0.41 + +USER root + +COPY etc_my.cnf /etc/my.cnf +COPY etc_mycnfd_docker.cnf /etc/my.cnf.d/docker.cnf +COPY etc_mycnfd_my.cnf /etc/my.cnf.d/my.cnf + +RUN chown -R mysql:root /etc/my.cnf /etc/my.cnf.d && \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +USER mysql:mysql diff --git a/sources/bxpercona8041/etc_my.cnf b/sources/bxpercona8041/etc_my.cnf new file mode 100644 index 0000000..df9069e --- /dev/null +++ b/sources/bxpercona8041/etc_my.cnf @@ -0,0 +1,35 @@ +# Percona Server template configuration +# +# For advice on how to change settings please see +# http://dev.mysql.com/doc/refman/8.0/en/server-configuration-defaults.html +# +[mysqld] +# +# Remove leading # and set to the amount of RAM for the most important data +# cache in MySQL. Start at 70% of total RAM for dedicated server, else 10%. +# innodb_buffer_pool_size = 128M +# +# Remove the leading "# " to disable binary logging +# Binary logging captures changes between backups and is enabled by +# default. It's default setting is log_bin=binlog +# disable_log_bin +# +# Remove leading # to set options mainly useful for reporting servers. +# The server defaults are faster for transactions and fast SELECTs. +# Adjust sizes as needed, experiment to find the optimal values. +# join_buffer_size = 128M +# sort_buffer_size = 2M +# read_rnd_buffer_size = 2M +# +# Remove leading # to revert to previous value for default_authentication_plugin, +# this will increase compatibility with older clients. For background, see: +# https://dev.mysql.com/doc/refman/8.0/en/server-system-variables.html#sysvar_default_authentication_plugin +# default-authentication-plugin=mysql_native_password +# +##datadir=/var/lib/mysql +##socket=/var/lib/mysql/mysql.sock +##log-error=/var/log/mysqld.log +##pid-file=/var/run/mysqld/mysqld.pid +# +!includedir /etc/my.cnf.d +# diff --git a/sources/bxpercona8041/etc_mycnfd_docker.cnf b/sources/bxpercona8041/etc_mycnfd_docker.cnf new file mode 100644 index 0000000..55405f3 --- /dev/null +++ b/sources/bxpercona8041/etc_mycnfd_docker.cnf @@ -0,0 +1,3 @@ +#[mysqld] +#host_cache_size=0 +#skip-name-resolve diff --git a/sources/bxpercona8041/etc_mycnfd_my.cnf b/sources/bxpercona8041/etc_mycnfd_my.cnf new file mode 100644 index 0000000..74c3e62 --- /dev/null +++ b/sources/bxpercona8041/etc_mycnfd_my.cnf @@ -0,0 +1,85 @@ +[client] +port = 3306 +default-character-set = utf8mb4 +user = mysql + +[mysqld_safe] +nice = 0 +#log-error = /var/log/mysql/error.log +user = mysql + +[mysqld] +#default-authentication-plugin = mysql_native_password # deprecated +#authentication_policy = "mysql_native_password,," # mysql_native_password deprecated 8.0.34 +authentication_policy = "*,," +user = mysql +port = 3306 +basedir = /usr +datadir = /var/lib/mysql +server-id = 101 +skip-external-locking +default-storage-engine = innodb +pid-file = /var/run/mysqld/mysqld.pid +transaction_isolation = READ-COMMITTED +max_allowed_packet = 16M +myisam-recover-options = BACKUP +explicit_defaults_for_timestamp = 1 +#expire_logs_days = 30 +#binlog_expire_logs_seconds = 2592000 +max_binlog_size = 1024M +sql_mode = "" +tmpdir = /tmp +innodb_file_per_table +innodb_buffer_pool_size = 1024M +innodb_flush_log_at_trx_commit = 2 +#innodb_log_file_size = 64M # deprecated percona 8.0.30 +innodb-redo-log-capacity = 104857600 +innodb_flush_method = O_DIRECT +innodb_strict_mode = OFF +innodb_default_row_format = DYNAMIC +character-set-server = utf8mb4 +collation-server = utf8mb4_0900_ai_ci +init-connect = "SET NAMES utf8mb4 COLLATE utf8mb4_0900_ai_ci" +#skip-character-set-client-handshake # deprecated 8.0.35 +skip-name-resolve +max_connections = 43 +table_open_cache = 8096 +thread_cache_size = 96 +thread_stack = 512K +max_heap_table_size = 128M +tmp_table_size = 128M +key_buffer_size = 48M +join_buffer_size = 8M +sort_buffer_size = 8M +bulk_insert_buffer_size = 2M +myisam_sort_buffer_size = 8M +general_log = 0 +#general_log_file = /var/log/mysql/mysql.log +#log_error = /var/log/mysql/error.log +skip-log-bin +#log_bin = /var/lib/mysql/mysql-binlog +log_bin_index = /var/lib/mysql/mysql-binlog.index +relay_log = /var/lib/mysql/mysql-relay-binlog +relay_log_index = /var/lib/mysql/mysql-relay-binlog.index +slow_query_log = 0 +#slow_query_log_file = /var/log/mysql/slow.log +sync_binlog = 0 +tls_version = TLSv1.2,TLSv1.3 +secure-log-path=/var/lib/mysql-files +percona_telemetry_disable = 1 # disable percona telemetry, from 8.0.37 and above + +[system_default_sect] +MinProtocol = TLSv1.2 + +[mysqldump] +quick +quote-names +max_allowed_packet = 16M +default-character-set = utf8mb4 +user = mysql + +[mysql] +user = mysql + +[isamchk] +key_buffer = 16M diff --git a/sources/bxpercona8042/Dockerfile b/sources/bxpercona8042/Dockerfile new file mode 100644 index 0000000..3ff3869 --- /dev/null +++ b/sources/bxpercona8042/Dockerfile @@ -0,0 +1,12 @@ +FROM percona/percona-server:8.0.42 + +USER root + +COPY etc_my.cnf /etc/my.cnf +COPY etc_mycnfd_docker.cnf /etc/my.cnf.d/docker.cnf +COPY etc_mycnfd_my.cnf /etc/my.cnf.d/my.cnf + +RUN chown -R mysql:root /etc/my.cnf /etc/my.cnf.d && \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +USER mysql:mysql diff --git a/sources/bxpercona8042/etc_my.cnf b/sources/bxpercona8042/etc_my.cnf new file mode 100644 index 0000000..df9069e --- /dev/null +++ b/sources/bxpercona8042/etc_my.cnf @@ -0,0 +1,35 @@ +# Percona Server template configuration +# +# For advice on how to change settings please see +# http://dev.mysql.com/doc/refman/8.0/en/server-configuration-defaults.html +# +[mysqld] +# +# Remove leading # and set to the amount of RAM for the most important data +# cache in MySQL. Start at 70% of total RAM for dedicated server, else 10%. +# innodb_buffer_pool_size = 128M +# +# Remove the leading "# " to disable binary logging +# Binary logging captures changes between backups and is enabled by +# default. It's default setting is log_bin=binlog +# disable_log_bin +# +# Remove leading # to set options mainly useful for reporting servers. +# The server defaults are faster for transactions and fast SELECTs. +# Adjust sizes as needed, experiment to find the optimal values. +# join_buffer_size = 128M +# sort_buffer_size = 2M +# read_rnd_buffer_size = 2M +# +# Remove leading # to revert to previous value for default_authentication_plugin, +# this will increase compatibility with older clients. For background, see: +# https://dev.mysql.com/doc/refman/8.0/en/server-system-variables.html#sysvar_default_authentication_plugin +# default-authentication-plugin=mysql_native_password +# +##datadir=/var/lib/mysql +##socket=/var/lib/mysql/mysql.sock +##log-error=/var/log/mysqld.log +##pid-file=/var/run/mysqld/mysqld.pid +# +!includedir /etc/my.cnf.d +# diff --git a/sources/bxpercona8042/etc_mycnfd_docker.cnf b/sources/bxpercona8042/etc_mycnfd_docker.cnf new file mode 100644 index 0000000..55405f3 --- /dev/null +++ b/sources/bxpercona8042/etc_mycnfd_docker.cnf @@ -0,0 +1,3 @@ +#[mysqld] +#host_cache_size=0 +#skip-name-resolve diff --git a/sources/bxpercona8042/etc_mycnfd_my.cnf b/sources/bxpercona8042/etc_mycnfd_my.cnf new file mode 100644 index 0000000..74c3e62 --- /dev/null +++ b/sources/bxpercona8042/etc_mycnfd_my.cnf @@ -0,0 +1,85 @@ +[client] +port = 3306 +default-character-set = utf8mb4 +user = mysql + +[mysqld_safe] +nice = 0 +#log-error = /var/log/mysql/error.log +user = mysql + +[mysqld] +#default-authentication-plugin = mysql_native_password # deprecated +#authentication_policy = "mysql_native_password,," # mysql_native_password deprecated 8.0.34 +authentication_policy = "*,," +user = mysql +port = 3306 +basedir = /usr +datadir = /var/lib/mysql +server-id = 101 +skip-external-locking +default-storage-engine = innodb +pid-file = /var/run/mysqld/mysqld.pid +transaction_isolation = READ-COMMITTED +max_allowed_packet = 16M +myisam-recover-options = BACKUP +explicit_defaults_for_timestamp = 1 +#expire_logs_days = 30 +#binlog_expire_logs_seconds = 2592000 +max_binlog_size = 1024M +sql_mode = "" +tmpdir = /tmp +innodb_file_per_table +innodb_buffer_pool_size = 1024M +innodb_flush_log_at_trx_commit = 2 +#innodb_log_file_size = 64M # deprecated percona 8.0.30 +innodb-redo-log-capacity = 104857600 +innodb_flush_method = O_DIRECT +innodb_strict_mode = OFF +innodb_default_row_format = DYNAMIC +character-set-server = utf8mb4 +collation-server = utf8mb4_0900_ai_ci +init-connect = "SET NAMES utf8mb4 COLLATE utf8mb4_0900_ai_ci" +#skip-character-set-client-handshake # deprecated 8.0.35 +skip-name-resolve +max_connections = 43 +table_open_cache = 8096 +thread_cache_size = 96 +thread_stack = 512K +max_heap_table_size = 128M +tmp_table_size = 128M +key_buffer_size = 48M +join_buffer_size = 8M +sort_buffer_size = 8M +bulk_insert_buffer_size = 2M +myisam_sort_buffer_size = 8M +general_log = 0 +#general_log_file = /var/log/mysql/mysql.log +#log_error = /var/log/mysql/error.log +skip-log-bin +#log_bin = /var/lib/mysql/mysql-binlog +log_bin_index = /var/lib/mysql/mysql-binlog.index +relay_log = /var/lib/mysql/mysql-relay-binlog +relay_log_index = /var/lib/mysql/mysql-relay-binlog.index +slow_query_log = 0 +#slow_query_log_file = /var/log/mysql/slow.log +sync_binlog = 0 +tls_version = TLSv1.2,TLSv1.3 +secure-log-path=/var/lib/mysql-files +percona_telemetry_disable = 1 # disable percona telemetry, from 8.0.37 and above + +[system_default_sect] +MinProtocol = TLSv1.2 + +[mysqldump] +quick +quote-names +max_allowed_packet = 16M +default-character-set = utf8mb4 +user = mysql + +[mysql] +user = mysql + +[isamchk] +key_buffer = 16M diff --git a/sources/bxpercona8043/Dockerfile b/sources/bxpercona8043/Dockerfile new file mode 100644 index 0000000..acf6397 --- /dev/null +++ b/sources/bxpercona8043/Dockerfile @@ -0,0 +1,12 @@ +FROM percona/percona-server:8.0.43 + +USER root + +COPY etc_my.cnf /etc/my.cnf +COPY etc_mycnfd_docker.cnf /etc/my.cnf.d/docker.cnf +COPY etc_mycnfd_my.cnf /etc/my.cnf.d/my.cnf + +RUN chown -R mysql:root /etc/my.cnf /etc/my.cnf.d && \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +USER mysql:mysql diff --git a/sources/bxpercona8043/etc_my.cnf b/sources/bxpercona8043/etc_my.cnf new file mode 100644 index 0000000..df9069e --- /dev/null +++ b/sources/bxpercona8043/etc_my.cnf @@ -0,0 +1,35 @@ +# Percona Server template configuration +# +# For advice on how to change settings please see +# http://dev.mysql.com/doc/refman/8.0/en/server-configuration-defaults.html +# +[mysqld] +# +# Remove leading # and set to the amount of RAM for the most important data +# cache in MySQL. Start at 70% of total RAM for dedicated server, else 10%. +# innodb_buffer_pool_size = 128M +# +# Remove the leading "# " to disable binary logging +# Binary logging captures changes between backups and is enabled by +# default. It's default setting is log_bin=binlog +# disable_log_bin +# +# Remove leading # to set options mainly useful for reporting servers. +# The server defaults are faster for transactions and fast SELECTs. +# Adjust sizes as needed, experiment to find the optimal values. +# join_buffer_size = 128M +# sort_buffer_size = 2M +# read_rnd_buffer_size = 2M +# +# Remove leading # to revert to previous value for default_authentication_plugin, +# this will increase compatibility with older clients. For background, see: +# https://dev.mysql.com/doc/refman/8.0/en/server-system-variables.html#sysvar_default_authentication_plugin +# default-authentication-plugin=mysql_native_password +# +##datadir=/var/lib/mysql +##socket=/var/lib/mysql/mysql.sock +##log-error=/var/log/mysqld.log +##pid-file=/var/run/mysqld/mysqld.pid +# +!includedir /etc/my.cnf.d +# diff --git a/sources/bxpercona8043/etc_mycnfd_docker.cnf b/sources/bxpercona8043/etc_mycnfd_docker.cnf new file mode 100644 index 0000000..55405f3 --- /dev/null +++ b/sources/bxpercona8043/etc_mycnfd_docker.cnf @@ -0,0 +1,3 @@ +#[mysqld] +#host_cache_size=0 +#skip-name-resolve diff --git a/sources/bxpercona8043/etc_mycnfd_my.cnf b/sources/bxpercona8043/etc_mycnfd_my.cnf new file mode 100644 index 0000000..74c3e62 --- /dev/null +++ b/sources/bxpercona8043/etc_mycnfd_my.cnf @@ -0,0 +1,85 @@ +[client] +port = 3306 +default-character-set = utf8mb4 +user = mysql + +[mysqld_safe] +nice = 0 +#log-error = /var/log/mysql/error.log +user = mysql + +[mysqld] +#default-authentication-plugin = mysql_native_password # deprecated +#authentication_policy = "mysql_native_password,," # mysql_native_password deprecated 8.0.34 +authentication_policy = "*,," +user = mysql +port = 3306 +basedir = /usr +datadir = /var/lib/mysql +server-id = 101 +skip-external-locking +default-storage-engine = innodb +pid-file = /var/run/mysqld/mysqld.pid +transaction_isolation = READ-COMMITTED +max_allowed_packet = 16M +myisam-recover-options = BACKUP +explicit_defaults_for_timestamp = 1 +#expire_logs_days = 30 +#binlog_expire_logs_seconds = 2592000 +max_binlog_size = 1024M +sql_mode = "" +tmpdir = /tmp +innodb_file_per_table +innodb_buffer_pool_size = 1024M +innodb_flush_log_at_trx_commit = 2 +#innodb_log_file_size = 64M # deprecated percona 8.0.30 +innodb-redo-log-capacity = 104857600 +innodb_flush_method = O_DIRECT +innodb_strict_mode = OFF +innodb_default_row_format = DYNAMIC +character-set-server = utf8mb4 +collation-server = utf8mb4_0900_ai_ci +init-connect = "SET NAMES utf8mb4 COLLATE utf8mb4_0900_ai_ci" +#skip-character-set-client-handshake # deprecated 8.0.35 +skip-name-resolve +max_connections = 43 +table_open_cache = 8096 +thread_cache_size = 96 +thread_stack = 512K +max_heap_table_size = 128M +tmp_table_size = 128M +key_buffer_size = 48M +join_buffer_size = 8M +sort_buffer_size = 8M +bulk_insert_buffer_size = 2M +myisam_sort_buffer_size = 8M +general_log = 0 +#general_log_file = /var/log/mysql/mysql.log +#log_error = /var/log/mysql/error.log +skip-log-bin +#log_bin = /var/lib/mysql/mysql-binlog +log_bin_index = /var/lib/mysql/mysql-binlog.index +relay_log = /var/lib/mysql/mysql-relay-binlog +relay_log_index = /var/lib/mysql/mysql-relay-binlog.index +slow_query_log = 0 +#slow_query_log_file = /var/log/mysql/slow.log +sync_binlog = 0 +tls_version = TLSv1.2,TLSv1.3 +secure-log-path=/var/lib/mysql-files +percona_telemetry_disable = 1 # disable percona telemetry, from 8.0.37 and above + +[system_default_sect] +MinProtocol = TLSv1.2 + +[mysqldump] +quick +quote-names +max_allowed_packet = 16M +default-character-set = utf8mb4 +user = mysql + +[mysql] +user = mysql + +[isamchk] +key_buffer = 16M diff --git a/sources/bxpercona8044/Dockerfile b/sources/bxpercona8044/Dockerfile new file mode 100644 index 0000000..935f010 --- /dev/null +++ b/sources/bxpercona8044/Dockerfile @@ -0,0 +1,12 @@ +FROM percona/percona-server:8.0.44 + +USER root + +COPY etc_my.cnf /etc/my.cnf +COPY etc_mycnfd_docker.cnf /etc/my.cnf.d/docker.cnf +COPY etc_mycnfd_my.cnf /etc/my.cnf.d/my.cnf + +RUN chown -R mysql:root /etc/my.cnf /etc/my.cnf.d && \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +USER mysql:mysql diff --git a/sources/bxpercona8044/etc_my.cnf b/sources/bxpercona8044/etc_my.cnf new file mode 100644 index 0000000..df9069e --- /dev/null +++ b/sources/bxpercona8044/etc_my.cnf @@ -0,0 +1,35 @@ +# Percona Server template configuration +# +# For advice on how to change settings please see +# http://dev.mysql.com/doc/refman/8.0/en/server-configuration-defaults.html +# +[mysqld] +# +# Remove leading # and set to the amount of RAM for the most important data +# cache in MySQL. Start at 70% of total RAM for dedicated server, else 10%. +# innodb_buffer_pool_size = 128M +# +# Remove the leading "# " to disable binary logging +# Binary logging captures changes between backups and is enabled by +# default. It's default setting is log_bin=binlog +# disable_log_bin +# +# Remove leading # to set options mainly useful for reporting servers. +# The server defaults are faster for transactions and fast SELECTs. +# Adjust sizes as needed, experiment to find the optimal values. +# join_buffer_size = 128M +# sort_buffer_size = 2M +# read_rnd_buffer_size = 2M +# +# Remove leading # to revert to previous value for default_authentication_plugin, +# this will increase compatibility with older clients. For background, see: +# https://dev.mysql.com/doc/refman/8.0/en/server-system-variables.html#sysvar_default_authentication_plugin +# default-authentication-plugin=mysql_native_password +# +##datadir=/var/lib/mysql +##socket=/var/lib/mysql/mysql.sock +##log-error=/var/log/mysqld.log +##pid-file=/var/run/mysqld/mysqld.pid +# +!includedir /etc/my.cnf.d +# diff --git a/sources/bxpercona8044/etc_mycnfd_docker.cnf b/sources/bxpercona8044/etc_mycnfd_docker.cnf new file mode 100644 index 0000000..55405f3 --- /dev/null +++ b/sources/bxpercona8044/etc_mycnfd_docker.cnf @@ -0,0 +1,3 @@ +#[mysqld] +#host_cache_size=0 +#skip-name-resolve diff --git a/sources/bxpercona8044/etc_mycnfd_my.cnf b/sources/bxpercona8044/etc_mycnfd_my.cnf new file mode 100644 index 0000000..74c3e62 --- /dev/null +++ b/sources/bxpercona8044/etc_mycnfd_my.cnf @@ -0,0 +1,85 @@ +[client] +port = 3306 +default-character-set = utf8mb4 +user = mysql + +[mysqld_safe] +nice = 0 +#log-error = /var/log/mysql/error.log +user = mysql + +[mysqld] +#default-authentication-plugin = mysql_native_password # deprecated +#authentication_policy = "mysql_native_password,," # mysql_native_password deprecated 8.0.34 +authentication_policy = "*,," +user = mysql +port = 3306 +basedir = /usr +datadir = /var/lib/mysql +server-id = 101 +skip-external-locking +default-storage-engine = innodb +pid-file = /var/run/mysqld/mysqld.pid +transaction_isolation = READ-COMMITTED +max_allowed_packet = 16M +myisam-recover-options = BACKUP +explicit_defaults_for_timestamp = 1 +#expire_logs_days = 30 +#binlog_expire_logs_seconds = 2592000 +max_binlog_size = 1024M +sql_mode = "" +tmpdir = /tmp +innodb_file_per_table +innodb_buffer_pool_size = 1024M +innodb_flush_log_at_trx_commit = 2 +#innodb_log_file_size = 64M # deprecated percona 8.0.30 +innodb-redo-log-capacity = 104857600 +innodb_flush_method = O_DIRECT +innodb_strict_mode = OFF +innodb_default_row_format = DYNAMIC +character-set-server = utf8mb4 +collation-server = utf8mb4_0900_ai_ci +init-connect = "SET NAMES utf8mb4 COLLATE utf8mb4_0900_ai_ci" +#skip-character-set-client-handshake # deprecated 8.0.35 +skip-name-resolve +max_connections = 43 +table_open_cache = 8096 +thread_cache_size = 96 +thread_stack = 512K +max_heap_table_size = 128M +tmp_table_size = 128M +key_buffer_size = 48M +join_buffer_size = 8M +sort_buffer_size = 8M +bulk_insert_buffer_size = 2M +myisam_sort_buffer_size = 8M +general_log = 0 +#general_log_file = /var/log/mysql/mysql.log +#log_error = /var/log/mysql/error.log +skip-log-bin +#log_bin = /var/lib/mysql/mysql-binlog +log_bin_index = /var/lib/mysql/mysql-binlog.index +relay_log = /var/lib/mysql/mysql-relay-binlog +relay_log_index = /var/lib/mysql/mysql-relay-binlog.index +slow_query_log = 0 +#slow_query_log_file = /var/log/mysql/slow.log +sync_binlog = 0 +tls_version = TLSv1.2,TLSv1.3 +secure-log-path=/var/lib/mysql-files +percona_telemetry_disable = 1 # disable percona telemetry, from 8.0.37 and above + +[system_default_sect] +MinProtocol = TLSv1.2 + +[mysqldump] +quick +quote-names +max_allowed_packet = 16M +default-character-set = utf8mb4 +user = mysql + +[mysql] +user = mysql + +[isamchk] +key_buffer = 16M diff --git a/sources/bxpercona844/Dockerfile b/sources/bxpercona844/Dockerfile new file mode 100644 index 0000000..933f7c3 --- /dev/null +++ b/sources/bxpercona844/Dockerfile @@ -0,0 +1,12 @@ +FROM percona/percona-server:8.4.4-4 + +USER root + +COPY etc_my.cnf /etc/my.cnf +COPY etc_mycnfd_docker.cnf /etc/my.cnf.d/docker.cnf +COPY etc_mycnfd_my.cnf /etc/my.cnf.d/my.cnf + +RUN chown -R mysql:root /etc/my.cnf /etc/my.cnf.d && \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +USER mysql:mysql diff --git a/sources/bxpercona844/etc_my.cnf b/sources/bxpercona844/etc_my.cnf new file mode 100644 index 0000000..48d35a8 --- /dev/null +++ b/sources/bxpercona844/etc_my.cnf @@ -0,0 +1,35 @@ +# Percona Server template configuration +# +# For advice on how to change settings please see +# http://dev.mysql.com/doc/refman/8.4/en/server-configuration-defaults.html +# +[mysqld] +# +# Remove leading # and set to the amount of RAM for the most important data +# cache in MySQL. Start at 70% of total RAM for dedicated server, else 10%. +# innodb_buffer_pool_size = 128M +# +# Remove the leading "# " to disable binary logging +# Binary logging captures changes between backups and is enabled by +# default. It's default setting is log_bin=binlog +# disable_log_bin +# +# Remove leading # to set options mainly useful for reporting servers. +# The server defaults are faster for transactions and fast SELECTs. +# Adjust sizes as needed, experiment to find the optimal values. +# join_buffer_size = 128M +# sort_buffer_size = 2M +# read_rnd_buffer_size = 2M +# +# Remove leading # to revert to previous value for default_authentication_plugin, +# this will increase compatibility with older clients. For background, see: +# https://dev.mysql.com/doc/refman/8.4/en/server-system-variables.html#sysvar_default_authentication_plugin +# default-authentication-plugin=mysql_native_password +# +##datadir=/var/lib/mysql +##socket=/var/lib/mysql/mysql.sock +##log-error=/var/log/mysqld.log +##pid-file=/var/run/mysqld/mysqld.pid +# +!includedir /etc/my.cnf.d +# diff --git a/sources/bxpercona844/etc_mycnfd_docker.cnf b/sources/bxpercona844/etc_mycnfd_docker.cnf new file mode 100644 index 0000000..55405f3 --- /dev/null +++ b/sources/bxpercona844/etc_mycnfd_docker.cnf @@ -0,0 +1,3 @@ +#[mysqld] +#host_cache_size=0 +#skip-name-resolve diff --git a/sources/bxpercona844/etc_mycnfd_my.cnf b/sources/bxpercona844/etc_mycnfd_my.cnf new file mode 100644 index 0000000..3d13828 --- /dev/null +++ b/sources/bxpercona844/etc_mycnfd_my.cnf @@ -0,0 +1,85 @@ +[client] +port = 3306 +default-character-set = utf8mb4 +user = mysql + +[mysqld_safe] +nice = 0 +#log-error = /var/log/mysql/error.log +user = mysql + +[mysqld] +#default-authentication-plugin = mysql_native_password # deprecated +#authentication_policy = "mysql_native_password,," # mysql_native_password deprecated 8.0.34 +authentication_policy = "*,," +user = mysql +port = 3306 +basedir = /usr +datadir = /var/lib/mysql +server-id = 101 +skip-external-locking +default-storage-engine = innodb +pid-file = /var/run/mysqld/mysqld.pid +transaction_isolation = READ-COMMITTED +max_allowed_packet = 16M +myisam-recover-options = BACKUP +explicit_defaults_for_timestamp = 1 +#expire_logs_days = 30 +#binlog_expire_logs_seconds = 2592000 +max_binlog_size = 1024M +sql_mode = "" +tmpdir = /tmp +innodb_file_per_table +innodb_buffer_pool_size = 1024M +innodb_flush_log_at_trx_commit = 2 +#innodb_log_file_size = 64M # deprecated percona 8.0.30 +innodb-redo-log-capacity = 104857600 +innodb_flush_method = O_DIRECT +innodb_strict_mode = OFF +innodb_default_row_format = DYNAMIC +character-set-server = utf8mb4 +collation-server = utf8mb4_0900_ai_ci +init-connect = "SET NAMES utf8mb4 COLLATE utf8mb4_0900_ai_ci" +#skip-character-set-client-handshake # deprecated 8.0.35 +skip-name-resolve +max_connections = 43 +table_open_cache = 8096 +thread_cache_size = 96 +thread_stack = 512K +max_heap_table_size = 128M +tmp_table_size = 128M +key_buffer_size = 48M +join_buffer_size = 8M +sort_buffer_size = 8M +bulk_insert_buffer_size = 2M +myisam_sort_buffer_size = 8M +general_log = 0 +#general_log_file = /var/log/mysql/mysql.log +#log_error = /var/log/mysql/error.log +skip-log-bin +#log_bin = /var/lib/mysql/mysql-binlog +log_bin_index = /var/lib/mysql/mysql-binlog.index +relay_log = /var/lib/mysql/mysql-relay-binlog +relay_log_index = /var/lib/mysql/mysql-relay-binlog.index +slow_query_log = 0 +#slow_query_log_file = /var/log/mysql/slow.log +sync_binlog = 0 +tls_version = TLSv1.2,TLSv1.3 +secure-log-path=/var/lib/mysql-files +percona_telemetry_disable = 1 # disable percona telemetry, from 8.4.0 and above + +[system_default_sect] +MinProtocol = TLSv1.2 + +[mysqldump] +quick +quote-names +max_allowed_packet = 16M +default-character-set = utf8mb4 +user = mysql + +[mysql] +user = mysql + +[isamchk] +key_buffer = 16M diff --git a/sources/bxpercona845/Dockerfile b/sources/bxpercona845/Dockerfile new file mode 100644 index 0000000..8ab6ddf --- /dev/null +++ b/sources/bxpercona845/Dockerfile @@ -0,0 +1,12 @@ +FROM percona/percona-server:8.4.5 + +USER root + +COPY etc_my.cnf /etc/my.cnf +COPY etc_mycnfd_docker.cnf /etc/my.cnf.d/docker.cnf +COPY etc_mycnfd_my.cnf /etc/my.cnf.d/my.cnf + +RUN chown -R mysql:root /etc/my.cnf /etc/my.cnf.d && \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +USER mysql:mysql diff --git a/sources/bxpercona845/etc_my.cnf b/sources/bxpercona845/etc_my.cnf new file mode 100644 index 0000000..48d35a8 --- /dev/null +++ b/sources/bxpercona845/etc_my.cnf @@ -0,0 +1,35 @@ +# Percona Server template configuration +# +# For advice on how to change settings please see +# http://dev.mysql.com/doc/refman/8.4/en/server-configuration-defaults.html +# +[mysqld] +# +# Remove leading # and set to the amount of RAM for the most important data +# cache in MySQL. Start at 70% of total RAM for dedicated server, else 10%. +# innodb_buffer_pool_size = 128M +# +# Remove the leading "# " to disable binary logging +# Binary logging captures changes between backups and is enabled by +# default. It's default setting is log_bin=binlog +# disable_log_bin +# +# Remove leading # to set options mainly useful for reporting servers. +# The server defaults are faster for transactions and fast SELECTs. +# Adjust sizes as needed, experiment to find the optimal values. +# join_buffer_size = 128M +# sort_buffer_size = 2M +# read_rnd_buffer_size = 2M +# +# Remove leading # to revert to previous value for default_authentication_plugin, +# this will increase compatibility with older clients. For background, see: +# https://dev.mysql.com/doc/refman/8.4/en/server-system-variables.html#sysvar_default_authentication_plugin +# default-authentication-plugin=mysql_native_password +# +##datadir=/var/lib/mysql +##socket=/var/lib/mysql/mysql.sock +##log-error=/var/log/mysqld.log +##pid-file=/var/run/mysqld/mysqld.pid +# +!includedir /etc/my.cnf.d +# diff --git a/sources/bxpercona845/etc_mycnfd_docker.cnf b/sources/bxpercona845/etc_mycnfd_docker.cnf new file mode 100644 index 0000000..55405f3 --- /dev/null +++ b/sources/bxpercona845/etc_mycnfd_docker.cnf @@ -0,0 +1,3 @@ +#[mysqld] +#host_cache_size=0 +#skip-name-resolve diff --git a/sources/bxpercona845/etc_mycnfd_my.cnf b/sources/bxpercona845/etc_mycnfd_my.cnf new file mode 100644 index 0000000..3d13828 --- /dev/null +++ b/sources/bxpercona845/etc_mycnfd_my.cnf @@ -0,0 +1,85 @@ +[client] +port = 3306 +default-character-set = utf8mb4 +user = mysql + +[mysqld_safe] +nice = 0 +#log-error = /var/log/mysql/error.log +user = mysql + +[mysqld] +#default-authentication-plugin = mysql_native_password # deprecated +#authentication_policy = "mysql_native_password,," # mysql_native_password deprecated 8.0.34 +authentication_policy = "*,," +user = mysql +port = 3306 +basedir = /usr +datadir = /var/lib/mysql +server-id = 101 +skip-external-locking +default-storage-engine = innodb +pid-file = /var/run/mysqld/mysqld.pid +transaction_isolation = READ-COMMITTED +max_allowed_packet = 16M +myisam-recover-options = BACKUP +explicit_defaults_for_timestamp = 1 +#expire_logs_days = 30 +#binlog_expire_logs_seconds = 2592000 +max_binlog_size = 1024M +sql_mode = "" +tmpdir = /tmp +innodb_file_per_table +innodb_buffer_pool_size = 1024M +innodb_flush_log_at_trx_commit = 2 +#innodb_log_file_size = 64M # deprecated percona 8.0.30 +innodb-redo-log-capacity = 104857600 +innodb_flush_method = O_DIRECT +innodb_strict_mode = OFF +innodb_default_row_format = DYNAMIC +character-set-server = utf8mb4 +collation-server = utf8mb4_0900_ai_ci +init-connect = "SET NAMES utf8mb4 COLLATE utf8mb4_0900_ai_ci" +#skip-character-set-client-handshake # deprecated 8.0.35 +skip-name-resolve +max_connections = 43 +table_open_cache = 8096 +thread_cache_size = 96 +thread_stack = 512K +max_heap_table_size = 128M +tmp_table_size = 128M +key_buffer_size = 48M +join_buffer_size = 8M +sort_buffer_size = 8M +bulk_insert_buffer_size = 2M +myisam_sort_buffer_size = 8M +general_log = 0 +#general_log_file = /var/log/mysql/mysql.log +#log_error = /var/log/mysql/error.log +skip-log-bin +#log_bin = /var/lib/mysql/mysql-binlog +log_bin_index = /var/lib/mysql/mysql-binlog.index +relay_log = /var/lib/mysql/mysql-relay-binlog +relay_log_index = /var/lib/mysql/mysql-relay-binlog.index +slow_query_log = 0 +#slow_query_log_file = /var/log/mysql/slow.log +sync_binlog = 0 +tls_version = TLSv1.2,TLSv1.3 +secure-log-path=/var/lib/mysql-files +percona_telemetry_disable = 1 # disable percona telemetry, from 8.4.0 and above + +[system_default_sect] +MinProtocol = TLSv1.2 + +[mysqldump] +quick +quote-names +max_allowed_packet = 16M +default-character-set = utf8mb4 +user = mysql + +[mysql] +user = mysql + +[isamchk] +key_buffer = 16M diff --git a/sources/bxpercona846/Dockerfile b/sources/bxpercona846/Dockerfile new file mode 100644 index 0000000..9006377 --- /dev/null +++ b/sources/bxpercona846/Dockerfile @@ -0,0 +1,12 @@ +FROM percona/percona-server:8.4.6 + +USER root + +COPY etc_my.cnf /etc/my.cnf +COPY etc_mycnfd_docker.cnf /etc/my.cnf.d/docker.cnf +COPY etc_mycnfd_my.cnf /etc/my.cnf.d/my.cnf + +RUN chown -R mysql:root /etc/my.cnf /etc/my.cnf.d && \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +USER mysql:mysql diff --git a/sources/bxpercona846/etc_my.cnf b/sources/bxpercona846/etc_my.cnf new file mode 100644 index 0000000..48d35a8 --- /dev/null +++ b/sources/bxpercona846/etc_my.cnf @@ -0,0 +1,35 @@ +# Percona Server template configuration +# +# For advice on how to change settings please see +# http://dev.mysql.com/doc/refman/8.4/en/server-configuration-defaults.html +# +[mysqld] +# +# Remove leading # and set to the amount of RAM for the most important data +# cache in MySQL. Start at 70% of total RAM for dedicated server, else 10%. +# innodb_buffer_pool_size = 128M +# +# Remove the leading "# " to disable binary logging +# Binary logging captures changes between backups and is enabled by +# default. It's default setting is log_bin=binlog +# disable_log_bin +# +# Remove leading # to set options mainly useful for reporting servers. +# The server defaults are faster for transactions and fast SELECTs. +# Adjust sizes as needed, experiment to find the optimal values. +# join_buffer_size = 128M +# sort_buffer_size = 2M +# read_rnd_buffer_size = 2M +# +# Remove leading # to revert to previous value for default_authentication_plugin, +# this will increase compatibility with older clients. For background, see: +# https://dev.mysql.com/doc/refman/8.4/en/server-system-variables.html#sysvar_default_authentication_plugin +# default-authentication-plugin=mysql_native_password +# +##datadir=/var/lib/mysql +##socket=/var/lib/mysql/mysql.sock +##log-error=/var/log/mysqld.log +##pid-file=/var/run/mysqld/mysqld.pid +# +!includedir /etc/my.cnf.d +# diff --git a/sources/bxpercona846/etc_mycnfd_docker.cnf b/sources/bxpercona846/etc_mycnfd_docker.cnf new file mode 100644 index 0000000..55405f3 --- /dev/null +++ b/sources/bxpercona846/etc_mycnfd_docker.cnf @@ -0,0 +1,3 @@ +#[mysqld] +#host_cache_size=0 +#skip-name-resolve diff --git a/sources/bxpercona846/etc_mycnfd_my.cnf b/sources/bxpercona846/etc_mycnfd_my.cnf new file mode 100644 index 0000000..3d13828 --- /dev/null +++ b/sources/bxpercona846/etc_mycnfd_my.cnf @@ -0,0 +1,85 @@ +[client] +port = 3306 +default-character-set = utf8mb4 +user = mysql + +[mysqld_safe] +nice = 0 +#log-error = /var/log/mysql/error.log +user = mysql + +[mysqld] +#default-authentication-plugin = mysql_native_password # deprecated +#authentication_policy = "mysql_native_password,," # mysql_native_password deprecated 8.0.34 +authentication_policy = "*,," +user = mysql +port = 3306 +basedir = /usr +datadir = /var/lib/mysql +server-id = 101 +skip-external-locking +default-storage-engine = innodb +pid-file = /var/run/mysqld/mysqld.pid +transaction_isolation = READ-COMMITTED +max_allowed_packet = 16M +myisam-recover-options = BACKUP +explicit_defaults_for_timestamp = 1 +#expire_logs_days = 30 +#binlog_expire_logs_seconds = 2592000 +max_binlog_size = 1024M +sql_mode = "" +tmpdir = /tmp +innodb_file_per_table +innodb_buffer_pool_size = 1024M +innodb_flush_log_at_trx_commit = 2 +#innodb_log_file_size = 64M # deprecated percona 8.0.30 +innodb-redo-log-capacity = 104857600 +innodb_flush_method = O_DIRECT +innodb_strict_mode = OFF +innodb_default_row_format = DYNAMIC +character-set-server = utf8mb4 +collation-server = utf8mb4_0900_ai_ci +init-connect = "SET NAMES utf8mb4 COLLATE utf8mb4_0900_ai_ci" +#skip-character-set-client-handshake # deprecated 8.0.35 +skip-name-resolve +max_connections = 43 +table_open_cache = 8096 +thread_cache_size = 96 +thread_stack = 512K +max_heap_table_size = 128M +tmp_table_size = 128M +key_buffer_size = 48M +join_buffer_size = 8M +sort_buffer_size = 8M +bulk_insert_buffer_size = 2M +myisam_sort_buffer_size = 8M +general_log = 0 +#general_log_file = /var/log/mysql/mysql.log +#log_error = /var/log/mysql/error.log +skip-log-bin +#log_bin = /var/lib/mysql/mysql-binlog +log_bin_index = /var/lib/mysql/mysql-binlog.index +relay_log = /var/lib/mysql/mysql-relay-binlog +relay_log_index = /var/lib/mysql/mysql-relay-binlog.index +slow_query_log = 0 +#slow_query_log_file = /var/log/mysql/slow.log +sync_binlog = 0 +tls_version = TLSv1.2,TLSv1.3 +secure-log-path=/var/lib/mysql-files +percona_telemetry_disable = 1 # disable percona telemetry, from 8.4.0 and above + +[system_default_sect] +MinProtocol = TLSv1.2 + +[mysqldump] +quick +quote-names +max_allowed_packet = 16M +default-character-set = utf8mb4 +user = mysql + +[mysql] +user = mysql + +[isamchk] +key_buffer = 16M diff --git a/sources/bxpercona847/Dockerfile b/sources/bxpercona847/Dockerfile new file mode 100644 index 0000000..9c06afb --- /dev/null +++ b/sources/bxpercona847/Dockerfile @@ -0,0 +1,12 @@ +FROM percona/percona-server:8.4.7 + +USER root + +COPY etc_my.cnf /etc/my.cnf +COPY etc_mycnfd_docker.cnf /etc/my.cnf.d/docker.cnf +COPY etc_mycnfd_my.cnf /etc/my.cnf.d/my.cnf + +RUN chown -R mysql:root /etc/my.cnf /etc/my.cnf.d && \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +USER mysql:mysql diff --git a/sources/bxpercona847/etc_my.cnf b/sources/bxpercona847/etc_my.cnf new file mode 100644 index 0000000..48d35a8 --- /dev/null +++ b/sources/bxpercona847/etc_my.cnf @@ -0,0 +1,35 @@ +# Percona Server template configuration +# +# For advice on how to change settings please see +# http://dev.mysql.com/doc/refman/8.4/en/server-configuration-defaults.html +# +[mysqld] +# +# Remove leading # and set to the amount of RAM for the most important data +# cache in MySQL. Start at 70% of total RAM for dedicated server, else 10%. +# innodb_buffer_pool_size = 128M +# +# Remove the leading "# " to disable binary logging +# Binary logging captures changes between backups and is enabled by +# default. It's default setting is log_bin=binlog +# disable_log_bin +# +# Remove leading # to set options mainly useful for reporting servers. +# The server defaults are faster for transactions and fast SELECTs. +# Adjust sizes as needed, experiment to find the optimal values. +# join_buffer_size = 128M +# sort_buffer_size = 2M +# read_rnd_buffer_size = 2M +# +# Remove leading # to revert to previous value for default_authentication_plugin, +# this will increase compatibility with older clients. For background, see: +# https://dev.mysql.com/doc/refman/8.4/en/server-system-variables.html#sysvar_default_authentication_plugin +# default-authentication-plugin=mysql_native_password +# +##datadir=/var/lib/mysql +##socket=/var/lib/mysql/mysql.sock +##log-error=/var/log/mysqld.log +##pid-file=/var/run/mysqld/mysqld.pid +# +!includedir /etc/my.cnf.d +# diff --git a/sources/bxpercona847/etc_mycnfd_docker.cnf b/sources/bxpercona847/etc_mycnfd_docker.cnf new file mode 100644 index 0000000..55405f3 --- /dev/null +++ b/sources/bxpercona847/etc_mycnfd_docker.cnf @@ -0,0 +1,3 @@ +#[mysqld] +#host_cache_size=0 +#skip-name-resolve diff --git a/sources/bxpercona847/etc_mycnfd_my.cnf b/sources/bxpercona847/etc_mycnfd_my.cnf new file mode 100644 index 0000000..3d13828 --- /dev/null +++ b/sources/bxpercona847/etc_mycnfd_my.cnf @@ -0,0 +1,85 @@ +[client] +port = 3306 +default-character-set = utf8mb4 +user = mysql + +[mysqld_safe] +nice = 0 +#log-error = /var/log/mysql/error.log +user = mysql + +[mysqld] +#default-authentication-plugin = mysql_native_password # deprecated +#authentication_policy = "mysql_native_password,," # mysql_native_password deprecated 8.0.34 +authentication_policy = "*,," +user = mysql +port = 3306 +basedir = /usr +datadir = /var/lib/mysql +server-id = 101 +skip-external-locking +default-storage-engine = innodb +pid-file = /var/run/mysqld/mysqld.pid +transaction_isolation = READ-COMMITTED +max_allowed_packet = 16M +myisam-recover-options = BACKUP +explicit_defaults_for_timestamp = 1 +#expire_logs_days = 30 +#binlog_expire_logs_seconds = 2592000 +max_binlog_size = 1024M +sql_mode = "" +tmpdir = /tmp +innodb_file_per_table +innodb_buffer_pool_size = 1024M +innodb_flush_log_at_trx_commit = 2 +#innodb_log_file_size = 64M # deprecated percona 8.0.30 +innodb-redo-log-capacity = 104857600 +innodb_flush_method = O_DIRECT +innodb_strict_mode = OFF +innodb_default_row_format = DYNAMIC +character-set-server = utf8mb4 +collation-server = utf8mb4_0900_ai_ci +init-connect = "SET NAMES utf8mb4 COLLATE utf8mb4_0900_ai_ci" +#skip-character-set-client-handshake # deprecated 8.0.35 +skip-name-resolve +max_connections = 43 +table_open_cache = 8096 +thread_cache_size = 96 +thread_stack = 512K +max_heap_table_size = 128M +tmp_table_size = 128M +key_buffer_size = 48M +join_buffer_size = 8M +sort_buffer_size = 8M +bulk_insert_buffer_size = 2M +myisam_sort_buffer_size = 8M +general_log = 0 +#general_log_file = /var/log/mysql/mysql.log +#log_error = /var/log/mysql/error.log +skip-log-bin +#log_bin = /var/lib/mysql/mysql-binlog +log_bin_index = /var/lib/mysql/mysql-binlog.index +relay_log = /var/lib/mysql/mysql-relay-binlog +relay_log_index = /var/lib/mysql/mysql-relay-binlog.index +slow_query_log = 0 +#slow_query_log_file = /var/log/mysql/slow.log +sync_binlog = 0 +tls_version = TLSv1.2,TLSv1.3 +secure-log-path=/var/lib/mysql-files +percona_telemetry_disable = 1 # disable percona telemetry, from 8.4.0 and above + +[system_default_sect] +MinProtocol = TLSv1.2 + +[mysqldump] +quick +quote-names +max_allowed_packet = 16M +default-character-set = utf8mb4 +user = mysql + +[mysql] +user = mysql + +[isamchk] +key_buffer = 16M diff --git a/sources/bxphp8227/Dockerfile b/sources/bxphp8227/Dockerfile new file mode 100644 index 0000000..ea4d34c --- /dev/null +++ b/sources/bxphp8227/Dockerfile @@ -0,0 +1,95 @@ +FROM php:8.2.27-fpm-alpine AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql16-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.3.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.24.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://pecl.php.net/get/mcrypt-1.0.7.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.1.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.4.1.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.7.0.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.2.27-fpm-alpine AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8227/bitrix.sh b/sources/bxphp8227/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8227/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8227/msmtprc b/sources/bxphp8227/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8227/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8228/Dockerfile b/sources/bxphp8228/Dockerfile new file mode 100644 index 0000000..c98d2b5 --- /dev/null +++ b/sources/bxphp8228/Dockerfile @@ -0,0 +1,95 @@ +FROM php:8.2.28-fpm-alpine AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql16-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.3.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.24.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://pecl.php.net/get/mcrypt-1.0.7.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.2.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.4.3.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.0.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.2.28-fpm-alpine AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8228/bitrix.sh b/sources/bxphp8228/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8228/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8228/msmtprc b/sources/bxphp8228/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8228/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8229/Dockerfile b/sources/bxphp8229/Dockerfile new file mode 100644 index 0000000..3833e94 --- /dev/null +++ b/sources/bxphp8229/Dockerfile @@ -0,0 +1,95 @@ +FROM php:8.2.29-fpm-alpine3.21 AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql16-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.3.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.24.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://pecl.php.net/get/mcrypt-1.0.7.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.2.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.4.4.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.0.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.2.29-fpm-alpine3.21 AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8229/bitrix.sh b/sources/bxphp8229/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8229/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8229/msmtprc b/sources/bxphp8229/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8229/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8230/Dockerfile b/sources/bxphp8230/Dockerfile new file mode 100644 index 0000000..3022dd3 --- /dev/null +++ b/sources/bxphp8230/Dockerfile @@ -0,0 +1,95 @@ +FROM php:8.2.30-fpm-alpine3.22 AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql17-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev libavif libavif-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.3.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.28.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://pecl.php.net/get/mcrypt-1.0.7.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.2.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.5.0.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.1.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-avif --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.2.30-fpm-alpine3.22 AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libavif libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8230/bitrix.sh b/sources/bxphp8230/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8230/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8230/msmtprc b/sources/bxphp8230/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8230/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8321/Dockerfile b/sources/bxphp8321/Dockerfile new file mode 100644 index 0000000..937b87b --- /dev/null +++ b/sources/bxphp8321/Dockerfile @@ -0,0 +1,95 @@ +FROM php:8.3.21-fpm-alpine AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql16-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.3.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.24.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://pecl.php.net/get/mcrypt-1.0.7.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.2.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.4.3.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.0.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.3.21-fpm-alpine AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8321/bitrix.sh b/sources/bxphp8321/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8321/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8321/msmtprc b/sources/bxphp8321/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8321/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8322/Dockerfile b/sources/bxphp8322/Dockerfile new file mode 100644 index 0000000..0603198 --- /dev/null +++ b/sources/bxphp8322/Dockerfile @@ -0,0 +1,95 @@ +FROM php:8.3.22-fpm-alpine AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql16-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.3.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.24.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://pecl.php.net/get/mcrypt-1.0.7.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.2.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.4.3.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.0.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.3.22-fpm-alpine AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8322/bitrix.sh b/sources/bxphp8322/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8322/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8322/msmtprc b/sources/bxphp8322/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8322/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8323/Dockerfile b/sources/bxphp8323/Dockerfile new file mode 100644 index 0000000..af615ed --- /dev/null +++ b/sources/bxphp8323/Dockerfile @@ -0,0 +1,95 @@ +FROM php:8.3.23-fpm-alpine3.21 AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql16-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.3.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.24.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://pecl.php.net/get/mcrypt-1.0.7.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.2.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.4.4.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.0.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.3.23-fpm-alpine3.21 AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8323/bitrix.sh b/sources/bxphp8323/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8323/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8323/msmtprc b/sources/bxphp8323/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8323/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8324/Dockerfile b/sources/bxphp8324/Dockerfile new file mode 100644 index 0000000..9938719 --- /dev/null +++ b/sources/bxphp8324/Dockerfile @@ -0,0 +1,95 @@ +FROM php:8.3.24-fpm-alpine3.21 AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql17-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.3.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.25.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://pecl.php.net/get/mcrypt-1.0.7.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.2.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.4.5.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.0.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.3.24-fpm-alpine3.21 AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8324/bitrix.sh b/sources/bxphp8324/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8324/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8324/msmtprc b/sources/bxphp8324/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8324/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8325/Dockerfile b/sources/bxphp8325/Dockerfile new file mode 100644 index 0000000..e4cf0e4 --- /dev/null +++ b/sources/bxphp8325/Dockerfile @@ -0,0 +1,95 @@ +FROM php:8.3.25-fpm-alpine3.21 AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql17-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.3.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.27.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://pecl.php.net/get/mcrypt-1.0.9.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.2.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.4.5.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.0.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.3.25-fpm-alpine3.21 AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8325/bitrix.sh b/sources/bxphp8325/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8325/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8325/msmtprc b/sources/bxphp8325/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8325/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8326/Dockerfile b/sources/bxphp8326/Dockerfile new file mode 100644 index 0000000..ae8abbe --- /dev/null +++ b/sources/bxphp8326/Dockerfile @@ -0,0 +1,95 @@ +FROM php:8.3.26-fpm-alpine3.21 AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql17-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.3.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.27.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://pecl.php.net/get/mcrypt-1.0.9.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.2.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.4.5.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.0.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.3.26-fpm-alpine3.21 AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8326/bitrix.sh b/sources/bxphp8326/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8326/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8326/msmtprc b/sources/bxphp8326/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8326/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8327/Dockerfile b/sources/bxphp8327/Dockerfile new file mode 100644 index 0000000..a1c7d87 --- /dev/null +++ b/sources/bxphp8327/Dockerfile @@ -0,0 +1,95 @@ +FROM php:8.3.27-fpm-alpine3.21 AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql17-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.4.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.27.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://pecl.php.net/get/mcrypt-1.0.9.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.2.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.4.6.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.0.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.3.27-fpm-alpine3.21 AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8327/bitrix.sh b/sources/bxphp8327/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8327/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8327/msmtprc b/sources/bxphp8327/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8327/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8328/Dockerfile b/sources/bxphp8328/Dockerfile new file mode 100644 index 0000000..29e9735 --- /dev/null +++ b/sources/bxphp8328/Dockerfile @@ -0,0 +1,95 @@ +FROM php:8.3.28-fpm-alpine3.21 AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql17-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev libavif libavif-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.4.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.27.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://pecl.php.net/get/mcrypt-1.0.9.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.3.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.4.7.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.0.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-avif --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.3.28-fpm-alpine3.21 AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8328/bitrix.sh b/sources/bxphp8328/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8328/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8328/msmtprc b/sources/bxphp8328/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8328/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8329/Dockerfile b/sources/bxphp8329/Dockerfile new file mode 100644 index 0000000..1b1e2cf --- /dev/null +++ b/sources/bxphp8329/Dockerfile @@ -0,0 +1,95 @@ +FROM php:8.3.29-fpm-alpine3.22 AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql17-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev libavif libavif-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.4.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.28.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://pecl.php.net/get/mcrypt-1.0.9.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.3.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.5.0.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.1.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-avif --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.3.29-fpm-alpine3.22 AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libavif libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8329/bitrix.sh b/sources/bxphp8329/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8329/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8329/msmtprc b/sources/bxphp8329/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8329/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8330/Dockerfile b/sources/bxphp8330/Dockerfile new file mode 100644 index 0000000..2d8a049 --- /dev/null +++ b/sources/bxphp8330/Dockerfile @@ -0,0 +1,95 @@ +FROM php:8.3.30-fpm-alpine3.22 AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql17-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev libavif libavif-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.4.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.28.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://pecl.php.net/get/mcrypt-1.0.9.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.3.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.5.0.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.2.0.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.1.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-avif --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.3.30-fpm-alpine3.22 AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libavif libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8330/bitrix.sh b/sources/bxphp8330/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8330/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8330/msmtprc b/sources/bxphp8330/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8330/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8410/Dockerfile b/sources/bxphp8410/Dockerfile new file mode 100644 index 0000000..2985cfc --- /dev/null +++ b/sources/bxphp8410/Dockerfile @@ -0,0 +1,96 @@ +FROM php:8.4.10-fpm-alpine3.21 AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql16-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.3.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.24.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/pspell && curl -fsSL https://pecl.php.net/get/pspell-1.0.1.tgz | tar xvz -C "/usr/src/php/ext/pspell" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://github.com/cyrax13/pecl.php.net/raw/refs/heads/main/mcrypt-1.0.7dev.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.2.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.4.4.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.0.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.4.10-fpm-alpine3.21 AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8410/bitrix.sh b/sources/bxphp8410/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8410/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8410/msmtprc b/sources/bxphp8410/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8410/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8411/Dockerfile b/sources/bxphp8411/Dockerfile new file mode 100644 index 0000000..2ccd3c1 --- /dev/null +++ b/sources/bxphp8411/Dockerfile @@ -0,0 +1,96 @@ +FROM php:8.4.11-fpm-alpine3.21 AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql17-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.3.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.25.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/pspell && curl -fsSL https://pecl.php.net/get/pspell-1.0.1.tgz | tar xvz -C "/usr/src/php/ext/pspell" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://github.com/cyrax13/pecl.php.net/raw/refs/heads/main/mcrypt-1.0.7dev.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.2.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.4.5.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.0.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.4.11-fpm-alpine3.21 AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8411/bitrix.sh b/sources/bxphp8411/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8411/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8411/msmtprc b/sources/bxphp8411/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8411/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8412/Dockerfile b/sources/bxphp8412/Dockerfile new file mode 100644 index 0000000..3624714 --- /dev/null +++ b/sources/bxphp8412/Dockerfile @@ -0,0 +1,96 @@ +FROM php:8.4.12-fpm-alpine3.21 AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql17-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.3.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.27.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/pspell && curl -fsSL https://pecl.php.net/get/pspell-1.0.1.tgz | tar xvz -C "/usr/src/php/ext/pspell" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://pecl.php.net/get/mcrypt-1.0.9.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.2.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.4.5.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.0.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.4.12-fpm-alpine3.21 AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8412/bitrix.sh b/sources/bxphp8412/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8412/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8412/msmtprc b/sources/bxphp8412/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8412/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8413/Dockerfile b/sources/bxphp8413/Dockerfile new file mode 100644 index 0000000..859165a --- /dev/null +++ b/sources/bxphp8413/Dockerfile @@ -0,0 +1,96 @@ +FROM php:8.4.13-fpm-alpine3.21 AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql17-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.3.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.27.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/pspell && curl -fsSL https://pecl.php.net/get/pspell-1.0.1.tgz | tar xvz -C "/usr/src/php/ext/pspell" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://pecl.php.net/get/mcrypt-1.0.9.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.2.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.4.5.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.0.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.4.13-fpm-alpine3.21 AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8413/bitrix.sh b/sources/bxphp8413/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8413/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8413/msmtprc b/sources/bxphp8413/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8413/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8414/Dockerfile b/sources/bxphp8414/Dockerfile new file mode 100644 index 0000000..2869672 --- /dev/null +++ b/sources/bxphp8414/Dockerfile @@ -0,0 +1,96 @@ +FROM php:8.4.14-fpm-alpine3.21 AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql17-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.4.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.27.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/pspell && curl -fsSL https://pecl.php.net/get/pspell-1.0.1.tgz | tar xvz -C "/usr/src/php/ext/pspell" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://pecl.php.net/get/mcrypt-1.0.9.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.2.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.4.6.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.0.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.4.14-fpm-alpine3.21 AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8414/bitrix.sh b/sources/bxphp8414/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8414/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8414/msmtprc b/sources/bxphp8414/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8414/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8415/Dockerfile b/sources/bxphp8415/Dockerfile new file mode 100644 index 0000000..a308041 --- /dev/null +++ b/sources/bxphp8415/Dockerfile @@ -0,0 +1,96 @@ +FROM php:8.4.15-fpm-alpine3.22 AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql17-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev libavif libavif-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.4.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.27.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/pspell && curl -fsSL https://pecl.php.net/get/pspell-1.0.1.tgz | tar xvz -C "/usr/src/php/ext/pspell" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://pecl.php.net/get/mcrypt-1.0.9.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.3.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.4.7.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.0.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-avif --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.4.15-fpm-alpine3.22 AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8415/bitrix.sh b/sources/bxphp8415/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8415/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8415/msmtprc b/sources/bxphp8415/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8415/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8416/Dockerfile b/sources/bxphp8416/Dockerfile new file mode 100644 index 0000000..e55cb8b --- /dev/null +++ b/sources/bxphp8416/Dockerfile @@ -0,0 +1,96 @@ +FROM php:8.4.16-fpm-alpine3.22 AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql17-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev libavif libavif-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.4.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.28.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/pspell && curl -fsSL https://pecl.php.net/get/pspell-1.0.1.tgz | tar xvz -C "/usr/src/php/ext/pspell" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://pecl.php.net/get/mcrypt-1.0.9.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.3.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.5.0.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.1.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-avif --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.4.16-fpm-alpine3.22 AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libavif libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8416/bitrix.sh b/sources/bxphp8416/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8416/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8416/msmtprc b/sources/bxphp8416/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8416/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8417/Dockerfile b/sources/bxphp8417/Dockerfile new file mode 100644 index 0000000..0641098 --- /dev/null +++ b/sources/bxphp8417/Dockerfile @@ -0,0 +1,96 @@ +FROM php:8.4.17-fpm-alpine3.22 AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql17-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev libavif libavif-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.4.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.28.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/pspell && curl -fsSL https://pecl.php.net/get/pspell-1.0.1.tgz | tar xvz -C "/usr/src/php/ext/pspell" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://pecl.php.net/get/mcrypt-1.0.9.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.3.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.5.0.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.2.0.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.1.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-avif --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.4.17-fpm-alpine3.22 AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libavif libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8417/bitrix.sh b/sources/bxphp8417/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8417/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8417/msmtprc b/sources/bxphp8417/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8417/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp8418/Dockerfile b/sources/bxphp8418/Dockerfile new file mode 100644 index 0000000..e82f137 --- /dev/null +++ b/sources/bxphp8418/Dockerfile @@ -0,0 +1,96 @@ +FROM php:8.4.18-fpm-alpine3.22 AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql17-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev libavif libavif-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.4.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.28.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/pspell && curl -fsSL https://pecl.php.net/get/pspell-1.0.1.tgz | tar xvz -C "/usr/src/php/ext/pspell" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://pecl.php.net/get/mcrypt-1.0.9.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.3.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.5.0.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.2.0.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.1.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-avif --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.4.18-fpm-alpine3.22 AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libavif libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp8418/bitrix.sh b/sources/bxphp8418/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp8418/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp8418/msmtprc b/sources/bxphp8418/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp8418/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp847/Dockerfile b/sources/bxphp847/Dockerfile new file mode 100644 index 0000000..5513ba6 --- /dev/null +++ b/sources/bxphp847/Dockerfile @@ -0,0 +1,96 @@ +FROM php:8.4.7-fpm-alpine3.21 AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql16-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.3.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.24.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/pspell && curl -fsSL https://pecl.php.net/get/pspell-1.0.1.tgz | tar xvz -C "/usr/src/php/ext/pspell" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://github.com/cyrax13/pecl.php.net/raw/refs/heads/main/mcrypt-1.0.7dev.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.2.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.4.3.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.0.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.4.7-fpm-alpine3.21 AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp847/bitrix.sh b/sources/bxphp847/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp847/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp847/msmtprc b/sources/bxphp847/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp847/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxphp848/Dockerfile b/sources/bxphp848/Dockerfile new file mode 100644 index 0000000..bfcf5e5 --- /dev/null +++ b/sources/bxphp848/Dockerfile @@ -0,0 +1,96 @@ +FROM php:8.4.8-fpm-alpine3.21 AS builder + +USER root + +RUN apk add --no-cache --virtual .build-deps \ + file \ + autoconf \ + dpkg-dev dpkg \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c \ + bzip2-dev \ + postgresql16-dev \ + zip libzip libzip-dev \ + freetype freetype-dev libpng libpng-dev libjpeg-turbo libjpeg-turbo-dev libxpm libxpm-dev libwebp libwebp-dev \ + openldap-dev libldap libsasl cyrus-sasl-dev \ + gettext gettext-dev \ + aspell-dev \ + libxml2-dev \ + libxslt-dev \ + linux-headers \ + libmemcached libmemcached-dev libmemcached-libs \ + libmcrypt-dev \ + lz4 lz4-dev liblzf liblzf-dev zstd zstd-dev \ + rabbitmq-c rabbitmq-c-dev libpq libpq-dev \ + libssh2-dev \ + imagemagick imagemagick-dev + +RUN docker-php-source extract && \ + mkdir -p /usr/src/php/ext/memcache && curl -fsSL https://pecl.php.net/get/memcache-8.2.tgz | tar xvz -C "/usr/src/php/ext/memcache" --strip 1 && \ + mkdir -p /usr/src/php/ext/memcached && curl -fsSL https://pecl.php.net/get/memcached-3.3.0.tgz | tar xvz -C "/usr/src/php/ext/memcached" --strip 1 && \ + mkdir -p /usr/src/php/ext/apcu && curl -fsSL https://pecl.php.net/get/apcu-5.1.24.tgz | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \ + mkdir -p /usr/src/php/ext/pspell && curl -fsSL https://pecl.php.net/get/pspell-1.0.1.tgz | tar xvz -C "/usr/src/php/ext/pspell" --strip 1 && \ + mkdir -p /usr/src/php/ext/mcrypt && curl -fsSL https://github.com/cyrax13/pecl.php.net/raw/refs/heads/main/mcrypt-1.0.7dev.tgz | tar xvz -C "/usr/src/php/ext/mcrypt" --strip 1 && \ + mkdir -p /usr/src/php/ext/msgpack && curl -fsSL https://pecl.php.net/get/msgpack-3.0.0.tgz | tar xvz -C "/usr/src/php/ext/msgpack" --strip 1 && \ + mkdir -p /usr/src/php/ext/igbinary && curl -fsSL https://pecl.php.net/get/igbinary-3.2.16.tgz | tar xvz -C "/usr/src/php/ext/igbinary" --strip 1 && \ + mkdir -p /usr/src/php/ext/redis && curl -fsSL https://pecl.php.net/get/redis-6.2.0.tgz | tar xvz -C "/usr/src/php/ext/redis" --strip 1 && \ + mkdir -p /usr/src/php/ext/xhprof && curl -fsSL https://pecl.php.net/get/xhprof-2.3.10.tgz | tar xvz -C "/usr/src/php/ext/xhprof" --strip 1 && \ + mkdir -p /usr/src/php/ext/xdebug && curl -fsSL https://pecl.php.net/get/xdebug-3.4.3.tgz | tar xvz -C "/usr/src/php/ext/xdebug" --strip 1 && \ + mkdir -p /usr/src/php/ext/amqp && curl -fsSL https://pecl.php.net/get/amqp-2.1.2.tgz | tar xvz -C "/usr/src/php/ext/amqp" --strip 1 && \ + mkdir -p /usr/src/php/ext/ssh2 && curl -fsSL https://pecl.php.net/get/ssh2-1.4.1.tgz | tar xvz -C "/usr/src/php/ext/ssh2" --strip 1 && \ + mkdir -p /usr/src/php/ext/imagick && curl -fsSL https://pecl.php.net/get/imagick-3.8.0.tgz | tar xvz -C "/usr/src/php/ext/imagick" --strip 1 && \ + cp -fr /usr/src/php/ext/xhprof/extension/* /usr/src/php/ext/xhprof/ && \ + cp -fr /usr/src/php/ext/igbinary /usr/local/include/php/ext/igbinary && \ + cp -fr /usr/src/php/ext/msgpack /usr/local/include/php/ext/msgpack + +RUN docker-php-ext-configure gd --with-freetype --with-jpeg --with-xpm --with-webp && \ + docker-php-ext-configure opcache --enable-opcache && \ + docker-php-ext-configure redis --enable-redis-igbinary --enable-redis-msgpack --enable-redis-lzf --enable-redis-zstd + +RUN docker-php-ext-install mysqli pdo_mysql bz2 pgsql pdo_pgsql zip gd opcache ldap exif intl calendar sodium gettext pspell xml xmlwriter xsl shmop sysvmsg sysvsem sysvshm sockets memcache memcached apcu mcrypt msgpack igbinary redis xhprof xdebug amqp ssh2 imagick + +FROM php:8.4.8-fpm-alpine3.21 AS production + +USER root + +COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ + +COPY --from=builder /usr/local/etc/ /usr/local/etc/ + +RUN mkdir -p /etc/periodic/1min && \ + mkdir -p /opt/msmtp/ + +COPY bitrix.sh /etc/periodic/1min/bitrix + +COPY msmtprc /opt/msmtp/.msmtprc + +RUN docker-php-source delete && \ + apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing catdoc && \ + apk add --no-cache msmtp curl openssl ca-certificates tzdata poppler-utils aspell bzip2 gettext libmcrypt libldap libsasl cyrus-sasl libmemcached libmemcached-libs icu-libs libxslt freetype libpng libjpeg-turbo libxpm libwebp libgomp zip libzip libxml2 lz4 liblzf zstd libpq rabbitmq-c libssh2 imagemagick && \ + curl -fsSL https://getcomposer.org/download/latest-stable/composer.phar -o composer.phar && \ + chmod +x composer.phar && \ + mv composer.phar /usr/local/bin/composer && \ + echo "* * * * * run-parts /etc/periodic/1min" >> /etc/crontabs/root && \ + sed -i '/^$/d' /etc/crontabs/root && \ + echo "" >> /etc/crontabs/root && \ + chmod -R a+x /etc/periodic/1min/bitrix && \ + chmod 600 /opt/msmtp/.msmtprc && \ + ln -s /opt/msmtp/.msmtprc /etc/msmtprc + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN mkdir -pv /opt/www /opt/.bx_temp /opt/browscap /opt/geoip2 /ssl && \ + chown -R bitrix:bitrix /usr/local/etc && \ + chown -R bitrix:bitrix /opt/www && \ + chown -R bitrix:bitrix /opt/.bx_temp && \ + chown -R bitrix:bitrix /opt/msmtp && \ + chown -R bitrix:bitrix /opt/browscap && \ + chown -R bitrix:bitrix /opt/geoip2 && \ + chown -R bitrix:bitrix /ssl + +USER bitrix:bitrix diff --git a/sources/bxphp848/bitrix.sh b/sources/bxphp848/bitrix.sh new file mode 100755 index 0000000..53225a5 --- /dev/null +++ b/sources/bxphp848/bitrix.sh @@ -0,0 +1,10 @@ +#!/bin/sh +# +if [[ -f /opt/www/bitrix/.settings.php ]]; +then + if [[ ! -f /opt/www/install.config && ! -f /opt/www/license.php && ! -f /opt/www/readme.php ]]; + then + su - bitrix -c 'php -f /opt/www/bitrix/modules/main/tools/cron_events.php; > /dev/null 2>&1' + fi +fi +# diff --git a/sources/bxphp848/msmtprc b/sources/bxphp848/msmtprc new file mode 100644 index 0000000..f0c41c6 --- /dev/null +++ b/sources/bxphp848/msmtprc @@ -0,0 +1,16 @@ +# smtp account configuration for default +account default +logfile /proc/self/fd/2 +host localhost +port 25 +from xxx@yyy.zzz +user xxx@yyy.zzz +password xxxyyyzzz +auth login +aliases /etc/aliases +keepbcc off +tls on +tls_starttls on +tls_certcheck on +tls_trust_file /etc/ssl/certs/ca-certificates.crt +protocol smtp diff --git a/sources/bxpush30/Dockerfile b/sources/bxpush30/Dockerfile new file mode 100644 index 0000000..db7392f --- /dev/null +++ b/sources/bxpush30/Dockerfile @@ -0,0 +1,47 @@ +FROM node:20 AS builder + +USER root + +ENV PUSH=push-server.tar.gz + +RUN mkdir -p /opt/push-server + +COPY push-server-0.4.0.tar.gz /opt/push-server/$PUSH + +WORKDIR /opt/push-server + +RUN tar xzvvf $PUSH && rm -f $PUSH + +RUN npm install --omit=dev + +FROM node:20-alpine AS production + +USER root + +RUN apk --no-cache add shadow bash gettext libintl curl openssl ca-certificates tzdata && \ + addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix && \ + mkdir -p /usr/local/bin && \ + mv /usr/bin/envsubst /usr/local/bin/envsubst && \ + [[ ! -d /tmp/push-server ]] && mkdir /tmp/push-server && \ + [[ ! -d /etc/push-server ]] && mkdir /etc/push-server && \ + mkdir -p /var/log/push-server + +WORKDIR /opt/push-server + +COPY --from=builder /opt/push-server /opt/push-server +COPY docker-entrypoint.sh /usr/local/bin/ +COPY push-server-pub.json /etc/push-server/push-server-pub.json +COPY push-server-sub.json /etc/push-server/push-server-sub.json + +RUN chown -R bitrix:bitrix /opt/push-server && \ + chown -R bitrix:bitrix /tmp/push-server && \ + chown -R bitrix:bitrix /etc/push-server && \ + chmod 0755 /usr/local/bin/docker-entrypoint.sh && \ + chown -R bitrix:bitrix /var/log/push-server + +# VOLUME /var/log/push-server + +USER bitrix:bitrix + +ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"] diff --git a/sources/bxpush30/docker-entrypoint.sh b/sources/bxpush30/docker-entrypoint.sh new file mode 100755 index 0000000..b783f13 --- /dev/null +++ b/sources/bxpush30/docker-entrypoint.sh @@ -0,0 +1,71 @@ +#!/bin/bash +# +# Push Server on NodeJS variables +# +# REDIS_HOST - redis host +# REDIS_PORT - redis port +# +# PUSH_SECURITY_KEY - push security key +# PUSH_PUB_MODE - push pub +# PUSH_PUB_PORT - push pub port +# PUSH_SUB_MODE - push sub +# PUSH_SUB_PORT - push sub port +# +# RUN_DIR - temporary directory for service; default /tmp/push-server +# PUB_URI - pub service uri +# REST_URI - rest service uri +# SUB_URI - sub service uri +# +export WORKDIR=/opt/push-server +export CONFIG_DIR=/etc/push-server +PUB_TMPL=$CONFIG_DIR/push-server-pub.json +SUB_TMPL=$CONFIG_DIR/push-server-sub.json +CONFIG=$CONFIG_DIR/config.json +export LOG_DIR=/var/log/push-server +[[ -z $RUN_DIR ]] && RUN_DIR=/tmp/push-server +export RUN_DIR +# +log() { + msg="${1}" + printf "%-16s: [%d]> %s\n" "$(date +%Y/%m/%dT%H:%M)" "$$" "$msg" +} +# +error() { + msg="${1}" + rtn="${2:-1}" + log "$msg" + exit $rtn +} +# +pushd $WORKDIR || error "Cannot access $WORKDIR" +[[ -z $PUSH_PUB_MODE && -z $PUSH_SUB_MODE ]] && error "Not defind push-server mode environment variables: PUSH_PUB_MODE or PUSH_SUB_MODE" +[[ $PUSH_PUB_MODE != "pub" && -z $PUSH_SUB_MODE ]] && error "Incorrect value in PUSH_PUB_MODE=$PUSH_PUB_MODE variable" +[[ -z $PUSH_PUB_MODE && $PUSH_SUB_MODE != "sub" ]] && error "Incorrect value in PUSH_SUB_MODE=$PUSH_SUB_MODE variable" +# +if [[ $PUSH_PUB_MODE == "pub" ]]; +then + log "PUSH_PUB_MODE=$PUSH_PUB_MODE" + TEMPLATE=$PUB_TMPL + [[ -z $REST_URI ]] && REST_URI="/bitrix/rest/" + [[ -z $PUB_URI ]] && PUB_URI="/bitrix/pub/" + log "REST_URI=$REST_URI" + log "PUB_URI=$PUB_URI" + export REST_URI + export PUB_URI +elif [[ $PUSH_SUB_MODE == "sub" ]]; +then + log "PUSH_SUB_MODE=$PUSH_SUB_MODE" + TEMPLATE=$SUB_TMPL + [[ -z $SUB_URI ]] && SUB_URI="/bitrix/subws/" + log "SUB_URI=$SUB_URI" + export SUB_URI +fi +# +popd +# +log "Create $CONFIG" +envsubst <$TEMPLATE >$CONFIG +# +log "Start server" +node server.js --config $CONFIG +# diff --git a/sources/bxpush30/push-server-0.4.0.tar.gz b/sources/bxpush30/push-server-0.4.0.tar.gz new file mode 100644 index 0000000..a5fce78 Binary files /dev/null and b/sources/bxpush30/push-server-0.4.0.tar.gz differ diff --git a/sources/bxpush30/push-server-pub.json b/sources/bxpush30/push-server-pub.json new file mode 100644 index 0000000..71d6362 --- /dev/null +++ b/sources/bxpush30/push-server-pub.json @@ -0,0 +1,49 @@ +{ + "servers": + [ + { + "name": "${PUSH_PUB_MODE}-${PUSH_PUB_PORT}", + "port": ${PUSH_PUB_PORT}, + "hostname": "0.0.0.0", + "backlog": 1024, + "routes": + { + "pub": "${PUB_URI}", + "stat": "/server-stat/", + "rest": "${REST_URI}" + } + } + ], + "publishMode": true, + "dataDir": "${WORKDIR}/data", + "processUniqueId": "${PUSH_PUB_MODE}-${PUSH_PUB_PORT}", + "clusterMode": true, + "storage": + { + "type": "redis", + "messageTLL": 86400, + "channelTLL": 86400, + "onlineTLL": 120, + "onlineDelta": 10, + "host": "${REDIS_HOST}", + "port": ${REDIS_PORT} + }, + "security": + { + "key": "${PUSH_SECURITY_KEY}" + }, + "limits": + { + "maxPayload": 1048576, + "maxConnPerChannel": 100, + "maxMessagesPerRequest": 100, + "maxChannelsPerRequest": 100, + "maxRequestsPerSecond": 50 + }, + "debug": + { + "folderName": "/var/log/push-server", + "ip": ["127.0.0.256"], + "trustProxy": true + } +} diff --git a/sources/bxpush30/push-server-sub.json b/sources/bxpush30/push-server-sub.json new file mode 100644 index 0000000..40191fd --- /dev/null +++ b/sources/bxpush30/push-server-sub.json @@ -0,0 +1,38 @@ +{ + "servers": + [ + { + "name": "${PUSH_SUB_MODE}-${PUSH_SUB_PORT}", + "port": ${PUSH_SUB_PORT}, + "hostname": "0.0.0.0", + "backlog": 1024, + "routes": + { + "sub": "${SUB_URI}" + } + } + ], + "dataDir": "${WORKDIR}/data", + "clusterMode": true, + "processUniqueId": "${PUSH_SUB_MODE}-${PUSH_SUB_PORT}", + "storage": + { + "type": "redis", + "messageTLL": 86400, + "channelTLL": 86400, + "onlineTLL": 120, + "onlineDelta": 10, + "host": "${REDIS_HOST}", + "port": ${REDIS_PORT} + }, + "security": + { + "key": "${PUSH_SECURITY_KEY}" + }, + "debug": + { + "folderName": "/var/log/push-server", + "ip": ["127.0.0.256"], + "trustProxy": true + } +} diff --git a/sources/bxpush31/Dockerfile b/sources/bxpush31/Dockerfile new file mode 100644 index 0000000..1ff5d64 --- /dev/null +++ b/sources/bxpush31/Dockerfile @@ -0,0 +1,47 @@ +FROM node:22 AS builder + +USER root + +ENV PUSH=push-server.tar.gz + +RUN mkdir -p /opt/push-server + +COPY push-server-0.4.0.tar.gz /opt/push-server/$PUSH + +WORKDIR /opt/push-server + +RUN tar xzvvf $PUSH && rm -f $PUSH + +RUN npm install --omit=dev + +FROM node:22-alpine AS production + +USER root + +RUN apk --no-cache add shadow bash gettext libintl curl openssl ca-certificates tzdata && \ + addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix && \ + mkdir -p /usr/local/bin && \ + mv /usr/bin/envsubst /usr/local/bin/envsubst && \ + [[ ! -d /tmp/push-server ]] && mkdir /tmp/push-server && \ + [[ ! -d /etc/push-server ]] && mkdir /etc/push-server && \ + mkdir -p /var/log/push-server + +WORKDIR /opt/push-server + +COPY --from=builder /opt/push-server /opt/push-server +COPY docker-entrypoint.sh /usr/local/bin/ +COPY push-server-pub.json /etc/push-server/push-server-pub.json +COPY push-server-sub.json /etc/push-server/push-server-sub.json + +RUN chown -R bitrix:bitrix /opt/push-server && \ + chown -R bitrix:bitrix /tmp/push-server && \ + chown -R bitrix:bitrix /etc/push-server && \ + chmod 0755 /usr/local/bin/docker-entrypoint.sh && \ + chown -R bitrix:bitrix /var/log/push-server + +# VOLUME /var/log/push-server + +USER bitrix:bitrix + +ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"] diff --git a/sources/bxpush31/docker-entrypoint.sh b/sources/bxpush31/docker-entrypoint.sh new file mode 100755 index 0000000..b783f13 --- /dev/null +++ b/sources/bxpush31/docker-entrypoint.sh @@ -0,0 +1,71 @@ +#!/bin/bash +# +# Push Server on NodeJS variables +# +# REDIS_HOST - redis host +# REDIS_PORT - redis port +# +# PUSH_SECURITY_KEY - push security key +# PUSH_PUB_MODE - push pub +# PUSH_PUB_PORT - push pub port +# PUSH_SUB_MODE - push sub +# PUSH_SUB_PORT - push sub port +# +# RUN_DIR - temporary directory for service; default /tmp/push-server +# PUB_URI - pub service uri +# REST_URI - rest service uri +# SUB_URI - sub service uri +# +export WORKDIR=/opt/push-server +export CONFIG_DIR=/etc/push-server +PUB_TMPL=$CONFIG_DIR/push-server-pub.json +SUB_TMPL=$CONFIG_DIR/push-server-sub.json +CONFIG=$CONFIG_DIR/config.json +export LOG_DIR=/var/log/push-server +[[ -z $RUN_DIR ]] && RUN_DIR=/tmp/push-server +export RUN_DIR +# +log() { + msg="${1}" + printf "%-16s: [%d]> %s\n" "$(date +%Y/%m/%dT%H:%M)" "$$" "$msg" +} +# +error() { + msg="${1}" + rtn="${2:-1}" + log "$msg" + exit $rtn +} +# +pushd $WORKDIR || error "Cannot access $WORKDIR" +[[ -z $PUSH_PUB_MODE && -z $PUSH_SUB_MODE ]] && error "Not defind push-server mode environment variables: PUSH_PUB_MODE or PUSH_SUB_MODE" +[[ $PUSH_PUB_MODE != "pub" && -z $PUSH_SUB_MODE ]] && error "Incorrect value in PUSH_PUB_MODE=$PUSH_PUB_MODE variable" +[[ -z $PUSH_PUB_MODE && $PUSH_SUB_MODE != "sub" ]] && error "Incorrect value in PUSH_SUB_MODE=$PUSH_SUB_MODE variable" +# +if [[ $PUSH_PUB_MODE == "pub" ]]; +then + log "PUSH_PUB_MODE=$PUSH_PUB_MODE" + TEMPLATE=$PUB_TMPL + [[ -z $REST_URI ]] && REST_URI="/bitrix/rest/" + [[ -z $PUB_URI ]] && PUB_URI="/bitrix/pub/" + log "REST_URI=$REST_URI" + log "PUB_URI=$PUB_URI" + export REST_URI + export PUB_URI +elif [[ $PUSH_SUB_MODE == "sub" ]]; +then + log "PUSH_SUB_MODE=$PUSH_SUB_MODE" + TEMPLATE=$SUB_TMPL + [[ -z $SUB_URI ]] && SUB_URI="/bitrix/subws/" + log "SUB_URI=$SUB_URI" + export SUB_URI +fi +# +popd +# +log "Create $CONFIG" +envsubst <$TEMPLATE >$CONFIG +# +log "Start server" +node server.js --config $CONFIG +# diff --git a/sources/bxpush31/push-server-0.4.0.tar.gz b/sources/bxpush31/push-server-0.4.0.tar.gz new file mode 100644 index 0000000..a5fce78 Binary files /dev/null and b/sources/bxpush31/push-server-0.4.0.tar.gz differ diff --git a/sources/bxpush31/push-server-pub.json b/sources/bxpush31/push-server-pub.json new file mode 100644 index 0000000..71d6362 --- /dev/null +++ b/sources/bxpush31/push-server-pub.json @@ -0,0 +1,49 @@ +{ + "servers": + [ + { + "name": "${PUSH_PUB_MODE}-${PUSH_PUB_PORT}", + "port": ${PUSH_PUB_PORT}, + "hostname": "0.0.0.0", + "backlog": 1024, + "routes": + { + "pub": "${PUB_URI}", + "stat": "/server-stat/", + "rest": "${REST_URI}" + } + } + ], + "publishMode": true, + "dataDir": "${WORKDIR}/data", + "processUniqueId": "${PUSH_PUB_MODE}-${PUSH_PUB_PORT}", + "clusterMode": true, + "storage": + { + "type": "redis", + "messageTLL": 86400, + "channelTLL": 86400, + "onlineTLL": 120, + "onlineDelta": 10, + "host": "${REDIS_HOST}", + "port": ${REDIS_PORT} + }, + "security": + { + "key": "${PUSH_SECURITY_KEY}" + }, + "limits": + { + "maxPayload": 1048576, + "maxConnPerChannel": 100, + "maxMessagesPerRequest": 100, + "maxChannelsPerRequest": 100, + "maxRequestsPerSecond": 50 + }, + "debug": + { + "folderName": "/var/log/push-server", + "ip": ["127.0.0.256"], + "trustProxy": true + } +} diff --git a/sources/bxpush31/push-server-sub.json b/sources/bxpush31/push-server-sub.json new file mode 100644 index 0000000..40191fd --- /dev/null +++ b/sources/bxpush31/push-server-sub.json @@ -0,0 +1,38 @@ +{ + "servers": + [ + { + "name": "${PUSH_SUB_MODE}-${PUSH_SUB_PORT}", + "port": ${PUSH_SUB_PORT}, + "hostname": "0.0.0.0", + "backlog": 1024, + "routes": + { + "sub": "${SUB_URI}" + } + } + ], + "dataDir": "${WORKDIR}/data", + "clusterMode": true, + "processUniqueId": "${PUSH_SUB_MODE}-${PUSH_SUB_PORT}", + "storage": + { + "type": "redis", + "messageTLL": 86400, + "channelTLL": 86400, + "onlineTLL": 120, + "onlineDelta": 10, + "host": "${REDIS_HOST}", + "port": ${REDIS_PORT} + }, + "security": + { + "key": "${PUSH_SECURITY_KEY}" + }, + "debug": + { + "folderName": "/var/log/push-server", + "ip": ["127.0.0.256"], + "trustProxy": true + } +} diff --git a/sources/bxpush32/Dockerfile b/sources/bxpush32/Dockerfile new file mode 100644 index 0000000..08e12f9 --- /dev/null +++ b/sources/bxpush32/Dockerfile @@ -0,0 +1,49 @@ +FROM node:22-trixie AS builder + +USER root + +ENV PUSH=push-server.tar.gz + +RUN mkdir -p /opt/push-server + +COPY push-server-0.5.0.tar.gz /opt/push-server/$PUSH + +WORKDIR /opt/push-server + +RUN tar xzvvf $PUSH && rm -f $PUSH + +RUN npm install --omit=dev + +FROM node:22-alpine AS production + +USER root + +RUN apk --no-cache add shadow bash gettext libintl curl openssl ca-certificates tzdata && \ + addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix && \ + mkdir -p /usr/local/bin && \ + mv /usr/bin/envsubst /usr/local/bin/envsubst && \ + [[ ! -d /tmp/push-server ]] && mkdir /tmp/push-server && \ + [[ ! -d /etc/push-server ]] && mkdir /etc/push-server && \ + mkdir -p /var/log/push-server && \ + ln -sf /dev/stdout /var/log/push-server/info.log && \ + ln -sf /dev/stderr /var/log/push-server/error.log + +WORKDIR /opt/push-server + +COPY --from=builder /opt/push-server /opt/push-server +COPY docker-entrypoint.sh /usr/local/bin/ +COPY push-server-pub.json /etc/push-server/push-server-pub.json +COPY push-server-sub.json /etc/push-server/push-server-sub.json + +RUN chown -R bitrix:bitrix /opt/push-server && \ + chown -R bitrix:bitrix /tmp/push-server && \ + chown -R bitrix:bitrix /etc/push-server && \ + chmod 0755 /usr/local/bin/docker-entrypoint.sh && \ + chown -R bitrix:bitrix /var/log/push-server + +# VOLUME /var/log/push-server + +USER bitrix:bitrix + +ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"] diff --git a/sources/bxpush32/docker-entrypoint.sh b/sources/bxpush32/docker-entrypoint.sh new file mode 100755 index 0000000..b783f13 --- /dev/null +++ b/sources/bxpush32/docker-entrypoint.sh @@ -0,0 +1,71 @@ +#!/bin/bash +# +# Push Server on NodeJS variables +# +# REDIS_HOST - redis host +# REDIS_PORT - redis port +# +# PUSH_SECURITY_KEY - push security key +# PUSH_PUB_MODE - push pub +# PUSH_PUB_PORT - push pub port +# PUSH_SUB_MODE - push sub +# PUSH_SUB_PORT - push sub port +# +# RUN_DIR - temporary directory for service; default /tmp/push-server +# PUB_URI - pub service uri +# REST_URI - rest service uri +# SUB_URI - sub service uri +# +export WORKDIR=/opt/push-server +export CONFIG_DIR=/etc/push-server +PUB_TMPL=$CONFIG_DIR/push-server-pub.json +SUB_TMPL=$CONFIG_DIR/push-server-sub.json +CONFIG=$CONFIG_DIR/config.json +export LOG_DIR=/var/log/push-server +[[ -z $RUN_DIR ]] && RUN_DIR=/tmp/push-server +export RUN_DIR +# +log() { + msg="${1}" + printf "%-16s: [%d]> %s\n" "$(date +%Y/%m/%dT%H:%M)" "$$" "$msg" +} +# +error() { + msg="${1}" + rtn="${2:-1}" + log "$msg" + exit $rtn +} +# +pushd $WORKDIR || error "Cannot access $WORKDIR" +[[ -z $PUSH_PUB_MODE && -z $PUSH_SUB_MODE ]] && error "Not defind push-server mode environment variables: PUSH_PUB_MODE or PUSH_SUB_MODE" +[[ $PUSH_PUB_MODE != "pub" && -z $PUSH_SUB_MODE ]] && error "Incorrect value in PUSH_PUB_MODE=$PUSH_PUB_MODE variable" +[[ -z $PUSH_PUB_MODE && $PUSH_SUB_MODE != "sub" ]] && error "Incorrect value in PUSH_SUB_MODE=$PUSH_SUB_MODE variable" +# +if [[ $PUSH_PUB_MODE == "pub" ]]; +then + log "PUSH_PUB_MODE=$PUSH_PUB_MODE" + TEMPLATE=$PUB_TMPL + [[ -z $REST_URI ]] && REST_URI="/bitrix/rest/" + [[ -z $PUB_URI ]] && PUB_URI="/bitrix/pub/" + log "REST_URI=$REST_URI" + log "PUB_URI=$PUB_URI" + export REST_URI + export PUB_URI +elif [[ $PUSH_SUB_MODE == "sub" ]]; +then + log "PUSH_SUB_MODE=$PUSH_SUB_MODE" + TEMPLATE=$SUB_TMPL + [[ -z $SUB_URI ]] && SUB_URI="/bitrix/subws/" + log "SUB_URI=$SUB_URI" + export SUB_URI +fi +# +popd +# +log "Create $CONFIG" +envsubst <$TEMPLATE >$CONFIG +# +log "Start server" +node server.js --config $CONFIG +# diff --git a/sources/bxpush32/push-server-0.5.0.tar.gz b/sources/bxpush32/push-server-0.5.0.tar.gz new file mode 100644 index 0000000..033771a Binary files /dev/null and b/sources/bxpush32/push-server-0.5.0.tar.gz differ diff --git a/sources/bxpush32/push-server-pub.json b/sources/bxpush32/push-server-pub.json new file mode 100644 index 0000000..83756c8 --- /dev/null +++ b/sources/bxpush32/push-server-pub.json @@ -0,0 +1,50 @@ +{ + "servers": + [ + { + "name": "${PUSH_PUB_MODE}-${PUSH_PUB_PORT}", + "port": ${PUSH_PUB_PORT}, + "hostname": "0.0.0.0", + "backlog": 1024, + "routes": + { + "pub": "${PUB_URI}", + "stat": "/server-stat/", + "rest": "${REST_URI}" + } + } + ], + "publishMode": true, + "dataDir": "${WORKDIR}/data", + "processUniqueId": "${PUSH_PUB_MODE}-${PUSH_PUB_PORT}", + "clusterMode": true, + "storage": + { + "type": "redis", + "messageTLL": 86400, + "channelTLL": 86400, + "onlineTLL": 120, + "onlineDelta": 10, + "host": "${REDIS_HOST}", + "port": ${REDIS_PORT} + }, + "security": + { + "key": "${PUSH_SECURITY_KEY}" + }, + "limits": + { + "maxPayload": 1048576, + "maxConnPerChannel": 100, + "maxMessagesPerRequest": 100, + "maxChannelsPerRequest": 100, + "maxRequestsPerSecond": 50 + }, + "debug": + { + "folderName": "/var/log/push-server", + "ip": ["127.0.0.256"], + "trustProxy": true, + "combineLogs": true + } +} diff --git a/sources/bxpush32/push-server-sub.json b/sources/bxpush32/push-server-sub.json new file mode 100644 index 0000000..13aa06b --- /dev/null +++ b/sources/bxpush32/push-server-sub.json @@ -0,0 +1,39 @@ +{ + "servers": + [ + { + "name": "${PUSH_SUB_MODE}-${PUSH_SUB_PORT}", + "port": ${PUSH_SUB_PORT}, + "hostname": "0.0.0.0", + "backlog": 1024, + "routes": + { + "sub": "${SUB_URI}" + } + } + ], + "dataDir": "${WORKDIR}/data", + "clusterMode": true, + "processUniqueId": "${PUSH_SUB_MODE}-${PUSH_SUB_PORT}", + "storage": + { + "type": "redis", + "messageTLL": 86400, + "channelTLL": 86400, + "onlineTLL": 120, + "onlineDelta": 10, + "host": "${REDIS_HOST}", + "port": ${REDIS_PORT} + }, + "security": + { + "key": "${PUSH_SECURITY_KEY}" + }, + "debug": + { + "folderName": "/var/log/push-server", + "ip": ["127.0.0.256"], + "trustProxy": true, + "combineLogs": true + } +} diff --git a/sources/bxsphinx2211/v1/Dockerfile b/sources/bxsphinx2211/v1/Dockerfile new file mode 100644 index 0000000..d09ad2c --- /dev/null +++ b/sources/bxsphinx2211/v1/Dockerfile @@ -0,0 +1,23 @@ +FROM alpine:3.21 + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN apk add --no-cache bash expat libgcc libpq libstdc++ mariadb-connector-c musl unixodbc zlib sphinx sphinx-doc sphinx-php curl openssl ca-certificates tzdata && \ + mkdir -pv /opt/sphinx/conf /opt/sphinx/log /opt/sphinx/run /opt/sphinx/dict /opt/sphinx/lib /opt/sphinx/binlogs + +COPY start.sh /opt/sphinx/ +COPY *.pak /opt/sphinx/dict/ +COPY sample_sphinx.conf /opt/sphinx/conf/sphinx.conf + +RUN ln -sf /dev/stdout /opt/sphinx/log/searchd.log && \ + ln -sf /dev/stderr /opt/sphinx/log/query.log && \ + chown -R bitrix:bitrix /opt/ + +# VOLUME ["/opt/sphinx/conf", "/opt/sphinx/log", "/opt/sphinx/dict", "/opt/sphinx/lib"] + +USER bitrix:bitrix + +EXPOSE 9312 9306 + +CMD ["bash", "/opt/sphinx/start.sh"] diff --git a/sources/bxsphinx2211/v1/de.pak b/sources/bxsphinx2211/v1/de.pak new file mode 100644 index 0000000..0e71585 Binary files /dev/null and b/sources/bxsphinx2211/v1/de.pak differ diff --git a/sources/bxsphinx2211/v1/en.pak b/sources/bxsphinx2211/v1/en.pak new file mode 100644 index 0000000..2b0e76d Binary files /dev/null and b/sources/bxsphinx2211/v1/en.pak differ diff --git a/sources/bxsphinx2211/v1/ru.pak b/sources/bxsphinx2211/v1/ru.pak new file mode 100644 index 0000000..0bce760 Binary files /dev/null and b/sources/bxsphinx2211/v1/ru.pak differ diff --git a/sources/bxsphinx2211/v1/sample_sphinx.conf b/sources/bxsphinx2211/v1/sample_sphinx.conf new file mode 100644 index 0000000..912822f --- /dev/null +++ b/sources/bxsphinx2211/v1/sample_sphinx.conf @@ -0,0 +1,47 @@ +# +index rt +{ + type = rt + rt_mem_limit = 128M + path = /opt/sphinx/lib/rt + rt_field = title + rt_field = content + rt_attr_uint = gid +} +# +searchd +{ + listen = 9312 + listen = 9306:mysql41 + log = /opt/sphinx/log/searchd.log + query_log = /opt/sphinx/log/query.log + read_timeout = 5 + client_timeout = 300 + max_children = 30 + persistent_connections_limit = 30 + pid_file = /opt/sphinx/run/searchd.pid + seamless_rotate = 1 + preopen_indexes = 1 + unlink_old = 1 + max_packet_size = 8M + max_filters = 256 + max_filter_values = 4096 + max_batch_queries = 32 + workers = threads + binlog_path = /opt/sphinx/binlogs + binlog_max_log_size = 512M + binlog_flush = 2 + rt_flush_period = 3600 +} +# +indexer +{ + mem_limit = 128M + lemmatizer_cache = 128M +} +# +common +{ + lemmatizer_base = /opt/sphinx/dict +} +# diff --git a/sources/bxsphinx2211/v1/start.sh b/sources/bxsphinx2211/v1/start.sh new file mode 100755 index 0000000..3846242 --- /dev/null +++ b/sources/bxsphinx2211/v1/start.sh @@ -0,0 +1,5 @@ +#!/bin/bash +# +#indexer --config /opt/sphinx/conf/sphinx.conf --rotate --all +searchd --config /opt/sphinx/conf/sphinx.conf --nodetach +# diff --git a/sources/bxsphinx2211/v2/Dockerfile b/sources/bxsphinx2211/v2/Dockerfile new file mode 100644 index 0000000..1c1a16a --- /dev/null +++ b/sources/bxsphinx2211/v2/Dockerfile @@ -0,0 +1,23 @@ +FROM alpine:3.22 + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN apk add --no-cache bash expat libgcc libpq libstdc++ mariadb-connector-c musl unixodbc zlib sphinx sphinx-doc sphinx-php curl openssl ca-certificates tzdata && \ + mkdir -pv /opt/sphinx/conf /opt/sphinx/log /opt/sphinx/run /opt/sphinx/dict /opt/sphinx/lib /opt/sphinx/binlogs + +COPY start.sh /opt/sphinx/ +COPY *.pak /opt/sphinx/dict/ +COPY sample_sphinx.conf /opt/sphinx/conf/sphinx.conf + +RUN ln -sf /dev/stdout /opt/sphinx/log/searchd.log && \ + ln -sf /dev/stderr /opt/sphinx/log/query.log && \ + chown -R bitrix:bitrix /opt/ + +# VOLUME ["/opt/sphinx/conf", "/opt/sphinx/log", "/opt/sphinx/dict", "/opt/sphinx/lib"] + +USER bitrix:bitrix + +EXPOSE 9312 9306 + +CMD ["bash", "/opt/sphinx/start.sh"] diff --git a/sources/bxsphinx2211/v2/de.pak b/sources/bxsphinx2211/v2/de.pak new file mode 100644 index 0000000..0e71585 Binary files /dev/null and b/sources/bxsphinx2211/v2/de.pak differ diff --git a/sources/bxsphinx2211/v2/en.pak b/sources/bxsphinx2211/v2/en.pak new file mode 100644 index 0000000..2b0e76d Binary files /dev/null and b/sources/bxsphinx2211/v2/en.pak differ diff --git a/sources/bxsphinx2211/v2/ru.pak b/sources/bxsphinx2211/v2/ru.pak new file mode 100644 index 0000000..0bce760 Binary files /dev/null and b/sources/bxsphinx2211/v2/ru.pak differ diff --git a/sources/bxsphinx2211/v2/sample_sphinx.conf b/sources/bxsphinx2211/v2/sample_sphinx.conf new file mode 100644 index 0000000..912822f --- /dev/null +++ b/sources/bxsphinx2211/v2/sample_sphinx.conf @@ -0,0 +1,47 @@ +# +index rt +{ + type = rt + rt_mem_limit = 128M + path = /opt/sphinx/lib/rt + rt_field = title + rt_field = content + rt_attr_uint = gid +} +# +searchd +{ + listen = 9312 + listen = 9306:mysql41 + log = /opt/sphinx/log/searchd.log + query_log = /opt/sphinx/log/query.log + read_timeout = 5 + client_timeout = 300 + max_children = 30 + persistent_connections_limit = 30 + pid_file = /opt/sphinx/run/searchd.pid + seamless_rotate = 1 + preopen_indexes = 1 + unlink_old = 1 + max_packet_size = 8M + max_filters = 256 + max_filter_values = 4096 + max_batch_queries = 32 + workers = threads + binlog_path = /opt/sphinx/binlogs + binlog_max_log_size = 512M + binlog_flush = 2 + rt_flush_period = 3600 +} +# +indexer +{ + mem_limit = 128M + lemmatizer_cache = 128M +} +# +common +{ + lemmatizer_base = /opt/sphinx/dict +} +# diff --git a/sources/bxsphinx2211/v2/start.sh b/sources/bxsphinx2211/v2/start.sh new file mode 100755 index 0000000..3846242 --- /dev/null +++ b/sources/bxsphinx2211/v2/start.sh @@ -0,0 +1,5 @@ +#!/bin/bash +# +#indexer --config /opt/sphinx/conf/sphinx.conf --rotate --all +searchd --config /opt/sphinx/conf/sphinx.conf --nodetach +# diff --git a/sources/bxssl10/Dockerfile b/sources/bxssl10/Dockerfile new file mode 100644 index 0000000..1df5dc7 --- /dev/null +++ b/sources/bxssl10/Dockerfile @@ -0,0 +1,22 @@ +FROM alpine:3.21 + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN apk add --no-cache curl openssl bash mc ca-certificates tzdata && \ + mkdir -pv /opt /ssl + +COPY cas.sh /opt/cas.sh +COPY srv.sh /opt/srv.sh +COPY dhparam.pem /ssl/dhparam.pem + +RUN chown -R bitrix:bitrix /ssl && \ + chown -R bitrix:bitrix /opt && \ + ln -s /opt/cas.sh /home/bitrix && \ + ln -s /opt/srv.sh /home/bitrix + +#VOLUME ["/ssl"] + +USER bitrix:bitrix + +CMD ["tail", "-f", "/dev/null"] diff --git a/sources/bxssl10/cas.sh b/sources/bxssl10/cas.sh new file mode 100755 index 0000000..2ca7b5e --- /dev/null +++ b/sources/bxssl10/cas.sh @@ -0,0 +1,336 @@ +#!/bin/bash +# +DHBITS=4096 # 2048 fast 4096 too long... +BITS=4096 +PROT=sha256 +RCA_DAYS=5840 # 16 years +ICA_DAYS=4380 # 12 years +DAYS=3650 # 10 years +# +SSL=/ssl +RCA=/ssl/root_ca +ICA=/ssl/intermediate_ca +SRV=/ssl/servers +# +CA_TXT='Certificate Authority' +RCA_TXT='Root CA' +ICA_TXT='Intermediate CA' +COUNTRY_NAME=${CA_COUNTRY_NAME:-RU} +STATE_OR_PROVINCE_NAME=${CA_STATE_OR_PROVINCE_NAME:-Kaliningrad Region} +LOCALITY_NAME=${CA_LOCALITY_NAME:-Kaliningrad} +ORGANIZATION_NAME=${CA_ORGANIZATION_NAME:-Dev Corporation Ltd} +ORGANIZATIONAL_UNIT_NAME=${CA_ORGANIZATIONAL_UNIT_NAME:-Dev Corporation Ltd Unit} +RCA_EMAIL_ADDRESS=${CA_EMAIL_ADDRESS:-info@devcorporation.ltd} +ICA_EMAIL_ADDRESS=${CA_EMAIL_ADDRESS:-info@devcorporation.ltd} +# +echo 'Create dirs...' +mkdir -p ${SSL} +mkdir -p ${RCA} && cd ${RCA} && mkdir certs crl newcerts private && touch index.txt && echo 1000 > serial +mkdir -p ${ICA} && cd ${ICA} && mkdir certs crl csr newcerts private && touch index.txt && echo 1000 > serial && echo 1000 > ${ICA}/crlnumber +mkdir -p ${SRV} && cd ${SRV} && mkdir certs crl csr newcerts private && touch index.txt && echo 1000 > serial && echo 1000 > ${SRV}/crlnumber +# +echo 'Create OpenSSL confs...' +echo '# OpenSSL Root CA configuration file. +# Copy to `'${RCA}'/openssl.cnf`. + +[ ca ] +# `man ca` +default_ca = CA_default + +[ CA_default ] +# Directory and file locations. +dir = '${RCA}' +certs = $dir/certs +crl_dir = $dir/crl +new_certs_dir = $dir/newcerts +database = $dir/index.txt +serial = $dir/serial +RANDFILE = $dir/private/.rand + +# The root key and root certificate. +private_key = $dir/private/rootCA.key.pem +certificate = $dir/certs/rootCA.cert.pem + +# For certificate revocation lists. +crlnumber = $dir/crlnumber +crl = $dir/crl/ca.crl.pem +crl_extensions = crl_ext +default_crl_days = 30 + +# SHA-1 is deprecated, so use SHA-2 instead. +default_md = '${PROT}' + +name_opt = ca_default +cert_opt = ca_default +default_days = '${RCA_DAYS}' +preserve = no +policy = policy_strict + +[ policy_strict ] +# The root CA should only sign intermediate certificates that match. +# See the POLICY FORMAT section of `man ca`. +countryName = match +stateOrProvinceName = match +organizationName = match +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +[ policy_loose ] +# Allow the intermediate CA to sign a more diverse range of certificates. +# See the POLICY FORMAT section of the `ca` man page. +countryName = optional +stateOrProvinceName = optional +localityName = optional +organizationName = optional +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +[ req ] +# Options for the `req` tool (`man req`). +default_bits = '${BITS}' +distinguished_name = req_distinguished_name +string_mask = utf8only + +# SHA-1 is deprecated, so use SHA-2 instead. +default_md = '${PROT}' + +# Extension to add when the -x509 option is used. +x509_extensions = v3_ca + +[ req_distinguished_name ] +# See . +countryName = '${COUNTRY_NAME}' +stateOrProvinceName = '${STATE_OR_PROVINCE_NAME}' +localityName = '${LOCALITY_NAME}' +0.organizationName = '${ORGANIZATION_NAME}' +organizationalUnitName = '${ORGANIZATION_NAME}' '${CA_TXT}' +commonName = '${ORGANIZATION_NAME}' '${RCA_TXT}' +emailAddress = '${RCA_EMAIL_ADDRESS}' + +# Optionally, specify some defaults. +countryName_default = '${COUNTRY_NAME}' +stateOrProvinceName_default = '${STATE_OR_PROVINCE_NAME}' +localityName_default = '${LOCALITY_NAME}' +0.organizationName_default = '${ORGANIZATION_NAME}' +organizationalUnitName_default = '${ORGANIZATION_NAME}' '${CA_TXT}' +emailAddress_default = '${RCA_EMAIL_ADDRESS}' + +[ v3_ca ] +# Extensions for a typical CA (`man x509v3_config`). +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid:always,issuer +basicConstraints = critical, CA:true +keyUsage = critical, digitalSignature, cRLSign, keyCertSign + +[ v3_intermediate_ca ] +# Extensions for a typical intermediate CA (`man x509v3_config`). +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid:always,issuer +basicConstraints = critical, CA:true, pathlen:0 +keyUsage = critical, digitalSignature, cRLSign, keyCertSign + +[ usr_cert ] +# Extensions for client certificates (`man x509v3_config`). +basicConstraints = CA:FALSE +nsCertType = client, email +nsComment = "OpenSSL Generated Certificate for QA" +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer +keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment +extendedKeyUsage = clientAuth, emailProtection + +[ server_cert ] +# Extensions for server certificates (`man x509v3_config`). +basicConstraints = CA:FALSE +nsCertType = server +nsComment = "OpenSSL Generated Certificate for QA" +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer:always +keyUsage = critical, digitalSignature, keyEncipherment +extendedKeyUsage = serverAuth + +[ crl_ext ] +# Extension for CRLs (`man x509v3_config`). +authorityKeyIdentifier=keyid:always + +[ ocsp ] +# Extension for OCSP signing certificates (`man ocsp`). +basicConstraints = CA:FALSE +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer +keyUsage = critical, digitalSignature +extendedKeyUsage = critical, OCSPSigning + +' >> ${RCA}/openssl.cnf +# +echo '# OpenSSL Intermediate CA configuration file. +# Copy to `'${ICA}'/openssl.cnf`. + +[ ca ] +# `man ca` +default_ca = CA_default + +[ CA_default ] +# Directory and file locations. +dir = '${ICA}' +certs = $dir/certs +crl_dir = $dir/crl +new_certs_dir = $dir/newcerts +database = $dir/index.txt +serial = $dir/serial +RANDFILE = $dir/private/.rand + +# The root key and root certificate. +private_key = $dir/private/intermediateCA.key.pem +certificate = $dir/certs/intermediateCA.cert.pem + +# For certificate revocation lists. +crlnumber = $dir/crlnumber +crl = $dir/crl/intermediate.crl.pem +crl_extensions = crl_ext +default_crl_days = 30 + +# SHA-1 is deprecated, so use SHA-2 instead. +default_md = '${PROT}' + +name_opt = ca_default +cert_opt = ca_default +default_days = '${ICA_DAYS}' +preserve = no +policy = policy_loose + +[ policy_strict ] +# The root CA should only sign intermediate certificates that match. +# See the POLICY FORMAT section of `man ca`. +countryName = match +stateOrProvinceName = match +organizationName = match +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +[ policy_loose ] +# Allow the intermediate CA to sign a more diverse range of certificates. +# See the POLICY FORMAT section of the `ca` man page. +countryName = optional +stateOrProvinceName = optional +localityName = optional +organizationName = optional +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +[ req ] +# Options for the `req` tool (`man req`). +default_bits = '${BITS}' +distinguished_name = req_distinguished_name +string_mask = utf8only + +# SHA-1 is deprecated, so use SHA-2 instead. +default_md = '${PROT}' + +# Extension to add when the -x509 option is used. +x509_extensions = v3_ca + +[ req_distinguished_name ] +# See . +countryName = '${COUNTRY_NAME}' +stateOrProvinceName = '${STATE_OR_PROVINCE_NAME}' +localityName = '${LOCALITY_NAME}' +0.organizationName = '${ORGANIZATION_NAME}' +organizationalUnitName = '${ORGANIZATION_NAME}' '${CA_TXT}' +commonName = '${ORGANIZATION_NAME}' '${ICA_TXT}' +emailAddress = '${ICA_EMAIL_ADDRESS}' + +# Optionally, specify some defaults. +countryName_default = '${COUNTRY_NAME}' +stateOrProvinceName_default = '${STATE_OR_PROVINCE_NAME}' +localityName_default = '${LOCALITY_NAME}' +0.organizationName_default = '${ORGANIZATION_NAME}' +organizationalUnitName_default = '${ORGANIZATION_NAME}' '${CA_TXT}' +emailAddress_default = '${ICA_EMAIL_ADDRESS}' + +[ v3_ca ] +# Extensions for a typical CA (`man x509v3_config`). +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid:always,issuer +basicConstraints = critical, CA:true +keyUsage = critical, digitalSignature, cRLSign, keyCertSign + +[ v3_intermediate_ca ] +# Extensions for a typical intermediate CA (`man x509v3_config`). +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid:always,issuer +basicConstraints = critical, CA:true, pathlen:0 +keyUsage = critical, digitalSignature, cRLSign, keyCertSign + +[ usr_cert ] +# Extensions for client certificates (`man x509v3_config`). +basicConstraints = CA:FALSE +nsCertType = client, email +nsComment = "OpenSSL Generated Certificate for QA" +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer +keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment +extendedKeyUsage = clientAuth, emailProtection + +[ server_cert ] +# Extensions for server certificates (`man x509v3_config`). +basicConstraints = CA:FALSE +nsCertType = server +nsComment = "OpenSSL Generated Certificate for QA" +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer:always +keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment +extendedKeyUsage = serverAuth + +[ crl_ext ] +# Extension for CRLs (`man x509v3_config`). +authorityKeyIdentifier=keyid:always + +[ ocsp ] +# Extension for OCSP signing certificates (`man ocsp`). +basicConstraints = CA:FALSE +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer +keyUsage = critical, digitalSignature +extendedKeyUsage = critical, OCSPSigning + +' >> ${ICA}/openssl.cnf +# +# DHParams +# +###echo 'DHParams...' +###cd ${SSL} +###openssl dhparam -out dhparam.pem ${DHBITS} +# +# Root CA +# +echo 'Root CA...' +cd ${RCA} +openssl genrsa -out private/rootCA.key.pem ${BITS} +openssl req -config openssl.cnf -x509 -new -key private/rootCA.key.pem -days ${RCA_DAYS} -${PROT} -extensions v3_ca -out certs/rootCA.cert.pem -subj "/C=${COUNTRY_NAME}/ST=${STATE_OR_PROVINCE_NAME}/L=${LOCALITY_NAME}/O=${ORGANIZATION_NAME}/OU=${ORGANIZATION_NAME} ${CA_TXT}/CN=${ORGANIZATION_NAME} ${RCA_TXT}" +openssl x509 -noout -text -in certs/rootCA.cert.pem +cp certs/rootCA.cert.pem ${SSL}/rootCA.cert.pem +# +# Intermediate CA +# +echo 'Intermediate CA...' +cd ${ICA} +openssl genrsa -out private/intermediateCA.key.pem ${BITS} +openssl req -config openssl.cnf -new -key private/intermediateCA.key.pem -${PROT} -out csr/intermediateCA.csr.pem -subj "/C=${COUNTRY_NAME}/ST=${STATE_OR_PROVINCE_NAME}/L=${LOCALITY_NAME}/O=${ORGANIZATION_NAME}/OU=${ORGANIZATION_NAME} ${CA_TXT}/CN=${ORGANIZATION_NAME} ${ICA_TXT}" +cd ${RCA} +openssl ca -batch -config openssl.cnf -extensions v3_intermediate_ca -days ${ICA_DAYS} -notext -md ${PROT} -in ${ICA}/csr/intermediateCA.csr.pem -out ${ICA}/certs/intermediateCA.cert.pem +cd ${ICA} +openssl x509 -noout -text -in certs/intermediateCA.cert.pem +openssl verify -CAfile ${RCA}/certs/rootCA.cert.pem certs/intermediateCA.cert.pem +cp certs/intermediateCA.cert.pem ${SSL}/intermediateCA.cert.pem +# +# CA Chain +# +echo 'CA chain...' +cat certs/intermediateCA.cert.pem ${RCA}/certs/rootCA.cert.pem > certs/ca-chain.cert.pem +cp certs/ca-chain.cert.pem ${SSL}/ca-chain.cert.pem +# diff --git a/sources/bxssl10/dhparam.pem b/sources/bxssl10/dhparam.pem new file mode 100644 index 0000000..3ff41f1 --- /dev/null +++ b/sources/bxssl10/dhparam.pem @@ -0,0 +1,13 @@ +-----BEGIN DH PARAMETERS----- +MIICCAKCAgEAjABhgFe0a51YaIq/jPyyr2QuQ2cLS4/WBUPfDM8SNLYH/4rHv9dD +JvAiPz/WiCDpZnBFMzeqzmT6vPtPfm0ypw8zpdjO3xMcF2xW5DrjdlKuO11CMbPg +a5jdmGuU/o0He7RHx7ypZnYXx/6Yx5uZtvSHxOnKmF5RY16EeFNtcAY9XFKWhSLB +8ZznDZ+mhvPEflrIr4cgyDGuU59SWnIMjYUuCoMvHeiE7iOAkSioq6H+s+P0EnqJ +IIT4mBHbDYwFA9vgfJ0kitknvhYAlOcfoV2SymJYW0LUgbbITThyr/QD3ntKiTcV +WkgDyubVJmZuAMlIqOFfXGts7yHtEoe1enYIKGeAsVaMYOQ47RSDqsKhHpaD6FEA +CUgc3UFEFQwYtRivlD3An4dYhFjAx+vmjWADjXTsyg4AUpUkUhps75jzb21sy3yu +YNI+IK+CRrkdc5GXFIX+J8FGcvXj5kxBaVJ15BZTZC4wZ/Uihp2WW3NkhUFMIYdx +6aqvku/KA+xuzOdTdg3e/jXJq9DWdyaQQpAFVMO+nRcI8BlIwYMiEKBPKt9JLbmS +dLLex8vzHqwThbkMR8AhzHb3szG6fQuLeNyxzOjiq4d5LZI6g1T/5/BLug1PjdjC +xPYv2YpdIO0/MfzSZbm6EfbACKA5+OMWxXloATycuho0qUlYhXUWOvsCAQI= +-----END DH PARAMETERS----- diff --git a/sources/bxssl10/srv.sh b/sources/bxssl10/srv.sh new file mode 100755 index 0000000..90c1a4c --- /dev/null +++ b/sources/bxssl10/srv.sh @@ -0,0 +1,203 @@ +#!/bin/bash +# +DOMAIN=$1 # example.com +WILD=$2 # *.example.com, use W for wildcard +# +DHBITS=4096 #4096 too long... +BITS=4096 +PROT=sha256 +DAYS=3650 # 10 years +# +SSL=/ssl +RCA=/ssl/root_ca +ICA=/ssl/intermediate_ca +SRV=/ssl/servers +# +CA_TXT='Certificate Authority' +RCA_TXT='Root CA' +ICA_TXT='Intermediate CA' +COUNTRY_NAME=${CERT_COUNTRY_NAME:-RU} +STATE_OR_PROVINCE_NAME=${CERT_STATE_OR_PROVINCE_NAME:-Kaliningrad Region} +LOCALITY_NAME=${CERT_LOCALITY_NAME:-Kaliningrad} +ORGANIZATION_NAME=${CERT_ORGANIZATION_NAME:-Dev Corporation Ltd} +ORGANIZATIONAL_UNIT_NAME=${CERT_ORGANIZATIONAL_UNIT_NAME:-Dev Corporation Ltd Unit} +EMAIL_ADDRESS=${CERT_EMAIL_ADDRESS:-info@info@devcorporation.ltd} +# Wildcard option +if [ "$WILD" = "W" ] +then + COMMON_NAME='*.'${DOMAIN} + DNS1='DNS.1 = '${DOMAIN} + DNS2='DNS.2 = *.'${DOMAIN} +else + COMMON_NAME=${DOMAIN} + DNS1='DNS = '${DOMAIN} + DNS2='' +fi +# +echo 'Create OpenSSL confs...' +echo '# OpenSSL configuration file. +# Copy to `'${SRV}'/openssl_'${DOMAIN}'.cnf`. + +[ ca ] +# `man ca` +default_ca = CA_default + +[ CA_default ] +# Directory and file locations. +dir = '${SRV}' +certs = $dir/certs +crl_dir = $dir/crl +new_certs_dir = $dir/newcerts +database = $dir/index.txt +serial = $dir/serial +RANDFILE = $dir/private/.rand + +# The root key and root certificate. +private_key = '${ICA}'/private/intermediateCA.key.pem +certificate = '${ICA}'/certs/intermediateCA.cert.pem + +# For certificate revocation lists. +crlnumber = $dir/crlnumber +crl = $dir/crl/intermediate.crl.pem +crl_extensions = crl_ext +default_crl_days = 30 + +# SHA-1 is deprecated, so use SHA-2 instead. +default_md = '${PROT}' + +name_opt = ca_default +cert_opt = ca_default +default_days = '${DAYS}' +preserve = no +policy = policy_loose + +[ policy_strict ] +# The root CA should only sign certificates that match. +# See the POLICY FORMAT section of `man ca`. +countryName = match +stateOrProvinceName = match +organizationName = match +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +[ policy_loose ] +# Allow the CA to sign a more diverse range of certificates. +# See the POLICY FORMAT section of the `ca` man page. +countryName = optional +stateOrProvinceName = optional +localityName = optional +organizationName = optional +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +[ req ] +# Options for the `req` tool (`man req`). +default_bits = '${BITS}' +distinguished_name = req_distinguished_name +string_mask = utf8only + +# SHA-1 is deprecated, so use SHA-2 instead. +default_md = '${PROT}' + +# Extension to add when the -x509 option is used. +x509_extensions = v3_ca + +[ req_distinguished_name ] +# See . +countryName = '${COUNTRY_NAME}' +stateOrProvinceName = '${STATE_OR_PROVINCE_NAME}' +localityName = '${LOCALITY_NAME}' +0.organizationName = '${ORGANIZATION_NAME}' +organizationalUnitName = '${ORGANIZATION_NAME}' '${CA_TXT}' +commonName = '${ORGANIZATION_NAME}' '${ICA_TXT}' +emailAddress = '${EMAIL_ADDRESS}' + +# Optionally, specify some defaults. +countryName_default = '${COUNTRY_NAME}' +stateOrProvinceName_default = '${STATE_OR_PROVINCE_NAME}' +localityName_default = '${LOCALITY_NAME}' +0.organizationName_default = '${ORGANIZATION_NAME}' +organizationalUnitName_default = '${ORGANIZATION_NAME}' '${CA_TXT}' +emailAddress_default = '${EMAIL_ADDRESS}' + +[ v3_ca ] +# Extensions for a typical CA (`man x509v3_config`). +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid:always,issuer +basicConstraints = critical, CA:true +keyUsage = critical, digitalSignature, cRLSign, keyCertSign + +[ v3_intermediate_ca ] +# Extensions for a typical CA (`man x509v3_config`). +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid:always,issuer +basicConstraints = critical, CA:true, pathlen:0 +keyUsage = critical, digitalSignature, cRLSign, keyCertSign + +[ usr_cert ] +# Extensions for client certificates (`man x509v3_config`). +basicConstraints = CA:FALSE +nsCertType = client, email +nsComment = "OpenSSL Generated Certificate for QA" +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer +keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment +extendedKeyUsage = clientAuth, emailProtection + +[ server_cert ] +# Extensions for server certificates (`man x509v3_config`). +basicConstraints = CA:FALSE +nsCertType = server +nsComment = "OpenSSL Generated Certificate for QA" +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer:always +keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment +extendedKeyUsage = serverAuth +subjectAltName = @alternate_names + +[ crl_ext ] +# Extension for CRLs (`man x509v3_config`). +authorityKeyIdentifier=keyid:always + +[ ocsp ] +# Extension for OCSP signing certificates (`man ocsp`). +basicConstraints = CA:FALSE +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer +keyUsage = critical, digitalSignature +extendedKeyUsage = critical, OCSPSigning + +[ alternate_names ] +'${DNS1}' +'${DNS2}' + +' >> ${SRV}'/openssl_'${DOMAIN}'.cnf' +# +# Server cert +# +echo 'Server cert...' +cd ${SRV} +openssl genrsa -out private/${DOMAIN}.key.pem ${BITS} +openssl req -config openssl_${DOMAIN}.cnf -key private/${DOMAIN}.key.pem -new -${PROT} -out csr/${DOMAIN}.csr.pem -subj "/C=${COUNTRY_NAME}/ST=${STATE_OR_PROVINCE_NAME}/L=${LOCALITY_NAME}/O=${ORGANIZATION_NAME}/OU=${ORGANIZATIONAL_UNIT_NAME} Web Services/CN=${COMMON_NAME}/emailAddress=${EMAIL_ADDRESS}" +openssl ca -batch -config openssl_${DOMAIN}.cnf -extensions server_cert -days ${DAYS} -notext -md ${PROT} -in csr/${DOMAIN}.csr.pem -out certs/${DOMAIN}.cert.pem +cp certs/${DOMAIN}.cert.pem ${SSL}/${DOMAIN}.cert.pem +cp private/${DOMAIN}.key.pem ${SSL}/${DOMAIN}.key.pem +openssl x509 -noout -text -in certs/${DOMAIN}.cert.pem +openssl verify -CAfile ${SSL}/ca-chain.cert.pem certs/${DOMAIN}.cert.pem +# +# Chain +# +echo 'Chain...' +cat ${SRV}/certs/${DOMAIN}.cert.pem ${ICA}/certs/intermediateCA.cert.pem > ${SSL}/${DOMAIN}.chain.cert.pem +# +# Fullchain +# +echo 'Full chain...' +cat ${SRV}/certs/${DOMAIN}.cert.pem ${ICA}/certs/intermediateCA.cert.pem ${RCA}/certs/rootCA.cert.pem > ${SSL}/${DOMAIN}.fullchain.cert.pem +# +# Fix key file rights +# +chmod 644 ${SSL}/${DOMAIN}.key.pem +# diff --git a/sources/bxssl11/Dockerfile b/sources/bxssl11/Dockerfile new file mode 100644 index 0000000..1341f92 --- /dev/null +++ b/sources/bxssl11/Dockerfile @@ -0,0 +1,22 @@ +FROM alpine:3.22 + +RUN addgroup -g 979 bitrix && \ + adduser -D -u 979 -G bitrix bitrix + +RUN apk add --no-cache curl openssl bash mc ca-certificates tzdata && \ + mkdir -pv /opt /ssl + +COPY cas.sh /opt/cas.sh +COPY srv.sh /opt/srv.sh +COPY dhparam.pem /ssl/dhparam.pem + +RUN chown -R bitrix:bitrix /ssl && \ + chown -R bitrix:bitrix /opt && \ + ln -s /opt/cas.sh /home/bitrix && \ + ln -s /opt/srv.sh /home/bitrix + +#VOLUME ["/ssl"] + +USER bitrix:bitrix + +CMD ["tail", "-f", "/dev/null"] diff --git a/sources/bxssl11/cas.sh b/sources/bxssl11/cas.sh new file mode 100755 index 0000000..2ca7b5e --- /dev/null +++ b/sources/bxssl11/cas.sh @@ -0,0 +1,336 @@ +#!/bin/bash +# +DHBITS=4096 # 2048 fast 4096 too long... +BITS=4096 +PROT=sha256 +RCA_DAYS=5840 # 16 years +ICA_DAYS=4380 # 12 years +DAYS=3650 # 10 years +# +SSL=/ssl +RCA=/ssl/root_ca +ICA=/ssl/intermediate_ca +SRV=/ssl/servers +# +CA_TXT='Certificate Authority' +RCA_TXT='Root CA' +ICA_TXT='Intermediate CA' +COUNTRY_NAME=${CA_COUNTRY_NAME:-RU} +STATE_OR_PROVINCE_NAME=${CA_STATE_OR_PROVINCE_NAME:-Kaliningrad Region} +LOCALITY_NAME=${CA_LOCALITY_NAME:-Kaliningrad} +ORGANIZATION_NAME=${CA_ORGANIZATION_NAME:-Dev Corporation Ltd} +ORGANIZATIONAL_UNIT_NAME=${CA_ORGANIZATIONAL_UNIT_NAME:-Dev Corporation Ltd Unit} +RCA_EMAIL_ADDRESS=${CA_EMAIL_ADDRESS:-info@devcorporation.ltd} +ICA_EMAIL_ADDRESS=${CA_EMAIL_ADDRESS:-info@devcorporation.ltd} +# +echo 'Create dirs...' +mkdir -p ${SSL} +mkdir -p ${RCA} && cd ${RCA} && mkdir certs crl newcerts private && touch index.txt && echo 1000 > serial +mkdir -p ${ICA} && cd ${ICA} && mkdir certs crl csr newcerts private && touch index.txt && echo 1000 > serial && echo 1000 > ${ICA}/crlnumber +mkdir -p ${SRV} && cd ${SRV} && mkdir certs crl csr newcerts private && touch index.txt && echo 1000 > serial && echo 1000 > ${SRV}/crlnumber +# +echo 'Create OpenSSL confs...' +echo '# OpenSSL Root CA configuration file. +# Copy to `'${RCA}'/openssl.cnf`. + +[ ca ] +# `man ca` +default_ca = CA_default + +[ CA_default ] +# Directory and file locations. +dir = '${RCA}' +certs = $dir/certs +crl_dir = $dir/crl +new_certs_dir = $dir/newcerts +database = $dir/index.txt +serial = $dir/serial +RANDFILE = $dir/private/.rand + +# The root key and root certificate. +private_key = $dir/private/rootCA.key.pem +certificate = $dir/certs/rootCA.cert.pem + +# For certificate revocation lists. +crlnumber = $dir/crlnumber +crl = $dir/crl/ca.crl.pem +crl_extensions = crl_ext +default_crl_days = 30 + +# SHA-1 is deprecated, so use SHA-2 instead. +default_md = '${PROT}' + +name_opt = ca_default +cert_opt = ca_default +default_days = '${RCA_DAYS}' +preserve = no +policy = policy_strict + +[ policy_strict ] +# The root CA should only sign intermediate certificates that match. +# See the POLICY FORMAT section of `man ca`. +countryName = match +stateOrProvinceName = match +organizationName = match +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +[ policy_loose ] +# Allow the intermediate CA to sign a more diverse range of certificates. +# See the POLICY FORMAT section of the `ca` man page. +countryName = optional +stateOrProvinceName = optional +localityName = optional +organizationName = optional +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +[ req ] +# Options for the `req` tool (`man req`). +default_bits = '${BITS}' +distinguished_name = req_distinguished_name +string_mask = utf8only + +# SHA-1 is deprecated, so use SHA-2 instead. +default_md = '${PROT}' + +# Extension to add when the -x509 option is used. +x509_extensions = v3_ca + +[ req_distinguished_name ] +# See . +countryName = '${COUNTRY_NAME}' +stateOrProvinceName = '${STATE_OR_PROVINCE_NAME}' +localityName = '${LOCALITY_NAME}' +0.organizationName = '${ORGANIZATION_NAME}' +organizationalUnitName = '${ORGANIZATION_NAME}' '${CA_TXT}' +commonName = '${ORGANIZATION_NAME}' '${RCA_TXT}' +emailAddress = '${RCA_EMAIL_ADDRESS}' + +# Optionally, specify some defaults. +countryName_default = '${COUNTRY_NAME}' +stateOrProvinceName_default = '${STATE_OR_PROVINCE_NAME}' +localityName_default = '${LOCALITY_NAME}' +0.organizationName_default = '${ORGANIZATION_NAME}' +organizationalUnitName_default = '${ORGANIZATION_NAME}' '${CA_TXT}' +emailAddress_default = '${RCA_EMAIL_ADDRESS}' + +[ v3_ca ] +# Extensions for a typical CA (`man x509v3_config`). +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid:always,issuer +basicConstraints = critical, CA:true +keyUsage = critical, digitalSignature, cRLSign, keyCertSign + +[ v3_intermediate_ca ] +# Extensions for a typical intermediate CA (`man x509v3_config`). +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid:always,issuer +basicConstraints = critical, CA:true, pathlen:0 +keyUsage = critical, digitalSignature, cRLSign, keyCertSign + +[ usr_cert ] +# Extensions for client certificates (`man x509v3_config`). +basicConstraints = CA:FALSE +nsCertType = client, email +nsComment = "OpenSSL Generated Certificate for QA" +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer +keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment +extendedKeyUsage = clientAuth, emailProtection + +[ server_cert ] +# Extensions for server certificates (`man x509v3_config`). +basicConstraints = CA:FALSE +nsCertType = server +nsComment = "OpenSSL Generated Certificate for QA" +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer:always +keyUsage = critical, digitalSignature, keyEncipherment +extendedKeyUsage = serverAuth + +[ crl_ext ] +# Extension for CRLs (`man x509v3_config`). +authorityKeyIdentifier=keyid:always + +[ ocsp ] +# Extension for OCSP signing certificates (`man ocsp`). +basicConstraints = CA:FALSE +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer +keyUsage = critical, digitalSignature +extendedKeyUsage = critical, OCSPSigning + +' >> ${RCA}/openssl.cnf +# +echo '# OpenSSL Intermediate CA configuration file. +# Copy to `'${ICA}'/openssl.cnf`. + +[ ca ] +# `man ca` +default_ca = CA_default + +[ CA_default ] +# Directory and file locations. +dir = '${ICA}' +certs = $dir/certs +crl_dir = $dir/crl +new_certs_dir = $dir/newcerts +database = $dir/index.txt +serial = $dir/serial +RANDFILE = $dir/private/.rand + +# The root key and root certificate. +private_key = $dir/private/intermediateCA.key.pem +certificate = $dir/certs/intermediateCA.cert.pem + +# For certificate revocation lists. +crlnumber = $dir/crlnumber +crl = $dir/crl/intermediate.crl.pem +crl_extensions = crl_ext +default_crl_days = 30 + +# SHA-1 is deprecated, so use SHA-2 instead. +default_md = '${PROT}' + +name_opt = ca_default +cert_opt = ca_default +default_days = '${ICA_DAYS}' +preserve = no +policy = policy_loose + +[ policy_strict ] +# The root CA should only sign intermediate certificates that match. +# See the POLICY FORMAT section of `man ca`. +countryName = match +stateOrProvinceName = match +organizationName = match +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +[ policy_loose ] +# Allow the intermediate CA to sign a more diverse range of certificates. +# See the POLICY FORMAT section of the `ca` man page. +countryName = optional +stateOrProvinceName = optional +localityName = optional +organizationName = optional +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +[ req ] +# Options for the `req` tool (`man req`). +default_bits = '${BITS}' +distinguished_name = req_distinguished_name +string_mask = utf8only + +# SHA-1 is deprecated, so use SHA-2 instead. +default_md = '${PROT}' + +# Extension to add when the -x509 option is used. +x509_extensions = v3_ca + +[ req_distinguished_name ] +# See . +countryName = '${COUNTRY_NAME}' +stateOrProvinceName = '${STATE_OR_PROVINCE_NAME}' +localityName = '${LOCALITY_NAME}' +0.organizationName = '${ORGANIZATION_NAME}' +organizationalUnitName = '${ORGANIZATION_NAME}' '${CA_TXT}' +commonName = '${ORGANIZATION_NAME}' '${ICA_TXT}' +emailAddress = '${ICA_EMAIL_ADDRESS}' + +# Optionally, specify some defaults. +countryName_default = '${COUNTRY_NAME}' +stateOrProvinceName_default = '${STATE_OR_PROVINCE_NAME}' +localityName_default = '${LOCALITY_NAME}' +0.organizationName_default = '${ORGANIZATION_NAME}' +organizationalUnitName_default = '${ORGANIZATION_NAME}' '${CA_TXT}' +emailAddress_default = '${ICA_EMAIL_ADDRESS}' + +[ v3_ca ] +# Extensions for a typical CA (`man x509v3_config`). +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid:always,issuer +basicConstraints = critical, CA:true +keyUsage = critical, digitalSignature, cRLSign, keyCertSign + +[ v3_intermediate_ca ] +# Extensions for a typical intermediate CA (`man x509v3_config`). +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid:always,issuer +basicConstraints = critical, CA:true, pathlen:0 +keyUsage = critical, digitalSignature, cRLSign, keyCertSign + +[ usr_cert ] +# Extensions for client certificates (`man x509v3_config`). +basicConstraints = CA:FALSE +nsCertType = client, email +nsComment = "OpenSSL Generated Certificate for QA" +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer +keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment +extendedKeyUsage = clientAuth, emailProtection + +[ server_cert ] +# Extensions for server certificates (`man x509v3_config`). +basicConstraints = CA:FALSE +nsCertType = server +nsComment = "OpenSSL Generated Certificate for QA" +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer:always +keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment +extendedKeyUsage = serverAuth + +[ crl_ext ] +# Extension for CRLs (`man x509v3_config`). +authorityKeyIdentifier=keyid:always + +[ ocsp ] +# Extension for OCSP signing certificates (`man ocsp`). +basicConstraints = CA:FALSE +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer +keyUsage = critical, digitalSignature +extendedKeyUsage = critical, OCSPSigning + +' >> ${ICA}/openssl.cnf +# +# DHParams +# +###echo 'DHParams...' +###cd ${SSL} +###openssl dhparam -out dhparam.pem ${DHBITS} +# +# Root CA +# +echo 'Root CA...' +cd ${RCA} +openssl genrsa -out private/rootCA.key.pem ${BITS} +openssl req -config openssl.cnf -x509 -new -key private/rootCA.key.pem -days ${RCA_DAYS} -${PROT} -extensions v3_ca -out certs/rootCA.cert.pem -subj "/C=${COUNTRY_NAME}/ST=${STATE_OR_PROVINCE_NAME}/L=${LOCALITY_NAME}/O=${ORGANIZATION_NAME}/OU=${ORGANIZATION_NAME} ${CA_TXT}/CN=${ORGANIZATION_NAME} ${RCA_TXT}" +openssl x509 -noout -text -in certs/rootCA.cert.pem +cp certs/rootCA.cert.pem ${SSL}/rootCA.cert.pem +# +# Intermediate CA +# +echo 'Intermediate CA...' +cd ${ICA} +openssl genrsa -out private/intermediateCA.key.pem ${BITS} +openssl req -config openssl.cnf -new -key private/intermediateCA.key.pem -${PROT} -out csr/intermediateCA.csr.pem -subj "/C=${COUNTRY_NAME}/ST=${STATE_OR_PROVINCE_NAME}/L=${LOCALITY_NAME}/O=${ORGANIZATION_NAME}/OU=${ORGANIZATION_NAME} ${CA_TXT}/CN=${ORGANIZATION_NAME} ${ICA_TXT}" +cd ${RCA} +openssl ca -batch -config openssl.cnf -extensions v3_intermediate_ca -days ${ICA_DAYS} -notext -md ${PROT} -in ${ICA}/csr/intermediateCA.csr.pem -out ${ICA}/certs/intermediateCA.cert.pem +cd ${ICA} +openssl x509 -noout -text -in certs/intermediateCA.cert.pem +openssl verify -CAfile ${RCA}/certs/rootCA.cert.pem certs/intermediateCA.cert.pem +cp certs/intermediateCA.cert.pem ${SSL}/intermediateCA.cert.pem +# +# CA Chain +# +echo 'CA chain...' +cat certs/intermediateCA.cert.pem ${RCA}/certs/rootCA.cert.pem > certs/ca-chain.cert.pem +cp certs/ca-chain.cert.pem ${SSL}/ca-chain.cert.pem +# diff --git a/sources/bxssl11/dhparam.pem b/sources/bxssl11/dhparam.pem new file mode 100644 index 0000000..c9e69bc --- /dev/null +++ b/sources/bxssl11/dhparam.pem @@ -0,0 +1,13 @@ +-----BEGIN DH PARAMETERS----- +MIICCAKCAgEA8TnLsFwqLUpBfXslJPsGayXgaDHxYdL/bhv12vwYMOyZGdep2ZAT +U7kmiwl0J7qRJ9Mv8ejMMIQ6NK5dYXsz9IeuDZYjjGKUG9fd1aaMSlZq+R+Viu25 +lvczcty67DTPvsNxSdJH5MoUM7V42J1DnKN8V2/uwbOxaJofDCKPAF5gHLKv4Hdq ++XUEPRsbaJQ+XiuAupes277+u36ioh8bYRVTAfC0xbT1pWC0yRy5US5xscTazrVE +M0e+3W3068KYfxkE9O9gqnwM7KrKhbJPn9v3Og96IXRfdoDPxNE3he1ljwEFydFh +Y50u9hSKS3Iuf9O+AyxNqJXQc3ZTaauETC7ZiP6LeH1tr3Yr53yqNAwkCr7YnGrg +roYF4odOWEwKlmWaOQvFGByZ5gV/Ukdvl/sYefVW8+9jncT7yzIVwUnG7YnS/rkH +xlNOOGGne7mAHuuRdSJvOr+msJxqDCWo7Pxi/p1Pj6lv40I78sQhBWiNTTLq5bej +et+hLQyMrZ84jXWZIqMMsai2Dx3ksK7lyYZvn8b9FjtuYEKs+NAbp8ekIK+m775V +zQm/TRRIoKys+OxKtyr1edKzLnQ8TaixZDpcNWk0SZ8cNWzs31h8NbZbi0+VWjnR +eyob3ipZU21ddEPDlCSf7g7Wf9NI1lN4G8pHdpHaW3vBwmNpzozMGMMCAQI= +-----END DH PARAMETERS----- diff --git a/sources/bxssl11/srv.sh b/sources/bxssl11/srv.sh new file mode 100755 index 0000000..90c1a4c --- /dev/null +++ b/sources/bxssl11/srv.sh @@ -0,0 +1,203 @@ +#!/bin/bash +# +DOMAIN=$1 # example.com +WILD=$2 # *.example.com, use W for wildcard +# +DHBITS=4096 #4096 too long... +BITS=4096 +PROT=sha256 +DAYS=3650 # 10 years +# +SSL=/ssl +RCA=/ssl/root_ca +ICA=/ssl/intermediate_ca +SRV=/ssl/servers +# +CA_TXT='Certificate Authority' +RCA_TXT='Root CA' +ICA_TXT='Intermediate CA' +COUNTRY_NAME=${CERT_COUNTRY_NAME:-RU} +STATE_OR_PROVINCE_NAME=${CERT_STATE_OR_PROVINCE_NAME:-Kaliningrad Region} +LOCALITY_NAME=${CERT_LOCALITY_NAME:-Kaliningrad} +ORGANIZATION_NAME=${CERT_ORGANIZATION_NAME:-Dev Corporation Ltd} +ORGANIZATIONAL_UNIT_NAME=${CERT_ORGANIZATIONAL_UNIT_NAME:-Dev Corporation Ltd Unit} +EMAIL_ADDRESS=${CERT_EMAIL_ADDRESS:-info@info@devcorporation.ltd} +# Wildcard option +if [ "$WILD" = "W" ] +then + COMMON_NAME='*.'${DOMAIN} + DNS1='DNS.1 = '${DOMAIN} + DNS2='DNS.2 = *.'${DOMAIN} +else + COMMON_NAME=${DOMAIN} + DNS1='DNS = '${DOMAIN} + DNS2='' +fi +# +echo 'Create OpenSSL confs...' +echo '# OpenSSL configuration file. +# Copy to `'${SRV}'/openssl_'${DOMAIN}'.cnf`. + +[ ca ] +# `man ca` +default_ca = CA_default + +[ CA_default ] +# Directory and file locations. +dir = '${SRV}' +certs = $dir/certs +crl_dir = $dir/crl +new_certs_dir = $dir/newcerts +database = $dir/index.txt +serial = $dir/serial +RANDFILE = $dir/private/.rand + +# The root key and root certificate. +private_key = '${ICA}'/private/intermediateCA.key.pem +certificate = '${ICA}'/certs/intermediateCA.cert.pem + +# For certificate revocation lists. +crlnumber = $dir/crlnumber +crl = $dir/crl/intermediate.crl.pem +crl_extensions = crl_ext +default_crl_days = 30 + +# SHA-1 is deprecated, so use SHA-2 instead. +default_md = '${PROT}' + +name_opt = ca_default +cert_opt = ca_default +default_days = '${DAYS}' +preserve = no +policy = policy_loose + +[ policy_strict ] +# The root CA should only sign certificates that match. +# See the POLICY FORMAT section of `man ca`. +countryName = match +stateOrProvinceName = match +organizationName = match +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +[ policy_loose ] +# Allow the CA to sign a more diverse range of certificates. +# See the POLICY FORMAT section of the `ca` man page. +countryName = optional +stateOrProvinceName = optional +localityName = optional +organizationName = optional +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +[ req ] +# Options for the `req` tool (`man req`). +default_bits = '${BITS}' +distinguished_name = req_distinguished_name +string_mask = utf8only + +# SHA-1 is deprecated, so use SHA-2 instead. +default_md = '${PROT}' + +# Extension to add when the -x509 option is used. +x509_extensions = v3_ca + +[ req_distinguished_name ] +# See . +countryName = '${COUNTRY_NAME}' +stateOrProvinceName = '${STATE_OR_PROVINCE_NAME}' +localityName = '${LOCALITY_NAME}' +0.organizationName = '${ORGANIZATION_NAME}' +organizationalUnitName = '${ORGANIZATION_NAME}' '${CA_TXT}' +commonName = '${ORGANIZATION_NAME}' '${ICA_TXT}' +emailAddress = '${EMAIL_ADDRESS}' + +# Optionally, specify some defaults. +countryName_default = '${COUNTRY_NAME}' +stateOrProvinceName_default = '${STATE_OR_PROVINCE_NAME}' +localityName_default = '${LOCALITY_NAME}' +0.organizationName_default = '${ORGANIZATION_NAME}' +organizationalUnitName_default = '${ORGANIZATION_NAME}' '${CA_TXT}' +emailAddress_default = '${EMAIL_ADDRESS}' + +[ v3_ca ] +# Extensions for a typical CA (`man x509v3_config`). +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid:always,issuer +basicConstraints = critical, CA:true +keyUsage = critical, digitalSignature, cRLSign, keyCertSign + +[ v3_intermediate_ca ] +# Extensions for a typical CA (`man x509v3_config`). +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid:always,issuer +basicConstraints = critical, CA:true, pathlen:0 +keyUsage = critical, digitalSignature, cRLSign, keyCertSign + +[ usr_cert ] +# Extensions for client certificates (`man x509v3_config`). +basicConstraints = CA:FALSE +nsCertType = client, email +nsComment = "OpenSSL Generated Certificate for QA" +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer +keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment +extendedKeyUsage = clientAuth, emailProtection + +[ server_cert ] +# Extensions for server certificates (`man x509v3_config`). +basicConstraints = CA:FALSE +nsCertType = server +nsComment = "OpenSSL Generated Certificate for QA" +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer:always +keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment +extendedKeyUsage = serverAuth +subjectAltName = @alternate_names + +[ crl_ext ] +# Extension for CRLs (`man x509v3_config`). +authorityKeyIdentifier=keyid:always + +[ ocsp ] +# Extension for OCSP signing certificates (`man ocsp`). +basicConstraints = CA:FALSE +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer +keyUsage = critical, digitalSignature +extendedKeyUsage = critical, OCSPSigning + +[ alternate_names ] +'${DNS1}' +'${DNS2}' + +' >> ${SRV}'/openssl_'${DOMAIN}'.cnf' +# +# Server cert +# +echo 'Server cert...' +cd ${SRV} +openssl genrsa -out private/${DOMAIN}.key.pem ${BITS} +openssl req -config openssl_${DOMAIN}.cnf -key private/${DOMAIN}.key.pem -new -${PROT} -out csr/${DOMAIN}.csr.pem -subj "/C=${COUNTRY_NAME}/ST=${STATE_OR_PROVINCE_NAME}/L=${LOCALITY_NAME}/O=${ORGANIZATION_NAME}/OU=${ORGANIZATIONAL_UNIT_NAME} Web Services/CN=${COMMON_NAME}/emailAddress=${EMAIL_ADDRESS}" +openssl ca -batch -config openssl_${DOMAIN}.cnf -extensions server_cert -days ${DAYS} -notext -md ${PROT} -in csr/${DOMAIN}.csr.pem -out certs/${DOMAIN}.cert.pem +cp certs/${DOMAIN}.cert.pem ${SSL}/${DOMAIN}.cert.pem +cp private/${DOMAIN}.key.pem ${SSL}/${DOMAIN}.key.pem +openssl x509 -noout -text -in certs/${DOMAIN}.cert.pem +openssl verify -CAfile ${SSL}/ca-chain.cert.pem certs/${DOMAIN}.cert.pem +# +# Chain +# +echo 'Chain...' +cat ${SRV}/certs/${DOMAIN}.cert.pem ${ICA}/certs/intermediateCA.cert.pem > ${SSL}/${DOMAIN}.chain.cert.pem +# +# Fullchain +# +echo 'Full chain...' +cat ${SRV}/certs/${DOMAIN}.cert.pem ${ICA}/certs/intermediateCA.cert.pem ${RCA}/certs/rootCA.cert.pem > ${SSL}/${DOMAIN}.fullchain.cert.pem +# +# Fix key file rights +# +chmod 644 ${SSL}/${DOMAIN}.key.pem +# diff --git a/sources/memcached1637/Dockerfile b/sources/memcached1637/Dockerfile new file mode 100644 index 0000000..118f635 --- /dev/null +++ b/sources/memcached1637/Dockerfile @@ -0,0 +1,83 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ + addgroup -g 11211 memcache; \ + adduser -D -u 11211 -G memcache memcache + +# ensure SASL's "libplain.so" is installed as per https://github.com/memcached/memcached/wiki/SASLHowto +RUN apk add --no-cache libsasl + +ENV MEMCACHED_VERSION 1.6.37 +ENV MEMCACHED_URL https://memcached.org/files/memcached-1.6.37.tar.gz +ENV MEMCACHED_SHA1 c85e2f5f57ca18501f22bf40f69257a890ccd79d + +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + ca-certificates \ + coreutils \ + cyrus-sasl-dev \ + dpkg-dev dpkg \ + gcc \ + libc-dev \ + libevent-dev \ + linux-headers \ + make \ + openssl \ + openssl-dev \ + perl \ + perl-io-socket-ssl \ + perl-utils \ + ; \ + \ + wget -O memcached.tar.gz "$MEMCACHED_URL"; \ + echo "$MEMCACHED_SHA1 memcached.tar.gz" | sha1sum -c -; \ + mkdir -p /usr/src/memcached; \ + tar -xzf memcached.tar.gz -C /usr/src/memcached --strip-components=1; \ + rm memcached.tar.gz; \ + \ + cd /usr/src/memcached; \ + \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --enable-extstore \ + --enable-sasl \ + --enable-sasl-pwdb \ + --enable-tls \ + ; \ + nproc="$(nproc)"; \ + make -j "$nproc"; \ + \ + make test PARALLEL="$nproc"; \ + \ + make install; \ + \ + cd /; \ + rm -rf /usr/src/memcached; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .memcached-rundeps $runDeps; \ + apk del --no-network .build-deps; \ + \ + memcached -V + +COPY docker-entrypoint.sh /usr/local/bin/ +RUN ln -s /usr/local/bin/docker-entrypoint.sh /entrypoint.sh # backwards compat +ENTRYPOINT ["docker-entrypoint.sh"] + +USER memcache +EXPOSE 11211 +CMD ["memcached"] diff --git a/sources/memcached1637/docker-entrypoint.sh b/sources/memcached1637/docker-entrypoint.sh new file mode 100755 index 0000000..35beb62 --- /dev/null +++ b/sources/memcached1637/docker-entrypoint.sh @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- memcached "$@" +fi + +exec "$@" diff --git a/sources/memcached1638/Dockerfile b/sources/memcached1638/Dockerfile new file mode 100644 index 0000000..931ad83 --- /dev/null +++ b/sources/memcached1638/Dockerfile @@ -0,0 +1,83 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ + addgroup -g 11211 memcache; \ + adduser -D -u 11211 -G memcache memcache + +# ensure SASL's "libplain.so" is installed as per https://github.com/memcached/memcached/wiki/SASLHowto +RUN apk add --no-cache libsasl + +ENV MEMCACHED_VERSION 1.6.38 +ENV MEMCACHED_URL https://memcached.org/files/memcached-1.6.38.tar.gz +ENV MEMCACHED_SHA1 2d132faaf4d4ffa4c1b5f55b2f09056a0e9181dd + +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + ca-certificates \ + coreutils \ + cyrus-sasl-dev \ + dpkg-dev dpkg \ + gcc \ + libc-dev \ + libevent-dev \ + linux-headers \ + make \ + openssl \ + openssl-dev \ + perl \ + perl-io-socket-ssl \ + perl-utils \ + ; \ + \ + wget -O memcached.tar.gz "$MEMCACHED_URL"; \ + echo "$MEMCACHED_SHA1 memcached.tar.gz" | sha1sum -c -; \ + mkdir -p /usr/src/memcached; \ + tar -xzf memcached.tar.gz -C /usr/src/memcached --strip-components=1; \ + rm memcached.tar.gz; \ + \ + cd /usr/src/memcached; \ + \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --enable-extstore \ + --enable-sasl \ + --enable-sasl-pwdb \ + --enable-tls \ + ; \ + nproc="$(nproc)"; \ + make -j "$nproc"; \ + \ + make test PARALLEL="$nproc"; \ + \ + make install; \ + \ + cd /; \ + rm -rf /usr/src/memcached; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .memcached-rundeps $runDeps; \ + apk del --no-network .build-deps; \ + \ + memcached -V + +COPY docker-entrypoint.sh /usr/local/bin/ +RUN ln -s /usr/local/bin/docker-entrypoint.sh /entrypoint.sh # backwards compat +ENTRYPOINT ["docker-entrypoint.sh"] + +USER memcache +EXPOSE 11211 +CMD ["memcached"] diff --git a/sources/memcached1638/docker-entrypoint.sh b/sources/memcached1638/docker-entrypoint.sh new file mode 100755 index 0000000..35beb62 --- /dev/null +++ b/sources/memcached1638/docker-entrypoint.sh @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- memcached "$@" +fi + +exec "$@" diff --git a/sources/memcached1639/Dockerfile b/sources/memcached1639/Dockerfile new file mode 100644 index 0000000..77b0934 --- /dev/null +++ b/sources/memcached1639/Dockerfile @@ -0,0 +1,89 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.22 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ + addgroup -g 11211 memcache; \ + adduser -D -u 11211 -G memcache memcache + +# ensure SASL's "libplain.so" is installed as per https://github.com/memcached/memcached/wiki/SASLHowto +RUN apk add --no-cache libsasl + +ENV MEMCACHED_VERSION 1.6.39 +ENV MEMCACHED_URL https://memcached.org/files/memcached-1.6.39.tar.gz +ENV MEMCACHED_SHA1 132d165af4d032d97081a2ccda645595d6bbb17b + +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + ca-certificates \ + coreutils \ + cyrus-sasl-dev \ + dpkg-dev dpkg \ + gcc \ + libc-dev \ + libevent-dev \ + linux-headers \ + make \ + openssl \ + openssl-dev \ + perl \ + perl-io-socket-ssl \ + perl-utils \ + ; \ + \ + wget -O memcached.tar.gz "$MEMCACHED_URL"; \ + echo "$MEMCACHED_SHA1 memcached.tar.gz" | sha1sum -c -; \ + mkdir -p /usr/src/memcached; \ + tar -xzf memcached.tar.gz -C /usr/src/memcached --strip-components=1; \ + rm memcached.tar.gz; \ + \ + cd /usr/src/memcached; \ + \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# https://github.com/memcached/memcached/issues/1220#issuecomment-2770251664: on arm32, we need to override the upstream alignment check (which fails to detect the need for alignment on arm32v6+ on our hardware for some reason, which then causes us to fail the tests 😭) + case "$gnuArch" in \ + arm-*abihf) export ac_cv_c_alignment=need ;; \ + esac; \ + ./configure \ + --build="$gnuArch" \ + --enable-extstore \ + --enable-proxy \ + --enable-sasl \ + --enable-sasl-pwdb \ + --enable-tls \ + ; \ + nproc="$(nproc)"; \ + make -j "$nproc"; \ + \ +# try the tests in parallel first, but many of them are resource-intensive, so fall back to serial + make test PARALLEL="$nproc" || make test; \ + \ + make install; \ + \ + cd /; \ + rm -rf /usr/src/memcached; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .memcached-rundeps $runDeps; \ + apk del --no-network .build-deps; \ + \ + memcached -V + +COPY docker-entrypoint.sh /usr/local/bin/ +RUN ln -s /usr/local/bin/docker-entrypoint.sh /entrypoint.sh # backwards compat +ENTRYPOINT ["docker-entrypoint.sh"] + +USER memcache +EXPOSE 11211 +CMD ["memcached"] diff --git a/sources/memcached1639/docker-entrypoint.sh b/sources/memcached1639/docker-entrypoint.sh new file mode 100755 index 0000000..35beb62 --- /dev/null +++ b/sources/memcached1639/docker-entrypoint.sh @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- memcached "$@" +fi + +exec "$@" diff --git a/sources/memcached1640/Dockerfile b/sources/memcached1640/Dockerfile new file mode 100644 index 0000000..037b517 --- /dev/null +++ b/sources/memcached1640/Dockerfile @@ -0,0 +1,89 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.23 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ + addgroup -g 11211 memcache; \ + adduser -D -u 11211 -G memcache memcache + +# ensure SASL's "libplain.so" is installed as per https://github.com/memcached/memcached/wiki/SASLHowto +RUN apk add --no-cache libsasl + +ENV MEMCACHED_VERSION 1.6.40 +ENV MEMCACHED_URL https://memcached.org/files/memcached-1.6.40.tar.gz +ENV MEMCACHED_SHA1 f2513db7079ee4c6558eb11fabb55e1adf1fdf38 + +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + ca-certificates \ + coreutils \ + cyrus-sasl-dev \ + dpkg-dev dpkg \ + gcc \ + libc-dev \ + libevent-dev \ + linux-headers \ + make \ + openssl \ + openssl-dev \ + perl \ + perl-io-socket-ssl \ + perl-utils \ + ; \ + \ + wget -O memcached.tar.gz "$MEMCACHED_URL"; \ + echo "$MEMCACHED_SHA1 memcached.tar.gz" | sha1sum -c -; \ + mkdir -p /usr/src/memcached; \ + tar -xzf memcached.tar.gz -C /usr/src/memcached --strip-components=1; \ + rm memcached.tar.gz; \ + \ + cd /usr/src/memcached; \ + \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# https://github.com/memcached/memcached/issues/1220#issuecomment-2770251664: on arm32, we need to override the upstream alignment check (which fails to detect the need for alignment on arm32v6+ on our hardware for some reason, which then causes us to fail the tests 😭) + case "$gnuArch" in \ + arm-*abihf) export ac_cv_c_alignment=need ;; \ + esac; \ + ./configure \ + --build="$gnuArch" \ + --enable-extstore \ + --enable-proxy \ + --enable-sasl \ + --enable-sasl-pwdb \ + --enable-tls \ + ; \ + nproc="$(nproc)"; \ + make -j "$nproc"; \ + \ +# try the tests in parallel first, but many of them are resource-intensive, so fall back to serial + make test PARALLEL="$nproc" || make test; \ + \ + make install; \ + \ + cd /; \ + rm -rf /usr/src/memcached; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .memcached-rundeps $runDeps; \ + apk del --no-network .build-deps; \ + \ + memcached -V + +COPY docker-entrypoint.sh /usr/local/bin/ +RUN ln -s /usr/local/bin/docker-entrypoint.sh /entrypoint.sh # backwards compat +ENTRYPOINT ["docker-entrypoint.sh"] + +USER memcache +EXPOSE 11211 +CMD ["memcached"] diff --git a/sources/memcached1640/docker-entrypoint.sh b/sources/memcached1640/docker-entrypoint.sh new file mode 100755 index 0000000..35beb62 --- /dev/null +++ b/sources/memcached1640/docker-entrypoint.sh @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- memcached "$@" +fi + +exec "$@" diff --git a/sources/nginx1263/10-listen-on-ipv6-by-default.sh b/sources/nginx1263/10-listen-on-ipv6-by-default.sh new file mode 100755 index 0000000..b90bf0c --- /dev/null +++ b/sources/nginx1263/10-listen-on-ipv6-by-default.sh @@ -0,0 +1,67 @@ +#!/bin/sh +# vim:sw=4:ts=4:et + +set -e + +entrypoint_log() { + if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then + echo "$@" + fi +} + +ME=$(basename "$0") +DEFAULT_CONF_FILE="etc/nginx/conf.d/default.conf" + +# check if we have ipv6 available +if [ ! -f "/proc/net/if_inet6" ]; then + entrypoint_log "$ME: info: ipv6 not available" + exit 0 +fi + +if [ ! -f "/$DEFAULT_CONF_FILE" ]; then + entrypoint_log "$ME: info: /$DEFAULT_CONF_FILE is not a file or does not exist" + exit 0 +fi + +# check if the file can be modified, e.g. not on a r/o filesystem +touch /$DEFAULT_CONF_FILE 2>/dev/null || { entrypoint_log "$ME: info: can not modify /$DEFAULT_CONF_FILE (read-only file system?)"; exit 0; } + +# check if the file is already modified, e.g. on a container restart +grep -q "listen \[::]\:80;" /$DEFAULT_CONF_FILE && { entrypoint_log "$ME: info: IPv6 listen already enabled"; exit 0; } + +if [ -f "/etc/os-release" ]; then + . /etc/os-release +else + entrypoint_log "$ME: info: can not guess the operating system" + exit 0 +fi + +entrypoint_log "$ME: info: Getting the checksum of /$DEFAULT_CONF_FILE" + +case "$ID" in + "debian") + CHECKSUM=$(dpkg-query --show --showformat='${Conffiles}\n' nginx | grep $DEFAULT_CONF_FILE | cut -d' ' -f 3) + echo "$CHECKSUM /$DEFAULT_CONF_FILE" | md5sum -c - >/dev/null 2>&1 || { + entrypoint_log "$ME: info: /$DEFAULT_CONF_FILE differs from the packaged version" + exit 0 + } + ;; + "alpine") + CHECKSUM=$(apk manifest nginx 2>/dev/null| grep $DEFAULT_CONF_FILE | cut -d' ' -f 1 | cut -d ':' -f 2) + echo "$CHECKSUM /$DEFAULT_CONF_FILE" | sha1sum -c - >/dev/null 2>&1 || { + entrypoint_log "$ME: info: /$DEFAULT_CONF_FILE differs from the packaged version" + exit 0 + } + ;; + *) + entrypoint_log "$ME: info: Unsupported distribution" + exit 0 + ;; +esac + +# enable ipv6 on default.conf listen sockets +sed -i -E 's,listen 80;,listen 80;\n listen [::]:80;,' /$DEFAULT_CONF_FILE + +entrypoint_log "$ME: info: Enabled listen on IPv6 in /$DEFAULT_CONF_FILE" + +exit 0 diff --git a/sources/nginx1263/15-local-resolvers.envsh b/sources/nginx1263/15-local-resolvers.envsh new file mode 100755 index 0000000..e830dda --- /dev/null +++ b/sources/nginx1263/15-local-resolvers.envsh @@ -0,0 +1,15 @@ +#!/bin/sh +# vim:sw=2:ts=2:sts=2:et + +set -eu + +LC_ALL=C +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + +[ "${NGINX_ENTRYPOINT_LOCAL_RESOLVERS:-}" ] || return 0 + +NGINX_LOCAL_RESOLVERS=$(awk 'BEGIN{ORS=" "} $1=="nameserver" {if ($2 ~ ":") {print "["$2"]"} else {print $2}}' /etc/resolv.conf) + +NGINX_LOCAL_RESOLVERS="${NGINX_LOCAL_RESOLVERS% }" + +export NGINX_LOCAL_RESOLVERS diff --git a/sources/nginx1263/20-envsubst-on-templates.sh b/sources/nginx1263/20-envsubst-on-templates.sh new file mode 100755 index 0000000..3804165 --- /dev/null +++ b/sources/nginx1263/20-envsubst-on-templates.sh @@ -0,0 +1,78 @@ +#!/bin/sh + +set -e + +ME=$(basename "$0") + +entrypoint_log() { + if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then + echo "$@" + fi +} + +add_stream_block() { + local conffile="/etc/nginx/nginx.conf" + + if grep -q -E "\s*stream\s*\{" "$conffile"; then + entrypoint_log "$ME: $conffile contains a stream block; include $stream_output_dir/*.conf to enable stream templates" + else + # check if the file can be modified, e.g. not on a r/o filesystem + touch "$conffile" 2>/dev/null || { entrypoint_log "$ME: info: can not modify $conffile (read-only file system?)"; exit 0; } + entrypoint_log "$ME: Appending stream block to $conffile to include $stream_output_dir/*.conf" + cat << END >> "$conffile" +# added by "$ME" on "$(date)" +stream { + include $stream_output_dir/*.conf; +} +END + fi +} + +auto_envsubst() { + local template_dir="${NGINX_ENVSUBST_TEMPLATE_DIR:-/etc/nginx/templates}" + local suffix="${NGINX_ENVSUBST_TEMPLATE_SUFFIX:-.template}" + local output_dir="${NGINX_ENVSUBST_OUTPUT_DIR:-/etc/nginx/conf.d}" + local stream_suffix="${NGINX_ENVSUBST_STREAM_TEMPLATE_SUFFIX:-.stream-template}" + local stream_output_dir="${NGINX_ENVSUBST_STREAM_OUTPUT_DIR:-/etc/nginx/stream-conf.d}" + local filter="${NGINX_ENVSUBST_FILTER:-}" + + local template defined_envs relative_path output_path subdir + defined_envs=$(printf '${%s} ' $(awk "END { for (name in ENVIRON) { print ( name ~ /${filter}/ ) ? name : \"\" } }" < /dev/null )) + [ -d "$template_dir" ] || return 0 + if [ ! -w "$output_dir" ]; then + entrypoint_log "$ME: ERROR: $template_dir exists, but $output_dir is not writable" + return 0 + fi + find "$template_dir" -follow -type f -name "*$suffix" -print | while read -r template; do + relative_path="${template#"$template_dir/"}" + output_path="$output_dir/${relative_path%"$suffix"}" + subdir=$(dirname "$relative_path") + # create a subdirectory where the template file exists + mkdir -p "$output_dir/$subdir" + entrypoint_log "$ME: Running envsubst on $template to $output_path" + envsubst "$defined_envs" < "$template" > "$output_path" + done + + # Print the first file with the stream suffix, this will be false if there are none + if test -n "$(find "$template_dir" -name "*$stream_suffix" -print -quit)"; then + mkdir -p "$stream_output_dir" + if [ ! -w "$stream_output_dir" ]; then + entrypoint_log "$ME: ERROR: $template_dir exists, but $stream_output_dir is not writable" + return 0 + fi + add_stream_block + find "$template_dir" -follow -type f -name "*$stream_suffix" -print | while read -r template; do + relative_path="${template#"$template_dir/"}" + output_path="$stream_output_dir/${relative_path%"$stream_suffix"}" + subdir=$(dirname "$relative_path") + # create a subdirectory where the template file exists + mkdir -p "$stream_output_dir/$subdir" + entrypoint_log "$ME: Running envsubst on $template to $output_path" + envsubst "$defined_envs" < "$template" > "$output_path" + done + fi +} + +auto_envsubst + +exit 0 diff --git a/sources/nginx1263/30-tune-worker-processes.sh b/sources/nginx1263/30-tune-worker-processes.sh new file mode 100755 index 0000000..defb994 --- /dev/null +++ b/sources/nginx1263/30-tune-worker-processes.sh @@ -0,0 +1,188 @@ +#!/bin/sh +# vim:sw=2:ts=2:sts=2:et + +set -eu + +LC_ALL=C +ME=$(basename "$0") +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + +[ "${NGINX_ENTRYPOINT_WORKER_PROCESSES_AUTOTUNE:-}" ] || exit 0 + +touch /etc/nginx/nginx.conf 2>/dev/null || { echo >&2 "$ME: error: can not modify /etc/nginx/nginx.conf (read-only file system?)"; exit 0; } + +ceildiv() { + num=$1 + div=$2 + echo $(( (num + div - 1) / div )) +} + +get_cpuset() { + cpusetroot=$1 + cpusetfile=$2 + ncpu=0 + [ -f "$cpusetroot/$cpusetfile" ] || return 1 + for token in $( tr ',' ' ' < "$cpusetroot/$cpusetfile" ); do + case "$token" in + *-*) + count=$( seq $(echo "$token" | tr '-' ' ') | wc -l ) + ncpu=$(( ncpu+count )) + ;; + *) + ncpu=$(( ncpu+1 )) + ;; + esac + done + echo "$ncpu" +} + +get_quota() { + cpuroot=$1 + ncpu=0 + [ -f "$cpuroot/cpu.cfs_quota_us" ] || return 1 + [ -f "$cpuroot/cpu.cfs_period_us" ] || return 1 + cfs_quota=$( cat "$cpuroot/cpu.cfs_quota_us" ) + cfs_period=$( cat "$cpuroot/cpu.cfs_period_us" ) + [ "$cfs_quota" = "-1" ] && return 1 + [ "$cfs_period" = "0" ] && return 1 + ncpu=$( ceildiv "$cfs_quota" "$cfs_period" ) + [ "$ncpu" -gt 0 ] || return 1 + echo "$ncpu" +} + +get_quota_v2() { + cpuroot=$1 + ncpu=0 + [ -f "$cpuroot/cpu.max" ] || return 1 + cfs_quota=$( cut -d' ' -f 1 < "$cpuroot/cpu.max" ) + cfs_period=$( cut -d' ' -f 2 < "$cpuroot/cpu.max" ) + [ "$cfs_quota" = "max" ] && return 1 + [ "$cfs_period" = "0" ] && return 1 + ncpu=$( ceildiv "$cfs_quota" "$cfs_period" ) + [ "$ncpu" -gt 0 ] || return 1 + echo "$ncpu" +} + +get_cgroup_v1_path() { + needle=$1 + found= + foundroot= + mountpoint= + + [ -r "/proc/self/mountinfo" ] || return 1 + [ -r "/proc/self/cgroup" ] || return 1 + + while IFS= read -r line; do + case "$needle" in + "cpuset") + case "$line" in + *cpuset*) + found=$( echo "$line" | cut -d ' ' -f 4,5 ) + break + ;; + esac + ;; + "cpu") + case "$line" in + *cpuset*) + ;; + *cpu,cpuacct*|*cpuacct,cpu|*cpuacct*|*cpu*) + found=$( echo "$line" | cut -d ' ' -f 4,5 ) + break + ;; + esac + esac + done << __EOF__ +$( grep -F -- '- cgroup ' /proc/self/mountinfo ) +__EOF__ + + while IFS= read -r line; do + controller=$( echo "$line" | cut -d: -f 2 ) + case "$needle" in + "cpuset") + case "$controller" in + cpuset) + mountpoint=$( echo "$line" | cut -d: -f 3 ) + break + ;; + esac + ;; + "cpu") + case "$controller" in + cpu,cpuacct|cpuacct,cpu|cpuacct|cpu) + mountpoint=$( echo "$line" | cut -d: -f 3 ) + break + ;; + esac + ;; + esac +done << __EOF__ +$( grep -F -- 'cpu' /proc/self/cgroup ) +__EOF__ + + case "${found%% *}" in + "/") + foundroot="${found##* }$mountpoint" + ;; + "$mountpoint") + foundroot="${found##* }" + ;; + esac + echo "$foundroot" +} + +get_cgroup_v2_path() { + found= + foundroot= + mountpoint= + + [ -r "/proc/self/mountinfo" ] || return 1 + [ -r "/proc/self/cgroup" ] || return 1 + + while IFS= read -r line; do + found=$( echo "$line" | cut -d ' ' -f 4,5 ) + done << __EOF__ +$( grep -F -- '- cgroup2 ' /proc/self/mountinfo ) +__EOF__ + + while IFS= read -r line; do + mountpoint=$( echo "$line" | cut -d: -f 3 ) +done << __EOF__ +$( grep -F -- '0::' /proc/self/cgroup ) +__EOF__ + + case "${found%% *}" in + "") + return 1 + ;; + "/") + foundroot="${found##* }$mountpoint" + ;; + "$mountpoint" | /../*) + foundroot="${found##* }" + ;; + esac + echo "$foundroot" +} + +ncpu_online=$( getconf _NPROCESSORS_ONLN ) +ncpu_cpuset= +ncpu_quota= +ncpu_cpuset_v2= +ncpu_quota_v2= + +cpuset=$( get_cgroup_v1_path "cpuset" ) && ncpu_cpuset=$( get_cpuset "$cpuset" "cpuset.effective_cpus" ) || ncpu_cpuset=$ncpu_online +cpu=$( get_cgroup_v1_path "cpu" ) && ncpu_quota=$( get_quota "$cpu" ) || ncpu_quota=$ncpu_online +cgroup_v2=$( get_cgroup_v2_path ) && ncpu_cpuset_v2=$( get_cpuset "$cgroup_v2" "cpuset.cpus.effective" ) || ncpu_cpuset_v2=$ncpu_online +cgroup_v2=$( get_cgroup_v2_path ) && ncpu_quota_v2=$( get_quota_v2 "$cgroup_v2" ) || ncpu_quota_v2=$ncpu_online + +ncpu=$( printf "%s\n%s\n%s\n%s\n%s\n" \ + "$ncpu_online" \ + "$ncpu_cpuset" \ + "$ncpu_quota" \ + "$ncpu_cpuset_v2" \ + "$ncpu_quota_v2" \ + | sort -n \ + | head -n 1 ) + +sed -i.bak -r 's/^(worker_processes)(.*)$/# Commented out by '"$ME"' on '"$(date)"'\n#\1\2\n\1 '"$ncpu"';/' /etc/nginx/nginx.conf diff --git a/sources/nginx1263/Dockerfile b/sources/nginx1263/Dockerfile new file mode 100644 index 0000000..d125af5 --- /dev/null +++ b/sources/nginx1263/Dockerfile @@ -0,0 +1,123 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "update.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# +FROM alpine:3.20 + +LABEL maintainer="NGINX Docker Maintainers " + +ENV NGINX_VERSION 1.26.3 +ENV PKG_RELEASE 1 +ENV DYNPKG_RELEASE 2 + +RUN set -x \ +# create nginx user/group first, to be consistent throughout docker variants + && addgroup -g 101 -S nginx \ + && adduser -S -D -H -u 101 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx \ + && apkArch="$(cat /etc/apk/arch)" \ + && nginxPackages=" \ + nginx=${NGINX_VERSION}-r${PKG_RELEASE} \ + " \ +# install prerequisites for public key and pkg-oss checks + && apk add --no-cache --virtual .checksum-deps \ + openssl \ + && case "$apkArch" in \ + x86_64|aarch64) \ +# arches officially built by upstream + set -x \ + && KEY_SHA512="e09fa32f0a0eab2b879ccbbc4d0e4fb9751486eedda75e35fac65802cc9faa266425edf83e261137a2f4d16281ce2c1a5f4502930fe75154723da014214f0655" \ + && wget -O /tmp/nginx_signing.rsa.pub https://nginx.org/keys/nginx_signing.rsa.pub \ + && if echo "$KEY_SHA512 */tmp/nginx_signing.rsa.pub" | sha512sum -c -; then \ + echo "key verification succeeded!"; \ + mv /tmp/nginx_signing.rsa.pub /etc/apk/keys/; \ + else \ + echo "key verification failed!"; \ + exit 1; \ + fi \ + && apk add -X "https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \ + ;; \ + *) \ +# we're on an architecture upstream doesn't officially build for +# let's build binaries from the published packaging sources + set -x \ + && tempDir="$(mktemp -d)" \ + && chown nobody:nobody $tempDir \ + && apk add --no-cache --virtual .build-deps \ + gcc \ + libc-dev \ + make \ + openssl-dev \ + pcre2-dev \ + zlib-dev \ + linux-headers \ + bash \ + alpine-sdk \ + findutils \ + curl \ + && su nobody -s /bin/sh -c " \ + export HOME=${tempDir} \ + && cd ${tempDir} \ + && curl -f -L -O https://github.com/nginx/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && PKGOSSCHECKSUM=\"3a4e869eded0c71e92f522e94edffea7fbfb5e78886ea7e484342fa2e028c62099a67d08860c249bf93776da97b924225e0d849dbb4697b298afe5421d7d6fea *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \ + && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \ + echo \"pkg-oss tarball checksum verification succeeded!\"; \ + else \ + echo \"pkg-oss tarball checksum verification failed!\"; \ + exit 1; \ + fi \ + && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \ + && cd alpine \ + && make base \ + && apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \ + && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \ + " \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \ + && apk del --no-network .build-deps \ + && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \ + ;; \ + esac \ +# remove checksum deps + && apk del --no-network .checksum-deps \ +# if we have leftovers from building, let's purge them (including extra, unnecessary build deps) + && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \ + && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \ +# Bring in gettext so we can get `envsubst`, then throw +# the rest away. To do this, we need to install `gettext` +# then move `envsubst` out of the way so `gettext` can +# be deleted completely, then move `envsubst` back. + && apk add --no-cache --virtual .gettext gettext \ + && mv /usr/bin/envsubst /tmp/ \ + \ + && runDeps="$( \ + scanelf --needed --nobanner /tmp/envsubst \ + | awk '{ gsub(/,/, "\nso:", $2); print "so:" $2 }' \ + | sort -u \ + | xargs -r apk info --installed \ + | sort -u \ + )" \ + && apk add --no-cache $runDeps \ + && apk del --no-network .gettext \ + && mv /tmp/envsubst /usr/local/bin/ \ +# Bring in tzdata so users could set the timezones through the environment +# variables + && apk add --no-cache tzdata \ +# forward request and error logs to docker log collector + && ln -sf /dev/stdout /var/log/nginx/access.log \ + && ln -sf /dev/stderr /var/log/nginx/error.log \ +# create a docker-entrypoint.d directory + && mkdir /docker-entrypoint.d + +COPY docker-entrypoint.sh / +COPY 10-listen-on-ipv6-by-default.sh /docker-entrypoint.d +COPY 15-local-resolvers.envsh /docker-entrypoint.d +COPY 20-envsubst-on-templates.sh /docker-entrypoint.d +COPY 30-tune-worker-processes.sh /docker-entrypoint.d +ENTRYPOINT ["/docker-entrypoint.sh"] + +EXPOSE 80 + +STOPSIGNAL SIGQUIT + +CMD ["nginx", "-g", "daemon off;"] diff --git a/sources/nginx1263/docker-entrypoint.sh b/sources/nginx1263/docker-entrypoint.sh new file mode 100755 index 0000000..8ea04f2 --- /dev/null +++ b/sources/nginx1263/docker-entrypoint.sh @@ -0,0 +1,47 @@ +#!/bin/sh +# vim:sw=4:ts=4:et + +set -e + +entrypoint_log() { + if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then + echo "$@" + fi +} + +if [ "$1" = "nginx" ] || [ "$1" = "nginx-debug" ]; then + if /usr/bin/find "/docker-entrypoint.d/" -mindepth 1 -maxdepth 1 -type f -print -quit 2>/dev/null | read v; then + entrypoint_log "$0: /docker-entrypoint.d/ is not empty, will attempt to perform configuration" + + entrypoint_log "$0: Looking for shell scripts in /docker-entrypoint.d/" + find "/docker-entrypoint.d/" -follow -type f -print | sort -V | while read -r f; do + case "$f" in + *.envsh) + if [ -x "$f" ]; then + entrypoint_log "$0: Sourcing $f"; + . "$f" + else + # warn on shell scripts without exec bit + entrypoint_log "$0: Ignoring $f, not executable"; + fi + ;; + *.sh) + if [ -x "$f" ]; then + entrypoint_log "$0: Launching $f"; + "$f" + else + # warn on shell scripts without exec bit + entrypoint_log "$0: Ignoring $f, not executable"; + fi + ;; + *) entrypoint_log "$0: Ignoring $f";; + esac + done + + entrypoint_log "$0: Configuration complete; ready for start up" + else + entrypoint_log "$0: No files found in /docker-entrypoint.d/, skipping configuration" + fi +fi + +exec "$@" diff --git a/sources/nginx1280/10-listen-on-ipv6-by-default.sh b/sources/nginx1280/10-listen-on-ipv6-by-default.sh new file mode 100755 index 0000000..b90bf0c --- /dev/null +++ b/sources/nginx1280/10-listen-on-ipv6-by-default.sh @@ -0,0 +1,67 @@ +#!/bin/sh +# vim:sw=4:ts=4:et + +set -e + +entrypoint_log() { + if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then + echo "$@" + fi +} + +ME=$(basename "$0") +DEFAULT_CONF_FILE="etc/nginx/conf.d/default.conf" + +# check if we have ipv6 available +if [ ! -f "/proc/net/if_inet6" ]; then + entrypoint_log "$ME: info: ipv6 not available" + exit 0 +fi + +if [ ! -f "/$DEFAULT_CONF_FILE" ]; then + entrypoint_log "$ME: info: /$DEFAULT_CONF_FILE is not a file or does not exist" + exit 0 +fi + +# check if the file can be modified, e.g. not on a r/o filesystem +touch /$DEFAULT_CONF_FILE 2>/dev/null || { entrypoint_log "$ME: info: can not modify /$DEFAULT_CONF_FILE (read-only file system?)"; exit 0; } + +# check if the file is already modified, e.g. on a container restart +grep -q "listen \[::]\:80;" /$DEFAULT_CONF_FILE && { entrypoint_log "$ME: info: IPv6 listen already enabled"; exit 0; } + +if [ -f "/etc/os-release" ]; then + . /etc/os-release +else + entrypoint_log "$ME: info: can not guess the operating system" + exit 0 +fi + +entrypoint_log "$ME: info: Getting the checksum of /$DEFAULT_CONF_FILE" + +case "$ID" in + "debian") + CHECKSUM=$(dpkg-query --show --showformat='${Conffiles}\n' nginx | grep $DEFAULT_CONF_FILE | cut -d' ' -f 3) + echo "$CHECKSUM /$DEFAULT_CONF_FILE" | md5sum -c - >/dev/null 2>&1 || { + entrypoint_log "$ME: info: /$DEFAULT_CONF_FILE differs from the packaged version" + exit 0 + } + ;; + "alpine") + CHECKSUM=$(apk manifest nginx 2>/dev/null| grep $DEFAULT_CONF_FILE | cut -d' ' -f 1 | cut -d ':' -f 2) + echo "$CHECKSUM /$DEFAULT_CONF_FILE" | sha1sum -c - >/dev/null 2>&1 || { + entrypoint_log "$ME: info: /$DEFAULT_CONF_FILE differs from the packaged version" + exit 0 + } + ;; + *) + entrypoint_log "$ME: info: Unsupported distribution" + exit 0 + ;; +esac + +# enable ipv6 on default.conf listen sockets +sed -i -E 's,listen 80;,listen 80;\n listen [::]:80;,' /$DEFAULT_CONF_FILE + +entrypoint_log "$ME: info: Enabled listen on IPv6 in /$DEFAULT_CONF_FILE" + +exit 0 diff --git a/sources/nginx1280/15-local-resolvers.envsh b/sources/nginx1280/15-local-resolvers.envsh new file mode 100755 index 0000000..e830dda --- /dev/null +++ b/sources/nginx1280/15-local-resolvers.envsh @@ -0,0 +1,15 @@ +#!/bin/sh +# vim:sw=2:ts=2:sts=2:et + +set -eu + +LC_ALL=C +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + +[ "${NGINX_ENTRYPOINT_LOCAL_RESOLVERS:-}" ] || return 0 + +NGINX_LOCAL_RESOLVERS=$(awk 'BEGIN{ORS=" "} $1=="nameserver" {if ($2 ~ ":") {print "["$2"]"} else {print $2}}' /etc/resolv.conf) + +NGINX_LOCAL_RESOLVERS="${NGINX_LOCAL_RESOLVERS% }" + +export NGINX_LOCAL_RESOLVERS diff --git a/sources/nginx1280/20-envsubst-on-templates.sh b/sources/nginx1280/20-envsubst-on-templates.sh new file mode 100755 index 0000000..3804165 --- /dev/null +++ b/sources/nginx1280/20-envsubst-on-templates.sh @@ -0,0 +1,78 @@ +#!/bin/sh + +set -e + +ME=$(basename "$0") + +entrypoint_log() { + if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then + echo "$@" + fi +} + +add_stream_block() { + local conffile="/etc/nginx/nginx.conf" + + if grep -q -E "\s*stream\s*\{" "$conffile"; then + entrypoint_log "$ME: $conffile contains a stream block; include $stream_output_dir/*.conf to enable stream templates" + else + # check if the file can be modified, e.g. not on a r/o filesystem + touch "$conffile" 2>/dev/null || { entrypoint_log "$ME: info: can not modify $conffile (read-only file system?)"; exit 0; } + entrypoint_log "$ME: Appending stream block to $conffile to include $stream_output_dir/*.conf" + cat << END >> "$conffile" +# added by "$ME" on "$(date)" +stream { + include $stream_output_dir/*.conf; +} +END + fi +} + +auto_envsubst() { + local template_dir="${NGINX_ENVSUBST_TEMPLATE_DIR:-/etc/nginx/templates}" + local suffix="${NGINX_ENVSUBST_TEMPLATE_SUFFIX:-.template}" + local output_dir="${NGINX_ENVSUBST_OUTPUT_DIR:-/etc/nginx/conf.d}" + local stream_suffix="${NGINX_ENVSUBST_STREAM_TEMPLATE_SUFFIX:-.stream-template}" + local stream_output_dir="${NGINX_ENVSUBST_STREAM_OUTPUT_DIR:-/etc/nginx/stream-conf.d}" + local filter="${NGINX_ENVSUBST_FILTER:-}" + + local template defined_envs relative_path output_path subdir + defined_envs=$(printf '${%s} ' $(awk "END { for (name in ENVIRON) { print ( name ~ /${filter}/ ) ? name : \"\" } }" < /dev/null )) + [ -d "$template_dir" ] || return 0 + if [ ! -w "$output_dir" ]; then + entrypoint_log "$ME: ERROR: $template_dir exists, but $output_dir is not writable" + return 0 + fi + find "$template_dir" -follow -type f -name "*$suffix" -print | while read -r template; do + relative_path="${template#"$template_dir/"}" + output_path="$output_dir/${relative_path%"$suffix"}" + subdir=$(dirname "$relative_path") + # create a subdirectory where the template file exists + mkdir -p "$output_dir/$subdir" + entrypoint_log "$ME: Running envsubst on $template to $output_path" + envsubst "$defined_envs" < "$template" > "$output_path" + done + + # Print the first file with the stream suffix, this will be false if there are none + if test -n "$(find "$template_dir" -name "*$stream_suffix" -print -quit)"; then + mkdir -p "$stream_output_dir" + if [ ! -w "$stream_output_dir" ]; then + entrypoint_log "$ME: ERROR: $template_dir exists, but $stream_output_dir is not writable" + return 0 + fi + add_stream_block + find "$template_dir" -follow -type f -name "*$stream_suffix" -print | while read -r template; do + relative_path="${template#"$template_dir/"}" + output_path="$stream_output_dir/${relative_path%"$stream_suffix"}" + subdir=$(dirname "$relative_path") + # create a subdirectory where the template file exists + mkdir -p "$stream_output_dir/$subdir" + entrypoint_log "$ME: Running envsubst on $template to $output_path" + envsubst "$defined_envs" < "$template" > "$output_path" + done + fi +} + +auto_envsubst + +exit 0 diff --git a/sources/nginx1280/30-tune-worker-processes.sh b/sources/nginx1280/30-tune-worker-processes.sh new file mode 100755 index 0000000..defb994 --- /dev/null +++ b/sources/nginx1280/30-tune-worker-processes.sh @@ -0,0 +1,188 @@ +#!/bin/sh +# vim:sw=2:ts=2:sts=2:et + +set -eu + +LC_ALL=C +ME=$(basename "$0") +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + +[ "${NGINX_ENTRYPOINT_WORKER_PROCESSES_AUTOTUNE:-}" ] || exit 0 + +touch /etc/nginx/nginx.conf 2>/dev/null || { echo >&2 "$ME: error: can not modify /etc/nginx/nginx.conf (read-only file system?)"; exit 0; } + +ceildiv() { + num=$1 + div=$2 + echo $(( (num + div - 1) / div )) +} + +get_cpuset() { + cpusetroot=$1 + cpusetfile=$2 + ncpu=0 + [ -f "$cpusetroot/$cpusetfile" ] || return 1 + for token in $( tr ',' ' ' < "$cpusetroot/$cpusetfile" ); do + case "$token" in + *-*) + count=$( seq $(echo "$token" | tr '-' ' ') | wc -l ) + ncpu=$(( ncpu+count )) + ;; + *) + ncpu=$(( ncpu+1 )) + ;; + esac + done + echo "$ncpu" +} + +get_quota() { + cpuroot=$1 + ncpu=0 + [ -f "$cpuroot/cpu.cfs_quota_us" ] || return 1 + [ -f "$cpuroot/cpu.cfs_period_us" ] || return 1 + cfs_quota=$( cat "$cpuroot/cpu.cfs_quota_us" ) + cfs_period=$( cat "$cpuroot/cpu.cfs_period_us" ) + [ "$cfs_quota" = "-1" ] && return 1 + [ "$cfs_period" = "0" ] && return 1 + ncpu=$( ceildiv "$cfs_quota" "$cfs_period" ) + [ "$ncpu" -gt 0 ] || return 1 + echo "$ncpu" +} + +get_quota_v2() { + cpuroot=$1 + ncpu=0 + [ -f "$cpuroot/cpu.max" ] || return 1 + cfs_quota=$( cut -d' ' -f 1 < "$cpuroot/cpu.max" ) + cfs_period=$( cut -d' ' -f 2 < "$cpuroot/cpu.max" ) + [ "$cfs_quota" = "max" ] && return 1 + [ "$cfs_period" = "0" ] && return 1 + ncpu=$( ceildiv "$cfs_quota" "$cfs_period" ) + [ "$ncpu" -gt 0 ] || return 1 + echo "$ncpu" +} + +get_cgroup_v1_path() { + needle=$1 + found= + foundroot= + mountpoint= + + [ -r "/proc/self/mountinfo" ] || return 1 + [ -r "/proc/self/cgroup" ] || return 1 + + while IFS= read -r line; do + case "$needle" in + "cpuset") + case "$line" in + *cpuset*) + found=$( echo "$line" | cut -d ' ' -f 4,5 ) + break + ;; + esac + ;; + "cpu") + case "$line" in + *cpuset*) + ;; + *cpu,cpuacct*|*cpuacct,cpu|*cpuacct*|*cpu*) + found=$( echo "$line" | cut -d ' ' -f 4,5 ) + break + ;; + esac + esac + done << __EOF__ +$( grep -F -- '- cgroup ' /proc/self/mountinfo ) +__EOF__ + + while IFS= read -r line; do + controller=$( echo "$line" | cut -d: -f 2 ) + case "$needle" in + "cpuset") + case "$controller" in + cpuset) + mountpoint=$( echo "$line" | cut -d: -f 3 ) + break + ;; + esac + ;; + "cpu") + case "$controller" in + cpu,cpuacct|cpuacct,cpu|cpuacct|cpu) + mountpoint=$( echo "$line" | cut -d: -f 3 ) + break + ;; + esac + ;; + esac +done << __EOF__ +$( grep -F -- 'cpu' /proc/self/cgroup ) +__EOF__ + + case "${found%% *}" in + "/") + foundroot="${found##* }$mountpoint" + ;; + "$mountpoint") + foundroot="${found##* }" + ;; + esac + echo "$foundroot" +} + +get_cgroup_v2_path() { + found= + foundroot= + mountpoint= + + [ -r "/proc/self/mountinfo" ] || return 1 + [ -r "/proc/self/cgroup" ] || return 1 + + while IFS= read -r line; do + found=$( echo "$line" | cut -d ' ' -f 4,5 ) + done << __EOF__ +$( grep -F -- '- cgroup2 ' /proc/self/mountinfo ) +__EOF__ + + while IFS= read -r line; do + mountpoint=$( echo "$line" | cut -d: -f 3 ) +done << __EOF__ +$( grep -F -- '0::' /proc/self/cgroup ) +__EOF__ + + case "${found%% *}" in + "") + return 1 + ;; + "/") + foundroot="${found##* }$mountpoint" + ;; + "$mountpoint" | /../*) + foundroot="${found##* }" + ;; + esac + echo "$foundroot" +} + +ncpu_online=$( getconf _NPROCESSORS_ONLN ) +ncpu_cpuset= +ncpu_quota= +ncpu_cpuset_v2= +ncpu_quota_v2= + +cpuset=$( get_cgroup_v1_path "cpuset" ) && ncpu_cpuset=$( get_cpuset "$cpuset" "cpuset.effective_cpus" ) || ncpu_cpuset=$ncpu_online +cpu=$( get_cgroup_v1_path "cpu" ) && ncpu_quota=$( get_quota "$cpu" ) || ncpu_quota=$ncpu_online +cgroup_v2=$( get_cgroup_v2_path ) && ncpu_cpuset_v2=$( get_cpuset "$cgroup_v2" "cpuset.cpus.effective" ) || ncpu_cpuset_v2=$ncpu_online +cgroup_v2=$( get_cgroup_v2_path ) && ncpu_quota_v2=$( get_quota_v2 "$cgroup_v2" ) || ncpu_quota_v2=$ncpu_online + +ncpu=$( printf "%s\n%s\n%s\n%s\n%s\n" \ + "$ncpu_online" \ + "$ncpu_cpuset" \ + "$ncpu_quota" \ + "$ncpu_cpuset_v2" \ + "$ncpu_quota_v2" \ + | sort -n \ + | head -n 1 ) + +sed -i.bak -r 's/^(worker_processes)(.*)$/# Commented out by '"$ME"' on '"$(date)"'\n#\1\2\n\1 '"$ncpu"';/' /etc/nginx/nginx.conf diff --git a/sources/nginx1280/Dockerfile b/sources/nginx1280/Dockerfile new file mode 100644 index 0000000..29bf5ba --- /dev/null +++ b/sources/nginx1280/Dockerfile @@ -0,0 +1,108 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "update.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# +FROM alpine:3.21 + +LABEL maintainer="NGINX Docker Maintainers " + +ENV NGINX_VERSION 1.28.0 +ENV PKG_RELEASE 1 +ENV DYNPKG_RELEASE 1 + +RUN set -x \ +# create nginx user/group first, to be consistent throughout docker variants + && addgroup -g 101 -S nginx \ + && adduser -S -D -H -u 101 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx \ + && apkArch="$(cat /etc/apk/arch)" \ + && nginxPackages=" \ + nginx=${NGINX_VERSION}-r${PKG_RELEASE} \ + " \ +# install prerequisites for public key and pkg-oss checks + && apk add --no-cache --virtual .checksum-deps \ + openssl \ + && case "$apkArch" in \ + x86_64|aarch64) \ +# arches officially built by upstream + set -x \ + && KEY_SHA512="e09fa32f0a0eab2b879ccbbc4d0e4fb9751486eedda75e35fac65802cc9faa266425edf83e261137a2f4d16281ce2c1a5f4502930fe75154723da014214f0655" \ + && wget -O /tmp/nginx_signing.rsa.pub https://nginx.org/keys/nginx_signing.rsa.pub \ + && if echo "$KEY_SHA512 */tmp/nginx_signing.rsa.pub" | sha512sum -c -; then \ + echo "key verification succeeded!"; \ + mv /tmp/nginx_signing.rsa.pub /etc/apk/keys/; \ + else \ + echo "key verification failed!"; \ + exit 1; \ + fi \ + && apk add -X "https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \ + ;; \ + *) \ +# we're on an architecture upstream doesn't officially build for +# let's build binaries from the published packaging sources + set -x \ + && tempDir="$(mktemp -d)" \ + && chown nobody:nobody $tempDir \ + && apk add --no-cache --virtual .build-deps \ + gcc \ + libc-dev \ + make \ + openssl-dev \ + pcre2-dev \ + zlib-dev \ + linux-headers \ + bash \ + alpine-sdk \ + findutils \ + curl \ + && su nobody -s /bin/sh -c " \ + export HOME=${tempDir} \ + && cd ${tempDir} \ + && curl -f -L -O https://github.com/nginx/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && PKGOSSCHECKSUM=\"517bc18954ccf4efddd51986584ca1f37966833ad342a297e1fe58fd0faf14c5a4dabcb23519dca433878a2927a95d6bea05a6749ee2fa67a33bf24cdc41b1e4 *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \ + && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \ + echo \"pkg-oss tarball checksum verification succeeded!\"; \ + else \ + echo \"pkg-oss tarball checksum verification failed!\"; \ + exit 1; \ + fi \ + && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \ + && cd alpine \ + && make base \ + && apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \ + && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \ + " \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \ + && apk del --no-network .build-deps \ + && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \ + ;; \ + esac \ +# remove checksum deps + && apk del --no-network .checksum-deps \ +# if we have leftovers from building, let's purge them (including extra, unnecessary build deps) + && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \ + && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \ +# Add `envsubst` for templating environment variables + && apk add --no-cache gettext-envsubst \ +# Bring in tzdata so users could set the timezones through the environment +# variables + && apk add --no-cache tzdata \ +# forward request and error logs to docker log collector + && ln -sf /dev/stdout /var/log/nginx/access.log \ + && ln -sf /dev/stderr /var/log/nginx/error.log \ +# create a docker-entrypoint.d directory + && mkdir /docker-entrypoint.d + +COPY docker-entrypoint.sh / +COPY 10-listen-on-ipv6-by-default.sh /docker-entrypoint.d +COPY 15-local-resolvers.envsh /docker-entrypoint.d +COPY 20-envsubst-on-templates.sh /docker-entrypoint.d +COPY 30-tune-worker-processes.sh /docker-entrypoint.d +ENTRYPOINT ["/docker-entrypoint.sh"] + +EXPOSE 80 + +STOPSIGNAL SIGQUIT + +CMD ["nginx", "-g", "daemon off;"] diff --git a/sources/nginx1280/docker-entrypoint.sh b/sources/nginx1280/docker-entrypoint.sh new file mode 100755 index 0000000..8ea04f2 --- /dev/null +++ b/sources/nginx1280/docker-entrypoint.sh @@ -0,0 +1,47 @@ +#!/bin/sh +# vim:sw=4:ts=4:et + +set -e + +entrypoint_log() { + if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then + echo "$@" + fi +} + +if [ "$1" = "nginx" ] || [ "$1" = "nginx-debug" ]; then + if /usr/bin/find "/docker-entrypoint.d/" -mindepth 1 -maxdepth 1 -type f -print -quit 2>/dev/null | read v; then + entrypoint_log "$0: /docker-entrypoint.d/ is not empty, will attempt to perform configuration" + + entrypoint_log "$0: Looking for shell scripts in /docker-entrypoint.d/" + find "/docker-entrypoint.d/" -follow -type f -print | sort -V | while read -r f; do + case "$f" in + *.envsh) + if [ -x "$f" ]; then + entrypoint_log "$0: Sourcing $f"; + . "$f" + else + # warn on shell scripts without exec bit + entrypoint_log "$0: Ignoring $f, not executable"; + fi + ;; + *.sh) + if [ -x "$f" ]; then + entrypoint_log "$0: Launching $f"; + "$f" + else + # warn on shell scripts without exec bit + entrypoint_log "$0: Ignoring $f, not executable"; + fi + ;; + *) entrypoint_log "$0: Ignoring $f";; + esac + done + + entrypoint_log "$0: Configuration complete; ready for start up" + else + entrypoint_log "$0: No files found in /docker-entrypoint.d/, skipping configuration" + fi +fi + +exec "$@" diff --git a/sources/nginx1281/10-listen-on-ipv6-by-default.sh b/sources/nginx1281/10-listen-on-ipv6-by-default.sh new file mode 100755 index 0000000..61a901d --- /dev/null +++ b/sources/nginx1281/10-listen-on-ipv6-by-default.sh @@ -0,0 +1,67 @@ +#!/bin/sh +# vim:sw=4:ts=4:et + +set -e + +entrypoint_log() { + if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then + echo "$@" + fi +} + +ME=$(basename "$0") +DEFAULT_CONF_FILE="etc/nginx/conf.d/default.conf" + +# check if we have ipv6 available +if [ ! -f "/proc/net/if_inet6" ]; then + entrypoint_log "$ME: info: ipv6 not available" + exit 0 +fi + +if [ ! -f "/$DEFAULT_CONF_FILE" ]; then + entrypoint_log "$ME: info: /$DEFAULT_CONF_FILE is not a file or does not exist" + exit 0 +fi + +# check if the file can be modified, e.g. not on a r/o filesystem +touch /$DEFAULT_CONF_FILE 2>/dev/null || { entrypoint_log "$ME: info: can not modify /$DEFAULT_CONF_FILE (read-only file system?)"; exit 0; } + +# check if the file is already modified, e.g. on a container restart +grep -q "listen \[::\]:80;" /$DEFAULT_CONF_FILE && { entrypoint_log "$ME: info: IPv6 listen already enabled"; exit 0; } + +if [ -f "/etc/os-release" ]; then + . /etc/os-release +else + entrypoint_log "$ME: info: can not guess the operating system" + exit 0 +fi + +entrypoint_log "$ME: info: Getting the checksum of /$DEFAULT_CONF_FILE" + +case "$ID" in + "debian") + CHECKSUM=$(dpkg-query --show --showformat='${Conffiles}\n' nginx | grep $DEFAULT_CONF_FILE | cut -d' ' -f 3) + echo "$CHECKSUM /$DEFAULT_CONF_FILE" | md5sum -c - >/dev/null 2>&1 || { + entrypoint_log "$ME: info: /$DEFAULT_CONF_FILE differs from the packaged version" + exit 0 + } + ;; + "alpine") + CHECKSUM=$(apk manifest nginx 2>/dev/null| grep $DEFAULT_CONF_FILE | cut -d' ' -f 1 | cut -d ':' -f 2) + echo "$CHECKSUM /$DEFAULT_CONF_FILE" | sha1sum -c - >/dev/null 2>&1 || { + entrypoint_log "$ME: info: /$DEFAULT_CONF_FILE differs from the packaged version" + exit 0 + } + ;; + *) + entrypoint_log "$ME: info: Unsupported distribution" + exit 0 + ;; +esac + +# enable ipv6 on default.conf listen sockets +sed -i -E 's,listen 80;,listen 80;\n listen [::]:80;,' /$DEFAULT_CONF_FILE + +entrypoint_log "$ME: info: Enabled listen on IPv6 in /$DEFAULT_CONF_FILE" + +exit 0 diff --git a/sources/nginx1281/15-local-resolvers.envsh b/sources/nginx1281/15-local-resolvers.envsh new file mode 100755 index 0000000..e830dda --- /dev/null +++ b/sources/nginx1281/15-local-resolvers.envsh @@ -0,0 +1,15 @@ +#!/bin/sh +# vim:sw=2:ts=2:sts=2:et + +set -eu + +LC_ALL=C +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + +[ "${NGINX_ENTRYPOINT_LOCAL_RESOLVERS:-}" ] || return 0 + +NGINX_LOCAL_RESOLVERS=$(awk 'BEGIN{ORS=" "} $1=="nameserver" {if ($2 ~ ":") {print "["$2"]"} else {print $2}}' /etc/resolv.conf) + +NGINX_LOCAL_RESOLVERS="${NGINX_LOCAL_RESOLVERS% }" + +export NGINX_LOCAL_RESOLVERS diff --git a/sources/nginx1281/20-envsubst-on-templates.sh b/sources/nginx1281/20-envsubst-on-templates.sh new file mode 100755 index 0000000..3804165 --- /dev/null +++ b/sources/nginx1281/20-envsubst-on-templates.sh @@ -0,0 +1,78 @@ +#!/bin/sh + +set -e + +ME=$(basename "$0") + +entrypoint_log() { + if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then + echo "$@" + fi +} + +add_stream_block() { + local conffile="/etc/nginx/nginx.conf" + + if grep -q -E "\s*stream\s*\{" "$conffile"; then + entrypoint_log "$ME: $conffile contains a stream block; include $stream_output_dir/*.conf to enable stream templates" + else + # check if the file can be modified, e.g. not on a r/o filesystem + touch "$conffile" 2>/dev/null || { entrypoint_log "$ME: info: can not modify $conffile (read-only file system?)"; exit 0; } + entrypoint_log "$ME: Appending stream block to $conffile to include $stream_output_dir/*.conf" + cat << END >> "$conffile" +# added by "$ME" on "$(date)" +stream { + include $stream_output_dir/*.conf; +} +END + fi +} + +auto_envsubst() { + local template_dir="${NGINX_ENVSUBST_TEMPLATE_DIR:-/etc/nginx/templates}" + local suffix="${NGINX_ENVSUBST_TEMPLATE_SUFFIX:-.template}" + local output_dir="${NGINX_ENVSUBST_OUTPUT_DIR:-/etc/nginx/conf.d}" + local stream_suffix="${NGINX_ENVSUBST_STREAM_TEMPLATE_SUFFIX:-.stream-template}" + local stream_output_dir="${NGINX_ENVSUBST_STREAM_OUTPUT_DIR:-/etc/nginx/stream-conf.d}" + local filter="${NGINX_ENVSUBST_FILTER:-}" + + local template defined_envs relative_path output_path subdir + defined_envs=$(printf '${%s} ' $(awk "END { for (name in ENVIRON) { print ( name ~ /${filter}/ ) ? name : \"\" } }" < /dev/null )) + [ -d "$template_dir" ] || return 0 + if [ ! -w "$output_dir" ]; then + entrypoint_log "$ME: ERROR: $template_dir exists, but $output_dir is not writable" + return 0 + fi + find "$template_dir" -follow -type f -name "*$suffix" -print | while read -r template; do + relative_path="${template#"$template_dir/"}" + output_path="$output_dir/${relative_path%"$suffix"}" + subdir=$(dirname "$relative_path") + # create a subdirectory where the template file exists + mkdir -p "$output_dir/$subdir" + entrypoint_log "$ME: Running envsubst on $template to $output_path" + envsubst "$defined_envs" < "$template" > "$output_path" + done + + # Print the first file with the stream suffix, this will be false if there are none + if test -n "$(find "$template_dir" -name "*$stream_suffix" -print -quit)"; then + mkdir -p "$stream_output_dir" + if [ ! -w "$stream_output_dir" ]; then + entrypoint_log "$ME: ERROR: $template_dir exists, but $stream_output_dir is not writable" + return 0 + fi + add_stream_block + find "$template_dir" -follow -type f -name "*$stream_suffix" -print | while read -r template; do + relative_path="${template#"$template_dir/"}" + output_path="$stream_output_dir/${relative_path%"$stream_suffix"}" + subdir=$(dirname "$relative_path") + # create a subdirectory where the template file exists + mkdir -p "$stream_output_dir/$subdir" + entrypoint_log "$ME: Running envsubst on $template to $output_path" + envsubst "$defined_envs" < "$template" > "$output_path" + done + fi +} + +auto_envsubst + +exit 0 diff --git a/sources/nginx1281/30-tune-worker-processes.sh b/sources/nginx1281/30-tune-worker-processes.sh new file mode 100755 index 0000000..defb994 --- /dev/null +++ b/sources/nginx1281/30-tune-worker-processes.sh @@ -0,0 +1,188 @@ +#!/bin/sh +# vim:sw=2:ts=2:sts=2:et + +set -eu + +LC_ALL=C +ME=$(basename "$0") +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + +[ "${NGINX_ENTRYPOINT_WORKER_PROCESSES_AUTOTUNE:-}" ] || exit 0 + +touch /etc/nginx/nginx.conf 2>/dev/null || { echo >&2 "$ME: error: can not modify /etc/nginx/nginx.conf (read-only file system?)"; exit 0; } + +ceildiv() { + num=$1 + div=$2 + echo $(( (num + div - 1) / div )) +} + +get_cpuset() { + cpusetroot=$1 + cpusetfile=$2 + ncpu=0 + [ -f "$cpusetroot/$cpusetfile" ] || return 1 + for token in $( tr ',' ' ' < "$cpusetroot/$cpusetfile" ); do + case "$token" in + *-*) + count=$( seq $(echo "$token" | tr '-' ' ') | wc -l ) + ncpu=$(( ncpu+count )) + ;; + *) + ncpu=$(( ncpu+1 )) + ;; + esac + done + echo "$ncpu" +} + +get_quota() { + cpuroot=$1 + ncpu=0 + [ -f "$cpuroot/cpu.cfs_quota_us" ] || return 1 + [ -f "$cpuroot/cpu.cfs_period_us" ] || return 1 + cfs_quota=$( cat "$cpuroot/cpu.cfs_quota_us" ) + cfs_period=$( cat "$cpuroot/cpu.cfs_period_us" ) + [ "$cfs_quota" = "-1" ] && return 1 + [ "$cfs_period" = "0" ] && return 1 + ncpu=$( ceildiv "$cfs_quota" "$cfs_period" ) + [ "$ncpu" -gt 0 ] || return 1 + echo "$ncpu" +} + +get_quota_v2() { + cpuroot=$1 + ncpu=0 + [ -f "$cpuroot/cpu.max" ] || return 1 + cfs_quota=$( cut -d' ' -f 1 < "$cpuroot/cpu.max" ) + cfs_period=$( cut -d' ' -f 2 < "$cpuroot/cpu.max" ) + [ "$cfs_quota" = "max" ] && return 1 + [ "$cfs_period" = "0" ] && return 1 + ncpu=$( ceildiv "$cfs_quota" "$cfs_period" ) + [ "$ncpu" -gt 0 ] || return 1 + echo "$ncpu" +} + +get_cgroup_v1_path() { + needle=$1 + found= + foundroot= + mountpoint= + + [ -r "/proc/self/mountinfo" ] || return 1 + [ -r "/proc/self/cgroup" ] || return 1 + + while IFS= read -r line; do + case "$needle" in + "cpuset") + case "$line" in + *cpuset*) + found=$( echo "$line" | cut -d ' ' -f 4,5 ) + break + ;; + esac + ;; + "cpu") + case "$line" in + *cpuset*) + ;; + *cpu,cpuacct*|*cpuacct,cpu|*cpuacct*|*cpu*) + found=$( echo "$line" | cut -d ' ' -f 4,5 ) + break + ;; + esac + esac + done << __EOF__ +$( grep -F -- '- cgroup ' /proc/self/mountinfo ) +__EOF__ + + while IFS= read -r line; do + controller=$( echo "$line" | cut -d: -f 2 ) + case "$needle" in + "cpuset") + case "$controller" in + cpuset) + mountpoint=$( echo "$line" | cut -d: -f 3 ) + break + ;; + esac + ;; + "cpu") + case "$controller" in + cpu,cpuacct|cpuacct,cpu|cpuacct|cpu) + mountpoint=$( echo "$line" | cut -d: -f 3 ) + break + ;; + esac + ;; + esac +done << __EOF__ +$( grep -F -- 'cpu' /proc/self/cgroup ) +__EOF__ + + case "${found%% *}" in + "/") + foundroot="${found##* }$mountpoint" + ;; + "$mountpoint") + foundroot="${found##* }" + ;; + esac + echo "$foundroot" +} + +get_cgroup_v2_path() { + found= + foundroot= + mountpoint= + + [ -r "/proc/self/mountinfo" ] || return 1 + [ -r "/proc/self/cgroup" ] || return 1 + + while IFS= read -r line; do + found=$( echo "$line" | cut -d ' ' -f 4,5 ) + done << __EOF__ +$( grep -F -- '- cgroup2 ' /proc/self/mountinfo ) +__EOF__ + + while IFS= read -r line; do + mountpoint=$( echo "$line" | cut -d: -f 3 ) +done << __EOF__ +$( grep -F -- '0::' /proc/self/cgroup ) +__EOF__ + + case "${found%% *}" in + "") + return 1 + ;; + "/") + foundroot="${found##* }$mountpoint" + ;; + "$mountpoint" | /../*) + foundroot="${found##* }" + ;; + esac + echo "$foundroot" +} + +ncpu_online=$( getconf _NPROCESSORS_ONLN ) +ncpu_cpuset= +ncpu_quota= +ncpu_cpuset_v2= +ncpu_quota_v2= + +cpuset=$( get_cgroup_v1_path "cpuset" ) && ncpu_cpuset=$( get_cpuset "$cpuset" "cpuset.effective_cpus" ) || ncpu_cpuset=$ncpu_online +cpu=$( get_cgroup_v1_path "cpu" ) && ncpu_quota=$( get_quota "$cpu" ) || ncpu_quota=$ncpu_online +cgroup_v2=$( get_cgroup_v2_path ) && ncpu_cpuset_v2=$( get_cpuset "$cgroup_v2" "cpuset.cpus.effective" ) || ncpu_cpuset_v2=$ncpu_online +cgroup_v2=$( get_cgroup_v2_path ) && ncpu_quota_v2=$( get_quota_v2 "$cgroup_v2" ) || ncpu_quota_v2=$ncpu_online + +ncpu=$( printf "%s\n%s\n%s\n%s\n%s\n" \ + "$ncpu_online" \ + "$ncpu_cpuset" \ + "$ncpu_quota" \ + "$ncpu_cpuset_v2" \ + "$ncpu_quota_v2" \ + | sort -n \ + | head -n 1 ) + +sed -i.bak -r 's/^(worker_processes)(.*)$/# Commented out by '"$ME"' on '"$(date)"'\n#\1\2\n\1 '"$ncpu"';/' /etc/nginx/nginx.conf diff --git a/sources/nginx1281/Dockerfile b/sources/nginx1281/Dockerfile new file mode 100644 index 0000000..676bf03 --- /dev/null +++ b/sources/nginx1281/Dockerfile @@ -0,0 +1,108 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "update.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# +FROM alpine:3.23 + +LABEL maintainer="NGINX Docker Maintainers " + +ENV NGINX_VERSION 1.28.1 +ENV PKG_RELEASE 1 +ENV DYNPKG_RELEASE 1 + +RUN set -x \ +# create nginx user/group first, to be consistent throughout docker variants + && addgroup -g 101 -S nginx \ + && adduser -S -D -H -u 101 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx \ + && apkArch="$(cat /etc/apk/arch)" \ + && nginxPackages=" \ + nginx=${NGINX_VERSION}-r${PKG_RELEASE} \ + " \ +# install prerequisites for public key and pkg-oss checks + && apk add --no-cache --virtual .checksum-deps \ + openssl \ + && case "$apkArch" in \ + x86_64|aarch64) \ +# arches officially built by upstream + set -x \ + && KEY_SHA512="e09fa32f0a0eab2b879ccbbc4d0e4fb9751486eedda75e35fac65802cc9faa266425edf83e261137a2f4d16281ce2c1a5f4502930fe75154723da014214f0655" \ + && wget -O /tmp/nginx_signing.rsa.pub https://nginx.org/keys/nginx_signing.rsa.pub \ + && if echo "$KEY_SHA512 */tmp/nginx_signing.rsa.pub" | sha512sum -c -; then \ + echo "key verification succeeded!"; \ + mv /tmp/nginx_signing.rsa.pub /etc/apk/keys/; \ + else \ + echo "key verification failed!"; \ + exit 1; \ + fi \ + && apk add -X "https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \ + ;; \ + *) \ +# we're on an architecture upstream doesn't officially build for +# let's build binaries from the published packaging sources + set -x \ + && tempDir="$(mktemp -d)" \ + && chown nobody:nobody $tempDir \ + && apk add --no-cache --virtual .build-deps \ + gcc \ + libc-dev \ + make \ + openssl-dev \ + pcre2-dev \ + zlib-dev \ + linux-headers \ + bash \ + alpine-sdk \ + findutils \ + curl \ + && su nobody -s /bin/sh -c " \ + export HOME=${tempDir} \ + && cd ${tempDir} \ + && curl -f -L -O https://github.com/nginx/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && PKGOSSCHECKSUM=\"4d43d5eadf39a2428e91a4e6fde0188f1cfb76354598d818d2ef2f8ff5cfa8d65993248b19a2d7ae663798d2362905e63ebd5dca6ca82cabc2831631d0e079ea *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \ + && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \ + echo \"pkg-oss tarball checksum verification succeeded!\"; \ + else \ + echo \"pkg-oss tarball checksum verification failed!\"; \ + exit 1; \ + fi \ + && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \ + && cd alpine \ + && make base \ + && apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \ + && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \ + " \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \ + && apk del --no-network .build-deps \ + && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \ + ;; \ + esac \ +# remove checksum deps + && apk del --no-network .checksum-deps \ +# if we have leftovers from building, let's purge them (including extra, unnecessary build deps) + && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \ + && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \ +# Add `envsubst` for templating environment variables + && apk add --no-cache gettext-envsubst \ +# Bring in tzdata so users could set the timezones through the environment +# variables + && apk add --no-cache tzdata \ +# forward request and error logs to docker log collector + && ln -sf /dev/stdout /var/log/nginx/access.log \ + && ln -sf /dev/stderr /var/log/nginx/error.log \ +# create a docker-entrypoint.d directory + && mkdir /docker-entrypoint.d + +COPY docker-entrypoint.sh / +COPY 10-listen-on-ipv6-by-default.sh /docker-entrypoint.d +COPY 15-local-resolvers.envsh /docker-entrypoint.d +COPY 20-envsubst-on-templates.sh /docker-entrypoint.d +COPY 30-tune-worker-processes.sh /docker-entrypoint.d +ENTRYPOINT ["/docker-entrypoint.sh"] + +EXPOSE 80 + +STOPSIGNAL SIGQUIT + +CMD ["nginx", "-g", "daemon off;"] diff --git a/sources/nginx1281/docker-entrypoint.sh b/sources/nginx1281/docker-entrypoint.sh new file mode 100755 index 0000000..8ea04f2 --- /dev/null +++ b/sources/nginx1281/docker-entrypoint.sh @@ -0,0 +1,47 @@ +#!/bin/sh +# vim:sw=4:ts=4:et + +set -e + +entrypoint_log() { + if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then + echo "$@" + fi +} + +if [ "$1" = "nginx" ] || [ "$1" = "nginx-debug" ]; then + if /usr/bin/find "/docker-entrypoint.d/" -mindepth 1 -maxdepth 1 -type f -print -quit 2>/dev/null | read v; then + entrypoint_log "$0: /docker-entrypoint.d/ is not empty, will attempt to perform configuration" + + entrypoint_log "$0: Looking for shell scripts in /docker-entrypoint.d/" + find "/docker-entrypoint.d/" -follow -type f -print | sort -V | while read -r f; do + case "$f" in + *.envsh) + if [ -x "$f" ]; then + entrypoint_log "$0: Sourcing $f"; + . "$f" + else + # warn on shell scripts without exec bit + entrypoint_log "$0: Ignoring $f, not executable"; + fi + ;; + *.sh) + if [ -x "$f" ]; then + entrypoint_log "$0: Launching $f"; + "$f" + else + # warn on shell scripts without exec bit + entrypoint_log "$0: Ignoring $f, not executable"; + fi + ;; + *) entrypoint_log "$0: Ignoring $f";; + esac + done + + entrypoint_log "$0: Configuration complete; ready for start up" + else + entrypoint_log "$0: No files found in /docker-entrypoint.d/, skipping configuration" + fi +fi + +exec "$@" diff --git a/sources/nginx1282/10-listen-on-ipv6-by-default.sh b/sources/nginx1282/10-listen-on-ipv6-by-default.sh new file mode 100755 index 0000000..61a901d --- /dev/null +++ b/sources/nginx1282/10-listen-on-ipv6-by-default.sh @@ -0,0 +1,67 @@ +#!/bin/sh +# vim:sw=4:ts=4:et + +set -e + +entrypoint_log() { + if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then + echo "$@" + fi +} + +ME=$(basename "$0") +DEFAULT_CONF_FILE="etc/nginx/conf.d/default.conf" + +# check if we have ipv6 available +if [ ! -f "/proc/net/if_inet6" ]; then + entrypoint_log "$ME: info: ipv6 not available" + exit 0 +fi + +if [ ! -f "/$DEFAULT_CONF_FILE" ]; then + entrypoint_log "$ME: info: /$DEFAULT_CONF_FILE is not a file or does not exist" + exit 0 +fi + +# check if the file can be modified, e.g. not on a r/o filesystem +touch /$DEFAULT_CONF_FILE 2>/dev/null || { entrypoint_log "$ME: info: can not modify /$DEFAULT_CONF_FILE (read-only file system?)"; exit 0; } + +# check if the file is already modified, e.g. on a container restart +grep -q "listen \[::\]:80;" /$DEFAULT_CONF_FILE && { entrypoint_log "$ME: info: IPv6 listen already enabled"; exit 0; } + +if [ -f "/etc/os-release" ]; then + . /etc/os-release +else + entrypoint_log "$ME: info: can not guess the operating system" + exit 0 +fi + +entrypoint_log "$ME: info: Getting the checksum of /$DEFAULT_CONF_FILE" + +case "$ID" in + "debian") + CHECKSUM=$(dpkg-query --show --showformat='${Conffiles}\n' nginx | grep $DEFAULT_CONF_FILE | cut -d' ' -f 3) + echo "$CHECKSUM /$DEFAULT_CONF_FILE" | md5sum -c - >/dev/null 2>&1 || { + entrypoint_log "$ME: info: /$DEFAULT_CONF_FILE differs from the packaged version" + exit 0 + } + ;; + "alpine") + CHECKSUM=$(apk manifest nginx 2>/dev/null| grep $DEFAULT_CONF_FILE | cut -d' ' -f 1 | cut -d ':' -f 2) + echo "$CHECKSUM /$DEFAULT_CONF_FILE" | sha1sum -c - >/dev/null 2>&1 || { + entrypoint_log "$ME: info: /$DEFAULT_CONF_FILE differs from the packaged version" + exit 0 + } + ;; + *) + entrypoint_log "$ME: info: Unsupported distribution" + exit 0 + ;; +esac + +# enable ipv6 on default.conf listen sockets +sed -i -E 's,listen 80;,listen 80;\n listen [::]:80;,' /$DEFAULT_CONF_FILE + +entrypoint_log "$ME: info: Enabled listen on IPv6 in /$DEFAULT_CONF_FILE" + +exit 0 diff --git a/sources/nginx1282/15-local-resolvers.envsh b/sources/nginx1282/15-local-resolvers.envsh new file mode 100755 index 0000000..e830dda --- /dev/null +++ b/sources/nginx1282/15-local-resolvers.envsh @@ -0,0 +1,15 @@ +#!/bin/sh +# vim:sw=2:ts=2:sts=2:et + +set -eu + +LC_ALL=C +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + +[ "${NGINX_ENTRYPOINT_LOCAL_RESOLVERS:-}" ] || return 0 + +NGINX_LOCAL_RESOLVERS=$(awk 'BEGIN{ORS=" "} $1=="nameserver" {if ($2 ~ ":") {print "["$2"]"} else {print $2}}' /etc/resolv.conf) + +NGINX_LOCAL_RESOLVERS="${NGINX_LOCAL_RESOLVERS% }" + +export NGINX_LOCAL_RESOLVERS diff --git a/sources/nginx1282/20-envsubst-on-templates.sh b/sources/nginx1282/20-envsubst-on-templates.sh new file mode 100755 index 0000000..3804165 --- /dev/null +++ b/sources/nginx1282/20-envsubst-on-templates.sh @@ -0,0 +1,78 @@ +#!/bin/sh + +set -e + +ME=$(basename "$0") + +entrypoint_log() { + if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then + echo "$@" + fi +} + +add_stream_block() { + local conffile="/etc/nginx/nginx.conf" + + if grep -q -E "\s*stream\s*\{" "$conffile"; then + entrypoint_log "$ME: $conffile contains a stream block; include $stream_output_dir/*.conf to enable stream templates" + else + # check if the file can be modified, e.g. not on a r/o filesystem + touch "$conffile" 2>/dev/null || { entrypoint_log "$ME: info: can not modify $conffile (read-only file system?)"; exit 0; } + entrypoint_log "$ME: Appending stream block to $conffile to include $stream_output_dir/*.conf" + cat << END >> "$conffile" +# added by "$ME" on "$(date)" +stream { + include $stream_output_dir/*.conf; +} +END + fi +} + +auto_envsubst() { + local template_dir="${NGINX_ENVSUBST_TEMPLATE_DIR:-/etc/nginx/templates}" + local suffix="${NGINX_ENVSUBST_TEMPLATE_SUFFIX:-.template}" + local output_dir="${NGINX_ENVSUBST_OUTPUT_DIR:-/etc/nginx/conf.d}" + local stream_suffix="${NGINX_ENVSUBST_STREAM_TEMPLATE_SUFFIX:-.stream-template}" + local stream_output_dir="${NGINX_ENVSUBST_STREAM_OUTPUT_DIR:-/etc/nginx/stream-conf.d}" + local filter="${NGINX_ENVSUBST_FILTER:-}" + + local template defined_envs relative_path output_path subdir + defined_envs=$(printf '${%s} ' $(awk "END { for (name in ENVIRON) { print ( name ~ /${filter}/ ) ? name : \"\" } }" < /dev/null )) + [ -d "$template_dir" ] || return 0 + if [ ! -w "$output_dir" ]; then + entrypoint_log "$ME: ERROR: $template_dir exists, but $output_dir is not writable" + return 0 + fi + find "$template_dir" -follow -type f -name "*$suffix" -print | while read -r template; do + relative_path="${template#"$template_dir/"}" + output_path="$output_dir/${relative_path%"$suffix"}" + subdir=$(dirname "$relative_path") + # create a subdirectory where the template file exists + mkdir -p "$output_dir/$subdir" + entrypoint_log "$ME: Running envsubst on $template to $output_path" + envsubst "$defined_envs" < "$template" > "$output_path" + done + + # Print the first file with the stream suffix, this will be false if there are none + if test -n "$(find "$template_dir" -name "*$stream_suffix" -print -quit)"; then + mkdir -p "$stream_output_dir" + if [ ! -w "$stream_output_dir" ]; then + entrypoint_log "$ME: ERROR: $template_dir exists, but $stream_output_dir is not writable" + return 0 + fi + add_stream_block + find "$template_dir" -follow -type f -name "*$stream_suffix" -print | while read -r template; do + relative_path="${template#"$template_dir/"}" + output_path="$stream_output_dir/${relative_path%"$stream_suffix"}" + subdir=$(dirname "$relative_path") + # create a subdirectory where the template file exists + mkdir -p "$stream_output_dir/$subdir" + entrypoint_log "$ME: Running envsubst on $template to $output_path" + envsubst "$defined_envs" < "$template" > "$output_path" + done + fi +} + +auto_envsubst + +exit 0 diff --git a/sources/nginx1282/30-tune-worker-processes.sh b/sources/nginx1282/30-tune-worker-processes.sh new file mode 100755 index 0000000..defb994 --- /dev/null +++ b/sources/nginx1282/30-tune-worker-processes.sh @@ -0,0 +1,188 @@ +#!/bin/sh +# vim:sw=2:ts=2:sts=2:et + +set -eu + +LC_ALL=C +ME=$(basename "$0") +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + +[ "${NGINX_ENTRYPOINT_WORKER_PROCESSES_AUTOTUNE:-}" ] || exit 0 + +touch /etc/nginx/nginx.conf 2>/dev/null || { echo >&2 "$ME: error: can not modify /etc/nginx/nginx.conf (read-only file system?)"; exit 0; } + +ceildiv() { + num=$1 + div=$2 + echo $(( (num + div - 1) / div )) +} + +get_cpuset() { + cpusetroot=$1 + cpusetfile=$2 + ncpu=0 + [ -f "$cpusetroot/$cpusetfile" ] || return 1 + for token in $( tr ',' ' ' < "$cpusetroot/$cpusetfile" ); do + case "$token" in + *-*) + count=$( seq $(echo "$token" | tr '-' ' ') | wc -l ) + ncpu=$(( ncpu+count )) + ;; + *) + ncpu=$(( ncpu+1 )) + ;; + esac + done + echo "$ncpu" +} + +get_quota() { + cpuroot=$1 + ncpu=0 + [ -f "$cpuroot/cpu.cfs_quota_us" ] || return 1 + [ -f "$cpuroot/cpu.cfs_period_us" ] || return 1 + cfs_quota=$( cat "$cpuroot/cpu.cfs_quota_us" ) + cfs_period=$( cat "$cpuroot/cpu.cfs_period_us" ) + [ "$cfs_quota" = "-1" ] && return 1 + [ "$cfs_period" = "0" ] && return 1 + ncpu=$( ceildiv "$cfs_quota" "$cfs_period" ) + [ "$ncpu" -gt 0 ] || return 1 + echo "$ncpu" +} + +get_quota_v2() { + cpuroot=$1 + ncpu=0 + [ -f "$cpuroot/cpu.max" ] || return 1 + cfs_quota=$( cut -d' ' -f 1 < "$cpuroot/cpu.max" ) + cfs_period=$( cut -d' ' -f 2 < "$cpuroot/cpu.max" ) + [ "$cfs_quota" = "max" ] && return 1 + [ "$cfs_period" = "0" ] && return 1 + ncpu=$( ceildiv "$cfs_quota" "$cfs_period" ) + [ "$ncpu" -gt 0 ] || return 1 + echo "$ncpu" +} + +get_cgroup_v1_path() { + needle=$1 + found= + foundroot= + mountpoint= + + [ -r "/proc/self/mountinfo" ] || return 1 + [ -r "/proc/self/cgroup" ] || return 1 + + while IFS= read -r line; do + case "$needle" in + "cpuset") + case "$line" in + *cpuset*) + found=$( echo "$line" | cut -d ' ' -f 4,5 ) + break + ;; + esac + ;; + "cpu") + case "$line" in + *cpuset*) + ;; + *cpu,cpuacct*|*cpuacct,cpu|*cpuacct*|*cpu*) + found=$( echo "$line" | cut -d ' ' -f 4,5 ) + break + ;; + esac + esac + done << __EOF__ +$( grep -F -- '- cgroup ' /proc/self/mountinfo ) +__EOF__ + + while IFS= read -r line; do + controller=$( echo "$line" | cut -d: -f 2 ) + case "$needle" in + "cpuset") + case "$controller" in + cpuset) + mountpoint=$( echo "$line" | cut -d: -f 3 ) + break + ;; + esac + ;; + "cpu") + case "$controller" in + cpu,cpuacct|cpuacct,cpu|cpuacct|cpu) + mountpoint=$( echo "$line" | cut -d: -f 3 ) + break + ;; + esac + ;; + esac +done << __EOF__ +$( grep -F -- 'cpu' /proc/self/cgroup ) +__EOF__ + + case "${found%% *}" in + "/") + foundroot="${found##* }$mountpoint" + ;; + "$mountpoint") + foundroot="${found##* }" + ;; + esac + echo "$foundroot" +} + +get_cgroup_v2_path() { + found= + foundroot= + mountpoint= + + [ -r "/proc/self/mountinfo" ] || return 1 + [ -r "/proc/self/cgroup" ] || return 1 + + while IFS= read -r line; do + found=$( echo "$line" | cut -d ' ' -f 4,5 ) + done << __EOF__ +$( grep -F -- '- cgroup2 ' /proc/self/mountinfo ) +__EOF__ + + while IFS= read -r line; do + mountpoint=$( echo "$line" | cut -d: -f 3 ) +done << __EOF__ +$( grep -F -- '0::' /proc/self/cgroup ) +__EOF__ + + case "${found%% *}" in + "") + return 1 + ;; + "/") + foundroot="${found##* }$mountpoint" + ;; + "$mountpoint" | /../*) + foundroot="${found##* }" + ;; + esac + echo "$foundroot" +} + +ncpu_online=$( getconf _NPROCESSORS_ONLN ) +ncpu_cpuset= +ncpu_quota= +ncpu_cpuset_v2= +ncpu_quota_v2= + +cpuset=$( get_cgroup_v1_path "cpuset" ) && ncpu_cpuset=$( get_cpuset "$cpuset" "cpuset.effective_cpus" ) || ncpu_cpuset=$ncpu_online +cpu=$( get_cgroup_v1_path "cpu" ) && ncpu_quota=$( get_quota "$cpu" ) || ncpu_quota=$ncpu_online +cgroup_v2=$( get_cgroup_v2_path ) && ncpu_cpuset_v2=$( get_cpuset "$cgroup_v2" "cpuset.cpus.effective" ) || ncpu_cpuset_v2=$ncpu_online +cgroup_v2=$( get_cgroup_v2_path ) && ncpu_quota_v2=$( get_quota_v2 "$cgroup_v2" ) || ncpu_quota_v2=$ncpu_online + +ncpu=$( printf "%s\n%s\n%s\n%s\n%s\n" \ + "$ncpu_online" \ + "$ncpu_cpuset" \ + "$ncpu_quota" \ + "$ncpu_cpuset_v2" \ + "$ncpu_quota_v2" \ + | sort -n \ + | head -n 1 ) + +sed -i.bak -r 's/^(worker_processes)(.*)$/# Commented out by '"$ME"' on '"$(date)"'\n#\1\2\n\1 '"$ncpu"';/' /etc/nginx/nginx.conf diff --git a/sources/nginx1282/Dockerfile b/sources/nginx1282/Dockerfile new file mode 100644 index 0000000..fb8ad1c --- /dev/null +++ b/sources/nginx1282/Dockerfile @@ -0,0 +1,108 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "update.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# +FROM alpine:3.23 + +LABEL maintainer="NGINX Docker Maintainers " + +ENV NGINX_VERSION 1.28.2 +ENV PKG_RELEASE 1 +ENV DYNPKG_RELEASE 1 + +RUN set -x \ +# create nginx user/group first, to be consistent throughout docker variants + && addgroup -g 101 -S nginx \ + && adduser -S -D -H -u 101 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx \ + && apkArch="$(cat /etc/apk/arch)" \ + && nginxPackages=" \ + nginx=${NGINX_VERSION}-r${PKG_RELEASE} \ + " \ +# install prerequisites for public key and pkg-oss checks + && apk add --no-cache --virtual .checksum-deps \ + openssl \ + && case "$apkArch" in \ + x86_64|aarch64) \ +# arches officially built by upstream + set -x \ + && KEY_SHA512="e09fa32f0a0eab2b879ccbbc4d0e4fb9751486eedda75e35fac65802cc9faa266425edf83e261137a2f4d16281ce2c1a5f4502930fe75154723da014214f0655" \ + && wget -O /tmp/nginx_signing.rsa.pub https://nginx.org/keys/nginx_signing.rsa.pub \ + && if echo "$KEY_SHA512 */tmp/nginx_signing.rsa.pub" | sha512sum -c -; then \ + echo "key verification succeeded!"; \ + mv /tmp/nginx_signing.rsa.pub /etc/apk/keys/; \ + else \ + echo "key verification failed!"; \ + exit 1; \ + fi \ + && apk add -X "https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \ + ;; \ + *) \ +# we're on an architecture upstream doesn't officially build for +# let's build binaries from the published packaging sources + set -x \ + && tempDir="$(mktemp -d)" \ + && chown nobody:nobody $tempDir \ + && apk add --no-cache --virtual .build-deps \ + gcc \ + libc-dev \ + make \ + openssl-dev \ + pcre2-dev \ + zlib-dev \ + linux-headers \ + bash \ + alpine-sdk \ + findutils \ + curl \ + && su nobody -s /bin/sh -c " \ + export HOME=${tempDir} \ + && cd ${tempDir} \ + && curl -f -L -O https://github.com/nginx/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && PKGOSSCHECKSUM=\"ef4545c05b1632a056482e3dbb47bb5d7393238318db3491e8bb308218cdb5f32dbb2ac73509097ac2426fd73270bc97836843a8b1846a396fd94e60826f7e3f *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \ + && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \ + echo \"pkg-oss tarball checksum verification succeeded!\"; \ + else \ + echo \"pkg-oss tarball checksum verification failed!\"; \ + exit 1; \ + fi \ + && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \ + && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \ + && cd alpine \ + && make base \ + && apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \ + && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \ + " \ + && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \ + && apk del --no-network .build-deps \ + && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \ + ;; \ + esac \ +# remove checksum deps + && apk del --no-network .checksum-deps \ +# if we have leftovers from building, let's purge them (including extra, unnecessary build deps) + && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \ + && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \ +# Add `envsubst` for templating environment variables + && apk add --no-cache gettext-envsubst \ +# Bring in tzdata so users could set the timezones through the environment +# variables + && apk add --no-cache tzdata \ +# forward request and error logs to docker log collector + && ln -sf /dev/stdout /var/log/nginx/access.log \ + && ln -sf /dev/stderr /var/log/nginx/error.log \ +# create a docker-entrypoint.d directory + && mkdir /docker-entrypoint.d + +COPY docker-entrypoint.sh / +COPY 10-listen-on-ipv6-by-default.sh /docker-entrypoint.d +COPY 15-local-resolvers.envsh /docker-entrypoint.d +COPY 20-envsubst-on-templates.sh /docker-entrypoint.d +COPY 30-tune-worker-processes.sh /docker-entrypoint.d +ENTRYPOINT ["/docker-entrypoint.sh"] + +EXPOSE 80 + +STOPSIGNAL SIGQUIT + +CMD ["nginx", "-g", "daemon off;"] diff --git a/sources/nginx1282/docker-entrypoint.sh b/sources/nginx1282/docker-entrypoint.sh new file mode 100755 index 0000000..8ea04f2 --- /dev/null +++ b/sources/nginx1282/docker-entrypoint.sh @@ -0,0 +1,47 @@ +#!/bin/sh +# vim:sw=4:ts=4:et + +set -e + +entrypoint_log() { + if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then + echo "$@" + fi +} + +if [ "$1" = "nginx" ] || [ "$1" = "nginx-debug" ]; then + if /usr/bin/find "/docker-entrypoint.d/" -mindepth 1 -maxdepth 1 -type f -print -quit 2>/dev/null | read v; then + entrypoint_log "$0: /docker-entrypoint.d/ is not empty, will attempt to perform configuration" + + entrypoint_log "$0: Looking for shell scripts in /docker-entrypoint.d/" + find "/docker-entrypoint.d/" -follow -type f -print | sort -V | while read -r f; do + case "$f" in + *.envsh) + if [ -x "$f" ]; then + entrypoint_log "$0: Sourcing $f"; + . "$f" + else + # warn on shell scripts without exec bit + entrypoint_log "$0: Ignoring $f, not executable"; + fi + ;; + *.sh) + if [ -x "$f" ]; then + entrypoint_log "$0: Launching $f"; + "$f" + else + # warn on shell scripts without exec bit + entrypoint_log "$0: Ignoring $f, not executable"; + fi + ;; + *) entrypoint_log "$0: Ignoring $f";; + esac + done + + entrypoint_log "$0: Configuration complete; ready for start up" + else + entrypoint_log "$0: No files found in /docker-entrypoint.d/, skipping configuration" + fi +fi + +exec "$@" diff --git a/sources/node20192/alpine/Dockerfile b/sources/node20192/alpine/Dockerfile new file mode 100644 index 0000000..9806044 --- /dev/null +++ b/sources/node20192/alpine/Dockerfile @@ -0,0 +1,110 @@ +FROM alpine:3.21 + +ENV NODE_VERSION 20.19.2 + +RUN addgroup -g 1000 node \ + && adduser -u 1000 -G node -s /bin/sh -D node \ + && apk add --no-cache \ + libstdc++ \ + && apk add --no-cache --virtual .build-deps \ + curl \ + && ARCH= OPENSSL_ARCH='linux*' && alpineArch="$(apk --print-arch)" \ + && case "${alpineArch##*-}" in \ + x86_64) ARCH='x64' CHECKSUM="03eabd9b71b3a2376693b521543251edd90dfb188883bcba4c07045d7ee46cd4" OPENSSL_ARCH=linux-x86_64;; \ + x86) OPENSSL_ARCH=linux-elf;; \ + aarch64) OPENSSL_ARCH=linux-aarch64;; \ + arm*) OPENSSL_ARCH=linux-armv4;; \ + ppc64le) OPENSSL_ARCH=linux-ppc64le;; \ + s390x) OPENSSL_ARCH=linux-s390x;; \ + *) ;; \ + esac \ + && if [ -n "${CHECKSUM}" ]; then \ + set -eu; \ + curl -fsSLO --compressed "https://unofficial-builds.nodejs.org/download/release/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz"; \ + echo "$CHECKSUM node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" | sha256sum -c - \ + && tar -xJf "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \ + && ln -s /usr/local/bin/node /usr/local/bin/nodejs; \ + else \ + echo "Building from source" \ + # backup build + && apk add --no-cache --virtual .build-deps-full \ + binutils-gold \ + g++ \ + gcc \ + gnupg \ + libgcc \ + linux-headers \ + make \ + python3 \ + py-setuptools \ + # use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150 + && export GNUPGHOME="$(mktemp -d)" \ + # gpg keys listed at https://github.com/nodejs/node#release-keys + && for key in \ + C0D6248439F1D5604AAFFB4021D900FFDB233756 \ + DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 \ + CC68F5A3106FF448322E48ED27F5E38D5B0A215F \ + 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 \ + 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 \ + C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C \ + 108F52B48DB57BB0CC439B2997B01419BD92F80A \ + A363A499291CBBC940DD62E41F10027AF002F8B0 \ + ; do \ + gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" || \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" ; \ + done \ + && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION.tar.xz" \ + && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \ + && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \ + && gpgconf --kill all \ + && rm -rf "$GNUPGHOME" \ + && grep " node-v$NODE_VERSION.tar.xz\$" SHASUMS256.txt | sha256sum -c - \ + && tar -xf "node-v$NODE_VERSION.tar.xz" \ + && cd "node-v$NODE_VERSION" \ + && ./configure \ + && make -j$(getconf _NPROCESSORS_ONLN) V= \ + && make install \ + && apk del .build-deps-full \ + && cd .. \ + && rm -Rf "node-v$NODE_VERSION" \ + && rm "node-v$NODE_VERSION.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt; \ + fi \ + && rm -f "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" \ + # Remove unused OpenSSL headers to save ~34MB. See this NodeJS issue: https://github.com/nodejs/node/issues/46451 + && find /usr/local/include/node/openssl/archs -mindepth 1 -maxdepth 1 ! -name "$OPENSSL_ARCH" -exec rm -rf {} \; \ + && apk del .build-deps \ + # smoke tests + && node --version \ + && npm --version \ + && rm -rf /tmp/* + +ENV YARN_VERSION 1.22.22 + +RUN apk add --no-cache --virtual .build-deps-yarn curl gnupg tar \ + # use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150 + && export GNUPGHOME="$(mktemp -d)" \ + && for key in \ + 6A010C5166006599AA17F08146C2130DFD2497F5 \ + ; do \ + gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" || \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" ; \ + done \ + && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \ + && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" \ + && gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \ + && gpgconf --kill all \ + && rm -rf "$GNUPGHOME" \ + && mkdir -p /opt \ + && tar -xzf yarn-v$YARN_VERSION.tar.gz -C /opt/ \ + && ln -s /opt/yarn-v$YARN_VERSION/bin/yarn /usr/local/bin/yarn \ + && ln -s /opt/yarn-v$YARN_VERSION/bin/yarnpkg /usr/local/bin/yarnpkg \ + && rm yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \ + && apk del .build-deps-yarn \ + # smoke test + && yarn --version \ + && rm -rf /tmp/* + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +CMD [ "node" ] diff --git a/sources/node20192/alpine/docker-entrypoint.sh b/sources/node20192/alpine/docker-entrypoint.sh new file mode 100755 index 0000000..1b3116e --- /dev/null +++ b/sources/node20192/alpine/docker-entrypoint.sh @@ -0,0 +1,11 @@ +#!/bin/sh +set -e + +# Run command with node if the first argument contains a "-" or is not a system command. The last +# part inside the "{}" is a workaround for the following bug in ash/dash: +# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264 +if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then + set -- node "$@" +fi + +exec "$@" diff --git a/sources/node20192/bookworm/Dockerfile b/sources/node20192/bookworm/Dockerfile new file mode 100644 index 0000000..c7b07eb --- /dev/null +++ b/sources/node20192/bookworm/Dockerfile @@ -0,0 +1,77 @@ +FROM buildpack-deps:bookworm + +RUN groupadd --gid 1000 node \ + && useradd --uid 1000 --gid node --shell /bin/bash --create-home node + +ENV NODE_VERSION 20.19.2 + +RUN ARCH= && dpkgArch="$(dpkg --print-architecture)" \ + && case "${dpkgArch##*-}" in \ + amd64) ARCH='x64';; \ + ppc64el) ARCH='ppc64le';; \ + s390x) ARCH='s390x';; \ + arm64) ARCH='arm64';; \ + armhf) ARCH='armv7l';; \ + i386) ARCH='x86';; \ + *) echo "unsupported architecture"; exit 1 ;; \ + esac \ + # use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150 + && export GNUPGHOME="$(mktemp -d)" \ + # gpg keys listed at https://github.com/nodejs/node#release-keys + && set -ex \ + && for key in \ + C0D6248439F1D5604AAFFB4021D900FFDB233756 \ + DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 \ + CC68F5A3106FF448322E48ED27F5E38D5B0A215F \ + 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 \ + 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 \ + C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C \ + 108F52B48DB57BB0CC439B2997B01419BD92F80A \ + A363A499291CBBC940DD62E41F10027AF002F8B0 \ + ; do \ + gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" || \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" ; \ + done \ + && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH.tar.xz" \ + && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \ + && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \ + && gpgconf --kill all \ + && rm -rf "$GNUPGHOME" \ + && grep " node-v$NODE_VERSION-linux-$ARCH.tar.xz\$" SHASUMS256.txt | sha256sum -c - \ + && tar -xJf "node-v$NODE_VERSION-linux-$ARCH.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \ + && rm "node-v$NODE_VERSION-linux-$ARCH.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt \ + && ln -s /usr/local/bin/node /usr/local/bin/nodejs \ + # smoke tests + && node --version \ + && npm --version \ + && rm -rf /tmp/* + +ENV YARN_VERSION 1.22.22 + +RUN set -ex \ + # use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150 + && export GNUPGHOME="$(mktemp -d)" \ + && for key in \ + 6A010C5166006599AA17F08146C2130DFD2497F5 \ + ; do \ + gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" || \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" ; \ + done \ + && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \ + && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" \ + && gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \ + && gpgconf --kill all \ + && rm -rf "$GNUPGHOME" \ + && mkdir -p /opt \ + && tar -xzf yarn-v$YARN_VERSION.tar.gz -C /opt/ \ + && ln -s /opt/yarn-v$YARN_VERSION/bin/yarn /usr/local/bin/yarn \ + && ln -s /opt/yarn-v$YARN_VERSION/bin/yarnpkg /usr/local/bin/yarnpkg \ + && rm yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \ + # smoke test + && yarn --version \ + && rm -rf /tmp/* + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +CMD [ "node" ] diff --git a/sources/node20192/bookworm/docker-entrypoint.sh b/sources/node20192/bookworm/docker-entrypoint.sh new file mode 100755 index 0000000..1b3116e --- /dev/null +++ b/sources/node20192/bookworm/docker-entrypoint.sh @@ -0,0 +1,11 @@ +#!/bin/sh +set -e + +# Run command with node if the first argument contains a "-" or is not a system command. The last +# part inside the "{}" is a workaround for the following bug in ash/dash: +# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264 +if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then + set -- node "$@" +fi + +exec "$@" diff --git a/sources/node22151/alpine/Dockerfile b/sources/node22151/alpine/Dockerfile new file mode 100644 index 0000000..cb17150 --- /dev/null +++ b/sources/node22151/alpine/Dockerfile @@ -0,0 +1,110 @@ +FROM alpine:3.21 + +ENV NODE_VERSION 22.15.1 + +RUN addgroup -g 1000 node \ + && adduser -u 1000 -G node -s /bin/sh -D node \ + && apk add --no-cache \ + libstdc++ \ + && apk add --no-cache --virtual .build-deps \ + curl \ + && ARCH= OPENSSL_ARCH='linux*' && alpineArch="$(apk --print-arch)" \ + && case "${alpineArch##*-}" in \ + x86_64) ARCH='x64' CHECKSUM="e6e13a4ee7c9baa7646ce993c8c9a8d93234bb48c9bf97d52d79be2b97c35439" OPENSSL_ARCH=linux-x86_64;; \ + x86) OPENSSL_ARCH=linux-elf;; \ + aarch64) OPENSSL_ARCH=linux-aarch64;; \ + arm*) OPENSSL_ARCH=linux-armv4;; \ + ppc64le) OPENSSL_ARCH=linux-ppc64le;; \ + s390x) OPENSSL_ARCH=linux-s390x;; \ + *) ;; \ + esac \ + && if [ -n "${CHECKSUM}" ]; then \ + set -eu; \ + curl -fsSLO --compressed "https://unofficial-builds.nodejs.org/download/release/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz"; \ + echo "$CHECKSUM node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" | sha256sum -c - \ + && tar -xJf "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \ + && ln -s /usr/local/bin/node /usr/local/bin/nodejs; \ + else \ + echo "Building from source" \ + # backup build + && apk add --no-cache --virtual .build-deps-full \ + binutils-gold \ + g++ \ + gcc \ + gnupg \ + libgcc \ + linux-headers \ + make \ + python3 \ + py-setuptools \ + # use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150 + && export GNUPGHOME="$(mktemp -d)" \ + # gpg keys listed at https://github.com/nodejs/node#release-keys + && for key in \ + C0D6248439F1D5604AAFFB4021D900FFDB233756 \ + DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 \ + CC68F5A3106FF448322E48ED27F5E38D5B0A215F \ + 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 \ + 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 \ + C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C \ + 108F52B48DB57BB0CC439B2997B01419BD92F80A \ + A363A499291CBBC940DD62E41F10027AF002F8B0 \ + ; do \ + gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" || \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" ; \ + done \ + && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION.tar.xz" \ + && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \ + && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \ + && gpgconf --kill all \ + && rm -rf "$GNUPGHOME" \ + && grep " node-v$NODE_VERSION.tar.xz\$" SHASUMS256.txt | sha256sum -c - \ + && tar -xf "node-v$NODE_VERSION.tar.xz" \ + && cd "node-v$NODE_VERSION" \ + && ./configure \ + && make -j$(getconf _NPROCESSORS_ONLN) V= \ + && make install \ + && apk del .build-deps-full \ + && cd .. \ + && rm -Rf "node-v$NODE_VERSION" \ + && rm "node-v$NODE_VERSION.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt; \ + fi \ + && rm -f "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" \ + # Remove unused OpenSSL headers to save ~34MB. See this NodeJS issue: https://github.com/nodejs/node/issues/46451 + && find /usr/local/include/node/openssl/archs -mindepth 1 -maxdepth 1 ! -name "$OPENSSL_ARCH" -exec rm -rf {} \; \ + && apk del .build-deps \ + # smoke tests + && node --version \ + && npm --version \ + && rm -rf /tmp/* + +ENV YARN_VERSION 1.22.22 + +RUN apk add --no-cache --virtual .build-deps-yarn curl gnupg tar \ + # use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150 + && export GNUPGHOME="$(mktemp -d)" \ + && for key in \ + 6A010C5166006599AA17F08146C2130DFD2497F5 \ + ; do \ + gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" || \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" ; \ + done \ + && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \ + && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" \ + && gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \ + && gpgconf --kill all \ + && rm -rf "$GNUPGHOME" \ + && mkdir -p /opt \ + && tar -xzf yarn-v$YARN_VERSION.tar.gz -C /opt/ \ + && ln -s /opt/yarn-v$YARN_VERSION/bin/yarn /usr/local/bin/yarn \ + && ln -s /opt/yarn-v$YARN_VERSION/bin/yarnpkg /usr/local/bin/yarnpkg \ + && rm yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \ + && apk del .build-deps-yarn \ + # smoke test + && yarn --version \ + && rm -rf /tmp/* + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +CMD [ "node" ] diff --git a/sources/node22151/alpine/docker-entrypoint.sh b/sources/node22151/alpine/docker-entrypoint.sh new file mode 100755 index 0000000..1b3116e --- /dev/null +++ b/sources/node22151/alpine/docker-entrypoint.sh @@ -0,0 +1,11 @@ +#!/bin/sh +set -e + +# Run command with node if the first argument contains a "-" or is not a system command. The last +# part inside the "{}" is a workaround for the following bug in ash/dash: +# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264 +if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then + set -- node "$@" +fi + +exec "$@" diff --git a/sources/node22151/bookworm/Dockerfile b/sources/node22151/bookworm/Dockerfile new file mode 100644 index 0000000..6ef4001 --- /dev/null +++ b/sources/node22151/bookworm/Dockerfile @@ -0,0 +1,77 @@ +FROM buildpack-deps:bookworm + +RUN groupadd --gid 1000 node \ + && useradd --uid 1000 --gid node --shell /bin/bash --create-home node + +ENV NODE_VERSION 22.15.1 + +RUN ARCH= && dpkgArch="$(dpkg --print-architecture)" \ + && case "${dpkgArch##*-}" in \ + amd64) ARCH='x64';; \ + ppc64el) ARCH='ppc64le';; \ + s390x) ARCH='s390x';; \ + arm64) ARCH='arm64';; \ + armhf) ARCH='armv7l';; \ + i386) ARCH='x86';; \ + *) echo "unsupported architecture"; exit 1 ;; \ + esac \ + # use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150 + && export GNUPGHOME="$(mktemp -d)" \ + # gpg keys listed at https://github.com/nodejs/node#release-keys + && set -ex \ + && for key in \ + C0D6248439F1D5604AAFFB4021D900FFDB233756 \ + DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 \ + CC68F5A3106FF448322E48ED27F5E38D5B0A215F \ + 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 \ + 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 \ + C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C \ + 108F52B48DB57BB0CC439B2997B01419BD92F80A \ + A363A499291CBBC940DD62E41F10027AF002F8B0 \ + ; do \ + gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" || \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" ; \ + done \ + && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH.tar.xz" \ + && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \ + && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \ + && gpgconf --kill all \ + && rm -rf "$GNUPGHOME" \ + && grep " node-v$NODE_VERSION-linux-$ARCH.tar.xz\$" SHASUMS256.txt | sha256sum -c - \ + && tar -xJf "node-v$NODE_VERSION-linux-$ARCH.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \ + && rm "node-v$NODE_VERSION-linux-$ARCH.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt \ + && ln -s /usr/local/bin/node /usr/local/bin/nodejs \ + # smoke tests + && node --version \ + && npm --version \ + && rm -rf /tmp/* + +ENV YARN_VERSION 1.22.22 + +RUN set -ex \ + # use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150 + && export GNUPGHOME="$(mktemp -d)" \ + && for key in \ + 6A010C5166006599AA17F08146C2130DFD2497F5 \ + ; do \ + gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" || \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" ; \ + done \ + && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \ + && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" \ + && gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \ + && gpgconf --kill all \ + && rm -rf "$GNUPGHOME" \ + && mkdir -p /opt \ + && tar -xzf yarn-v$YARN_VERSION.tar.gz -C /opt/ \ + && ln -s /opt/yarn-v$YARN_VERSION/bin/yarn /usr/local/bin/yarn \ + && ln -s /opt/yarn-v$YARN_VERSION/bin/yarnpkg /usr/local/bin/yarnpkg \ + && rm yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \ + # smoke test + && yarn --version \ + && rm -rf /tmp/* + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +CMD [ "node" ] diff --git a/sources/node22151/bookworm/docker-entrypoint.sh b/sources/node22151/bookworm/docker-entrypoint.sh new file mode 100755 index 0000000..1b3116e --- /dev/null +++ b/sources/node22151/bookworm/docker-entrypoint.sh @@ -0,0 +1,11 @@ +#!/bin/sh +set -e + +# Run command with node if the first argument contains a "-" or is not a system command. The last +# part inside the "{}" is a workaround for the following bug in ash/dash: +# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264 +if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then + set -- node "$@" +fi + +exec "$@" diff --git a/sources/node22220/alpine/Dockerfile b/sources/node22220/alpine/Dockerfile new file mode 100644 index 0000000..f21aa92 --- /dev/null +++ b/sources/node22220/alpine/Dockerfile @@ -0,0 +1,110 @@ +FROM alpine:3.23 + +ENV NODE_VERSION=22.22.0 + +RUN addgroup -g 1000 node \ + && adduser -u 1000 -G node -s /bin/sh -D node \ + && apk add --no-cache \ + libstdc++ \ + && apk add --no-cache --virtual .build-deps \ + curl \ + && ARCH= OPENSSL_ARCH='linux*' && alpineArch="$(apk --print-arch)" \ + && case "${alpineArch##*-}" in \ + x86_64) ARCH='x64' CHECKSUM="5618c83f81bdf51ac7fdfdf5bd6e179c15294b10ae4af13c028a27d54a0bd780" OPENSSL_ARCH=linux-x86_64;; \ + x86) OPENSSL_ARCH=linux-elf;; \ + aarch64) OPENSSL_ARCH=linux-aarch64;; \ + arm*) OPENSSL_ARCH=linux-armv4;; \ + ppc64le) OPENSSL_ARCH=linux-ppc64le;; \ + s390x) OPENSSL_ARCH=linux-s390x;; \ + *) ;; \ + esac \ + && if [ -n "${CHECKSUM}" ]; then \ + set -eu; \ + curl -fsSLO --compressed "https://unofficial-builds.nodejs.org/download/release/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz"; \ + echo "$CHECKSUM node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" | sha256sum -c - \ + && tar -xJf "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \ + && ln -s /usr/local/bin/node /usr/local/bin/nodejs; \ + else \ + echo "Building from source" \ + # backup build + && apk add --no-cache --virtual .build-deps-full \ + binutils-gold \ + g++ \ + gcc \ + gnupg \ + libgcc \ + linux-headers \ + make \ + python3 \ + py-setuptools \ + # use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150 + && export GNUPGHOME="$(mktemp -d)" \ + # gpg keys listed at https://github.com/nodejs/node#release-keys + && for key in \ + 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356 \ + DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 \ + CC68F5A3106FF448322E48ED27F5E38D5B0A215F \ + 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 \ + 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 \ + C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C \ + 108F52B48DB57BB0CC439B2997B01419BD92F80A \ + A363A499291CBBC940DD62E41F10027AF002F8B0 \ + ; do \ + { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \ + { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \ + done \ + && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION.tar.xz" \ + && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \ + && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \ + && gpgconf --kill all \ + && rm -rf "$GNUPGHOME" \ + && grep " node-v$NODE_VERSION.tar.xz\$" SHASUMS256.txt | sha256sum -c - \ + && tar -xf "node-v$NODE_VERSION.tar.xz" \ + && cd "node-v$NODE_VERSION" \ + && ./configure \ + && make -j$(getconf _NPROCESSORS_ONLN) V= \ + && make install \ + && apk del .build-deps-full \ + && cd .. \ + && rm -Rf "node-v$NODE_VERSION" \ + && rm "node-v$NODE_VERSION.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt; \ + fi \ + && rm -f "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" \ + # Remove unused OpenSSL headers to save ~34MB. See this NodeJS issue: https://github.com/nodejs/node/issues/46451 + && find /usr/local/include/node/openssl/archs -mindepth 1 -maxdepth 1 ! -name "$OPENSSL_ARCH" -exec rm -rf {} \; \ + && apk del .build-deps \ + # smoke tests + && node --version \ + && npm --version \ + && rm -rf /tmp/* + +ENV YARN_VERSION=1.22.22 + +RUN apk add --no-cache --virtual .build-deps-yarn curl gnupg tar \ + # use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150 + && export GNUPGHOME="$(mktemp -d)" \ + && for key in \ + 6A010C5166006599AA17F08146C2130DFD2497F5 \ + ; do \ + { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \ + { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \ + done \ + && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \ + && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" \ + && gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \ + && gpgconf --kill all \ + && rm -rf "$GNUPGHOME" \ + && mkdir -p /opt \ + && tar -xzf yarn-v$YARN_VERSION.tar.gz -C /opt/ \ + && ln -s /opt/yarn-v$YARN_VERSION/bin/yarn /usr/local/bin/yarn \ + && ln -s /opt/yarn-v$YARN_VERSION/bin/yarnpkg /usr/local/bin/yarnpkg \ + && rm yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \ + && apk del .build-deps-yarn \ + # smoke test + && yarn --version \ + && rm -rf /tmp/* + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +CMD [ "node" ] diff --git a/sources/node22220/alpine/docker-entrypoint.sh b/sources/node22220/alpine/docker-entrypoint.sh new file mode 100755 index 0000000..1b3116e --- /dev/null +++ b/sources/node22220/alpine/docker-entrypoint.sh @@ -0,0 +1,11 @@ +#!/bin/sh +set -e + +# Run command with node if the first argument contains a "-" or is not a system command. The last +# part inside the "{}" is a workaround for the following bug in ash/dash: +# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264 +if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then + set -- node "$@" +fi + +exec "$@" diff --git a/sources/node22220/trixie/Dockerfile b/sources/node22220/trixie/Dockerfile new file mode 100644 index 0000000..0da1da6 --- /dev/null +++ b/sources/node22220/trixie/Dockerfile @@ -0,0 +1,77 @@ +FROM buildpack-deps:trixie + +RUN groupadd --gid 1000 node \ + && useradd --uid 1000 --gid node --shell /bin/bash --create-home node + +ENV NODE_VERSION=22.22.0 + +RUN ARCH= && dpkgArch="$(dpkg --print-architecture)" \ + && case "${dpkgArch##*-}" in \ + amd64) ARCH='x64';; \ + ppc64el) ARCH='ppc64le';; \ + s390x) ARCH='s390x';; \ + arm64) ARCH='arm64';; \ + armhf) ARCH='armv7l';; \ + i386) ARCH='x86';; \ + *) echo "unsupported architecture"; exit 1 ;; \ + esac \ + # use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150 + && export GNUPGHOME="$(mktemp -d)" \ + # gpg keys listed at https://github.com/nodejs/node#release-keys + && set -ex \ + && for key in \ + 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356 \ + DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 \ + CC68F5A3106FF448322E48ED27F5E38D5B0A215F \ + 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 \ + 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 \ + C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C \ + 108F52B48DB57BB0CC439B2997B01419BD92F80A \ + A363A499291CBBC940DD62E41F10027AF002F8B0 \ + ; do \ + { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \ + { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \ + done \ + && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH.tar.xz" \ + && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \ + && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \ + && gpgconf --kill all \ + && rm -rf "$GNUPGHOME" \ + && grep " node-v$NODE_VERSION-linux-$ARCH.tar.xz\$" SHASUMS256.txt | sha256sum -c - \ + && tar -xJf "node-v$NODE_VERSION-linux-$ARCH.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \ + && rm "node-v$NODE_VERSION-linux-$ARCH.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt \ + && ln -s /usr/local/bin/node /usr/local/bin/nodejs \ + # smoke tests + && node --version \ + && npm --version \ + && rm -rf /tmp/* + +ENV YARN_VERSION=1.22.22 + +RUN set -ex \ + # use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150 + && export GNUPGHOME="$(mktemp -d)" \ + && for key in \ + 6A010C5166006599AA17F08146C2130DFD2497F5 \ + ; do \ + { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \ + { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \ + done \ + && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \ + && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" \ + && gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \ + && gpgconf --kill all \ + && rm -rf "$GNUPGHOME" \ + && mkdir -p /opt \ + && tar -xzf yarn-v$YARN_VERSION.tar.gz -C /opt/ \ + && ln -s /opt/yarn-v$YARN_VERSION/bin/yarn /usr/local/bin/yarn \ + && ln -s /opt/yarn-v$YARN_VERSION/bin/yarnpkg /usr/local/bin/yarnpkg \ + && rm yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \ + # smoke test + && yarn --version \ + && rm -rf /tmp/* + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +CMD [ "node" ] diff --git a/sources/node22220/trixie/docker-entrypoint.sh b/sources/node22220/trixie/docker-entrypoint.sh new file mode 100755 index 0000000..1b3116e --- /dev/null +++ b/sources/node22220/trixie/docker-entrypoint.sh @@ -0,0 +1,11 @@ +#!/bin/sh +set -e + +# Run command with node if the first argument contains a "-" or is not a system command. The last +# part inside the "{}" is a workaround for the following bug in ash/dash: +# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874264 +if [ "${1#-}" != "${1}" ] || [ -z "$(command -v "${1}")" ] || { [ -f "${1}" ] && ! [ -x "${1}" ]; }; then + set -- node "$@" +fi + +exec "$@" diff --git a/sources/percona8040/Dockerfile b/sources/percona8040/Dockerfile new file mode 100644 index 0000000..c295b44 --- /dev/null +++ b/sources/percona8040/Dockerfile @@ -0,0 +1,138 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +ENV PS_VERSION 8.0.40-31.1 +ENV MYSQL_SHELL_VERSION 8.0.40-1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.0.40-31-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV CALL_HOME_VERSION 0.1 +# Do not report during Docker image creation. +# Note that doing so, would create telemetry config file +# which would prevent reporting when new container is started. +# If we want to track Docker image creation as well, +# remove telemetry config file after installing packages! +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + percona-release disable all; \ + percona-release enable ps-80 ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/j/jemalloc-5.2.1-2.el9.x86_64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/g/gflags-2.2.2-9.el9.x86_64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + #microdnf -y install epel-release; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8040/Dockerfile-dockerhub b/sources/percona8040/Dockerfile-dockerhub new file mode 100644 index 0000000..e6a1805 --- /dev/null +++ b/sources/percona8040/Dockerfile-dockerhub @@ -0,0 +1,126 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +ENV PS_VERSION 8.0.39-30.1 +ENV MYSQL_SHELL_VERSION 8.0.38-1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.0.39-30-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV CALL_HOME_VERSION 0.1 +# Do not report during Docker image creation. +# Note that doing so, would create telemetry config file +# which would prevent reporting when new container is started. +# If we want to track Docker image creation as well, +# remove telemetry config file after installing packages! +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + percona-release disable all; \ + percona-release enable ps-80 ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/j/jemalloc-5.2.1-2.el9.x86_64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/g/gflags-2.2.2-9.el9.x86_64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + #microdnf -y install epel-release; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry-dockerhub.sh /docker-entrypoint.sh +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8040/Dockerfile.aarch64 b/sources/percona8040/Dockerfile.aarch64 new file mode 100644 index 0000000..7815ab6 --- /dev/null +++ b/sources/percona8040/Dockerfile.aarch64 @@ -0,0 +1,135 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +ENV PS_VERSION 8.0.40-31.1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.0.40-31-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV CALL_HOME_VERSION 0.1 + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +# Do not report during Docker image creation. +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + #yum -y install epel-release; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + sed -i "s|x86_64|x86_64 aarch64|" /usr/bin/percona-release; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + #microdnf -y module disable mysql; \ + percona-release disable all; \ + percona-release enable ps-80 ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + rm -rf /tmp/percona-*; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/j/jemalloc-5.2.1-2.el9.aarch64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/g/gflags-2.2.2-9.el9.aarch64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-telemetry-agent; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ + +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8040/Dockerfile.ubi8 b/sources/percona8040/Dockerfile.ubi8 new file mode 100644 index 0000000..39c405a --- /dev/null +++ b/sources/percona8040/Dockerfile.ubi8 @@ -0,0 +1,105 @@ +# This is temporary placeholder for UBI8-based Docker image for PS-8.0 +FROM redhat/ubi8-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +RUN set -ex; \ + # shadow-utils are needed for user/group manipulation on UBI-based images + microdnf -y update; \ + microdnf -y install glibc-langpack-en \ + nss_wrapper \ + shadow-utils; \ + microdnf clean all; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +# Do not report during Docker image creation. +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + microdnf -y install findutils; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + #microdnf -y module disable mysql; \ + percona-release disable all; \ + percona-release enable ps-80 release; \ + percona-release enable mysql-shell release; \ + curl -Lf -o /tmp/numactl-libs.rpm https://rpmfind.net/linux/centos/8-stream/BaseOS/x86_64/os/Packages/numactl-libs-2.0.16-3.el8.x86_64.rpm; \ + rpmkeys --checksig /tmp/numactl-libs.rpm; \ + rpm -i /tmp/numactl-libs.rpm; \ + rm -rf /tmp/numactl-libs.rpm + +ENV PS_VERSION 8.0.35-27.1 +ENV MYSQL_SHELL_VERSION 8.0.35-1 +ENV OS_VER el8 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV CALL_HOME_VERSION 0.1 + +RUN set -ex; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + policycoreutils; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nskip-host-cache\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}-openshift" + +COPY ps-entry.sh /docker-entrypoint.sh +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8040/README-build.md b/sources/percona8040/README-build.md new file mode 100644 index 0000000..fe6c366 --- /dev/null +++ b/sources/percona8040/README-build.md @@ -0,0 +1,40 @@ +Build image + + `docker build -t percona-server Dockerfile` + +or + + `docker build -t percona-server Dockerfile` + +Tag image + + `docker tag percona/percona-server:8.0` + +Push to hub + + `docker push percona/percona-server:8.0` + +Usage +===== + + vi ./docker-compose.yml + percona: + image: percona/percona-server:latest + name: perconaserver + environment: + MYSQL_ROOT_PASSWORD: secret + ports: + - "3306" + volumes: + # create volumes for use + - /var/log/mysql + - /var/lib/mysql + # bind mount my local my.cnf + # - $PWD/my.cnf:/etc/my.cnf + command: + # Workaround for no my.cnf in image + - '--user=mysql' + 7) Start the container from cli + docker-compose up + 8) Check status + docker-compose ps diff --git a/sources/percona8040/README.md b/sources/percona8040/README.md new file mode 100644 index 0000000..be73183 --- /dev/null +++ b/sources/percona8040/README.md @@ -0,0 +1,158 @@ +![logo](https://www.percona.com/wp-content/uploads/2023/03/font-1.jpg) + +# What is Percona Server? + +Percona Server is an enhanced drop-in replacement for MySQL. With Percona Server, your queries will run faster and more consistently. You will consolidate servers on powerful hardware and will delay sharding, or avoid it entirely. + +For more information and related downloads for Percona Server and other Percona products, please visit http://www.percona.com. + +# Percona Server Docker Images + +These are the only official Percona Server Docker images, created and maintained by the Percona team. The image has the Percona Fractal Tree based storage engine `TokuDB` enabled. The available versions are: + + Percona Server 8.0.15-6.1 (tag: 8.0) + +Images are updated when new releases are published. + +# How to Use the Images + +## Start a Percona Server Instance + +Start a Percona Server container as follows: + + docker run --name container-name -e MYSQL_ROOT_PASSWORD=secret -d percona/percona-server:tag + +Where `container-name` is the name you want to assign to your container, `secret` is the password to be set for the root user and `tag` is the tag specifying the version you want. See the list above for relevant tags, or look at the [full list of tags](https://registry.hub.docker.com/u/percona/percona-server/tags/manage/). + +## Connect to Percona Server from an Application in Another Docker Container + +This image exposes the standard MySQL port (3306), so container linking makes the instance available to other containers. Start other containers like this in order to link it to the Percona Server container: + + docker run --name app-container-name --link container-name -d app-that-uses-mysql + +## Connect to Percona Server from the MySQL Command Line Client + +The following command starts another container instance and runs the `mysql` command line client against your original container, allowing you to execute SQL statements against your database: + + docker run -it --link container-name --rm percona/percona-server:tag mysql -h container-name -P 3306 -uroot -psecret' + +where `container-name` is the name of your database container. + +# Environment Variables + +When you start a Percona Server container, you can adjust the configuration of the instance by passing one or more environment variables on the `docker run` command line. Do note that none of the variables below will have any effect if you start the container with a data directory that already contains a database: any pre-existing database will always be left untouched on container startup. + +Most of the variables listed below are optional, but one of the variables `MYSQL_ROOT_PASSWORD`, `MYSQL_ALLOW_EMPTY_PASSWORD`, `MYSQL_RANDOM_ROOT_PASSWORD` must be given. + +## `MYSQL_ROOT_PASSWORD` + +This variable specifies a password that will be set for the root superuser account. In the above example, it was set to `secret`. **NOTE:** Setting the MySQL root user password on the command line is insecure. + +## `MYSQL_ROOT_PASSWORD_FILE` + +This variable specifies a file that will be read for the root user account. This can be a mounted file when you run your container. This can also be used in the scope of the Docker Secrets (Swarm mode) functionality. + +## `MYSQL_RANDOM_ROOT_PASSWORD` + +When this variable is set to `yes`, a random password for the server's root user will be generated. The password will be printed to stdout in the container, and it can be obtained by using the command `docker logs container-name`. + +## `MYSQL_ONETIME_PASSWORD` + +This variable is optional. When set to `yes`, the root user's password will be set as expired, and must be changed before we can login normally. This is only supported by version 5.6 or newer. + +## `MYSQL_DATABASE` + +This variable is optional. It allows you to specify the name of a database to be created on image startup. If a user/password was supplied (see below) then that user will be granted superuser access (corresponding to GRANT ALL) to this database. + +## `MYSQL_USER`, `MYSQL_PASSWORD` + +These variables are optional, used in conjunction to create a new user and set that user's password. This user will be granted superuser permissions (see above) for the database specified by the `MYSQL_DATABASE` variable. Both variables are required for a user to be created. + +Do note that there is no need to use this mechanism to create the `root` superuser, that user gets created by default with the password set by either of the mechanisms (given or generated) discussed above. + +## `MYSQL_ALLOW_EMPTY_PASSWORD` + +Set to `yes` to allow the container to be started with a blank password for the root user. **NOTE:** Setting this variable to `yes` is not recommended unless you really know what you are doing, since this will leave your instance completely unprotected, allowing anyone to gain complete superuser access. + +## `INIT_TOKUDB` + +Set to `1` to allow the container to be started with enabled TOKUDB engine. + +## `INIT_ROCKSDB` + +Set to `1` to allow the container to be started with enabled ROCKSDB engine. + +## `MYSQL_INIT_ONLY` + +Set to `1` will skip starting the `mysqld` process and will run only the initialization part if MySQL was not initialized before. + +# Notes, Tips, Gotchas + +## Secure Container Startup + +In many use cases, employing the `MYSQL_ROOT_PASSWORD` variable to specify the MySQL root user password on initial container startup is insecure. Instead, to keep your setup as secure as possible, we strongly recommend using the `MYSQL_RANDOM_ROOT_PASSWORD` option. To further secure your instance, we also recommend using the `MYSQL_ONETIME_PASSWORD` variable if you use version 5.6 or higher. + +## Where to Store Data + +There are many two ways to store data used by applications that run in Docker containers. We maintain our usual stance and encourage users to investigate the options and use the method that best suits their use case. Here are some of the options available: + +* Let Docker manage the storage of your database data by writing the database files to disk on the host system using its own internal volume management. The current solutions, devicemapper, aufs and overlayfs have negative performance records. +* Create a data directory on the host system (outside the container on high performance storage) and mount this to a directory visible from inside the container. This places the database files in a known location on the host system, and makes it easy for tools and applications on the host system to access the files. The user needs to make sure that the directory exists, and that permissions and other security mechanisms on the host system are set up correctly. + +The Docker documentation is a good starting point for understanding the different storage options and variations, and there are multiple blog and forum postings that discuss and give advice in this area. We will simply show the basic procedure here for the latter option above: + +1. Create a data directory on a suitable volume on your host system, e.g. `/local/datadir`. +2. Start your container like this: + +``` + docker run --name container-name -v /local/datadir:/var/lib/mysql -e MYSQL_ROOT_PASSWORD=secret -d percona/percona-server:tag +``` + +The `-v /local/datadir:/var/lib/mysql` part of the command mounts the `/local/datadir` directory from the underlying host system as `/var/lib/mysql` inside the container, where MySQL by default will write its data files. + +Note that users on systems with SELinux enabled may experience problems with this. The current workaround is to assign the relevant SELinux policy type to the new data directory so that the container will be allowed to access it: + + chcon -Rt svirt_sandbox_file_t /local/datadir + +## Existing Data + +If you start your MySQL container instance with a data directory that already contains a data (specifically, a `mysql` subdirectory where all our system tables live), the `$MYSQL_ROOT_PASSWORD` variable should be omitted from the `docker run` command. + +## Port forwarding + +Docker allows mapping of ports on the container to ports on the host system by using the -p option. If you start the container as follows, you can connect to the database by connecting your client to a port on the host machine. This can greatly simplfy consolidating many instances to a single host. In this example port 6603, the we use the address of the Docker host to connect to the TCP port the Docker deamon is forwarding from: + + docker run --name container-name `-p 6603:3306` -d percona/percona-server + mysql -h docker_host_ip -P 6603 + +## Passing options to the server + +You can pass arbitrary command line options to the MySQL server by appending them to the `run command`: + + docker run --name my-container-name -d percona/percona-server --option1=value --option2=value + +In this case, the values of option1 and option2 will be passed directly to the server when it is started. The following command will for instance start your container with UTF-8 as the default setting for character set and collation for all databases in MySQL: + + docker run --name container-name -d percona/percona-server --character-set-server=utf8 --collation-server=utf8_general_ci + +## Using a Custom Percona Server Config File + +The Percona Server startup configuration in these Docker images is specified in the file `/etc/my.cnf`. If you want to customize this configuration for your own purposes, you can create your alternative configuration file in a directory on the host machine and then mount this file in the appropriate location inside the Percona Server container, effectively replacing the standard configuration file. + +If you want to base your changes on the standard configuration file, start your Percona Server container in the standard way described above, then do: + + docker exec -it my-container-name cat /etc/my.cnf > /my/custom/config-file + +... where `/my/custom/config-file` is the path and name of the new configuration file. Then start a new Percona Server container like this: + + docker run --name my-new-container-name -v /my/custom/config-file:/etc/my.cnf -e MYSQL_ROOT_PASSWORD=my-secret-pw -d percona/percona-server:tag + +This will start a new Percona Server container `my-new-container-name` where the Percona Server instance uses the startup options specified in `/my/custom/config-file`. + +# Supported Docker Versions + +These images are officially supported by the MySQL team on Docker version 1.9. Support for older versions (down to 1.0) is provided on a best-effort basis, but we strongly recommend running on the most recent version, since that is assumed for parts of the documentation above. + +# User Feedback + +We welcome your feedback! diff --git a/sources/percona8040/docker-compose.yml b/sources/percona8040/docker-compose.yml new file mode 100644 index 0000000..fed5e73 --- /dev/null +++ b/sources/percona8040/docker-compose.yml @@ -0,0 +1,33 @@ +version: '2' +services: + percona-server: + image: percona/percona-server:8.0 + environment: + MYSQL_ROOT_PASSWORD: secret + ports: + - "3306" + volumes: + # create volumes for use + - /var/lib/mysql + # bind mount my local my.cnf + # - $PWD/my.cnf:/etc/my.cnf.d/my.cnf + +# uncomment sections below if you want to enable PMM +# pmm-server: +# image: percona/pmm-server:latest +# ports: +# - "443:443" +# environment: +# - SERVER_USER=pmm +# - SERVER_PASSWORD=pmm +# pmm-client-ps: +# image: perconalab/pmm-client:latest +# environment: +# - PMM_SERVER=pmm-server:443 +# - PMM_USER=pmm +# - PMM_PASSWORD=pmm +# - DB_TYPE=mysql +# - DB_HOST=percona-server +# - DB_PORT=3306 +# - DB_USER=root +# - DB_PASSWORD=secret diff --git a/sources/percona8040/ps-entry-dockerhub.sh b/sources/percona8040/ps-entry-dockerhub.sh new file mode 100755 index 0000000..9f08ef1 --- /dev/null +++ b/sources/percona8040/ps-entry-dockerhub.sh @@ -0,0 +1,250 @@ +#!/bin/bash +set -eo pipefail +shopt -s nullglob +# if command starts with an option, prepend mysqld +if [ "${1:0:1}" = '-' ]; then + set -- mysqld "$@" +fi +# skip setup if they want an option that stops mysqld +wantHelp= +for arg; do + case "$arg" in + -'?'|--help|--print-defaults|-V|--version) + wantHelp=1 + break + ;; + esac +done + +# usage: file_env VAR [DEFAULT] +# ie: file_env 'XYZ_DB_PASSWORD' 'example' +# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of +# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature) +file_env() { + local var="$1" + local fileVar="${var}_FILE" + local def="${2:-}" + if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then + echo >&2 "error: both $var and $fileVar are set (but are exclusive)" + exit 1 + fi + local val="$def" + if [ "${!var:-}" ]; then + val="${!var}" + elif [ "${!fileVar:-}" ]; then + val="$(< "${!fileVar}")" + fi + export "$var"="$val" + unset "$fileVar" +} + +# usage: process_init_file FILENAME MYSQLCOMMAND... +# ie: process_init_file foo.sh mysql -uroot +# (process a single initializer file, based on its extension. we define this +# function here, so that initializer scripts (*.sh) can use the same logic, +# potentially recursively, or override the logic used in subsequent calls) +process_init_file() { + local f="$1"; shift + local mysql=( "$@" ) + + case "$f" in + *.sh) echo "$0: running $f"; . "$f" ;; + *.sql) echo "$0: running $f"; "${mysql[@]}" < "$f"; echo ;; + *.sql.gz) echo "$0: running $f"; gunzip -c "$f" | "${mysql[@]}"; echo ;; + *) echo "$0: ignoring $f" ;; + esac + echo +} + +_check_config() { + toRun=( "$@" --verbose --help ) + if ! errors="$("${toRun[@]}" 2>&1 >/dev/null)"; then + cat >&2 <<-EOM + + ERROR: mysqld failed while attempting to check config + command was: "${toRun[*]}" + + $errors + EOM + exit 1 + fi +} + +# Fetch value from server config +# We use mysqld --verbose --help instead of my_print_defaults because the +# latter only show values present in config files, and not server defaults +_get_config() { + local conf="$1"; shift + "$@" --verbose --help --log-bin-index="$(mktemp -u)" 2>/dev/null \ + | awk '$1 == "'"$conf"'" && /^[^ \t]/ { sub(/^[^ \t]+[ \t]+/, ""); print; exit }' + # match "datadir /some/path with/spaces in/it here" but not "--xyz=abc\n datadir (xyz)" +} + +if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then + # still need to check config, container may have started with --user + _check_config "$@" + + if [ -n "$INIT_TOKUDB" ]; then + export LD_PRELOAD=/usr/lib64/libjemalloc.so.1 + fi + # Get config + DATADIR="$(_get_config 'datadir' "$@")" + + if [ ! -d "$DATADIR/mysql" ]; then + file_env 'MYSQL_ROOT_PASSWORD' + if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + echo >&2 'error: database is uninitialized and password option is not specified ' + echo >&2 ' You need to specify one of MYSQL_ROOT_PASSWORD, MYSQL_ALLOW_EMPTY_PASSWORD and MYSQL_RANDOM_ROOT_PASSWORD' + exit 1 + fi + + mkdir -p "$DATADIR" + + echo 'Initializing database' + "$@" --initialize-insecure + echo 'Database initialized' + + if command -v mysql_ssl_rsa_setup > /dev/null && [ ! -e "$DATADIR/server-key.pem" ]; then + # https://github.com/mysql/mysql-server/blob/23032807537d8dd8ee4ec1c4d40f0633cd4e12f9/packaging/deb-in/extra/mysql-systemd-start#L81-L84 + echo 'Initializing certificates' + mysql_ssl_rsa_setup --datadir="$DATADIR" + echo 'Certificates initialized' + fi + + SOCKET="$(_get_config 'socket' "$@")" + "$@" --skip-networking --socket="${SOCKET}" & + pid="$!" + + mysql=( mysql --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" --password="" ) + + for i in {120..0}; do + if echo 'SELECT 1' | "${mysql[@]}" &> /dev/null; then + break + fi + echo 'MySQL init process in progress...' + sleep 1 + done + if [ "$i" = 0 ]; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + if [ -z "$MYSQL_INITDB_SKIP_TZINFO" ]; then + ( + echo "SET @@SESSION.SQL_LOG_BIN = off;" + # sed is for https://bugs.mysql.com/bug.php?id=20545 + mysql_tzinfo_to_sql /usr/share/zoneinfo | sed 's/Local time zone must be set--see zic manual page/FCTY/' + ) | "${mysql[@]}" mysql + fi + + # install TokuDB engine + if [ -n "$INIT_TOKUDB" ]; then + ps-admin --docker --enable-tokudb -u root -p $MYSQL_ROOT_PASSWORD + fi + if [ -n "$INIT_ROCKSDB" ]; then + ps-admin --enable-rocksdb -u root -p $MYSQL_ROOT_PASSWORD + fi + + if [ ! -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + MYSQL_ROOT_PASSWORD="$(pwmake 128)" + echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD" + fi + + rootCreate= + # default root to listen for connections from anywhere + file_env 'MYSQL_ROOT_HOST' '%' + if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then + # no, we don't care if read finds a terminating character in this heredoc + # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151 + read -r -d '' rootCreate <<-EOSQL || true + CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ; + EOSQL + fi + + "${mysql[@]}" <<-EOSQL + -- What's done in this file shouldn't be replicated + -- or products like mysql-fabric won't work + SET @@SESSION.SQL_LOG_BIN=0; + + DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'mysql.infoschema', 'mysql.session', 'root') OR host NOT IN ('localhost') ; + ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ; + ${rootCreate} + DROP DATABASE IF EXISTS test ; + FLUSH PRIVILEGES ; + EOSQL + + if [ ! -z "$MYSQL_ROOT_PASSWORD" ]; then + mysql+=( -p"${MYSQL_ROOT_PASSWORD}" ) + fi + + file_env 'MYSQL_DATABASE' + if [ "$MYSQL_DATABASE" ]; then + echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" | "${mysql[@]}" + mysql+=( "$MYSQL_DATABASE" ) + fi + + file_env 'MYSQL_USER' + file_env 'MYSQL_PASSWORD' + if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then + echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" | "${mysql[@]}" + + if [ "$MYSQL_DATABASE" ]; then + echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}" + fi + + echo 'FLUSH PRIVILEGES ;' | "${mysql[@]}" + fi + + echo + ls /docker-entrypoint-initdb.d/ > /dev/null + for f in /docker-entrypoint-initdb.d/*; do + process_init_file "$f" "${mysql[@]}" + done + + if [ ! -z "$MYSQL_ONETIME_PASSWORD" ]; then + "${mysql[@]}" <<-EOSQL + ALTER USER 'root'@'%' PASSWORD EXPIRE; + EOSQL + fi + if ! kill -s TERM "$pid" || ! wait "$pid"; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + echo + echo 'MySQL init process done. Ready for start up.' + echo + fi + + # exit when MYSQL_INIT_ONLY environment variable is set to avoid starting mysqld + if [ ! -z "$MYSQL_INIT_ONLY" ]; then + echo 'Initialization complete, now exiting!' + exit 0 + fi +fi + +if [ ! -z "${PERCONA_INSTANCE_ID}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -i ${PERCONA_INSTANCE_ID}" +fi + +if [ ! -z "${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -j ${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" +fi + +if [ ! -z "${PERCONA_SEND_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -t ${PERCONA_SEND_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -t 7" +fi + +if [ ! -z "${PERCONA_CONNECT_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -c ${PERCONA_CONNECT_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -c 2" +fi + +/call-home.sh -f "PRODUCT_FAMILY_PS" -v "${PS_TELEMETRY_VERSION}" -d "DOCKER" ${CALL_HOME_OPTIONAL_PARAMS} &> /dev/null || : + +exec "$@" diff --git a/sources/percona8040/ps-entry.sh b/sources/percona8040/ps-entry.sh new file mode 100755 index 0000000..a7fe81b --- /dev/null +++ b/sources/percona8040/ps-entry.sh @@ -0,0 +1,253 @@ +#!/bin/bash +set -eo pipefail +shopt -s nullglob +# if command starts with an option, prepend mysqld +if [ "${1:0:1}" = '-' ]; then + set -- mysqld "$@" +fi +# skip setup if they want an option that stops mysqld +wantHelp= +for arg; do + case "$arg" in + -'?'|--help|--print-defaults|-V|--version) + wantHelp=1 + break + ;; + esac +done + +# usage: file_env VAR [DEFAULT] +# ie: file_env 'XYZ_DB_PASSWORD' 'example' +# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of +# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature) +file_env() { + local var="$1" + local fileVar="${var}_FILE" + local def="${2:-}" + if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then + echo >&2 "error: both $var and $fileVar are set (but are exclusive)" + exit 1 + fi + local val="$def" + if [ "${!var:-}" ]; then + val="${!var}" + elif [ "${!fileVar:-}" ]; then + val="$(< "${!fileVar}")" + fi + export "$var"="$val" + unset "$fileVar" +} + +# usage: process_init_file FILENAME MYSQLCOMMAND... +# ie: process_init_file foo.sh mysql -uroot +# (process a single initializer file, based on its extension. we define this +# function here, so that initializer scripts (*.sh) can use the same logic, +# potentially recursively, or override the logic used in subsequent calls) +process_init_file() { + local f="$1"; shift + local mysql=( "$@" ) + + case "$f" in + *.sh) echo "$0: running $f"; . "$f" ;; + *.sql) echo "$0: running $f"; "${mysql[@]}" < "$f"; echo ;; + *.sql.gz) echo "$0: running $f"; gunzip -c "$f" | "${mysql[@]}"; echo ;; + *) echo "$0: ignoring $f" ;; + esac + echo +} + +_check_config() { + toRun=( "$@" --verbose --help ) + if ! errors="$("${toRun[@]}" 2>&1 >/dev/null)"; then + cat >&2 <<-EOM + + ERROR: mysqld failed while attempting to check config + command was: "${toRun[*]}" + + $errors + EOM + exit 1 + fi +} + +# Fetch value from server config +# We use mysqld --verbose --help instead of my_print_defaults because the +# latter only show values present in config files, and not server defaults +_get_config() { + local conf="$1"; shift + "$@" --verbose --help --log-bin-index="$(mktemp -u)" 2>/dev/null \ + | awk '$1 == "'"$conf"'" && /^[^ \t]/ { sub(/^[^ \t]+[ \t]+/, ""); print; exit }' + # match "datadir /some/path with/spaces in/it here" but not "--xyz=abc\n datadir (xyz)" +} + +if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then + # still need to check config, container may have started with --user + _check_config "$@" + + if [ -n "$INIT_TOKUDB" ]; then + export LD_PRELOAD=/usr/lib64/libjemalloc.so.1 + fi + # Get config + DATADIR="$(_get_config 'datadir' "$@")" + + if [ ! -d "$DATADIR/mysql" ]; then + file_env 'MYSQL_ROOT_PASSWORD' + if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + echo >&2 'error: database is uninitialized and password option is not specified ' + echo >&2 ' You need to specify one of MYSQL_ROOT_PASSWORD, MYSQL_ALLOW_EMPTY_PASSWORD and MYSQL_RANDOM_ROOT_PASSWORD' + exit 1 + fi + + mkdir -p "$DATADIR" + + echo 'Initializing database' + "$@" --initialize-insecure + echo 'Database initialized' + + if command -v mysql_ssl_rsa_setup > /dev/null && [ ! -e "$DATADIR/server-key.pem" ]; then + # https://github.com/mysql/mysql-server/blob/23032807537d8dd8ee4ec1c4d40f0633cd4e12f9/packaging/deb-in/extra/mysql-systemd-start#L81-L84 + echo 'Initializing certificates' + mysql_ssl_rsa_setup --datadir="$DATADIR" + echo 'Certificates initialized' + fi + + SOCKET="$(_get_config 'socket' "$@")" + "$@" --skip-networking --socket="${SOCKET}" & + pid="$!" + + mysql=( mysql --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" --password="" ) + + for i in {120..0}; do + if echo 'SELECT 1' | "${mysql[@]}" &> /dev/null; then + break + fi + echo 'MySQL init process in progress...' + sleep 1 + done + if [ "$i" = 0 ]; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + if [ -z "$MYSQL_INITDB_SKIP_TZINFO" ]; then + ( + echo "SET @@SESSION.SQL_LOG_BIN = off;" + # sed is for https://bugs.mysql.com/bug.php?id=20545 + mysql_tzinfo_to_sql /usr/share/zoneinfo | sed 's/Local time zone must be set--see zic manual page/FCTY/' + ) | "${mysql[@]}" mysql + fi + + # install TokuDB engine + if [ -n "$INIT_TOKUDB" ]; then + ps-admin --docker --enable-tokudb -u root -p $MYSQL_ROOT_PASSWORD + fi + if [ -n "$INIT_ROCKSDB" ]; then + ps-admin --enable-rocksdb -u root -p $MYSQL_ROOT_PASSWORD + fi + + if [ ! -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + MYSQL_ROOT_PASSWORD="$(pwmake 128)" + echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD" + fi + + rootCreate= + # default root to listen for connections from anywhere + file_env 'MYSQL_ROOT_HOST' '%' + if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then + # no, we don't care if read finds a terminating character in this heredoc + # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151 + read -r -d '' rootCreate <<-EOSQL || true + CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ; + EOSQL + fi + + "${mysql[@]}" <<-EOSQL + -- What's done in this file shouldn't be replicated + -- or products like mysql-fabric won't work + SET @@SESSION.SQL_LOG_BIN=0; + + DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'mysql.infoschema', 'mysql.session', 'root') OR host NOT IN ('localhost') ; + ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ; + ${rootCreate} + DROP DATABASE IF EXISTS test ; + FLUSH PRIVILEGES ; + EOSQL + + if [ ! -z "$MYSQL_ROOT_PASSWORD" ]; then + mysql+=( -p"${MYSQL_ROOT_PASSWORD}" ) + fi + + file_env 'MYSQL_DATABASE' + if [ "$MYSQL_DATABASE" ]; then + echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" | "${mysql[@]}" + mysql+=( "$MYSQL_DATABASE" ) + fi + + file_env 'MYSQL_USER' + file_env 'MYSQL_PASSWORD' + if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then + echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" | "${mysql[@]}" + + if [ "$MYSQL_DATABASE" ]; then + echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}" + fi + + echo 'FLUSH PRIVILEGES ;' | "${mysql[@]}" + fi + + echo + ls /docker-entrypoint-initdb.d/ > /dev/null + for f in /docker-entrypoint-initdb.d/*; do + process_init_file "$f" "${mysql[@]}" + done + + if [ ! -z "$MYSQL_ONETIME_PASSWORD" ]; then + "${mysql[@]}" <<-EOSQL + ALTER USER 'root'@'%' PASSWORD EXPIRE; + EOSQL + fi + if ! kill -s TERM "$pid" || ! wait "$pid"; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + echo + echo 'MySQL init process done. Ready for start up.' + echo + fi + + # exit when MYSQL_INIT_ONLY environment variable is set to avoid starting mysqld + if [ ! -z "$MYSQL_INIT_ONLY" ]; then + echo 'Initialization complete, now exiting!' + exit 0 + fi +fi + +if [ ! -z "${PERCONA_INSTANCE_ID}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -i ${PERCONA_INSTANCE_ID}" +fi + +if [ ! -z "${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -j ${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" +fi + +if [ ! -z "${PERCONA_SEND_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -t ${PERCONA_SEND_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -t 7" +fi + +if [ ! -z "${PERCONA_CONNECT_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -c ${PERCONA_CONNECT_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -c 2" +fi + +if [[ ${PERCONA_TELEMETRY_DISABLE} -ne "0" ]]; then + exec "$@" --percona_telemetry_disable=1 +else + /usr/bin/telemetry-agent-supervisor.sh & + exec "$@" +fi diff --git a/sources/percona8040/telemetry-agent-supervisor.sh b/sources/percona8040/telemetry-agent-supervisor.sh new file mode 100755 index 0000000..6ad026e --- /dev/null +++ b/sources/percona8040/telemetry-agent-supervisor.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +# phase-0 telemetry +/call-home.sh -f "PRODUCT_FAMILY_PS" -v "${PS_TELEMETRY_VERSION}" -d "DOCKER" ${CALL_HOME_OPTIONAL_PARAMS} &> /dev/null || : + +# phase-1 telemetry +for i in {1..3}; do + /usr/bin/percona-telemetry-agent >> /var/log/percona/telemetry-agent.log 2>> /var/log/percona/telemetry-agent-error.log + if [ $? -eq 0 ]; then + break + fi + sleep 5 +done +sleep infinity diff --git a/sources/percona8041/Dockerfile b/sources/percona8041/Dockerfile new file mode 100644 index 0000000..451ed9d --- /dev/null +++ b/sources/percona8041/Dockerfile @@ -0,0 +1,140 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +ENV PS_VERSION 8.0.41-32.1 +ENV MYSQL_SHELL_VERSION 8.0.40-1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO release +ENV PS_TELEMETRY_VERSION 8.0.41-32-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 +# Do not report during Docker image creation. +# Note that doing so, would create telemetry config file +# which would prevent reporting when new container is started. +# If we want to track Docker image creation as well, +# remove telemetry config file after installing packages! +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + percona-release disable all; \ + percona-release enable ps-80 ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/j/jemalloc-5.2.1-2.el9.x86_64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/g/gflags-2.2.2-9.el9.x86_64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + #microdnf -y install epel-release; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8041/Dockerfile-dockerhub b/sources/percona8041/Dockerfile-dockerhub new file mode 100644 index 0000000..e833701 --- /dev/null +++ b/sources/percona8041/Dockerfile-dockerhub @@ -0,0 +1,128 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +ENV PS_VERSION 8.0.41-32.1 +ENV MYSQL_SHELL_VERSION 8.0.41-1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO release +ENV PS_TELEMETRY_VERSION 8.0.41-32-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 +# Do not report during Docker image creation. +# Note that doing so, would create telemetry config file +# which would prevent reporting when new container is started. +# If we want to track Docker image creation as well, +# remove telemetry config file after installing packages! +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + percona-release disable all; \ + percona-release enable ps-80 ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/j/jemalloc-5.2.1-2.el9.x86_64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/g/gflags-2.2.2-9.el9.x86_64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + #microdnf -y install epel-release; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry-dockerhub.sh /docker-entrypoint.sh +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8041/Dockerfile.aarch64 b/sources/percona8041/Dockerfile.aarch64 new file mode 100644 index 0000000..78e5bdd --- /dev/null +++ b/sources/percona8041/Dockerfile.aarch64 @@ -0,0 +1,137 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +ENV PS_VERSION 8.0.41-32.1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV PS_REPO release +ENV PS_TELEMETRY_VERSION 8.0.41-32-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +# Do not report during Docker image creation. +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + #yum -y install epel-release; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + sed -i "s|x86_64|x86_64 aarch64|" /usr/bin/percona-release; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + #microdnf -y module disable mysql; \ + percona-release disable all; \ + percona-release enable ps-80 ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + rm -rf /tmp/percona-*; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/j/jemalloc-5.2.1-2.el9.aarch64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/g/gflags-2.2.2-9.el9.aarch64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-telemetry-agent; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ + +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8041/Dockerfile.ubi8 b/sources/percona8041/Dockerfile.ubi8 new file mode 100644 index 0000000..39c405a --- /dev/null +++ b/sources/percona8041/Dockerfile.ubi8 @@ -0,0 +1,105 @@ +# This is temporary placeholder for UBI8-based Docker image for PS-8.0 +FROM redhat/ubi8-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +RUN set -ex; \ + # shadow-utils are needed for user/group manipulation on UBI-based images + microdnf -y update; \ + microdnf -y install glibc-langpack-en \ + nss_wrapper \ + shadow-utils; \ + microdnf clean all; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +# Do not report during Docker image creation. +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + microdnf -y install findutils; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + #microdnf -y module disable mysql; \ + percona-release disable all; \ + percona-release enable ps-80 release; \ + percona-release enable mysql-shell release; \ + curl -Lf -o /tmp/numactl-libs.rpm https://rpmfind.net/linux/centos/8-stream/BaseOS/x86_64/os/Packages/numactl-libs-2.0.16-3.el8.x86_64.rpm; \ + rpmkeys --checksig /tmp/numactl-libs.rpm; \ + rpm -i /tmp/numactl-libs.rpm; \ + rm -rf /tmp/numactl-libs.rpm + +ENV PS_VERSION 8.0.35-27.1 +ENV MYSQL_SHELL_VERSION 8.0.35-1 +ENV OS_VER el8 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV CALL_HOME_VERSION 0.1 + +RUN set -ex; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + policycoreutils; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nskip-host-cache\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}-openshift" + +COPY ps-entry.sh /docker-entrypoint.sh +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8041/README-build.md b/sources/percona8041/README-build.md new file mode 100644 index 0000000..fe6c366 --- /dev/null +++ b/sources/percona8041/README-build.md @@ -0,0 +1,40 @@ +Build image + + `docker build -t percona-server Dockerfile` + +or + + `docker build -t percona-server Dockerfile` + +Tag image + + `docker tag percona/percona-server:8.0` + +Push to hub + + `docker push percona/percona-server:8.0` + +Usage +===== + + vi ./docker-compose.yml + percona: + image: percona/percona-server:latest + name: perconaserver + environment: + MYSQL_ROOT_PASSWORD: secret + ports: + - "3306" + volumes: + # create volumes for use + - /var/log/mysql + - /var/lib/mysql + # bind mount my local my.cnf + # - $PWD/my.cnf:/etc/my.cnf + command: + # Workaround for no my.cnf in image + - '--user=mysql' + 7) Start the container from cli + docker-compose up + 8) Check status + docker-compose ps diff --git a/sources/percona8041/README.md b/sources/percona8041/README.md new file mode 100644 index 0000000..be73183 --- /dev/null +++ b/sources/percona8041/README.md @@ -0,0 +1,158 @@ +![logo](https://www.percona.com/wp-content/uploads/2023/03/font-1.jpg) + +# What is Percona Server? + +Percona Server is an enhanced drop-in replacement for MySQL. With Percona Server, your queries will run faster and more consistently. You will consolidate servers on powerful hardware and will delay sharding, or avoid it entirely. + +For more information and related downloads for Percona Server and other Percona products, please visit http://www.percona.com. + +# Percona Server Docker Images + +These are the only official Percona Server Docker images, created and maintained by the Percona team. The image has the Percona Fractal Tree based storage engine `TokuDB` enabled. The available versions are: + + Percona Server 8.0.15-6.1 (tag: 8.0) + +Images are updated when new releases are published. + +# How to Use the Images + +## Start a Percona Server Instance + +Start a Percona Server container as follows: + + docker run --name container-name -e MYSQL_ROOT_PASSWORD=secret -d percona/percona-server:tag + +Where `container-name` is the name you want to assign to your container, `secret` is the password to be set for the root user and `tag` is the tag specifying the version you want. See the list above for relevant tags, or look at the [full list of tags](https://registry.hub.docker.com/u/percona/percona-server/tags/manage/). + +## Connect to Percona Server from an Application in Another Docker Container + +This image exposes the standard MySQL port (3306), so container linking makes the instance available to other containers. Start other containers like this in order to link it to the Percona Server container: + + docker run --name app-container-name --link container-name -d app-that-uses-mysql + +## Connect to Percona Server from the MySQL Command Line Client + +The following command starts another container instance and runs the `mysql` command line client against your original container, allowing you to execute SQL statements against your database: + + docker run -it --link container-name --rm percona/percona-server:tag mysql -h container-name -P 3306 -uroot -psecret' + +where `container-name` is the name of your database container. + +# Environment Variables + +When you start a Percona Server container, you can adjust the configuration of the instance by passing one or more environment variables on the `docker run` command line. Do note that none of the variables below will have any effect if you start the container with a data directory that already contains a database: any pre-existing database will always be left untouched on container startup. + +Most of the variables listed below are optional, but one of the variables `MYSQL_ROOT_PASSWORD`, `MYSQL_ALLOW_EMPTY_PASSWORD`, `MYSQL_RANDOM_ROOT_PASSWORD` must be given. + +## `MYSQL_ROOT_PASSWORD` + +This variable specifies a password that will be set for the root superuser account. In the above example, it was set to `secret`. **NOTE:** Setting the MySQL root user password on the command line is insecure. + +## `MYSQL_ROOT_PASSWORD_FILE` + +This variable specifies a file that will be read for the root user account. This can be a mounted file when you run your container. This can also be used in the scope of the Docker Secrets (Swarm mode) functionality. + +## `MYSQL_RANDOM_ROOT_PASSWORD` + +When this variable is set to `yes`, a random password for the server's root user will be generated. The password will be printed to stdout in the container, and it can be obtained by using the command `docker logs container-name`. + +## `MYSQL_ONETIME_PASSWORD` + +This variable is optional. When set to `yes`, the root user's password will be set as expired, and must be changed before we can login normally. This is only supported by version 5.6 or newer. + +## `MYSQL_DATABASE` + +This variable is optional. It allows you to specify the name of a database to be created on image startup. If a user/password was supplied (see below) then that user will be granted superuser access (corresponding to GRANT ALL) to this database. + +## `MYSQL_USER`, `MYSQL_PASSWORD` + +These variables are optional, used in conjunction to create a new user and set that user's password. This user will be granted superuser permissions (see above) for the database specified by the `MYSQL_DATABASE` variable. Both variables are required for a user to be created. + +Do note that there is no need to use this mechanism to create the `root` superuser, that user gets created by default with the password set by either of the mechanisms (given or generated) discussed above. + +## `MYSQL_ALLOW_EMPTY_PASSWORD` + +Set to `yes` to allow the container to be started with a blank password for the root user. **NOTE:** Setting this variable to `yes` is not recommended unless you really know what you are doing, since this will leave your instance completely unprotected, allowing anyone to gain complete superuser access. + +## `INIT_TOKUDB` + +Set to `1` to allow the container to be started with enabled TOKUDB engine. + +## `INIT_ROCKSDB` + +Set to `1` to allow the container to be started with enabled ROCKSDB engine. + +## `MYSQL_INIT_ONLY` + +Set to `1` will skip starting the `mysqld` process and will run only the initialization part if MySQL was not initialized before. + +# Notes, Tips, Gotchas + +## Secure Container Startup + +In many use cases, employing the `MYSQL_ROOT_PASSWORD` variable to specify the MySQL root user password on initial container startup is insecure. Instead, to keep your setup as secure as possible, we strongly recommend using the `MYSQL_RANDOM_ROOT_PASSWORD` option. To further secure your instance, we also recommend using the `MYSQL_ONETIME_PASSWORD` variable if you use version 5.6 or higher. + +## Where to Store Data + +There are many two ways to store data used by applications that run in Docker containers. We maintain our usual stance and encourage users to investigate the options and use the method that best suits their use case. Here are some of the options available: + +* Let Docker manage the storage of your database data by writing the database files to disk on the host system using its own internal volume management. The current solutions, devicemapper, aufs and overlayfs have negative performance records. +* Create a data directory on the host system (outside the container on high performance storage) and mount this to a directory visible from inside the container. This places the database files in a known location on the host system, and makes it easy for tools and applications on the host system to access the files. The user needs to make sure that the directory exists, and that permissions and other security mechanisms on the host system are set up correctly. + +The Docker documentation is a good starting point for understanding the different storage options and variations, and there are multiple blog and forum postings that discuss and give advice in this area. We will simply show the basic procedure here for the latter option above: + +1. Create a data directory on a suitable volume on your host system, e.g. `/local/datadir`. +2. Start your container like this: + +``` + docker run --name container-name -v /local/datadir:/var/lib/mysql -e MYSQL_ROOT_PASSWORD=secret -d percona/percona-server:tag +``` + +The `-v /local/datadir:/var/lib/mysql` part of the command mounts the `/local/datadir` directory from the underlying host system as `/var/lib/mysql` inside the container, where MySQL by default will write its data files. + +Note that users on systems with SELinux enabled may experience problems with this. The current workaround is to assign the relevant SELinux policy type to the new data directory so that the container will be allowed to access it: + + chcon -Rt svirt_sandbox_file_t /local/datadir + +## Existing Data + +If you start your MySQL container instance with a data directory that already contains a data (specifically, a `mysql` subdirectory where all our system tables live), the `$MYSQL_ROOT_PASSWORD` variable should be omitted from the `docker run` command. + +## Port forwarding + +Docker allows mapping of ports on the container to ports on the host system by using the -p option. If you start the container as follows, you can connect to the database by connecting your client to a port on the host machine. This can greatly simplfy consolidating many instances to a single host. In this example port 6603, the we use the address of the Docker host to connect to the TCP port the Docker deamon is forwarding from: + + docker run --name container-name `-p 6603:3306` -d percona/percona-server + mysql -h docker_host_ip -P 6603 + +## Passing options to the server + +You can pass arbitrary command line options to the MySQL server by appending them to the `run command`: + + docker run --name my-container-name -d percona/percona-server --option1=value --option2=value + +In this case, the values of option1 and option2 will be passed directly to the server when it is started. The following command will for instance start your container with UTF-8 as the default setting for character set and collation for all databases in MySQL: + + docker run --name container-name -d percona/percona-server --character-set-server=utf8 --collation-server=utf8_general_ci + +## Using a Custom Percona Server Config File + +The Percona Server startup configuration in these Docker images is specified in the file `/etc/my.cnf`. If you want to customize this configuration for your own purposes, you can create your alternative configuration file in a directory on the host machine and then mount this file in the appropriate location inside the Percona Server container, effectively replacing the standard configuration file. + +If you want to base your changes on the standard configuration file, start your Percona Server container in the standard way described above, then do: + + docker exec -it my-container-name cat /etc/my.cnf > /my/custom/config-file + +... where `/my/custom/config-file` is the path and name of the new configuration file. Then start a new Percona Server container like this: + + docker run --name my-new-container-name -v /my/custom/config-file:/etc/my.cnf -e MYSQL_ROOT_PASSWORD=my-secret-pw -d percona/percona-server:tag + +This will start a new Percona Server container `my-new-container-name` where the Percona Server instance uses the startup options specified in `/my/custom/config-file`. + +# Supported Docker Versions + +These images are officially supported by the MySQL team on Docker version 1.9. Support for older versions (down to 1.0) is provided on a best-effort basis, but we strongly recommend running on the most recent version, since that is assumed for parts of the documentation above. + +# User Feedback + +We welcome your feedback! diff --git a/sources/percona8041/docker-compose.yml b/sources/percona8041/docker-compose.yml new file mode 100644 index 0000000..fed5e73 --- /dev/null +++ b/sources/percona8041/docker-compose.yml @@ -0,0 +1,33 @@ +version: '2' +services: + percona-server: + image: percona/percona-server:8.0 + environment: + MYSQL_ROOT_PASSWORD: secret + ports: + - "3306" + volumes: + # create volumes for use + - /var/lib/mysql + # bind mount my local my.cnf + # - $PWD/my.cnf:/etc/my.cnf.d/my.cnf + +# uncomment sections below if you want to enable PMM +# pmm-server: +# image: percona/pmm-server:latest +# ports: +# - "443:443" +# environment: +# - SERVER_USER=pmm +# - SERVER_PASSWORD=pmm +# pmm-client-ps: +# image: perconalab/pmm-client:latest +# environment: +# - PMM_SERVER=pmm-server:443 +# - PMM_USER=pmm +# - PMM_PASSWORD=pmm +# - DB_TYPE=mysql +# - DB_HOST=percona-server +# - DB_PORT=3306 +# - DB_USER=root +# - DB_PASSWORD=secret diff --git a/sources/percona8041/ps-entry-dockerhub.sh b/sources/percona8041/ps-entry-dockerhub.sh new file mode 100755 index 0000000..9f08ef1 --- /dev/null +++ b/sources/percona8041/ps-entry-dockerhub.sh @@ -0,0 +1,250 @@ +#!/bin/bash +set -eo pipefail +shopt -s nullglob +# if command starts with an option, prepend mysqld +if [ "${1:0:1}" = '-' ]; then + set -- mysqld "$@" +fi +# skip setup if they want an option that stops mysqld +wantHelp= +for arg; do + case "$arg" in + -'?'|--help|--print-defaults|-V|--version) + wantHelp=1 + break + ;; + esac +done + +# usage: file_env VAR [DEFAULT] +# ie: file_env 'XYZ_DB_PASSWORD' 'example' +# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of +# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature) +file_env() { + local var="$1" + local fileVar="${var}_FILE" + local def="${2:-}" + if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then + echo >&2 "error: both $var and $fileVar are set (but are exclusive)" + exit 1 + fi + local val="$def" + if [ "${!var:-}" ]; then + val="${!var}" + elif [ "${!fileVar:-}" ]; then + val="$(< "${!fileVar}")" + fi + export "$var"="$val" + unset "$fileVar" +} + +# usage: process_init_file FILENAME MYSQLCOMMAND... +# ie: process_init_file foo.sh mysql -uroot +# (process a single initializer file, based on its extension. we define this +# function here, so that initializer scripts (*.sh) can use the same logic, +# potentially recursively, or override the logic used in subsequent calls) +process_init_file() { + local f="$1"; shift + local mysql=( "$@" ) + + case "$f" in + *.sh) echo "$0: running $f"; . "$f" ;; + *.sql) echo "$0: running $f"; "${mysql[@]}" < "$f"; echo ;; + *.sql.gz) echo "$0: running $f"; gunzip -c "$f" | "${mysql[@]}"; echo ;; + *) echo "$0: ignoring $f" ;; + esac + echo +} + +_check_config() { + toRun=( "$@" --verbose --help ) + if ! errors="$("${toRun[@]}" 2>&1 >/dev/null)"; then + cat >&2 <<-EOM + + ERROR: mysqld failed while attempting to check config + command was: "${toRun[*]}" + + $errors + EOM + exit 1 + fi +} + +# Fetch value from server config +# We use mysqld --verbose --help instead of my_print_defaults because the +# latter only show values present in config files, and not server defaults +_get_config() { + local conf="$1"; shift + "$@" --verbose --help --log-bin-index="$(mktemp -u)" 2>/dev/null \ + | awk '$1 == "'"$conf"'" && /^[^ \t]/ { sub(/^[^ \t]+[ \t]+/, ""); print; exit }' + # match "datadir /some/path with/spaces in/it here" but not "--xyz=abc\n datadir (xyz)" +} + +if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then + # still need to check config, container may have started with --user + _check_config "$@" + + if [ -n "$INIT_TOKUDB" ]; then + export LD_PRELOAD=/usr/lib64/libjemalloc.so.1 + fi + # Get config + DATADIR="$(_get_config 'datadir' "$@")" + + if [ ! -d "$DATADIR/mysql" ]; then + file_env 'MYSQL_ROOT_PASSWORD' + if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + echo >&2 'error: database is uninitialized and password option is not specified ' + echo >&2 ' You need to specify one of MYSQL_ROOT_PASSWORD, MYSQL_ALLOW_EMPTY_PASSWORD and MYSQL_RANDOM_ROOT_PASSWORD' + exit 1 + fi + + mkdir -p "$DATADIR" + + echo 'Initializing database' + "$@" --initialize-insecure + echo 'Database initialized' + + if command -v mysql_ssl_rsa_setup > /dev/null && [ ! -e "$DATADIR/server-key.pem" ]; then + # https://github.com/mysql/mysql-server/blob/23032807537d8dd8ee4ec1c4d40f0633cd4e12f9/packaging/deb-in/extra/mysql-systemd-start#L81-L84 + echo 'Initializing certificates' + mysql_ssl_rsa_setup --datadir="$DATADIR" + echo 'Certificates initialized' + fi + + SOCKET="$(_get_config 'socket' "$@")" + "$@" --skip-networking --socket="${SOCKET}" & + pid="$!" + + mysql=( mysql --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" --password="" ) + + for i in {120..0}; do + if echo 'SELECT 1' | "${mysql[@]}" &> /dev/null; then + break + fi + echo 'MySQL init process in progress...' + sleep 1 + done + if [ "$i" = 0 ]; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + if [ -z "$MYSQL_INITDB_SKIP_TZINFO" ]; then + ( + echo "SET @@SESSION.SQL_LOG_BIN = off;" + # sed is for https://bugs.mysql.com/bug.php?id=20545 + mysql_tzinfo_to_sql /usr/share/zoneinfo | sed 's/Local time zone must be set--see zic manual page/FCTY/' + ) | "${mysql[@]}" mysql + fi + + # install TokuDB engine + if [ -n "$INIT_TOKUDB" ]; then + ps-admin --docker --enable-tokudb -u root -p $MYSQL_ROOT_PASSWORD + fi + if [ -n "$INIT_ROCKSDB" ]; then + ps-admin --enable-rocksdb -u root -p $MYSQL_ROOT_PASSWORD + fi + + if [ ! -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + MYSQL_ROOT_PASSWORD="$(pwmake 128)" + echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD" + fi + + rootCreate= + # default root to listen for connections from anywhere + file_env 'MYSQL_ROOT_HOST' '%' + if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then + # no, we don't care if read finds a terminating character in this heredoc + # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151 + read -r -d '' rootCreate <<-EOSQL || true + CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ; + EOSQL + fi + + "${mysql[@]}" <<-EOSQL + -- What's done in this file shouldn't be replicated + -- or products like mysql-fabric won't work + SET @@SESSION.SQL_LOG_BIN=0; + + DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'mysql.infoschema', 'mysql.session', 'root') OR host NOT IN ('localhost') ; + ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ; + ${rootCreate} + DROP DATABASE IF EXISTS test ; + FLUSH PRIVILEGES ; + EOSQL + + if [ ! -z "$MYSQL_ROOT_PASSWORD" ]; then + mysql+=( -p"${MYSQL_ROOT_PASSWORD}" ) + fi + + file_env 'MYSQL_DATABASE' + if [ "$MYSQL_DATABASE" ]; then + echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" | "${mysql[@]}" + mysql+=( "$MYSQL_DATABASE" ) + fi + + file_env 'MYSQL_USER' + file_env 'MYSQL_PASSWORD' + if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then + echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" | "${mysql[@]}" + + if [ "$MYSQL_DATABASE" ]; then + echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}" + fi + + echo 'FLUSH PRIVILEGES ;' | "${mysql[@]}" + fi + + echo + ls /docker-entrypoint-initdb.d/ > /dev/null + for f in /docker-entrypoint-initdb.d/*; do + process_init_file "$f" "${mysql[@]}" + done + + if [ ! -z "$MYSQL_ONETIME_PASSWORD" ]; then + "${mysql[@]}" <<-EOSQL + ALTER USER 'root'@'%' PASSWORD EXPIRE; + EOSQL + fi + if ! kill -s TERM "$pid" || ! wait "$pid"; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + echo + echo 'MySQL init process done. Ready for start up.' + echo + fi + + # exit when MYSQL_INIT_ONLY environment variable is set to avoid starting mysqld + if [ ! -z "$MYSQL_INIT_ONLY" ]; then + echo 'Initialization complete, now exiting!' + exit 0 + fi +fi + +if [ ! -z "${PERCONA_INSTANCE_ID}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -i ${PERCONA_INSTANCE_ID}" +fi + +if [ ! -z "${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -j ${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" +fi + +if [ ! -z "${PERCONA_SEND_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -t ${PERCONA_SEND_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -t 7" +fi + +if [ ! -z "${PERCONA_CONNECT_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -c ${PERCONA_CONNECT_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -c 2" +fi + +/call-home.sh -f "PRODUCT_FAMILY_PS" -v "${PS_TELEMETRY_VERSION}" -d "DOCKER" ${CALL_HOME_OPTIONAL_PARAMS} &> /dev/null || : + +exec "$@" diff --git a/sources/percona8041/ps-entry.sh b/sources/percona8041/ps-entry.sh new file mode 100755 index 0000000..a7fe81b --- /dev/null +++ b/sources/percona8041/ps-entry.sh @@ -0,0 +1,253 @@ +#!/bin/bash +set -eo pipefail +shopt -s nullglob +# if command starts with an option, prepend mysqld +if [ "${1:0:1}" = '-' ]; then + set -- mysqld "$@" +fi +# skip setup if they want an option that stops mysqld +wantHelp= +for arg; do + case "$arg" in + -'?'|--help|--print-defaults|-V|--version) + wantHelp=1 + break + ;; + esac +done + +# usage: file_env VAR [DEFAULT] +# ie: file_env 'XYZ_DB_PASSWORD' 'example' +# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of +# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature) +file_env() { + local var="$1" + local fileVar="${var}_FILE" + local def="${2:-}" + if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then + echo >&2 "error: both $var and $fileVar are set (but are exclusive)" + exit 1 + fi + local val="$def" + if [ "${!var:-}" ]; then + val="${!var}" + elif [ "${!fileVar:-}" ]; then + val="$(< "${!fileVar}")" + fi + export "$var"="$val" + unset "$fileVar" +} + +# usage: process_init_file FILENAME MYSQLCOMMAND... +# ie: process_init_file foo.sh mysql -uroot +# (process a single initializer file, based on its extension. we define this +# function here, so that initializer scripts (*.sh) can use the same logic, +# potentially recursively, or override the logic used in subsequent calls) +process_init_file() { + local f="$1"; shift + local mysql=( "$@" ) + + case "$f" in + *.sh) echo "$0: running $f"; . "$f" ;; + *.sql) echo "$0: running $f"; "${mysql[@]}" < "$f"; echo ;; + *.sql.gz) echo "$0: running $f"; gunzip -c "$f" | "${mysql[@]}"; echo ;; + *) echo "$0: ignoring $f" ;; + esac + echo +} + +_check_config() { + toRun=( "$@" --verbose --help ) + if ! errors="$("${toRun[@]}" 2>&1 >/dev/null)"; then + cat >&2 <<-EOM + + ERROR: mysqld failed while attempting to check config + command was: "${toRun[*]}" + + $errors + EOM + exit 1 + fi +} + +# Fetch value from server config +# We use mysqld --verbose --help instead of my_print_defaults because the +# latter only show values present in config files, and not server defaults +_get_config() { + local conf="$1"; shift + "$@" --verbose --help --log-bin-index="$(mktemp -u)" 2>/dev/null \ + | awk '$1 == "'"$conf"'" && /^[^ \t]/ { sub(/^[^ \t]+[ \t]+/, ""); print; exit }' + # match "datadir /some/path with/spaces in/it here" but not "--xyz=abc\n datadir (xyz)" +} + +if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then + # still need to check config, container may have started with --user + _check_config "$@" + + if [ -n "$INIT_TOKUDB" ]; then + export LD_PRELOAD=/usr/lib64/libjemalloc.so.1 + fi + # Get config + DATADIR="$(_get_config 'datadir' "$@")" + + if [ ! -d "$DATADIR/mysql" ]; then + file_env 'MYSQL_ROOT_PASSWORD' + if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + echo >&2 'error: database is uninitialized and password option is not specified ' + echo >&2 ' You need to specify one of MYSQL_ROOT_PASSWORD, MYSQL_ALLOW_EMPTY_PASSWORD and MYSQL_RANDOM_ROOT_PASSWORD' + exit 1 + fi + + mkdir -p "$DATADIR" + + echo 'Initializing database' + "$@" --initialize-insecure + echo 'Database initialized' + + if command -v mysql_ssl_rsa_setup > /dev/null && [ ! -e "$DATADIR/server-key.pem" ]; then + # https://github.com/mysql/mysql-server/blob/23032807537d8dd8ee4ec1c4d40f0633cd4e12f9/packaging/deb-in/extra/mysql-systemd-start#L81-L84 + echo 'Initializing certificates' + mysql_ssl_rsa_setup --datadir="$DATADIR" + echo 'Certificates initialized' + fi + + SOCKET="$(_get_config 'socket' "$@")" + "$@" --skip-networking --socket="${SOCKET}" & + pid="$!" + + mysql=( mysql --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" --password="" ) + + for i in {120..0}; do + if echo 'SELECT 1' | "${mysql[@]}" &> /dev/null; then + break + fi + echo 'MySQL init process in progress...' + sleep 1 + done + if [ "$i" = 0 ]; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + if [ -z "$MYSQL_INITDB_SKIP_TZINFO" ]; then + ( + echo "SET @@SESSION.SQL_LOG_BIN = off;" + # sed is for https://bugs.mysql.com/bug.php?id=20545 + mysql_tzinfo_to_sql /usr/share/zoneinfo | sed 's/Local time zone must be set--see zic manual page/FCTY/' + ) | "${mysql[@]}" mysql + fi + + # install TokuDB engine + if [ -n "$INIT_TOKUDB" ]; then + ps-admin --docker --enable-tokudb -u root -p $MYSQL_ROOT_PASSWORD + fi + if [ -n "$INIT_ROCKSDB" ]; then + ps-admin --enable-rocksdb -u root -p $MYSQL_ROOT_PASSWORD + fi + + if [ ! -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + MYSQL_ROOT_PASSWORD="$(pwmake 128)" + echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD" + fi + + rootCreate= + # default root to listen for connections from anywhere + file_env 'MYSQL_ROOT_HOST' '%' + if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then + # no, we don't care if read finds a terminating character in this heredoc + # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151 + read -r -d '' rootCreate <<-EOSQL || true + CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ; + EOSQL + fi + + "${mysql[@]}" <<-EOSQL + -- What's done in this file shouldn't be replicated + -- or products like mysql-fabric won't work + SET @@SESSION.SQL_LOG_BIN=0; + + DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'mysql.infoschema', 'mysql.session', 'root') OR host NOT IN ('localhost') ; + ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ; + ${rootCreate} + DROP DATABASE IF EXISTS test ; + FLUSH PRIVILEGES ; + EOSQL + + if [ ! -z "$MYSQL_ROOT_PASSWORD" ]; then + mysql+=( -p"${MYSQL_ROOT_PASSWORD}" ) + fi + + file_env 'MYSQL_DATABASE' + if [ "$MYSQL_DATABASE" ]; then + echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" | "${mysql[@]}" + mysql+=( "$MYSQL_DATABASE" ) + fi + + file_env 'MYSQL_USER' + file_env 'MYSQL_PASSWORD' + if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then + echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" | "${mysql[@]}" + + if [ "$MYSQL_DATABASE" ]; then + echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}" + fi + + echo 'FLUSH PRIVILEGES ;' | "${mysql[@]}" + fi + + echo + ls /docker-entrypoint-initdb.d/ > /dev/null + for f in /docker-entrypoint-initdb.d/*; do + process_init_file "$f" "${mysql[@]}" + done + + if [ ! -z "$MYSQL_ONETIME_PASSWORD" ]; then + "${mysql[@]}" <<-EOSQL + ALTER USER 'root'@'%' PASSWORD EXPIRE; + EOSQL + fi + if ! kill -s TERM "$pid" || ! wait "$pid"; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + echo + echo 'MySQL init process done. Ready for start up.' + echo + fi + + # exit when MYSQL_INIT_ONLY environment variable is set to avoid starting mysqld + if [ ! -z "$MYSQL_INIT_ONLY" ]; then + echo 'Initialization complete, now exiting!' + exit 0 + fi +fi + +if [ ! -z "${PERCONA_INSTANCE_ID}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -i ${PERCONA_INSTANCE_ID}" +fi + +if [ ! -z "${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -j ${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" +fi + +if [ ! -z "${PERCONA_SEND_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -t ${PERCONA_SEND_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -t 7" +fi + +if [ ! -z "${PERCONA_CONNECT_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -c ${PERCONA_CONNECT_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -c 2" +fi + +if [[ ${PERCONA_TELEMETRY_DISABLE} -ne "0" ]]; then + exec "$@" --percona_telemetry_disable=1 +else + /usr/bin/telemetry-agent-supervisor.sh & + exec "$@" +fi diff --git a/sources/percona8041/telemetry-agent-supervisor.sh b/sources/percona8041/telemetry-agent-supervisor.sh new file mode 100755 index 0000000..6ad026e --- /dev/null +++ b/sources/percona8041/telemetry-agent-supervisor.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +# phase-0 telemetry +/call-home.sh -f "PRODUCT_FAMILY_PS" -v "${PS_TELEMETRY_VERSION}" -d "DOCKER" ${CALL_HOME_OPTIONAL_PARAMS} &> /dev/null || : + +# phase-1 telemetry +for i in {1..3}; do + /usr/bin/percona-telemetry-agent >> /var/log/percona/telemetry-agent.log 2>> /var/log/percona/telemetry-agent-error.log + if [ $? -eq 0 ]; then + break + fi + sleep 5 +done +sleep infinity diff --git a/sources/percona8042/Dockerfile b/sources/percona8042/Dockerfile new file mode 100644 index 0000000..8de9477 --- /dev/null +++ b/sources/percona8042/Dockerfile @@ -0,0 +1,140 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +ENV PS_VERSION 8.0.42-33.1 +ENV MYSQL_SHELL_VERSION 8.0.42-1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.0.42-33-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 +# Do not report during Docker image creation. +# Note that doing so, would create telemetry config file +# which would prevent reporting when new container is started. +# If we want to track Docker image creation as well, +# remove telemetry config file after installing packages! +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + percona-release disable all; \ + percona-release enable ps-80 ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/j/jemalloc-5.2.1-2.el9.x86_64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/g/gflags-2.2.2-9.el9.x86_64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + #microdnf -y install epel-release; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8042/Dockerfile-dockerhub b/sources/percona8042/Dockerfile-dockerhub new file mode 100644 index 0000000..d8c01b9 --- /dev/null +++ b/sources/percona8042/Dockerfile-dockerhub @@ -0,0 +1,128 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +ENV PS_VERSION 8.0.42-33.1 +ENV MYSQL_SHELL_VERSION 8.0.42-1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.0.42-33-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 +# Do not report during Docker image creation. +# Note that doing so, would create telemetry config file +# which would prevent reporting when new container is started. +# If we want to track Docker image creation as well, +# remove telemetry config file after installing packages! +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + percona-release disable all; \ + percona-release enable ps-80 ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/j/jemalloc-5.2.1-2.el9.x86_64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/g/gflags-2.2.2-9.el9.x86_64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + #microdnf -y install epel-release; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry-dockerhub.sh /docker-entrypoint.sh +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8042/Dockerfile.aarch64 b/sources/percona8042/Dockerfile.aarch64 new file mode 100644 index 0000000..cc21454 --- /dev/null +++ b/sources/percona8042/Dockerfile.aarch64 @@ -0,0 +1,137 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +ENV PS_VERSION 8.0.42-33.1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.0.42-33-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +# Do not report during Docker image creation. +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + #yum -y install epel-release; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + sed -i "s|x86_64|x86_64 aarch64|" /usr/bin/percona-release; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + #microdnf -y module disable mysql; \ + percona-release disable all; \ + percona-release enable ps-80 ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + rm -rf /tmp/percona-*; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/j/jemalloc-5.2.1-2.el9.aarch64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/g/gflags-2.2.2-9.el9.aarch64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-telemetry-agent; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ + +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8042/Dockerfile.ubi8 b/sources/percona8042/Dockerfile.ubi8 new file mode 100644 index 0000000..39c405a --- /dev/null +++ b/sources/percona8042/Dockerfile.ubi8 @@ -0,0 +1,105 @@ +# This is temporary placeholder for UBI8-based Docker image for PS-8.0 +FROM redhat/ubi8-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +RUN set -ex; \ + # shadow-utils are needed for user/group manipulation on UBI-based images + microdnf -y update; \ + microdnf -y install glibc-langpack-en \ + nss_wrapper \ + shadow-utils; \ + microdnf clean all; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +# Do not report during Docker image creation. +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + microdnf -y install findutils; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + #microdnf -y module disable mysql; \ + percona-release disable all; \ + percona-release enable ps-80 release; \ + percona-release enable mysql-shell release; \ + curl -Lf -o /tmp/numactl-libs.rpm https://rpmfind.net/linux/centos/8-stream/BaseOS/x86_64/os/Packages/numactl-libs-2.0.16-3.el8.x86_64.rpm; \ + rpmkeys --checksig /tmp/numactl-libs.rpm; \ + rpm -i /tmp/numactl-libs.rpm; \ + rm -rf /tmp/numactl-libs.rpm + +ENV PS_VERSION 8.0.35-27.1 +ENV MYSQL_SHELL_VERSION 8.0.35-1 +ENV OS_VER el8 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV CALL_HOME_VERSION 0.1 + +RUN set -ex; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + policycoreutils; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nskip-host-cache\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}-openshift" + +COPY ps-entry.sh /docker-entrypoint.sh +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8042/README-build.md b/sources/percona8042/README-build.md new file mode 100644 index 0000000..fe6c366 --- /dev/null +++ b/sources/percona8042/README-build.md @@ -0,0 +1,40 @@ +Build image + + `docker build -t percona-server Dockerfile` + +or + + `docker build -t percona-server Dockerfile` + +Tag image + + `docker tag percona/percona-server:8.0` + +Push to hub + + `docker push percona/percona-server:8.0` + +Usage +===== + + vi ./docker-compose.yml + percona: + image: percona/percona-server:latest + name: perconaserver + environment: + MYSQL_ROOT_PASSWORD: secret + ports: + - "3306" + volumes: + # create volumes for use + - /var/log/mysql + - /var/lib/mysql + # bind mount my local my.cnf + # - $PWD/my.cnf:/etc/my.cnf + command: + # Workaround for no my.cnf in image + - '--user=mysql' + 7) Start the container from cli + docker-compose up + 8) Check status + docker-compose ps diff --git a/sources/percona8042/README.md b/sources/percona8042/README.md new file mode 100644 index 0000000..be73183 --- /dev/null +++ b/sources/percona8042/README.md @@ -0,0 +1,158 @@ +![logo](https://www.percona.com/wp-content/uploads/2023/03/font-1.jpg) + +# What is Percona Server? + +Percona Server is an enhanced drop-in replacement for MySQL. With Percona Server, your queries will run faster and more consistently. You will consolidate servers on powerful hardware and will delay sharding, or avoid it entirely. + +For more information and related downloads for Percona Server and other Percona products, please visit http://www.percona.com. + +# Percona Server Docker Images + +These are the only official Percona Server Docker images, created and maintained by the Percona team. The image has the Percona Fractal Tree based storage engine `TokuDB` enabled. The available versions are: + + Percona Server 8.0.15-6.1 (tag: 8.0) + +Images are updated when new releases are published. + +# How to Use the Images + +## Start a Percona Server Instance + +Start a Percona Server container as follows: + + docker run --name container-name -e MYSQL_ROOT_PASSWORD=secret -d percona/percona-server:tag + +Where `container-name` is the name you want to assign to your container, `secret` is the password to be set for the root user and `tag` is the tag specifying the version you want. See the list above for relevant tags, or look at the [full list of tags](https://registry.hub.docker.com/u/percona/percona-server/tags/manage/). + +## Connect to Percona Server from an Application in Another Docker Container + +This image exposes the standard MySQL port (3306), so container linking makes the instance available to other containers. Start other containers like this in order to link it to the Percona Server container: + + docker run --name app-container-name --link container-name -d app-that-uses-mysql + +## Connect to Percona Server from the MySQL Command Line Client + +The following command starts another container instance and runs the `mysql` command line client against your original container, allowing you to execute SQL statements against your database: + + docker run -it --link container-name --rm percona/percona-server:tag mysql -h container-name -P 3306 -uroot -psecret' + +where `container-name` is the name of your database container. + +# Environment Variables + +When you start a Percona Server container, you can adjust the configuration of the instance by passing one or more environment variables on the `docker run` command line. Do note that none of the variables below will have any effect if you start the container with a data directory that already contains a database: any pre-existing database will always be left untouched on container startup. + +Most of the variables listed below are optional, but one of the variables `MYSQL_ROOT_PASSWORD`, `MYSQL_ALLOW_EMPTY_PASSWORD`, `MYSQL_RANDOM_ROOT_PASSWORD` must be given. + +## `MYSQL_ROOT_PASSWORD` + +This variable specifies a password that will be set for the root superuser account. In the above example, it was set to `secret`. **NOTE:** Setting the MySQL root user password on the command line is insecure. + +## `MYSQL_ROOT_PASSWORD_FILE` + +This variable specifies a file that will be read for the root user account. This can be a mounted file when you run your container. This can also be used in the scope of the Docker Secrets (Swarm mode) functionality. + +## `MYSQL_RANDOM_ROOT_PASSWORD` + +When this variable is set to `yes`, a random password for the server's root user will be generated. The password will be printed to stdout in the container, and it can be obtained by using the command `docker logs container-name`. + +## `MYSQL_ONETIME_PASSWORD` + +This variable is optional. When set to `yes`, the root user's password will be set as expired, and must be changed before we can login normally. This is only supported by version 5.6 or newer. + +## `MYSQL_DATABASE` + +This variable is optional. It allows you to specify the name of a database to be created on image startup. If a user/password was supplied (see below) then that user will be granted superuser access (corresponding to GRANT ALL) to this database. + +## `MYSQL_USER`, `MYSQL_PASSWORD` + +These variables are optional, used in conjunction to create a new user and set that user's password. This user will be granted superuser permissions (see above) for the database specified by the `MYSQL_DATABASE` variable. Both variables are required for a user to be created. + +Do note that there is no need to use this mechanism to create the `root` superuser, that user gets created by default with the password set by either of the mechanisms (given or generated) discussed above. + +## `MYSQL_ALLOW_EMPTY_PASSWORD` + +Set to `yes` to allow the container to be started with a blank password for the root user. **NOTE:** Setting this variable to `yes` is not recommended unless you really know what you are doing, since this will leave your instance completely unprotected, allowing anyone to gain complete superuser access. + +## `INIT_TOKUDB` + +Set to `1` to allow the container to be started with enabled TOKUDB engine. + +## `INIT_ROCKSDB` + +Set to `1` to allow the container to be started with enabled ROCKSDB engine. + +## `MYSQL_INIT_ONLY` + +Set to `1` will skip starting the `mysqld` process and will run only the initialization part if MySQL was not initialized before. + +# Notes, Tips, Gotchas + +## Secure Container Startup + +In many use cases, employing the `MYSQL_ROOT_PASSWORD` variable to specify the MySQL root user password on initial container startup is insecure. Instead, to keep your setup as secure as possible, we strongly recommend using the `MYSQL_RANDOM_ROOT_PASSWORD` option. To further secure your instance, we also recommend using the `MYSQL_ONETIME_PASSWORD` variable if you use version 5.6 or higher. + +## Where to Store Data + +There are many two ways to store data used by applications that run in Docker containers. We maintain our usual stance and encourage users to investigate the options and use the method that best suits their use case. Here are some of the options available: + +* Let Docker manage the storage of your database data by writing the database files to disk on the host system using its own internal volume management. The current solutions, devicemapper, aufs and overlayfs have negative performance records. +* Create a data directory on the host system (outside the container on high performance storage) and mount this to a directory visible from inside the container. This places the database files in a known location on the host system, and makes it easy for tools and applications on the host system to access the files. The user needs to make sure that the directory exists, and that permissions and other security mechanisms on the host system are set up correctly. + +The Docker documentation is a good starting point for understanding the different storage options and variations, and there are multiple blog and forum postings that discuss and give advice in this area. We will simply show the basic procedure here for the latter option above: + +1. Create a data directory on a suitable volume on your host system, e.g. `/local/datadir`. +2. Start your container like this: + +``` + docker run --name container-name -v /local/datadir:/var/lib/mysql -e MYSQL_ROOT_PASSWORD=secret -d percona/percona-server:tag +``` + +The `-v /local/datadir:/var/lib/mysql` part of the command mounts the `/local/datadir` directory from the underlying host system as `/var/lib/mysql` inside the container, where MySQL by default will write its data files. + +Note that users on systems with SELinux enabled may experience problems with this. The current workaround is to assign the relevant SELinux policy type to the new data directory so that the container will be allowed to access it: + + chcon -Rt svirt_sandbox_file_t /local/datadir + +## Existing Data + +If you start your MySQL container instance with a data directory that already contains a data (specifically, a `mysql` subdirectory where all our system tables live), the `$MYSQL_ROOT_PASSWORD` variable should be omitted from the `docker run` command. + +## Port forwarding + +Docker allows mapping of ports on the container to ports on the host system by using the -p option. If you start the container as follows, you can connect to the database by connecting your client to a port on the host machine. This can greatly simplfy consolidating many instances to a single host. In this example port 6603, the we use the address of the Docker host to connect to the TCP port the Docker deamon is forwarding from: + + docker run --name container-name `-p 6603:3306` -d percona/percona-server + mysql -h docker_host_ip -P 6603 + +## Passing options to the server + +You can pass arbitrary command line options to the MySQL server by appending them to the `run command`: + + docker run --name my-container-name -d percona/percona-server --option1=value --option2=value + +In this case, the values of option1 and option2 will be passed directly to the server when it is started. The following command will for instance start your container with UTF-8 as the default setting for character set and collation for all databases in MySQL: + + docker run --name container-name -d percona/percona-server --character-set-server=utf8 --collation-server=utf8_general_ci + +## Using a Custom Percona Server Config File + +The Percona Server startup configuration in these Docker images is specified in the file `/etc/my.cnf`. If you want to customize this configuration for your own purposes, you can create your alternative configuration file in a directory on the host machine and then mount this file in the appropriate location inside the Percona Server container, effectively replacing the standard configuration file. + +If you want to base your changes on the standard configuration file, start your Percona Server container in the standard way described above, then do: + + docker exec -it my-container-name cat /etc/my.cnf > /my/custom/config-file + +... where `/my/custom/config-file` is the path and name of the new configuration file. Then start a new Percona Server container like this: + + docker run --name my-new-container-name -v /my/custom/config-file:/etc/my.cnf -e MYSQL_ROOT_PASSWORD=my-secret-pw -d percona/percona-server:tag + +This will start a new Percona Server container `my-new-container-name` where the Percona Server instance uses the startup options specified in `/my/custom/config-file`. + +# Supported Docker Versions + +These images are officially supported by the MySQL team on Docker version 1.9. Support for older versions (down to 1.0) is provided on a best-effort basis, but we strongly recommend running on the most recent version, since that is assumed for parts of the documentation above. + +# User Feedback + +We welcome your feedback! diff --git a/sources/percona8042/docker-compose.yml b/sources/percona8042/docker-compose.yml new file mode 100644 index 0000000..fed5e73 --- /dev/null +++ b/sources/percona8042/docker-compose.yml @@ -0,0 +1,33 @@ +version: '2' +services: + percona-server: + image: percona/percona-server:8.0 + environment: + MYSQL_ROOT_PASSWORD: secret + ports: + - "3306" + volumes: + # create volumes for use + - /var/lib/mysql + # bind mount my local my.cnf + # - $PWD/my.cnf:/etc/my.cnf.d/my.cnf + +# uncomment sections below if you want to enable PMM +# pmm-server: +# image: percona/pmm-server:latest +# ports: +# - "443:443" +# environment: +# - SERVER_USER=pmm +# - SERVER_PASSWORD=pmm +# pmm-client-ps: +# image: perconalab/pmm-client:latest +# environment: +# - PMM_SERVER=pmm-server:443 +# - PMM_USER=pmm +# - PMM_PASSWORD=pmm +# - DB_TYPE=mysql +# - DB_HOST=percona-server +# - DB_PORT=3306 +# - DB_USER=root +# - DB_PASSWORD=secret diff --git a/sources/percona8042/ps-entry-dockerhub.sh b/sources/percona8042/ps-entry-dockerhub.sh new file mode 100755 index 0000000..9f08ef1 --- /dev/null +++ b/sources/percona8042/ps-entry-dockerhub.sh @@ -0,0 +1,250 @@ +#!/bin/bash +set -eo pipefail +shopt -s nullglob +# if command starts with an option, prepend mysqld +if [ "${1:0:1}" = '-' ]; then + set -- mysqld "$@" +fi +# skip setup if they want an option that stops mysqld +wantHelp= +for arg; do + case "$arg" in + -'?'|--help|--print-defaults|-V|--version) + wantHelp=1 + break + ;; + esac +done + +# usage: file_env VAR [DEFAULT] +# ie: file_env 'XYZ_DB_PASSWORD' 'example' +# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of +# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature) +file_env() { + local var="$1" + local fileVar="${var}_FILE" + local def="${2:-}" + if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then + echo >&2 "error: both $var and $fileVar are set (but are exclusive)" + exit 1 + fi + local val="$def" + if [ "${!var:-}" ]; then + val="${!var}" + elif [ "${!fileVar:-}" ]; then + val="$(< "${!fileVar}")" + fi + export "$var"="$val" + unset "$fileVar" +} + +# usage: process_init_file FILENAME MYSQLCOMMAND... +# ie: process_init_file foo.sh mysql -uroot +# (process a single initializer file, based on its extension. we define this +# function here, so that initializer scripts (*.sh) can use the same logic, +# potentially recursively, or override the logic used in subsequent calls) +process_init_file() { + local f="$1"; shift + local mysql=( "$@" ) + + case "$f" in + *.sh) echo "$0: running $f"; . "$f" ;; + *.sql) echo "$0: running $f"; "${mysql[@]}" < "$f"; echo ;; + *.sql.gz) echo "$0: running $f"; gunzip -c "$f" | "${mysql[@]}"; echo ;; + *) echo "$0: ignoring $f" ;; + esac + echo +} + +_check_config() { + toRun=( "$@" --verbose --help ) + if ! errors="$("${toRun[@]}" 2>&1 >/dev/null)"; then + cat >&2 <<-EOM + + ERROR: mysqld failed while attempting to check config + command was: "${toRun[*]}" + + $errors + EOM + exit 1 + fi +} + +# Fetch value from server config +# We use mysqld --verbose --help instead of my_print_defaults because the +# latter only show values present in config files, and not server defaults +_get_config() { + local conf="$1"; shift + "$@" --verbose --help --log-bin-index="$(mktemp -u)" 2>/dev/null \ + | awk '$1 == "'"$conf"'" && /^[^ \t]/ { sub(/^[^ \t]+[ \t]+/, ""); print; exit }' + # match "datadir /some/path with/spaces in/it here" but not "--xyz=abc\n datadir (xyz)" +} + +if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then + # still need to check config, container may have started with --user + _check_config "$@" + + if [ -n "$INIT_TOKUDB" ]; then + export LD_PRELOAD=/usr/lib64/libjemalloc.so.1 + fi + # Get config + DATADIR="$(_get_config 'datadir' "$@")" + + if [ ! -d "$DATADIR/mysql" ]; then + file_env 'MYSQL_ROOT_PASSWORD' + if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + echo >&2 'error: database is uninitialized and password option is not specified ' + echo >&2 ' You need to specify one of MYSQL_ROOT_PASSWORD, MYSQL_ALLOW_EMPTY_PASSWORD and MYSQL_RANDOM_ROOT_PASSWORD' + exit 1 + fi + + mkdir -p "$DATADIR" + + echo 'Initializing database' + "$@" --initialize-insecure + echo 'Database initialized' + + if command -v mysql_ssl_rsa_setup > /dev/null && [ ! -e "$DATADIR/server-key.pem" ]; then + # https://github.com/mysql/mysql-server/blob/23032807537d8dd8ee4ec1c4d40f0633cd4e12f9/packaging/deb-in/extra/mysql-systemd-start#L81-L84 + echo 'Initializing certificates' + mysql_ssl_rsa_setup --datadir="$DATADIR" + echo 'Certificates initialized' + fi + + SOCKET="$(_get_config 'socket' "$@")" + "$@" --skip-networking --socket="${SOCKET}" & + pid="$!" + + mysql=( mysql --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" --password="" ) + + for i in {120..0}; do + if echo 'SELECT 1' | "${mysql[@]}" &> /dev/null; then + break + fi + echo 'MySQL init process in progress...' + sleep 1 + done + if [ "$i" = 0 ]; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + if [ -z "$MYSQL_INITDB_SKIP_TZINFO" ]; then + ( + echo "SET @@SESSION.SQL_LOG_BIN = off;" + # sed is for https://bugs.mysql.com/bug.php?id=20545 + mysql_tzinfo_to_sql /usr/share/zoneinfo | sed 's/Local time zone must be set--see zic manual page/FCTY/' + ) | "${mysql[@]}" mysql + fi + + # install TokuDB engine + if [ -n "$INIT_TOKUDB" ]; then + ps-admin --docker --enable-tokudb -u root -p $MYSQL_ROOT_PASSWORD + fi + if [ -n "$INIT_ROCKSDB" ]; then + ps-admin --enable-rocksdb -u root -p $MYSQL_ROOT_PASSWORD + fi + + if [ ! -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + MYSQL_ROOT_PASSWORD="$(pwmake 128)" + echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD" + fi + + rootCreate= + # default root to listen for connections from anywhere + file_env 'MYSQL_ROOT_HOST' '%' + if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then + # no, we don't care if read finds a terminating character in this heredoc + # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151 + read -r -d '' rootCreate <<-EOSQL || true + CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ; + EOSQL + fi + + "${mysql[@]}" <<-EOSQL + -- What's done in this file shouldn't be replicated + -- or products like mysql-fabric won't work + SET @@SESSION.SQL_LOG_BIN=0; + + DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'mysql.infoschema', 'mysql.session', 'root') OR host NOT IN ('localhost') ; + ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ; + ${rootCreate} + DROP DATABASE IF EXISTS test ; + FLUSH PRIVILEGES ; + EOSQL + + if [ ! -z "$MYSQL_ROOT_PASSWORD" ]; then + mysql+=( -p"${MYSQL_ROOT_PASSWORD}" ) + fi + + file_env 'MYSQL_DATABASE' + if [ "$MYSQL_DATABASE" ]; then + echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" | "${mysql[@]}" + mysql+=( "$MYSQL_DATABASE" ) + fi + + file_env 'MYSQL_USER' + file_env 'MYSQL_PASSWORD' + if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then + echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" | "${mysql[@]}" + + if [ "$MYSQL_DATABASE" ]; then + echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}" + fi + + echo 'FLUSH PRIVILEGES ;' | "${mysql[@]}" + fi + + echo + ls /docker-entrypoint-initdb.d/ > /dev/null + for f in /docker-entrypoint-initdb.d/*; do + process_init_file "$f" "${mysql[@]}" + done + + if [ ! -z "$MYSQL_ONETIME_PASSWORD" ]; then + "${mysql[@]}" <<-EOSQL + ALTER USER 'root'@'%' PASSWORD EXPIRE; + EOSQL + fi + if ! kill -s TERM "$pid" || ! wait "$pid"; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + echo + echo 'MySQL init process done. Ready for start up.' + echo + fi + + # exit when MYSQL_INIT_ONLY environment variable is set to avoid starting mysqld + if [ ! -z "$MYSQL_INIT_ONLY" ]; then + echo 'Initialization complete, now exiting!' + exit 0 + fi +fi + +if [ ! -z "${PERCONA_INSTANCE_ID}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -i ${PERCONA_INSTANCE_ID}" +fi + +if [ ! -z "${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -j ${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" +fi + +if [ ! -z "${PERCONA_SEND_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -t ${PERCONA_SEND_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -t 7" +fi + +if [ ! -z "${PERCONA_CONNECT_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -c ${PERCONA_CONNECT_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -c 2" +fi + +/call-home.sh -f "PRODUCT_FAMILY_PS" -v "${PS_TELEMETRY_VERSION}" -d "DOCKER" ${CALL_HOME_OPTIONAL_PARAMS} &> /dev/null || : + +exec "$@" diff --git a/sources/percona8042/ps-entry.sh b/sources/percona8042/ps-entry.sh new file mode 100755 index 0000000..a7fe81b --- /dev/null +++ b/sources/percona8042/ps-entry.sh @@ -0,0 +1,253 @@ +#!/bin/bash +set -eo pipefail +shopt -s nullglob +# if command starts with an option, prepend mysqld +if [ "${1:0:1}" = '-' ]; then + set -- mysqld "$@" +fi +# skip setup if they want an option that stops mysqld +wantHelp= +for arg; do + case "$arg" in + -'?'|--help|--print-defaults|-V|--version) + wantHelp=1 + break + ;; + esac +done + +# usage: file_env VAR [DEFAULT] +# ie: file_env 'XYZ_DB_PASSWORD' 'example' +# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of +# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature) +file_env() { + local var="$1" + local fileVar="${var}_FILE" + local def="${2:-}" + if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then + echo >&2 "error: both $var and $fileVar are set (but are exclusive)" + exit 1 + fi + local val="$def" + if [ "${!var:-}" ]; then + val="${!var}" + elif [ "${!fileVar:-}" ]; then + val="$(< "${!fileVar}")" + fi + export "$var"="$val" + unset "$fileVar" +} + +# usage: process_init_file FILENAME MYSQLCOMMAND... +# ie: process_init_file foo.sh mysql -uroot +# (process a single initializer file, based on its extension. we define this +# function here, so that initializer scripts (*.sh) can use the same logic, +# potentially recursively, or override the logic used in subsequent calls) +process_init_file() { + local f="$1"; shift + local mysql=( "$@" ) + + case "$f" in + *.sh) echo "$0: running $f"; . "$f" ;; + *.sql) echo "$0: running $f"; "${mysql[@]}" < "$f"; echo ;; + *.sql.gz) echo "$0: running $f"; gunzip -c "$f" | "${mysql[@]}"; echo ;; + *) echo "$0: ignoring $f" ;; + esac + echo +} + +_check_config() { + toRun=( "$@" --verbose --help ) + if ! errors="$("${toRun[@]}" 2>&1 >/dev/null)"; then + cat >&2 <<-EOM + + ERROR: mysqld failed while attempting to check config + command was: "${toRun[*]}" + + $errors + EOM + exit 1 + fi +} + +# Fetch value from server config +# We use mysqld --verbose --help instead of my_print_defaults because the +# latter only show values present in config files, and not server defaults +_get_config() { + local conf="$1"; shift + "$@" --verbose --help --log-bin-index="$(mktemp -u)" 2>/dev/null \ + | awk '$1 == "'"$conf"'" && /^[^ \t]/ { sub(/^[^ \t]+[ \t]+/, ""); print; exit }' + # match "datadir /some/path with/spaces in/it here" but not "--xyz=abc\n datadir (xyz)" +} + +if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then + # still need to check config, container may have started with --user + _check_config "$@" + + if [ -n "$INIT_TOKUDB" ]; then + export LD_PRELOAD=/usr/lib64/libjemalloc.so.1 + fi + # Get config + DATADIR="$(_get_config 'datadir' "$@")" + + if [ ! -d "$DATADIR/mysql" ]; then + file_env 'MYSQL_ROOT_PASSWORD' + if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + echo >&2 'error: database is uninitialized and password option is not specified ' + echo >&2 ' You need to specify one of MYSQL_ROOT_PASSWORD, MYSQL_ALLOW_EMPTY_PASSWORD and MYSQL_RANDOM_ROOT_PASSWORD' + exit 1 + fi + + mkdir -p "$DATADIR" + + echo 'Initializing database' + "$@" --initialize-insecure + echo 'Database initialized' + + if command -v mysql_ssl_rsa_setup > /dev/null && [ ! -e "$DATADIR/server-key.pem" ]; then + # https://github.com/mysql/mysql-server/blob/23032807537d8dd8ee4ec1c4d40f0633cd4e12f9/packaging/deb-in/extra/mysql-systemd-start#L81-L84 + echo 'Initializing certificates' + mysql_ssl_rsa_setup --datadir="$DATADIR" + echo 'Certificates initialized' + fi + + SOCKET="$(_get_config 'socket' "$@")" + "$@" --skip-networking --socket="${SOCKET}" & + pid="$!" + + mysql=( mysql --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" --password="" ) + + for i in {120..0}; do + if echo 'SELECT 1' | "${mysql[@]}" &> /dev/null; then + break + fi + echo 'MySQL init process in progress...' + sleep 1 + done + if [ "$i" = 0 ]; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + if [ -z "$MYSQL_INITDB_SKIP_TZINFO" ]; then + ( + echo "SET @@SESSION.SQL_LOG_BIN = off;" + # sed is for https://bugs.mysql.com/bug.php?id=20545 + mysql_tzinfo_to_sql /usr/share/zoneinfo | sed 's/Local time zone must be set--see zic manual page/FCTY/' + ) | "${mysql[@]}" mysql + fi + + # install TokuDB engine + if [ -n "$INIT_TOKUDB" ]; then + ps-admin --docker --enable-tokudb -u root -p $MYSQL_ROOT_PASSWORD + fi + if [ -n "$INIT_ROCKSDB" ]; then + ps-admin --enable-rocksdb -u root -p $MYSQL_ROOT_PASSWORD + fi + + if [ ! -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + MYSQL_ROOT_PASSWORD="$(pwmake 128)" + echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD" + fi + + rootCreate= + # default root to listen for connections from anywhere + file_env 'MYSQL_ROOT_HOST' '%' + if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then + # no, we don't care if read finds a terminating character in this heredoc + # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151 + read -r -d '' rootCreate <<-EOSQL || true + CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ; + EOSQL + fi + + "${mysql[@]}" <<-EOSQL + -- What's done in this file shouldn't be replicated + -- or products like mysql-fabric won't work + SET @@SESSION.SQL_LOG_BIN=0; + + DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'mysql.infoschema', 'mysql.session', 'root') OR host NOT IN ('localhost') ; + ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ; + ${rootCreate} + DROP DATABASE IF EXISTS test ; + FLUSH PRIVILEGES ; + EOSQL + + if [ ! -z "$MYSQL_ROOT_PASSWORD" ]; then + mysql+=( -p"${MYSQL_ROOT_PASSWORD}" ) + fi + + file_env 'MYSQL_DATABASE' + if [ "$MYSQL_DATABASE" ]; then + echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" | "${mysql[@]}" + mysql+=( "$MYSQL_DATABASE" ) + fi + + file_env 'MYSQL_USER' + file_env 'MYSQL_PASSWORD' + if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then + echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" | "${mysql[@]}" + + if [ "$MYSQL_DATABASE" ]; then + echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}" + fi + + echo 'FLUSH PRIVILEGES ;' | "${mysql[@]}" + fi + + echo + ls /docker-entrypoint-initdb.d/ > /dev/null + for f in /docker-entrypoint-initdb.d/*; do + process_init_file "$f" "${mysql[@]}" + done + + if [ ! -z "$MYSQL_ONETIME_PASSWORD" ]; then + "${mysql[@]}" <<-EOSQL + ALTER USER 'root'@'%' PASSWORD EXPIRE; + EOSQL + fi + if ! kill -s TERM "$pid" || ! wait "$pid"; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + echo + echo 'MySQL init process done. Ready for start up.' + echo + fi + + # exit when MYSQL_INIT_ONLY environment variable is set to avoid starting mysqld + if [ ! -z "$MYSQL_INIT_ONLY" ]; then + echo 'Initialization complete, now exiting!' + exit 0 + fi +fi + +if [ ! -z "${PERCONA_INSTANCE_ID}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -i ${PERCONA_INSTANCE_ID}" +fi + +if [ ! -z "${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -j ${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" +fi + +if [ ! -z "${PERCONA_SEND_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -t ${PERCONA_SEND_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -t 7" +fi + +if [ ! -z "${PERCONA_CONNECT_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -c ${PERCONA_CONNECT_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -c 2" +fi + +if [[ ${PERCONA_TELEMETRY_DISABLE} -ne "0" ]]; then + exec "$@" --percona_telemetry_disable=1 +else + /usr/bin/telemetry-agent-supervisor.sh & + exec "$@" +fi diff --git a/sources/percona8042/telemetry-agent-supervisor.sh b/sources/percona8042/telemetry-agent-supervisor.sh new file mode 100755 index 0000000..6ad026e --- /dev/null +++ b/sources/percona8042/telemetry-agent-supervisor.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +# phase-0 telemetry +/call-home.sh -f "PRODUCT_FAMILY_PS" -v "${PS_TELEMETRY_VERSION}" -d "DOCKER" ${CALL_HOME_OPTIONAL_PARAMS} &> /dev/null || : + +# phase-1 telemetry +for i in {1..3}; do + /usr/bin/percona-telemetry-agent >> /var/log/percona/telemetry-agent.log 2>> /var/log/percona/telemetry-agent-error.log + if [ $? -eq 0 ]; then + break + fi + sleep 5 +done +sleep infinity diff --git a/sources/percona8043/Dockerfile b/sources/percona8043/Dockerfile new file mode 100644 index 0000000..e7e92b4 --- /dev/null +++ b/sources/percona8043/Dockerfile @@ -0,0 +1,140 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +ENV PS_VERSION 8.0.43-34.1 +ENV MYSQL_SHELL_VERSION 8.0.43-1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.0.43-34-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 +# Do not report during Docker image creation. +# Note that doing so, would create telemetry config file +# which would prevent reporting when new container is started. +# If we want to track Docker image creation as well, +# remove telemetry config file after installing packages! +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + percona-release disable all; \ + percona-release enable ps-80 ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/j/jemalloc-5.2.1-2.el9.x86_64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/g/gflags-2.2.2-9.el9.x86_64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + #microdnf -y install epel-release; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8043/Dockerfile-dockerhub b/sources/percona8043/Dockerfile-dockerhub new file mode 100644 index 0000000..0cf47a5 --- /dev/null +++ b/sources/percona8043/Dockerfile-dockerhub @@ -0,0 +1,128 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +ENV PS_VERSION 8.0.43-34.1 +ENV MYSQL_SHELL_VERSION 8.0.43-1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.0.43-34-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 +# Do not report during Docker image creation. +# Note that doing so, would create telemetry config file +# which would prevent reporting when new container is started. +# If we want to track Docker image creation as well, +# remove telemetry config file after installing packages! +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + percona-release disable all; \ + percona-release enable ps-80 ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/j/jemalloc-5.2.1-2.el9.x86_64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/g/gflags-2.2.2-9.el9.x86_64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + #microdnf -y install epel-release; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry-dockerhub.sh /docker-entrypoint.sh +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8043/Dockerfile.aarch64 b/sources/percona8043/Dockerfile.aarch64 new file mode 100644 index 0000000..cb45184 --- /dev/null +++ b/sources/percona8043/Dockerfile.aarch64 @@ -0,0 +1,141 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +ENV PS_VERSION 8.0.43-34.1 +ENV MYSQL_SHELL_VERSION 8.0.43-1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.0.43-34-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +# Do not report during Docker image creation. +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + #yum -y install epel-release; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + sed -i "s|x86_64|x86_64 aarch64|" /usr/bin/percona-release; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + #microdnf -y module disable mysql; \ + percona-release disable all; \ + percona-release enable ps-80 ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + rm -rf /tmp/percona-*; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/j/jemalloc-5.2.1-2.el9.aarch64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/g/gflags-2.2.2-9.el9.aarch64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION} \ + percona-telemetry-agent; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ + +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8043/Dockerfile.ubi8 b/sources/percona8043/Dockerfile.ubi8 new file mode 100644 index 0000000..39c405a --- /dev/null +++ b/sources/percona8043/Dockerfile.ubi8 @@ -0,0 +1,105 @@ +# This is temporary placeholder for UBI8-based Docker image for PS-8.0 +FROM redhat/ubi8-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +RUN set -ex; \ + # shadow-utils are needed for user/group manipulation on UBI-based images + microdnf -y update; \ + microdnf -y install glibc-langpack-en \ + nss_wrapper \ + shadow-utils; \ + microdnf clean all; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +# Do not report during Docker image creation. +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + microdnf -y install findutils; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + #microdnf -y module disable mysql; \ + percona-release disable all; \ + percona-release enable ps-80 release; \ + percona-release enable mysql-shell release; \ + curl -Lf -o /tmp/numactl-libs.rpm https://rpmfind.net/linux/centos/8-stream/BaseOS/x86_64/os/Packages/numactl-libs-2.0.16-3.el8.x86_64.rpm; \ + rpmkeys --checksig /tmp/numactl-libs.rpm; \ + rpm -i /tmp/numactl-libs.rpm; \ + rm -rf /tmp/numactl-libs.rpm + +ENV PS_VERSION 8.0.35-27.1 +ENV MYSQL_SHELL_VERSION 8.0.35-1 +ENV OS_VER el8 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV CALL_HOME_VERSION 0.1 + +RUN set -ex; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + policycoreutils; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nskip-host-cache\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}-openshift" + +COPY ps-entry.sh /docker-entrypoint.sh +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8043/README-build.md b/sources/percona8043/README-build.md new file mode 100644 index 0000000..fe6c366 --- /dev/null +++ b/sources/percona8043/README-build.md @@ -0,0 +1,40 @@ +Build image + + `docker build -t percona-server Dockerfile` + +or + + `docker build -t percona-server Dockerfile` + +Tag image + + `docker tag percona/percona-server:8.0` + +Push to hub + + `docker push percona/percona-server:8.0` + +Usage +===== + + vi ./docker-compose.yml + percona: + image: percona/percona-server:latest + name: perconaserver + environment: + MYSQL_ROOT_PASSWORD: secret + ports: + - "3306" + volumes: + # create volumes for use + - /var/log/mysql + - /var/lib/mysql + # bind mount my local my.cnf + # - $PWD/my.cnf:/etc/my.cnf + command: + # Workaround for no my.cnf in image + - '--user=mysql' + 7) Start the container from cli + docker-compose up + 8) Check status + docker-compose ps diff --git a/sources/percona8043/README.md b/sources/percona8043/README.md new file mode 100644 index 0000000..be73183 --- /dev/null +++ b/sources/percona8043/README.md @@ -0,0 +1,158 @@ +![logo](https://www.percona.com/wp-content/uploads/2023/03/font-1.jpg) + +# What is Percona Server? + +Percona Server is an enhanced drop-in replacement for MySQL. With Percona Server, your queries will run faster and more consistently. You will consolidate servers on powerful hardware and will delay sharding, or avoid it entirely. + +For more information and related downloads for Percona Server and other Percona products, please visit http://www.percona.com. + +# Percona Server Docker Images + +These are the only official Percona Server Docker images, created and maintained by the Percona team. The image has the Percona Fractal Tree based storage engine `TokuDB` enabled. The available versions are: + + Percona Server 8.0.15-6.1 (tag: 8.0) + +Images are updated when new releases are published. + +# How to Use the Images + +## Start a Percona Server Instance + +Start a Percona Server container as follows: + + docker run --name container-name -e MYSQL_ROOT_PASSWORD=secret -d percona/percona-server:tag + +Where `container-name` is the name you want to assign to your container, `secret` is the password to be set for the root user and `tag` is the tag specifying the version you want. See the list above for relevant tags, or look at the [full list of tags](https://registry.hub.docker.com/u/percona/percona-server/tags/manage/). + +## Connect to Percona Server from an Application in Another Docker Container + +This image exposes the standard MySQL port (3306), so container linking makes the instance available to other containers. Start other containers like this in order to link it to the Percona Server container: + + docker run --name app-container-name --link container-name -d app-that-uses-mysql + +## Connect to Percona Server from the MySQL Command Line Client + +The following command starts another container instance and runs the `mysql` command line client against your original container, allowing you to execute SQL statements against your database: + + docker run -it --link container-name --rm percona/percona-server:tag mysql -h container-name -P 3306 -uroot -psecret' + +where `container-name` is the name of your database container. + +# Environment Variables + +When you start a Percona Server container, you can adjust the configuration of the instance by passing one or more environment variables on the `docker run` command line. Do note that none of the variables below will have any effect if you start the container with a data directory that already contains a database: any pre-existing database will always be left untouched on container startup. + +Most of the variables listed below are optional, but one of the variables `MYSQL_ROOT_PASSWORD`, `MYSQL_ALLOW_EMPTY_PASSWORD`, `MYSQL_RANDOM_ROOT_PASSWORD` must be given. + +## `MYSQL_ROOT_PASSWORD` + +This variable specifies a password that will be set for the root superuser account. In the above example, it was set to `secret`. **NOTE:** Setting the MySQL root user password on the command line is insecure. + +## `MYSQL_ROOT_PASSWORD_FILE` + +This variable specifies a file that will be read for the root user account. This can be a mounted file when you run your container. This can also be used in the scope of the Docker Secrets (Swarm mode) functionality. + +## `MYSQL_RANDOM_ROOT_PASSWORD` + +When this variable is set to `yes`, a random password for the server's root user will be generated. The password will be printed to stdout in the container, and it can be obtained by using the command `docker logs container-name`. + +## `MYSQL_ONETIME_PASSWORD` + +This variable is optional. When set to `yes`, the root user's password will be set as expired, and must be changed before we can login normally. This is only supported by version 5.6 or newer. + +## `MYSQL_DATABASE` + +This variable is optional. It allows you to specify the name of a database to be created on image startup. If a user/password was supplied (see below) then that user will be granted superuser access (corresponding to GRANT ALL) to this database. + +## `MYSQL_USER`, `MYSQL_PASSWORD` + +These variables are optional, used in conjunction to create a new user and set that user's password. This user will be granted superuser permissions (see above) for the database specified by the `MYSQL_DATABASE` variable. Both variables are required for a user to be created. + +Do note that there is no need to use this mechanism to create the `root` superuser, that user gets created by default with the password set by either of the mechanisms (given or generated) discussed above. + +## `MYSQL_ALLOW_EMPTY_PASSWORD` + +Set to `yes` to allow the container to be started with a blank password for the root user. **NOTE:** Setting this variable to `yes` is not recommended unless you really know what you are doing, since this will leave your instance completely unprotected, allowing anyone to gain complete superuser access. + +## `INIT_TOKUDB` + +Set to `1` to allow the container to be started with enabled TOKUDB engine. + +## `INIT_ROCKSDB` + +Set to `1` to allow the container to be started with enabled ROCKSDB engine. + +## `MYSQL_INIT_ONLY` + +Set to `1` will skip starting the `mysqld` process and will run only the initialization part if MySQL was not initialized before. + +# Notes, Tips, Gotchas + +## Secure Container Startup + +In many use cases, employing the `MYSQL_ROOT_PASSWORD` variable to specify the MySQL root user password on initial container startup is insecure. Instead, to keep your setup as secure as possible, we strongly recommend using the `MYSQL_RANDOM_ROOT_PASSWORD` option. To further secure your instance, we also recommend using the `MYSQL_ONETIME_PASSWORD` variable if you use version 5.6 or higher. + +## Where to Store Data + +There are many two ways to store data used by applications that run in Docker containers. We maintain our usual stance and encourage users to investigate the options and use the method that best suits their use case. Here are some of the options available: + +* Let Docker manage the storage of your database data by writing the database files to disk on the host system using its own internal volume management. The current solutions, devicemapper, aufs and overlayfs have negative performance records. +* Create a data directory on the host system (outside the container on high performance storage) and mount this to a directory visible from inside the container. This places the database files in a known location on the host system, and makes it easy for tools and applications on the host system to access the files. The user needs to make sure that the directory exists, and that permissions and other security mechanisms on the host system are set up correctly. + +The Docker documentation is a good starting point for understanding the different storage options and variations, and there are multiple blog and forum postings that discuss and give advice in this area. We will simply show the basic procedure here for the latter option above: + +1. Create a data directory on a suitable volume on your host system, e.g. `/local/datadir`. +2. Start your container like this: + +``` + docker run --name container-name -v /local/datadir:/var/lib/mysql -e MYSQL_ROOT_PASSWORD=secret -d percona/percona-server:tag +``` + +The `-v /local/datadir:/var/lib/mysql` part of the command mounts the `/local/datadir` directory from the underlying host system as `/var/lib/mysql` inside the container, where MySQL by default will write its data files. + +Note that users on systems with SELinux enabled may experience problems with this. The current workaround is to assign the relevant SELinux policy type to the new data directory so that the container will be allowed to access it: + + chcon -Rt svirt_sandbox_file_t /local/datadir + +## Existing Data + +If you start your MySQL container instance with a data directory that already contains a data (specifically, a `mysql` subdirectory where all our system tables live), the `$MYSQL_ROOT_PASSWORD` variable should be omitted from the `docker run` command. + +## Port forwarding + +Docker allows mapping of ports on the container to ports on the host system by using the -p option. If you start the container as follows, you can connect to the database by connecting your client to a port on the host machine. This can greatly simplfy consolidating many instances to a single host. In this example port 6603, the we use the address of the Docker host to connect to the TCP port the Docker deamon is forwarding from: + + docker run --name container-name `-p 6603:3306` -d percona/percona-server + mysql -h docker_host_ip -P 6603 + +## Passing options to the server + +You can pass arbitrary command line options to the MySQL server by appending them to the `run command`: + + docker run --name my-container-name -d percona/percona-server --option1=value --option2=value + +In this case, the values of option1 and option2 will be passed directly to the server when it is started. The following command will for instance start your container with UTF-8 as the default setting for character set and collation for all databases in MySQL: + + docker run --name container-name -d percona/percona-server --character-set-server=utf8 --collation-server=utf8_general_ci + +## Using a Custom Percona Server Config File + +The Percona Server startup configuration in these Docker images is specified in the file `/etc/my.cnf`. If you want to customize this configuration for your own purposes, you can create your alternative configuration file in a directory on the host machine and then mount this file in the appropriate location inside the Percona Server container, effectively replacing the standard configuration file. + +If you want to base your changes on the standard configuration file, start your Percona Server container in the standard way described above, then do: + + docker exec -it my-container-name cat /etc/my.cnf > /my/custom/config-file + +... where `/my/custom/config-file` is the path and name of the new configuration file. Then start a new Percona Server container like this: + + docker run --name my-new-container-name -v /my/custom/config-file:/etc/my.cnf -e MYSQL_ROOT_PASSWORD=my-secret-pw -d percona/percona-server:tag + +This will start a new Percona Server container `my-new-container-name` where the Percona Server instance uses the startup options specified in `/my/custom/config-file`. + +# Supported Docker Versions + +These images are officially supported by the MySQL team on Docker version 1.9. Support for older versions (down to 1.0) is provided on a best-effort basis, but we strongly recommend running on the most recent version, since that is assumed for parts of the documentation above. + +# User Feedback + +We welcome your feedback! diff --git a/sources/percona8043/docker-compose.yml b/sources/percona8043/docker-compose.yml new file mode 100644 index 0000000..fed5e73 --- /dev/null +++ b/sources/percona8043/docker-compose.yml @@ -0,0 +1,33 @@ +version: '2' +services: + percona-server: + image: percona/percona-server:8.0 + environment: + MYSQL_ROOT_PASSWORD: secret + ports: + - "3306" + volumes: + # create volumes for use + - /var/lib/mysql + # bind mount my local my.cnf + # - $PWD/my.cnf:/etc/my.cnf.d/my.cnf + +# uncomment sections below if you want to enable PMM +# pmm-server: +# image: percona/pmm-server:latest +# ports: +# - "443:443" +# environment: +# - SERVER_USER=pmm +# - SERVER_PASSWORD=pmm +# pmm-client-ps: +# image: perconalab/pmm-client:latest +# environment: +# - PMM_SERVER=pmm-server:443 +# - PMM_USER=pmm +# - PMM_PASSWORD=pmm +# - DB_TYPE=mysql +# - DB_HOST=percona-server +# - DB_PORT=3306 +# - DB_USER=root +# - DB_PASSWORD=secret diff --git a/sources/percona8043/ps-entry-dockerhub.sh b/sources/percona8043/ps-entry-dockerhub.sh new file mode 100755 index 0000000..9f08ef1 --- /dev/null +++ b/sources/percona8043/ps-entry-dockerhub.sh @@ -0,0 +1,250 @@ +#!/bin/bash +set -eo pipefail +shopt -s nullglob +# if command starts with an option, prepend mysqld +if [ "${1:0:1}" = '-' ]; then + set -- mysqld "$@" +fi +# skip setup if they want an option that stops mysqld +wantHelp= +for arg; do + case "$arg" in + -'?'|--help|--print-defaults|-V|--version) + wantHelp=1 + break + ;; + esac +done + +# usage: file_env VAR [DEFAULT] +# ie: file_env 'XYZ_DB_PASSWORD' 'example' +# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of +# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature) +file_env() { + local var="$1" + local fileVar="${var}_FILE" + local def="${2:-}" + if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then + echo >&2 "error: both $var and $fileVar are set (but are exclusive)" + exit 1 + fi + local val="$def" + if [ "${!var:-}" ]; then + val="${!var}" + elif [ "${!fileVar:-}" ]; then + val="$(< "${!fileVar}")" + fi + export "$var"="$val" + unset "$fileVar" +} + +# usage: process_init_file FILENAME MYSQLCOMMAND... +# ie: process_init_file foo.sh mysql -uroot +# (process a single initializer file, based on its extension. we define this +# function here, so that initializer scripts (*.sh) can use the same logic, +# potentially recursively, or override the logic used in subsequent calls) +process_init_file() { + local f="$1"; shift + local mysql=( "$@" ) + + case "$f" in + *.sh) echo "$0: running $f"; . "$f" ;; + *.sql) echo "$0: running $f"; "${mysql[@]}" < "$f"; echo ;; + *.sql.gz) echo "$0: running $f"; gunzip -c "$f" | "${mysql[@]}"; echo ;; + *) echo "$0: ignoring $f" ;; + esac + echo +} + +_check_config() { + toRun=( "$@" --verbose --help ) + if ! errors="$("${toRun[@]}" 2>&1 >/dev/null)"; then + cat >&2 <<-EOM + + ERROR: mysqld failed while attempting to check config + command was: "${toRun[*]}" + + $errors + EOM + exit 1 + fi +} + +# Fetch value from server config +# We use mysqld --verbose --help instead of my_print_defaults because the +# latter only show values present in config files, and not server defaults +_get_config() { + local conf="$1"; shift + "$@" --verbose --help --log-bin-index="$(mktemp -u)" 2>/dev/null \ + | awk '$1 == "'"$conf"'" && /^[^ \t]/ { sub(/^[^ \t]+[ \t]+/, ""); print; exit }' + # match "datadir /some/path with/spaces in/it here" but not "--xyz=abc\n datadir (xyz)" +} + +if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then + # still need to check config, container may have started with --user + _check_config "$@" + + if [ -n "$INIT_TOKUDB" ]; then + export LD_PRELOAD=/usr/lib64/libjemalloc.so.1 + fi + # Get config + DATADIR="$(_get_config 'datadir' "$@")" + + if [ ! -d "$DATADIR/mysql" ]; then + file_env 'MYSQL_ROOT_PASSWORD' + if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + echo >&2 'error: database is uninitialized and password option is not specified ' + echo >&2 ' You need to specify one of MYSQL_ROOT_PASSWORD, MYSQL_ALLOW_EMPTY_PASSWORD and MYSQL_RANDOM_ROOT_PASSWORD' + exit 1 + fi + + mkdir -p "$DATADIR" + + echo 'Initializing database' + "$@" --initialize-insecure + echo 'Database initialized' + + if command -v mysql_ssl_rsa_setup > /dev/null && [ ! -e "$DATADIR/server-key.pem" ]; then + # https://github.com/mysql/mysql-server/blob/23032807537d8dd8ee4ec1c4d40f0633cd4e12f9/packaging/deb-in/extra/mysql-systemd-start#L81-L84 + echo 'Initializing certificates' + mysql_ssl_rsa_setup --datadir="$DATADIR" + echo 'Certificates initialized' + fi + + SOCKET="$(_get_config 'socket' "$@")" + "$@" --skip-networking --socket="${SOCKET}" & + pid="$!" + + mysql=( mysql --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" --password="" ) + + for i in {120..0}; do + if echo 'SELECT 1' | "${mysql[@]}" &> /dev/null; then + break + fi + echo 'MySQL init process in progress...' + sleep 1 + done + if [ "$i" = 0 ]; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + if [ -z "$MYSQL_INITDB_SKIP_TZINFO" ]; then + ( + echo "SET @@SESSION.SQL_LOG_BIN = off;" + # sed is for https://bugs.mysql.com/bug.php?id=20545 + mysql_tzinfo_to_sql /usr/share/zoneinfo | sed 's/Local time zone must be set--see zic manual page/FCTY/' + ) | "${mysql[@]}" mysql + fi + + # install TokuDB engine + if [ -n "$INIT_TOKUDB" ]; then + ps-admin --docker --enable-tokudb -u root -p $MYSQL_ROOT_PASSWORD + fi + if [ -n "$INIT_ROCKSDB" ]; then + ps-admin --enable-rocksdb -u root -p $MYSQL_ROOT_PASSWORD + fi + + if [ ! -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + MYSQL_ROOT_PASSWORD="$(pwmake 128)" + echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD" + fi + + rootCreate= + # default root to listen for connections from anywhere + file_env 'MYSQL_ROOT_HOST' '%' + if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then + # no, we don't care if read finds a terminating character in this heredoc + # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151 + read -r -d '' rootCreate <<-EOSQL || true + CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ; + EOSQL + fi + + "${mysql[@]}" <<-EOSQL + -- What's done in this file shouldn't be replicated + -- or products like mysql-fabric won't work + SET @@SESSION.SQL_LOG_BIN=0; + + DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'mysql.infoschema', 'mysql.session', 'root') OR host NOT IN ('localhost') ; + ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ; + ${rootCreate} + DROP DATABASE IF EXISTS test ; + FLUSH PRIVILEGES ; + EOSQL + + if [ ! -z "$MYSQL_ROOT_PASSWORD" ]; then + mysql+=( -p"${MYSQL_ROOT_PASSWORD}" ) + fi + + file_env 'MYSQL_DATABASE' + if [ "$MYSQL_DATABASE" ]; then + echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" | "${mysql[@]}" + mysql+=( "$MYSQL_DATABASE" ) + fi + + file_env 'MYSQL_USER' + file_env 'MYSQL_PASSWORD' + if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then + echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" | "${mysql[@]}" + + if [ "$MYSQL_DATABASE" ]; then + echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}" + fi + + echo 'FLUSH PRIVILEGES ;' | "${mysql[@]}" + fi + + echo + ls /docker-entrypoint-initdb.d/ > /dev/null + for f in /docker-entrypoint-initdb.d/*; do + process_init_file "$f" "${mysql[@]}" + done + + if [ ! -z "$MYSQL_ONETIME_PASSWORD" ]; then + "${mysql[@]}" <<-EOSQL + ALTER USER 'root'@'%' PASSWORD EXPIRE; + EOSQL + fi + if ! kill -s TERM "$pid" || ! wait "$pid"; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + echo + echo 'MySQL init process done. Ready for start up.' + echo + fi + + # exit when MYSQL_INIT_ONLY environment variable is set to avoid starting mysqld + if [ ! -z "$MYSQL_INIT_ONLY" ]; then + echo 'Initialization complete, now exiting!' + exit 0 + fi +fi + +if [ ! -z "${PERCONA_INSTANCE_ID}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -i ${PERCONA_INSTANCE_ID}" +fi + +if [ ! -z "${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -j ${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" +fi + +if [ ! -z "${PERCONA_SEND_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -t ${PERCONA_SEND_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -t 7" +fi + +if [ ! -z "${PERCONA_CONNECT_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -c ${PERCONA_CONNECT_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -c 2" +fi + +/call-home.sh -f "PRODUCT_FAMILY_PS" -v "${PS_TELEMETRY_VERSION}" -d "DOCKER" ${CALL_HOME_OPTIONAL_PARAMS} &> /dev/null || : + +exec "$@" diff --git a/sources/percona8043/ps-entry.sh b/sources/percona8043/ps-entry.sh new file mode 100755 index 0000000..a7fe81b --- /dev/null +++ b/sources/percona8043/ps-entry.sh @@ -0,0 +1,253 @@ +#!/bin/bash +set -eo pipefail +shopt -s nullglob +# if command starts with an option, prepend mysqld +if [ "${1:0:1}" = '-' ]; then + set -- mysqld "$@" +fi +# skip setup if they want an option that stops mysqld +wantHelp= +for arg; do + case "$arg" in + -'?'|--help|--print-defaults|-V|--version) + wantHelp=1 + break + ;; + esac +done + +# usage: file_env VAR [DEFAULT] +# ie: file_env 'XYZ_DB_PASSWORD' 'example' +# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of +# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature) +file_env() { + local var="$1" + local fileVar="${var}_FILE" + local def="${2:-}" + if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then + echo >&2 "error: both $var and $fileVar are set (but are exclusive)" + exit 1 + fi + local val="$def" + if [ "${!var:-}" ]; then + val="${!var}" + elif [ "${!fileVar:-}" ]; then + val="$(< "${!fileVar}")" + fi + export "$var"="$val" + unset "$fileVar" +} + +# usage: process_init_file FILENAME MYSQLCOMMAND... +# ie: process_init_file foo.sh mysql -uroot +# (process a single initializer file, based on its extension. we define this +# function here, so that initializer scripts (*.sh) can use the same logic, +# potentially recursively, or override the logic used in subsequent calls) +process_init_file() { + local f="$1"; shift + local mysql=( "$@" ) + + case "$f" in + *.sh) echo "$0: running $f"; . "$f" ;; + *.sql) echo "$0: running $f"; "${mysql[@]}" < "$f"; echo ;; + *.sql.gz) echo "$0: running $f"; gunzip -c "$f" | "${mysql[@]}"; echo ;; + *) echo "$0: ignoring $f" ;; + esac + echo +} + +_check_config() { + toRun=( "$@" --verbose --help ) + if ! errors="$("${toRun[@]}" 2>&1 >/dev/null)"; then + cat >&2 <<-EOM + + ERROR: mysqld failed while attempting to check config + command was: "${toRun[*]}" + + $errors + EOM + exit 1 + fi +} + +# Fetch value from server config +# We use mysqld --verbose --help instead of my_print_defaults because the +# latter only show values present in config files, and not server defaults +_get_config() { + local conf="$1"; shift + "$@" --verbose --help --log-bin-index="$(mktemp -u)" 2>/dev/null \ + | awk '$1 == "'"$conf"'" && /^[^ \t]/ { sub(/^[^ \t]+[ \t]+/, ""); print; exit }' + # match "datadir /some/path with/spaces in/it here" but not "--xyz=abc\n datadir (xyz)" +} + +if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then + # still need to check config, container may have started with --user + _check_config "$@" + + if [ -n "$INIT_TOKUDB" ]; then + export LD_PRELOAD=/usr/lib64/libjemalloc.so.1 + fi + # Get config + DATADIR="$(_get_config 'datadir' "$@")" + + if [ ! -d "$DATADIR/mysql" ]; then + file_env 'MYSQL_ROOT_PASSWORD' + if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + echo >&2 'error: database is uninitialized and password option is not specified ' + echo >&2 ' You need to specify one of MYSQL_ROOT_PASSWORD, MYSQL_ALLOW_EMPTY_PASSWORD and MYSQL_RANDOM_ROOT_PASSWORD' + exit 1 + fi + + mkdir -p "$DATADIR" + + echo 'Initializing database' + "$@" --initialize-insecure + echo 'Database initialized' + + if command -v mysql_ssl_rsa_setup > /dev/null && [ ! -e "$DATADIR/server-key.pem" ]; then + # https://github.com/mysql/mysql-server/blob/23032807537d8dd8ee4ec1c4d40f0633cd4e12f9/packaging/deb-in/extra/mysql-systemd-start#L81-L84 + echo 'Initializing certificates' + mysql_ssl_rsa_setup --datadir="$DATADIR" + echo 'Certificates initialized' + fi + + SOCKET="$(_get_config 'socket' "$@")" + "$@" --skip-networking --socket="${SOCKET}" & + pid="$!" + + mysql=( mysql --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" --password="" ) + + for i in {120..0}; do + if echo 'SELECT 1' | "${mysql[@]}" &> /dev/null; then + break + fi + echo 'MySQL init process in progress...' + sleep 1 + done + if [ "$i" = 0 ]; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + if [ -z "$MYSQL_INITDB_SKIP_TZINFO" ]; then + ( + echo "SET @@SESSION.SQL_LOG_BIN = off;" + # sed is for https://bugs.mysql.com/bug.php?id=20545 + mysql_tzinfo_to_sql /usr/share/zoneinfo | sed 's/Local time zone must be set--see zic manual page/FCTY/' + ) | "${mysql[@]}" mysql + fi + + # install TokuDB engine + if [ -n "$INIT_TOKUDB" ]; then + ps-admin --docker --enable-tokudb -u root -p $MYSQL_ROOT_PASSWORD + fi + if [ -n "$INIT_ROCKSDB" ]; then + ps-admin --enable-rocksdb -u root -p $MYSQL_ROOT_PASSWORD + fi + + if [ ! -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + MYSQL_ROOT_PASSWORD="$(pwmake 128)" + echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD" + fi + + rootCreate= + # default root to listen for connections from anywhere + file_env 'MYSQL_ROOT_HOST' '%' + if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then + # no, we don't care if read finds a terminating character in this heredoc + # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151 + read -r -d '' rootCreate <<-EOSQL || true + CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ; + EOSQL + fi + + "${mysql[@]}" <<-EOSQL + -- What's done in this file shouldn't be replicated + -- or products like mysql-fabric won't work + SET @@SESSION.SQL_LOG_BIN=0; + + DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'mysql.infoschema', 'mysql.session', 'root') OR host NOT IN ('localhost') ; + ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ; + ${rootCreate} + DROP DATABASE IF EXISTS test ; + FLUSH PRIVILEGES ; + EOSQL + + if [ ! -z "$MYSQL_ROOT_PASSWORD" ]; then + mysql+=( -p"${MYSQL_ROOT_PASSWORD}" ) + fi + + file_env 'MYSQL_DATABASE' + if [ "$MYSQL_DATABASE" ]; then + echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" | "${mysql[@]}" + mysql+=( "$MYSQL_DATABASE" ) + fi + + file_env 'MYSQL_USER' + file_env 'MYSQL_PASSWORD' + if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then + echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" | "${mysql[@]}" + + if [ "$MYSQL_DATABASE" ]; then + echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}" + fi + + echo 'FLUSH PRIVILEGES ;' | "${mysql[@]}" + fi + + echo + ls /docker-entrypoint-initdb.d/ > /dev/null + for f in /docker-entrypoint-initdb.d/*; do + process_init_file "$f" "${mysql[@]}" + done + + if [ ! -z "$MYSQL_ONETIME_PASSWORD" ]; then + "${mysql[@]}" <<-EOSQL + ALTER USER 'root'@'%' PASSWORD EXPIRE; + EOSQL + fi + if ! kill -s TERM "$pid" || ! wait "$pid"; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + echo + echo 'MySQL init process done. Ready for start up.' + echo + fi + + # exit when MYSQL_INIT_ONLY environment variable is set to avoid starting mysqld + if [ ! -z "$MYSQL_INIT_ONLY" ]; then + echo 'Initialization complete, now exiting!' + exit 0 + fi +fi + +if [ ! -z "${PERCONA_INSTANCE_ID}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -i ${PERCONA_INSTANCE_ID}" +fi + +if [ ! -z "${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -j ${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" +fi + +if [ ! -z "${PERCONA_SEND_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -t ${PERCONA_SEND_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -t 7" +fi + +if [ ! -z "${PERCONA_CONNECT_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -c ${PERCONA_CONNECT_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -c 2" +fi + +if [[ ${PERCONA_TELEMETRY_DISABLE} -ne "0" ]]; then + exec "$@" --percona_telemetry_disable=1 +else + /usr/bin/telemetry-agent-supervisor.sh & + exec "$@" +fi diff --git a/sources/percona8043/telemetry-agent-supervisor.sh b/sources/percona8043/telemetry-agent-supervisor.sh new file mode 100755 index 0000000..6ad026e --- /dev/null +++ b/sources/percona8043/telemetry-agent-supervisor.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +# phase-0 telemetry +/call-home.sh -f "PRODUCT_FAMILY_PS" -v "${PS_TELEMETRY_VERSION}" -d "DOCKER" ${CALL_HOME_OPTIONAL_PARAMS} &> /dev/null || : + +# phase-1 telemetry +for i in {1..3}; do + /usr/bin/percona-telemetry-agent >> /var/log/percona/telemetry-agent.log 2>> /var/log/percona/telemetry-agent-error.log + if [ $? -eq 0 ]; then + break + fi + sleep 5 +done +sleep infinity diff --git a/sources/percona8044/Dockerfile b/sources/percona8044/Dockerfile new file mode 100644 index 0000000..3edeeed --- /dev/null +++ b/sources/percona8044/Dockerfile @@ -0,0 +1,152 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL name="Percona Server" \ + release="8.0" \ + vendor="Percona" \ + summary="Percona Server database server" \ + description="Percona Server is a fast, stable and true multi-user, multi-threaded SQL \ + database server. SQL (Structured Query Language) is the most popular database \ + query language in the world. The main goals of Percona Server are speed, \ + robustness and ease of use." \ + maintainer="Percona Development " + +LABEL org.opencontainers.image.authors="info@percona.com" + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +ENV PS_VERSION 8.0.44-35.1 +ENV MYSQL_SHELL_VERSION 8.0.44-1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.0.44-35-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 +# Do not report during Docker image creation. +# Note that doing so, would create telemetry config file +# which would prevent reporting when new container is started. +# If we want to track Docker image creation as well, +# remove telemetry config file after installing packages! +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + percona-release disable all; \ + percona-release enable ps-80 ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/j/jemalloc-5.2.1-2.el9.x86_64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/g/gflags-2.2.2-9.el9.x86_64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + #microdnf -y install epel-release; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +COPY LICENSE /licenses/LICENSE.Dockerfile + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8044/Dockerfile-dockerhub b/sources/percona8044/Dockerfile-dockerhub new file mode 100644 index 0000000..cf1450b --- /dev/null +++ b/sources/percona8044/Dockerfile-dockerhub @@ -0,0 +1,128 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +ENV PS_VERSION 8.0.44-35.1 +ENV MYSQL_SHELL_VERSION 8.0.44-1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.0.44-35-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 +# Do not report during Docker image creation. +# Note that doing so, would create telemetry config file +# which would prevent reporting when new container is started. +# If we want to track Docker image creation as well, +# remove telemetry config file after installing packages! +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + percona-release disable all; \ + percona-release enable ps-80 ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/j/jemalloc-5.2.1-2.el9.x86_64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/g/gflags-2.2.2-9.el9.x86_64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + #microdnf -y install epel-release; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry-dockerhub.sh /docker-entrypoint.sh +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8044/Dockerfile-mysqlsh-upstream b/sources/percona8044/Dockerfile-mysqlsh-upstream new file mode 100644 index 0000000..1432745 --- /dev/null +++ b/sources/percona8044/Dockerfile-mysqlsh-upstream @@ -0,0 +1,142 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +ENV PS_VERSION 8.0.44-35.1 +ENV MYSQL_SHELL_VERSION 8.0.44-1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.0.44-35-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 +# Do not report during Docker image creation. +# Note that doing so, would create telemetry config file +# which would prevent reporting when new container is started. +# If we want to track Docker image creation as well, +# remove telemetry config file after installing packages! +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils libssh; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + percona-release disable all; \ + percona-release enable ps-80 ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/j/jemalloc-5.2.1-2.el9.x86_64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/g/gflags-2.2.2-9.el9.x86_64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + curl -Lf -o /tmp/mysql-shell.rpm https://dev.mysql.com/get/Downloads/MySQL-Shell/mysql-shell-${MYSQL_SHELL_VERSION}.el9.x86_64.rpm; \ + rpm -i /tmp/mysql-shell.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm mysql-shell.rpm + +RUN set -ex; \ + #microdnf -y install epel-release; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +COPY LICENSE /licenses/LICENSE.Dockerfile + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8044/Dockerfile-mysqlsh-upstream.aarch64 b/sources/percona8044/Dockerfile-mysqlsh-upstream.aarch64 new file mode 100644 index 0000000..f327fc8 --- /dev/null +++ b/sources/percona8044/Dockerfile-mysqlsh-upstream.aarch64 @@ -0,0 +1,143 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +ENV PS_VERSION 8.0.44-35.1 +ENV MYSQL_SHELL_VERSION 8.0.44-1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.0.44-35-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +# Do not report during Docker image creation. +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + #yum -y install epel-release; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils libssh; \ + rpm -i /tmp/percona-release.rpm; \ + sed -i "s|x86_64|x86_64 aarch64|" /usr/bin/percona-release; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + #microdnf -y module disable mysql; \ + percona-release disable all; \ + percona-release enable ps-80 ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + rm -rf /tmp/percona-*; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/j/jemalloc-5.2.1-2.el9.aarch64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/g/gflags-2.2.2-9.el9.aarch64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + curl -Lf -o /tmp/mysql-shell.rpm https://dev.mysql.com/get/Downloads/MySQL-Shell/mysql-shell-${MYSQL_SHELL_VERSION}.el9.aarch64.rpm; \ + rpm -i /tmp/mysql-shell.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm /tmp/mysql-shell.rpm + +RUN set -ex; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-telemetry-agent; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ + +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +COPY LICENSE /licenses/LICENSE.Dockerfile + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8044/Dockerfile.aarch64 b/sources/percona8044/Dockerfile.aarch64 new file mode 100644 index 0000000..0ff7625 --- /dev/null +++ b/sources/percona8044/Dockerfile.aarch64 @@ -0,0 +1,153 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL name="Percona Server" \ + release="8.0" \ + vendor="Percona" \ + summary="Percona Server database server" \ + description="Percona Server is a fast, stable and true multi-user, multi-threaded SQL \ + database server. SQL (Structured Query Language) is the most popular database \ + query language in the world. The main goals of Percona Server are speed, \ + robustness and ease of use." \ + maintainer="Percona Development " + +LABEL org.opencontainers.image.authors="info@percona.com" + +ENV PS_VERSION 8.0.44-35.1 +ENV MYSQL_SHELL_VERSION 8.0.44-1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.0.44-35-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +# Do not report during Docker image creation. +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + #yum -y install epel-release; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + sed -i "s|x86_64|x86_64 aarch64|" /usr/bin/percona-release; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + #microdnf -y module disable mysql; \ + percona-release disable all; \ + percona-release enable ps-80 ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + rm -rf /tmp/percona-*; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/j/jemalloc-5.2.1-2.el9.aarch64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/g/gflags-2.2.2-9.el9.aarch64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION} \ + percona-telemetry-agent; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ + +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +COPY LICENSE /licenses/LICENSE.Dockerfile + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8044/Dockerfile.ubi8 b/sources/percona8044/Dockerfile.ubi8 new file mode 100644 index 0000000..39c405a --- /dev/null +++ b/sources/percona8044/Dockerfile.ubi8 @@ -0,0 +1,105 @@ +# This is temporary placeholder for UBI8-based Docker image for PS-8.0 +FROM redhat/ubi8-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +RUN set -ex; \ + # shadow-utils are needed for user/group manipulation on UBI-based images + microdnf -y update; \ + microdnf -y install glibc-langpack-en \ + nss_wrapper \ + shadow-utils; \ + microdnf clean all; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +# Do not report during Docker image creation. +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + microdnf -y install findutils; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + #microdnf -y module disable mysql; \ + percona-release disable all; \ + percona-release enable ps-80 release; \ + percona-release enable mysql-shell release; \ + curl -Lf -o /tmp/numactl-libs.rpm https://rpmfind.net/linux/centos/8-stream/BaseOS/x86_64/os/Packages/numactl-libs-2.0.16-3.el8.x86_64.rpm; \ + rpmkeys --checksig /tmp/numactl-libs.rpm; \ + rpm -i /tmp/numactl-libs.rpm; \ + rm -rf /tmp/numactl-libs.rpm + +ENV PS_VERSION 8.0.35-27.1 +ENV MYSQL_SHELL_VERSION 8.0.35-1 +ENV OS_VER el8 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV CALL_HOME_VERSION 0.1 + +RUN set -ex; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + policycoreutils; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nskip-host-cache\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}-openshift" + +COPY ps-entry.sh /docker-entrypoint.sh +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona8044/LICENSE b/sources/percona8044/LICENSE new file mode 100644 index 0000000..2399231 --- /dev/null +++ b/sources/percona8044/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright 2018 Percona, LLC + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/sources/percona8044/README-build.md b/sources/percona8044/README-build.md new file mode 100644 index 0000000..fe6c366 --- /dev/null +++ b/sources/percona8044/README-build.md @@ -0,0 +1,40 @@ +Build image + + `docker build -t percona-server Dockerfile` + +or + + `docker build -t percona-server Dockerfile` + +Tag image + + `docker tag percona/percona-server:8.0` + +Push to hub + + `docker push percona/percona-server:8.0` + +Usage +===== + + vi ./docker-compose.yml + percona: + image: percona/percona-server:latest + name: perconaserver + environment: + MYSQL_ROOT_PASSWORD: secret + ports: + - "3306" + volumes: + # create volumes for use + - /var/log/mysql + - /var/lib/mysql + # bind mount my local my.cnf + # - $PWD/my.cnf:/etc/my.cnf + command: + # Workaround for no my.cnf in image + - '--user=mysql' + 7) Start the container from cli + docker-compose up + 8) Check status + docker-compose ps diff --git a/sources/percona8044/README.md b/sources/percona8044/README.md new file mode 100644 index 0000000..be73183 --- /dev/null +++ b/sources/percona8044/README.md @@ -0,0 +1,158 @@ +![logo](https://www.percona.com/wp-content/uploads/2023/03/font-1.jpg) + +# What is Percona Server? + +Percona Server is an enhanced drop-in replacement for MySQL. With Percona Server, your queries will run faster and more consistently. You will consolidate servers on powerful hardware and will delay sharding, or avoid it entirely. + +For more information and related downloads for Percona Server and other Percona products, please visit http://www.percona.com. + +# Percona Server Docker Images + +These are the only official Percona Server Docker images, created and maintained by the Percona team. The image has the Percona Fractal Tree based storage engine `TokuDB` enabled. The available versions are: + + Percona Server 8.0.15-6.1 (tag: 8.0) + +Images are updated when new releases are published. + +# How to Use the Images + +## Start a Percona Server Instance + +Start a Percona Server container as follows: + + docker run --name container-name -e MYSQL_ROOT_PASSWORD=secret -d percona/percona-server:tag + +Where `container-name` is the name you want to assign to your container, `secret` is the password to be set for the root user and `tag` is the tag specifying the version you want. See the list above for relevant tags, or look at the [full list of tags](https://registry.hub.docker.com/u/percona/percona-server/tags/manage/). + +## Connect to Percona Server from an Application in Another Docker Container + +This image exposes the standard MySQL port (3306), so container linking makes the instance available to other containers. Start other containers like this in order to link it to the Percona Server container: + + docker run --name app-container-name --link container-name -d app-that-uses-mysql + +## Connect to Percona Server from the MySQL Command Line Client + +The following command starts another container instance and runs the `mysql` command line client against your original container, allowing you to execute SQL statements against your database: + + docker run -it --link container-name --rm percona/percona-server:tag mysql -h container-name -P 3306 -uroot -psecret' + +where `container-name` is the name of your database container. + +# Environment Variables + +When you start a Percona Server container, you can adjust the configuration of the instance by passing one or more environment variables on the `docker run` command line. Do note that none of the variables below will have any effect if you start the container with a data directory that already contains a database: any pre-existing database will always be left untouched on container startup. + +Most of the variables listed below are optional, but one of the variables `MYSQL_ROOT_PASSWORD`, `MYSQL_ALLOW_EMPTY_PASSWORD`, `MYSQL_RANDOM_ROOT_PASSWORD` must be given. + +## `MYSQL_ROOT_PASSWORD` + +This variable specifies a password that will be set for the root superuser account. In the above example, it was set to `secret`. **NOTE:** Setting the MySQL root user password on the command line is insecure. + +## `MYSQL_ROOT_PASSWORD_FILE` + +This variable specifies a file that will be read for the root user account. This can be a mounted file when you run your container. This can also be used in the scope of the Docker Secrets (Swarm mode) functionality. + +## `MYSQL_RANDOM_ROOT_PASSWORD` + +When this variable is set to `yes`, a random password for the server's root user will be generated. The password will be printed to stdout in the container, and it can be obtained by using the command `docker logs container-name`. + +## `MYSQL_ONETIME_PASSWORD` + +This variable is optional. When set to `yes`, the root user's password will be set as expired, and must be changed before we can login normally. This is only supported by version 5.6 or newer. + +## `MYSQL_DATABASE` + +This variable is optional. It allows you to specify the name of a database to be created on image startup. If a user/password was supplied (see below) then that user will be granted superuser access (corresponding to GRANT ALL) to this database. + +## `MYSQL_USER`, `MYSQL_PASSWORD` + +These variables are optional, used in conjunction to create a new user and set that user's password. This user will be granted superuser permissions (see above) for the database specified by the `MYSQL_DATABASE` variable. Both variables are required for a user to be created. + +Do note that there is no need to use this mechanism to create the `root` superuser, that user gets created by default with the password set by either of the mechanisms (given or generated) discussed above. + +## `MYSQL_ALLOW_EMPTY_PASSWORD` + +Set to `yes` to allow the container to be started with a blank password for the root user. **NOTE:** Setting this variable to `yes` is not recommended unless you really know what you are doing, since this will leave your instance completely unprotected, allowing anyone to gain complete superuser access. + +## `INIT_TOKUDB` + +Set to `1` to allow the container to be started with enabled TOKUDB engine. + +## `INIT_ROCKSDB` + +Set to `1` to allow the container to be started with enabled ROCKSDB engine. + +## `MYSQL_INIT_ONLY` + +Set to `1` will skip starting the `mysqld` process and will run only the initialization part if MySQL was not initialized before. + +# Notes, Tips, Gotchas + +## Secure Container Startup + +In many use cases, employing the `MYSQL_ROOT_PASSWORD` variable to specify the MySQL root user password on initial container startup is insecure. Instead, to keep your setup as secure as possible, we strongly recommend using the `MYSQL_RANDOM_ROOT_PASSWORD` option. To further secure your instance, we also recommend using the `MYSQL_ONETIME_PASSWORD` variable if you use version 5.6 or higher. + +## Where to Store Data + +There are many two ways to store data used by applications that run in Docker containers. We maintain our usual stance and encourage users to investigate the options and use the method that best suits their use case. Here are some of the options available: + +* Let Docker manage the storage of your database data by writing the database files to disk on the host system using its own internal volume management. The current solutions, devicemapper, aufs and overlayfs have negative performance records. +* Create a data directory on the host system (outside the container on high performance storage) and mount this to a directory visible from inside the container. This places the database files in a known location on the host system, and makes it easy for tools and applications on the host system to access the files. The user needs to make sure that the directory exists, and that permissions and other security mechanisms on the host system are set up correctly. + +The Docker documentation is a good starting point for understanding the different storage options and variations, and there are multiple blog and forum postings that discuss and give advice in this area. We will simply show the basic procedure here for the latter option above: + +1. Create a data directory on a suitable volume on your host system, e.g. `/local/datadir`. +2. Start your container like this: + +``` + docker run --name container-name -v /local/datadir:/var/lib/mysql -e MYSQL_ROOT_PASSWORD=secret -d percona/percona-server:tag +``` + +The `-v /local/datadir:/var/lib/mysql` part of the command mounts the `/local/datadir` directory from the underlying host system as `/var/lib/mysql` inside the container, where MySQL by default will write its data files. + +Note that users on systems with SELinux enabled may experience problems with this. The current workaround is to assign the relevant SELinux policy type to the new data directory so that the container will be allowed to access it: + + chcon -Rt svirt_sandbox_file_t /local/datadir + +## Existing Data + +If you start your MySQL container instance with a data directory that already contains a data (specifically, a `mysql` subdirectory where all our system tables live), the `$MYSQL_ROOT_PASSWORD` variable should be omitted from the `docker run` command. + +## Port forwarding + +Docker allows mapping of ports on the container to ports on the host system by using the -p option. If you start the container as follows, you can connect to the database by connecting your client to a port on the host machine. This can greatly simplfy consolidating many instances to a single host. In this example port 6603, the we use the address of the Docker host to connect to the TCP port the Docker deamon is forwarding from: + + docker run --name container-name `-p 6603:3306` -d percona/percona-server + mysql -h docker_host_ip -P 6603 + +## Passing options to the server + +You can pass arbitrary command line options to the MySQL server by appending them to the `run command`: + + docker run --name my-container-name -d percona/percona-server --option1=value --option2=value + +In this case, the values of option1 and option2 will be passed directly to the server when it is started. The following command will for instance start your container with UTF-8 as the default setting for character set and collation for all databases in MySQL: + + docker run --name container-name -d percona/percona-server --character-set-server=utf8 --collation-server=utf8_general_ci + +## Using a Custom Percona Server Config File + +The Percona Server startup configuration in these Docker images is specified in the file `/etc/my.cnf`. If you want to customize this configuration for your own purposes, you can create your alternative configuration file in a directory on the host machine and then mount this file in the appropriate location inside the Percona Server container, effectively replacing the standard configuration file. + +If you want to base your changes on the standard configuration file, start your Percona Server container in the standard way described above, then do: + + docker exec -it my-container-name cat /etc/my.cnf > /my/custom/config-file + +... where `/my/custom/config-file` is the path and name of the new configuration file. Then start a new Percona Server container like this: + + docker run --name my-new-container-name -v /my/custom/config-file:/etc/my.cnf -e MYSQL_ROOT_PASSWORD=my-secret-pw -d percona/percona-server:tag + +This will start a new Percona Server container `my-new-container-name` where the Percona Server instance uses the startup options specified in `/my/custom/config-file`. + +# Supported Docker Versions + +These images are officially supported by the MySQL team on Docker version 1.9. Support for older versions (down to 1.0) is provided on a best-effort basis, but we strongly recommend running on the most recent version, since that is assumed for parts of the documentation above. + +# User Feedback + +We welcome your feedback! diff --git a/sources/percona8044/docker-compose.yml b/sources/percona8044/docker-compose.yml new file mode 100644 index 0000000..fed5e73 --- /dev/null +++ b/sources/percona8044/docker-compose.yml @@ -0,0 +1,33 @@ +version: '2' +services: + percona-server: + image: percona/percona-server:8.0 + environment: + MYSQL_ROOT_PASSWORD: secret + ports: + - "3306" + volumes: + # create volumes for use + - /var/lib/mysql + # bind mount my local my.cnf + # - $PWD/my.cnf:/etc/my.cnf.d/my.cnf + +# uncomment sections below if you want to enable PMM +# pmm-server: +# image: percona/pmm-server:latest +# ports: +# - "443:443" +# environment: +# - SERVER_USER=pmm +# - SERVER_PASSWORD=pmm +# pmm-client-ps: +# image: perconalab/pmm-client:latest +# environment: +# - PMM_SERVER=pmm-server:443 +# - PMM_USER=pmm +# - PMM_PASSWORD=pmm +# - DB_TYPE=mysql +# - DB_HOST=percona-server +# - DB_PORT=3306 +# - DB_USER=root +# - DB_PASSWORD=secret diff --git a/sources/percona8044/ps-entry-dockerhub.sh b/sources/percona8044/ps-entry-dockerhub.sh new file mode 100755 index 0000000..9f08ef1 --- /dev/null +++ b/sources/percona8044/ps-entry-dockerhub.sh @@ -0,0 +1,250 @@ +#!/bin/bash +set -eo pipefail +shopt -s nullglob +# if command starts with an option, prepend mysqld +if [ "${1:0:1}" = '-' ]; then + set -- mysqld "$@" +fi +# skip setup if they want an option that stops mysqld +wantHelp= +for arg; do + case "$arg" in + -'?'|--help|--print-defaults|-V|--version) + wantHelp=1 + break + ;; + esac +done + +# usage: file_env VAR [DEFAULT] +# ie: file_env 'XYZ_DB_PASSWORD' 'example' +# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of +# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature) +file_env() { + local var="$1" + local fileVar="${var}_FILE" + local def="${2:-}" + if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then + echo >&2 "error: both $var and $fileVar are set (but are exclusive)" + exit 1 + fi + local val="$def" + if [ "${!var:-}" ]; then + val="${!var}" + elif [ "${!fileVar:-}" ]; then + val="$(< "${!fileVar}")" + fi + export "$var"="$val" + unset "$fileVar" +} + +# usage: process_init_file FILENAME MYSQLCOMMAND... +# ie: process_init_file foo.sh mysql -uroot +# (process a single initializer file, based on its extension. we define this +# function here, so that initializer scripts (*.sh) can use the same logic, +# potentially recursively, or override the logic used in subsequent calls) +process_init_file() { + local f="$1"; shift + local mysql=( "$@" ) + + case "$f" in + *.sh) echo "$0: running $f"; . "$f" ;; + *.sql) echo "$0: running $f"; "${mysql[@]}" < "$f"; echo ;; + *.sql.gz) echo "$0: running $f"; gunzip -c "$f" | "${mysql[@]}"; echo ;; + *) echo "$0: ignoring $f" ;; + esac + echo +} + +_check_config() { + toRun=( "$@" --verbose --help ) + if ! errors="$("${toRun[@]}" 2>&1 >/dev/null)"; then + cat >&2 <<-EOM + + ERROR: mysqld failed while attempting to check config + command was: "${toRun[*]}" + + $errors + EOM + exit 1 + fi +} + +# Fetch value from server config +# We use mysqld --verbose --help instead of my_print_defaults because the +# latter only show values present in config files, and not server defaults +_get_config() { + local conf="$1"; shift + "$@" --verbose --help --log-bin-index="$(mktemp -u)" 2>/dev/null \ + | awk '$1 == "'"$conf"'" && /^[^ \t]/ { sub(/^[^ \t]+[ \t]+/, ""); print; exit }' + # match "datadir /some/path with/spaces in/it here" but not "--xyz=abc\n datadir (xyz)" +} + +if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then + # still need to check config, container may have started with --user + _check_config "$@" + + if [ -n "$INIT_TOKUDB" ]; then + export LD_PRELOAD=/usr/lib64/libjemalloc.so.1 + fi + # Get config + DATADIR="$(_get_config 'datadir' "$@")" + + if [ ! -d "$DATADIR/mysql" ]; then + file_env 'MYSQL_ROOT_PASSWORD' + if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + echo >&2 'error: database is uninitialized and password option is not specified ' + echo >&2 ' You need to specify one of MYSQL_ROOT_PASSWORD, MYSQL_ALLOW_EMPTY_PASSWORD and MYSQL_RANDOM_ROOT_PASSWORD' + exit 1 + fi + + mkdir -p "$DATADIR" + + echo 'Initializing database' + "$@" --initialize-insecure + echo 'Database initialized' + + if command -v mysql_ssl_rsa_setup > /dev/null && [ ! -e "$DATADIR/server-key.pem" ]; then + # https://github.com/mysql/mysql-server/blob/23032807537d8dd8ee4ec1c4d40f0633cd4e12f9/packaging/deb-in/extra/mysql-systemd-start#L81-L84 + echo 'Initializing certificates' + mysql_ssl_rsa_setup --datadir="$DATADIR" + echo 'Certificates initialized' + fi + + SOCKET="$(_get_config 'socket' "$@")" + "$@" --skip-networking --socket="${SOCKET}" & + pid="$!" + + mysql=( mysql --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" --password="" ) + + for i in {120..0}; do + if echo 'SELECT 1' | "${mysql[@]}" &> /dev/null; then + break + fi + echo 'MySQL init process in progress...' + sleep 1 + done + if [ "$i" = 0 ]; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + if [ -z "$MYSQL_INITDB_SKIP_TZINFO" ]; then + ( + echo "SET @@SESSION.SQL_LOG_BIN = off;" + # sed is for https://bugs.mysql.com/bug.php?id=20545 + mysql_tzinfo_to_sql /usr/share/zoneinfo | sed 's/Local time zone must be set--see zic manual page/FCTY/' + ) | "${mysql[@]}" mysql + fi + + # install TokuDB engine + if [ -n "$INIT_TOKUDB" ]; then + ps-admin --docker --enable-tokudb -u root -p $MYSQL_ROOT_PASSWORD + fi + if [ -n "$INIT_ROCKSDB" ]; then + ps-admin --enable-rocksdb -u root -p $MYSQL_ROOT_PASSWORD + fi + + if [ ! -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + MYSQL_ROOT_PASSWORD="$(pwmake 128)" + echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD" + fi + + rootCreate= + # default root to listen for connections from anywhere + file_env 'MYSQL_ROOT_HOST' '%' + if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then + # no, we don't care if read finds a terminating character in this heredoc + # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151 + read -r -d '' rootCreate <<-EOSQL || true + CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ; + EOSQL + fi + + "${mysql[@]}" <<-EOSQL + -- What's done in this file shouldn't be replicated + -- or products like mysql-fabric won't work + SET @@SESSION.SQL_LOG_BIN=0; + + DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'mysql.infoschema', 'mysql.session', 'root') OR host NOT IN ('localhost') ; + ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ; + ${rootCreate} + DROP DATABASE IF EXISTS test ; + FLUSH PRIVILEGES ; + EOSQL + + if [ ! -z "$MYSQL_ROOT_PASSWORD" ]; then + mysql+=( -p"${MYSQL_ROOT_PASSWORD}" ) + fi + + file_env 'MYSQL_DATABASE' + if [ "$MYSQL_DATABASE" ]; then + echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" | "${mysql[@]}" + mysql+=( "$MYSQL_DATABASE" ) + fi + + file_env 'MYSQL_USER' + file_env 'MYSQL_PASSWORD' + if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then + echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" | "${mysql[@]}" + + if [ "$MYSQL_DATABASE" ]; then + echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}" + fi + + echo 'FLUSH PRIVILEGES ;' | "${mysql[@]}" + fi + + echo + ls /docker-entrypoint-initdb.d/ > /dev/null + for f in /docker-entrypoint-initdb.d/*; do + process_init_file "$f" "${mysql[@]}" + done + + if [ ! -z "$MYSQL_ONETIME_PASSWORD" ]; then + "${mysql[@]}" <<-EOSQL + ALTER USER 'root'@'%' PASSWORD EXPIRE; + EOSQL + fi + if ! kill -s TERM "$pid" || ! wait "$pid"; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + echo + echo 'MySQL init process done. Ready for start up.' + echo + fi + + # exit when MYSQL_INIT_ONLY environment variable is set to avoid starting mysqld + if [ ! -z "$MYSQL_INIT_ONLY" ]; then + echo 'Initialization complete, now exiting!' + exit 0 + fi +fi + +if [ ! -z "${PERCONA_INSTANCE_ID}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -i ${PERCONA_INSTANCE_ID}" +fi + +if [ ! -z "${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -j ${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" +fi + +if [ ! -z "${PERCONA_SEND_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -t ${PERCONA_SEND_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -t 7" +fi + +if [ ! -z "${PERCONA_CONNECT_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -c ${PERCONA_CONNECT_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -c 2" +fi + +/call-home.sh -f "PRODUCT_FAMILY_PS" -v "${PS_TELEMETRY_VERSION}" -d "DOCKER" ${CALL_HOME_OPTIONAL_PARAMS} &> /dev/null || : + +exec "$@" diff --git a/sources/percona8044/ps-entry.sh b/sources/percona8044/ps-entry.sh new file mode 100755 index 0000000..a7fe81b --- /dev/null +++ b/sources/percona8044/ps-entry.sh @@ -0,0 +1,253 @@ +#!/bin/bash +set -eo pipefail +shopt -s nullglob +# if command starts with an option, prepend mysqld +if [ "${1:0:1}" = '-' ]; then + set -- mysqld "$@" +fi +# skip setup if they want an option that stops mysqld +wantHelp= +for arg; do + case "$arg" in + -'?'|--help|--print-defaults|-V|--version) + wantHelp=1 + break + ;; + esac +done + +# usage: file_env VAR [DEFAULT] +# ie: file_env 'XYZ_DB_PASSWORD' 'example' +# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of +# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature) +file_env() { + local var="$1" + local fileVar="${var}_FILE" + local def="${2:-}" + if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then + echo >&2 "error: both $var and $fileVar are set (but are exclusive)" + exit 1 + fi + local val="$def" + if [ "${!var:-}" ]; then + val="${!var}" + elif [ "${!fileVar:-}" ]; then + val="$(< "${!fileVar}")" + fi + export "$var"="$val" + unset "$fileVar" +} + +# usage: process_init_file FILENAME MYSQLCOMMAND... +# ie: process_init_file foo.sh mysql -uroot +# (process a single initializer file, based on its extension. we define this +# function here, so that initializer scripts (*.sh) can use the same logic, +# potentially recursively, or override the logic used in subsequent calls) +process_init_file() { + local f="$1"; shift + local mysql=( "$@" ) + + case "$f" in + *.sh) echo "$0: running $f"; . "$f" ;; + *.sql) echo "$0: running $f"; "${mysql[@]}" < "$f"; echo ;; + *.sql.gz) echo "$0: running $f"; gunzip -c "$f" | "${mysql[@]}"; echo ;; + *) echo "$0: ignoring $f" ;; + esac + echo +} + +_check_config() { + toRun=( "$@" --verbose --help ) + if ! errors="$("${toRun[@]}" 2>&1 >/dev/null)"; then + cat >&2 <<-EOM + + ERROR: mysqld failed while attempting to check config + command was: "${toRun[*]}" + + $errors + EOM + exit 1 + fi +} + +# Fetch value from server config +# We use mysqld --verbose --help instead of my_print_defaults because the +# latter only show values present in config files, and not server defaults +_get_config() { + local conf="$1"; shift + "$@" --verbose --help --log-bin-index="$(mktemp -u)" 2>/dev/null \ + | awk '$1 == "'"$conf"'" && /^[^ \t]/ { sub(/^[^ \t]+[ \t]+/, ""); print; exit }' + # match "datadir /some/path with/spaces in/it here" but not "--xyz=abc\n datadir (xyz)" +} + +if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then + # still need to check config, container may have started with --user + _check_config "$@" + + if [ -n "$INIT_TOKUDB" ]; then + export LD_PRELOAD=/usr/lib64/libjemalloc.so.1 + fi + # Get config + DATADIR="$(_get_config 'datadir' "$@")" + + if [ ! -d "$DATADIR/mysql" ]; then + file_env 'MYSQL_ROOT_PASSWORD' + if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + echo >&2 'error: database is uninitialized and password option is not specified ' + echo >&2 ' You need to specify one of MYSQL_ROOT_PASSWORD, MYSQL_ALLOW_EMPTY_PASSWORD and MYSQL_RANDOM_ROOT_PASSWORD' + exit 1 + fi + + mkdir -p "$DATADIR" + + echo 'Initializing database' + "$@" --initialize-insecure + echo 'Database initialized' + + if command -v mysql_ssl_rsa_setup > /dev/null && [ ! -e "$DATADIR/server-key.pem" ]; then + # https://github.com/mysql/mysql-server/blob/23032807537d8dd8ee4ec1c4d40f0633cd4e12f9/packaging/deb-in/extra/mysql-systemd-start#L81-L84 + echo 'Initializing certificates' + mysql_ssl_rsa_setup --datadir="$DATADIR" + echo 'Certificates initialized' + fi + + SOCKET="$(_get_config 'socket' "$@")" + "$@" --skip-networking --socket="${SOCKET}" & + pid="$!" + + mysql=( mysql --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" --password="" ) + + for i in {120..0}; do + if echo 'SELECT 1' | "${mysql[@]}" &> /dev/null; then + break + fi + echo 'MySQL init process in progress...' + sleep 1 + done + if [ "$i" = 0 ]; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + if [ -z "$MYSQL_INITDB_SKIP_TZINFO" ]; then + ( + echo "SET @@SESSION.SQL_LOG_BIN = off;" + # sed is for https://bugs.mysql.com/bug.php?id=20545 + mysql_tzinfo_to_sql /usr/share/zoneinfo | sed 's/Local time zone must be set--see zic manual page/FCTY/' + ) | "${mysql[@]}" mysql + fi + + # install TokuDB engine + if [ -n "$INIT_TOKUDB" ]; then + ps-admin --docker --enable-tokudb -u root -p $MYSQL_ROOT_PASSWORD + fi + if [ -n "$INIT_ROCKSDB" ]; then + ps-admin --enable-rocksdb -u root -p $MYSQL_ROOT_PASSWORD + fi + + if [ ! -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + MYSQL_ROOT_PASSWORD="$(pwmake 128)" + echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD" + fi + + rootCreate= + # default root to listen for connections from anywhere + file_env 'MYSQL_ROOT_HOST' '%' + if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then + # no, we don't care if read finds a terminating character in this heredoc + # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151 + read -r -d '' rootCreate <<-EOSQL || true + CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ; + EOSQL + fi + + "${mysql[@]}" <<-EOSQL + -- What's done in this file shouldn't be replicated + -- or products like mysql-fabric won't work + SET @@SESSION.SQL_LOG_BIN=0; + + DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'mysql.infoschema', 'mysql.session', 'root') OR host NOT IN ('localhost') ; + ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ; + ${rootCreate} + DROP DATABASE IF EXISTS test ; + FLUSH PRIVILEGES ; + EOSQL + + if [ ! -z "$MYSQL_ROOT_PASSWORD" ]; then + mysql+=( -p"${MYSQL_ROOT_PASSWORD}" ) + fi + + file_env 'MYSQL_DATABASE' + if [ "$MYSQL_DATABASE" ]; then + echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" | "${mysql[@]}" + mysql+=( "$MYSQL_DATABASE" ) + fi + + file_env 'MYSQL_USER' + file_env 'MYSQL_PASSWORD' + if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then + echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" | "${mysql[@]}" + + if [ "$MYSQL_DATABASE" ]; then + echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}" + fi + + echo 'FLUSH PRIVILEGES ;' | "${mysql[@]}" + fi + + echo + ls /docker-entrypoint-initdb.d/ > /dev/null + for f in /docker-entrypoint-initdb.d/*; do + process_init_file "$f" "${mysql[@]}" + done + + if [ ! -z "$MYSQL_ONETIME_PASSWORD" ]; then + "${mysql[@]}" <<-EOSQL + ALTER USER 'root'@'%' PASSWORD EXPIRE; + EOSQL + fi + if ! kill -s TERM "$pid" || ! wait "$pid"; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + echo + echo 'MySQL init process done. Ready for start up.' + echo + fi + + # exit when MYSQL_INIT_ONLY environment variable is set to avoid starting mysqld + if [ ! -z "$MYSQL_INIT_ONLY" ]; then + echo 'Initialization complete, now exiting!' + exit 0 + fi +fi + +if [ ! -z "${PERCONA_INSTANCE_ID}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -i ${PERCONA_INSTANCE_ID}" +fi + +if [ ! -z "${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -j ${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" +fi + +if [ ! -z "${PERCONA_SEND_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -t ${PERCONA_SEND_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -t 7" +fi + +if [ ! -z "${PERCONA_CONNECT_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -c ${PERCONA_CONNECT_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -c 2" +fi + +if [[ ${PERCONA_TELEMETRY_DISABLE} -ne "0" ]]; then + exec "$@" --percona_telemetry_disable=1 +else + /usr/bin/telemetry-agent-supervisor.sh & + exec "$@" +fi diff --git a/sources/percona8044/telemetry-agent-supervisor.sh b/sources/percona8044/telemetry-agent-supervisor.sh new file mode 100755 index 0000000..6ad026e --- /dev/null +++ b/sources/percona8044/telemetry-agent-supervisor.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +# phase-0 telemetry +/call-home.sh -f "PRODUCT_FAMILY_PS" -v "${PS_TELEMETRY_VERSION}" -d "DOCKER" ${CALL_HOME_OPTIONAL_PARAMS} &> /dev/null || : + +# phase-1 telemetry +for i in {1..3}; do + /usr/bin/percona-telemetry-agent >> /var/log/percona/telemetry-agent.log 2>> /var/log/percona/telemetry-agent-error.log + if [ $? -eq 0 ]; then + break + fi + sleep 5 +done +sleep infinity diff --git a/sources/percona844/Dockerfile b/sources/percona844/Dockerfile new file mode 100644 index 0000000..b9f0aff --- /dev/null +++ b/sources/percona844/Dockerfile @@ -0,0 +1,140 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +ENV PS_VERSION 8.4.4-4.1 +ENV MYSQL_SHELL_VERSION 8.4.4-1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.4.4-4-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 +# Do not report during Docker image creation. +# Note that doing so, would create telemetry config file +# which would prevent reporting when new container is started. +# If we want to track Docker image creation as well, +# remove telemetry config file after installing packages! +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + percona-release disable all; \ + percona-release enable ps-84-lts ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/j/jemalloc-5.2.1-2.el9.x86_64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/g/gflags-2.2.2-9.el9.x86_64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + #microdnf -y install epel-release; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona844/Dockerfile-dockerhub b/sources/percona844/Dockerfile-dockerhub new file mode 100644 index 0000000..0a3d6f6 --- /dev/null +++ b/sources/percona844/Dockerfile-dockerhub @@ -0,0 +1,128 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +ENV PS_VERSION 8.4.4-4.1 +ENV MYSQL_SHELL_VERSION 8.4.4-1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.4.4-4-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 +# Do not report during Docker image creation. +# Note that doing so, would create telemetry config file +# which would prevent reporting when new container is started. +# If we want to track Docker image creation as well, +# remove telemetry config file after installing packages! +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + percona-release disable all; \ + percona-release enable ps-84-lts ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/j/jemalloc-5.2.1-2.el9.x86_64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/g/gflags-2.2.2-9.el9.x86_64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + #microdnf -y install epel-release; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry-dockerhub.sh /docker-entrypoint.sh +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona844/Dockerfile.aarch64 b/sources/percona844/Dockerfile.aarch64 new file mode 100644 index 0000000..f81febd --- /dev/null +++ b/sources/percona844/Dockerfile.aarch64 @@ -0,0 +1,137 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +ENV PS_VERSION 8.4.4-4.1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.4.4-4-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +# Do not report during Docker image creation. +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + #yum -y install epel-release; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + sed -i "s|x86_64|x86_64 aarch64|" /usr/bin/percona-release; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + #microdnf -y module disable mysql; \ + percona-release disable all; \ + percona-release enable ps-84-lts ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + rm -rf /tmp/percona-*; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/j/jemalloc-5.2.1-2.el9.aarch64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/g/gflags-2.2.2-9.el9.aarch64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-telemetry-agent; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ + +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona844/README-build.md b/sources/percona844/README-build.md new file mode 100644 index 0000000..b801e9a --- /dev/null +++ b/sources/percona844/README-build.md @@ -0,0 +1,40 @@ +Build image + + `docker build -t percona-server Dockerfile` + +or + + `docker build -t percona-server Dockerfile` + +Tag image + + `docker tag percona/percona-server:8.4` + +Push to hub + + `docker push percona/percona-server:8.4` + +Usage +===== + + vi ./docker-compose.yml + percona: + image: percona/percona-server:latest + name: perconaserver + environment: + MYSQL_ROOT_PASSWORD: secret + ports: + - "3306" + volumes: + # create volumes for use + - /var/log/mysql + - /var/lib/mysql + # bind mount my local my.cnf + # - $PWD/my.cnf:/etc/my.cnf + command: + # Workaround for no my.cnf in image + - '--user=mysql' + 7) Start the container from cli + docker-compose up + 8) Check status + docker-compose ps diff --git a/sources/percona844/README.md b/sources/percona844/README.md new file mode 100644 index 0000000..1d7d74b --- /dev/null +++ b/sources/percona844/README.md @@ -0,0 +1,158 @@ +![logo](https://www.percona.com/wp-content/uploads/2023/03/font-1.jpg) + +# What is Percona Server? + +Percona Server is an enhanced drop-in replacement for MySQL. With Percona Server, your queries will run faster and more consistently. You will consolidate servers on powerful hardware and will delay sharding, or avoid it entirely. + +For more information and related downloads for Percona Server and other Percona products, please visit http://www.percona.com. + +# Percona Server Docker Images + +These are the only official Percona Server Docker images, created and maintained by the Percona team. The image has the Percona Fractal Tree based storage engine `TokuDB` enabled. The available versions are: + + Percona Server 8.4.4-4.1 (tag: 8.4) + +Images are updated when new releases are published. + +# How to Use the Images + +## Start a Percona Server Instance + +Start a Percona Server container as follows: + + docker run --name container-name -e MYSQL_ROOT_PASSWORD=secret -d percona/percona-server:tag + +Where `container-name` is the name you want to assign to your container, `secret` is the password to be set for the root user and `tag` is the tag specifying the version you want. See the list above for relevant tags, or look at the [full list of tags](https://registry.hub.docker.com/u/percona/percona-server/tags/manage/). + +## Connect to Percona Server from an Application in Another Docker Container + +This image exposes the standard MySQL port (3306), so container linking makes the instance available to other containers. Start other containers like this in order to link it to the Percona Server container: + + docker run --name app-container-name --link container-name -d app-that-uses-mysql + +## Connect to Percona Server from the MySQL Command Line Client + +The following command starts another container instance and runs the `mysql` command line client against your original container, allowing you to execute SQL statements against your database: + + docker run -it --link container-name --rm percona/percona-server:tag mysql -h container-name -P 3306 -uroot -psecret' + +where `container-name` is the name of your database container. + +# Environment Variables + +When you start a Percona Server container, you can adjust the configuration of the instance by passing one or more environment variables on the `docker run` command line. Do note that none of the variables below will have any effect if you start the container with a data directory that already contains a database: any pre-existing database will always be left untouched on container startup. + +Most of the variables listed below are optional, but one of the variables `MYSQL_ROOT_PASSWORD`, `MYSQL_ALLOW_EMPTY_PASSWORD`, `MYSQL_RANDOM_ROOT_PASSWORD` must be given. + +## `MYSQL_ROOT_PASSWORD` + +This variable specifies a password that will be set for the root superuser account. In the above example, it was set to `secret`. **NOTE:** Setting the MySQL root user password on the command line is insecure. + +## `MYSQL_ROOT_PASSWORD_FILE` + +This variable specifies a file that will be read for the root user account. This can be a mounted file when you run your container. This can also be used in the scope of the Docker Secrets (Swarm mode) functionality. + +## `MYSQL_RANDOM_ROOT_PASSWORD` + +When this variable is set to `yes`, a random password for the server's root user will be generated. The password will be printed to stdout in the container, and it can be obtained by using the command `docker logs container-name`. + +## `MYSQL_ONETIME_PASSWORD` + +This variable is optional. When set to `yes`, the root user's password will be set as expired, and must be changed before we can login normally. This is only supported by version 5.6 or newer. + +## `MYSQL_DATABASE` + +This variable is optional. It allows you to specify the name of a database to be created on image startup. If a user/password was supplied (see below) then that user will be granted superuser access (corresponding to GRANT ALL) to this database. + +## `MYSQL_USER`, `MYSQL_PASSWORD` + +These variables are optional, used in conjunction to create a new user and set that user's password. This user will be granted superuser permissions (see above) for the database specified by the `MYSQL_DATABASE` variable. Both variables are required for a user to be created. + +Do note that there is no need to use this mechanism to create the `root` superuser, that user gets created by default with the password set by either of the mechanisms (given or generated) discussed above. + +## `MYSQL_ALLOW_EMPTY_PASSWORD` + +Set to `yes` to allow the container to be started with a blank password for the root user. **NOTE:** Setting this variable to `yes` is not recommended unless you really know what you are doing, since this will leave your instance completely unprotected, allowing anyone to gain complete superuser access. + +## `INIT_TOKUDB` + +Set to `1` to allow the container to be started with enabled TOKUDB engine. + +## `INIT_ROCKSDB` + +Set to `1` to allow the container to be started with enabled ROCKSDB engine. + +## `MYSQL_INIT_ONLY` + +Set to `1` will skip starting the `mysqld` process and will run only the initialization part if MySQL was not initialized before. + +# Notes, Tips, Gotchas + +## Secure Container Startup + +In many use cases, employing the `MYSQL_ROOT_PASSWORD` variable to specify the MySQL root user password on initial container startup is insecure. Instead, to keep your setup as secure as possible, we strongly recommend using the `MYSQL_RANDOM_ROOT_PASSWORD` option. To further secure your instance, we also recommend using the `MYSQL_ONETIME_PASSWORD` variable if you use version 5.6 or higher. + +## Where to Store Data + +There are many two ways to store data used by applications that run in Docker containers. We maintain our usual stance and encourage users to investigate the options and use the method that best suits their use case. Here are some of the options available: + +* Let Docker manage the storage of your database data by writing the database files to disk on the host system using its own internal volume management. The current solutions, devicemapper, aufs and overlayfs have negative performance records. +* Create a data directory on the host system (outside the container on high performance storage) and mount this to a directory visible from inside the container. This places the database files in a known location on the host system, and makes it easy for tools and applications on the host system to access the files. The user needs to make sure that the directory exists, and that permissions and other security mechanisms on the host system are set up correctly. + +The Docker documentation is a good starting point for understanding the different storage options and variations, and there are multiple blog and forum postings that discuss and give advice in this area. We will simply show the basic procedure here for the latter option above: + +1. Create a data directory on a suitable volume on your host system, e.g. `/local/datadir`. +2. Start your container like this: + +``` + docker run --name container-name -v /local/datadir:/var/lib/mysql -e MYSQL_ROOT_PASSWORD=secret -d percona/percona-server:tag +``` + +The `-v /local/datadir:/var/lib/mysql` part of the command mounts the `/local/datadir` directory from the underlying host system as `/var/lib/mysql` inside the container, where MySQL by default will write its data files. + +Note that users on systems with SELinux enabled may experience problems with this. The current workaround is to assign the relevant SELinux policy type to the new data directory so that the container will be allowed to access it: + + chcon -Rt svirt_sandbox_file_t /local/datadir + +## Existing Data + +If you start your MySQL container instance with a data directory that already contains a data (specifically, a `mysql` subdirectory where all our system tables live), the `$MYSQL_ROOT_PASSWORD` variable should be omitted from the `docker run` command. + +## Port forwarding + +Docker allows mapping of ports on the container to ports on the host system by using the -p option. If you start the container as follows, you can connect to the database by connecting your client to a port on the host machine. This can greatly simplfy consolidating many instances to a single host. In this example port 6603, the we use the address of the Docker host to connect to the TCP port the Docker deamon is forwarding from: + + docker run --name container-name `-p 6603:3306` -d percona/percona-server + mysql -h docker_host_ip -P 6603 + +## Passing options to the server + +You can pass arbitrary command line options to the MySQL server by appending them to the `run command`: + + docker run --name my-container-name -d percona/percona-server --option1=value --option2=value + +In this case, the values of option1 and option2 will be passed directly to the server when it is started. The following command will for instance start your container with UTF-8 as the default setting for character set and collation for all databases in MySQL: + + docker run --name container-name -d percona/percona-server --character-set-server=utf8 --collation-server=utf8_general_ci + +## Using a Custom Percona Server Config File + +The Percona Server startup configuration in these Docker images is specified in the file `/etc/my.cnf`. If you want to customize this configuration for your own purposes, you can create your alternative configuration file in a directory on the host machine and then mount this file in the appropriate location inside the Percona Server container, effectively replacing the standard configuration file. + +If you want to base your changes on the standard configuration file, start your Percona Server container in the standard way described above, then do: + + docker exec -it my-container-name cat /etc/my.cnf > /my/custom/config-file + +... where `/my/custom/config-file` is the path and name of the new configuration file. Then start a new Percona Server container like this: + + docker run --name my-new-container-name -v /my/custom/config-file:/etc/my.cnf -e MYSQL_ROOT_PASSWORD=my-secret-pw -d percona/percona-server:tag + +This will start a new Percona Server container `my-new-container-name` where the Percona Server instance uses the startup options specified in `/my/custom/config-file`. + +# Supported Docker Versions + +These images are officially supported by the MySQL team on Docker version 1.9. Support for older versions (down to 1.0) is provided on a best-effort basis, but we strongly recommend running on the most recent version, since that is assumed for parts of the documentation above. + +# User Feedback + +We welcome your feedback! diff --git a/sources/percona844/docker-compose.yml b/sources/percona844/docker-compose.yml new file mode 100644 index 0000000..5061086 --- /dev/null +++ b/sources/percona844/docker-compose.yml @@ -0,0 +1,33 @@ +version: '2' +services: + percona-server: + image: percona/percona-server:8.4 + environment: + MYSQL_ROOT_PASSWORD: secret + ports: + - "3306" + volumes: + # create volumes for use + - /var/lib/mysql + # bind mount my local my.cnf + # - $PWD/my.cnf:/etc/my.cnf.d/my.cnf + +# uncomment sections below if you want to enable PMM +# pmm-server: +# image: percona/pmm-server:latest +# ports: +# - "443:443" +# environment: +# - SERVER_USER=pmm +# - SERVER_PASSWORD=pmm +# pmm-client-ps: +# image: perconalab/pmm-client:latest +# environment: +# - PMM_SERVER=pmm-server:443 +# - PMM_USER=pmm +# - PMM_PASSWORD=pmm +# - DB_TYPE=mysql +# - DB_HOST=percona-server +# - DB_PORT=3306 +# - DB_USER=root +# - DB_PASSWORD=secret diff --git a/sources/percona844/ps-entry-dockerhub.sh b/sources/percona844/ps-entry-dockerhub.sh new file mode 100755 index 0000000..9f08ef1 --- /dev/null +++ b/sources/percona844/ps-entry-dockerhub.sh @@ -0,0 +1,250 @@ +#!/bin/bash +set -eo pipefail +shopt -s nullglob +# if command starts with an option, prepend mysqld +if [ "${1:0:1}" = '-' ]; then + set -- mysqld "$@" +fi +# skip setup if they want an option that stops mysqld +wantHelp= +for arg; do + case "$arg" in + -'?'|--help|--print-defaults|-V|--version) + wantHelp=1 + break + ;; + esac +done + +# usage: file_env VAR [DEFAULT] +# ie: file_env 'XYZ_DB_PASSWORD' 'example' +# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of +# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature) +file_env() { + local var="$1" + local fileVar="${var}_FILE" + local def="${2:-}" + if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then + echo >&2 "error: both $var and $fileVar are set (but are exclusive)" + exit 1 + fi + local val="$def" + if [ "${!var:-}" ]; then + val="${!var}" + elif [ "${!fileVar:-}" ]; then + val="$(< "${!fileVar}")" + fi + export "$var"="$val" + unset "$fileVar" +} + +# usage: process_init_file FILENAME MYSQLCOMMAND... +# ie: process_init_file foo.sh mysql -uroot +# (process a single initializer file, based on its extension. we define this +# function here, so that initializer scripts (*.sh) can use the same logic, +# potentially recursively, or override the logic used in subsequent calls) +process_init_file() { + local f="$1"; shift + local mysql=( "$@" ) + + case "$f" in + *.sh) echo "$0: running $f"; . "$f" ;; + *.sql) echo "$0: running $f"; "${mysql[@]}" < "$f"; echo ;; + *.sql.gz) echo "$0: running $f"; gunzip -c "$f" | "${mysql[@]}"; echo ;; + *) echo "$0: ignoring $f" ;; + esac + echo +} + +_check_config() { + toRun=( "$@" --verbose --help ) + if ! errors="$("${toRun[@]}" 2>&1 >/dev/null)"; then + cat >&2 <<-EOM + + ERROR: mysqld failed while attempting to check config + command was: "${toRun[*]}" + + $errors + EOM + exit 1 + fi +} + +# Fetch value from server config +# We use mysqld --verbose --help instead of my_print_defaults because the +# latter only show values present in config files, and not server defaults +_get_config() { + local conf="$1"; shift + "$@" --verbose --help --log-bin-index="$(mktemp -u)" 2>/dev/null \ + | awk '$1 == "'"$conf"'" && /^[^ \t]/ { sub(/^[^ \t]+[ \t]+/, ""); print; exit }' + # match "datadir /some/path with/spaces in/it here" but not "--xyz=abc\n datadir (xyz)" +} + +if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then + # still need to check config, container may have started with --user + _check_config "$@" + + if [ -n "$INIT_TOKUDB" ]; then + export LD_PRELOAD=/usr/lib64/libjemalloc.so.1 + fi + # Get config + DATADIR="$(_get_config 'datadir' "$@")" + + if [ ! -d "$DATADIR/mysql" ]; then + file_env 'MYSQL_ROOT_PASSWORD' + if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + echo >&2 'error: database is uninitialized and password option is not specified ' + echo >&2 ' You need to specify one of MYSQL_ROOT_PASSWORD, MYSQL_ALLOW_EMPTY_PASSWORD and MYSQL_RANDOM_ROOT_PASSWORD' + exit 1 + fi + + mkdir -p "$DATADIR" + + echo 'Initializing database' + "$@" --initialize-insecure + echo 'Database initialized' + + if command -v mysql_ssl_rsa_setup > /dev/null && [ ! -e "$DATADIR/server-key.pem" ]; then + # https://github.com/mysql/mysql-server/blob/23032807537d8dd8ee4ec1c4d40f0633cd4e12f9/packaging/deb-in/extra/mysql-systemd-start#L81-L84 + echo 'Initializing certificates' + mysql_ssl_rsa_setup --datadir="$DATADIR" + echo 'Certificates initialized' + fi + + SOCKET="$(_get_config 'socket' "$@")" + "$@" --skip-networking --socket="${SOCKET}" & + pid="$!" + + mysql=( mysql --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" --password="" ) + + for i in {120..0}; do + if echo 'SELECT 1' | "${mysql[@]}" &> /dev/null; then + break + fi + echo 'MySQL init process in progress...' + sleep 1 + done + if [ "$i" = 0 ]; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + if [ -z "$MYSQL_INITDB_SKIP_TZINFO" ]; then + ( + echo "SET @@SESSION.SQL_LOG_BIN = off;" + # sed is for https://bugs.mysql.com/bug.php?id=20545 + mysql_tzinfo_to_sql /usr/share/zoneinfo | sed 's/Local time zone must be set--see zic manual page/FCTY/' + ) | "${mysql[@]}" mysql + fi + + # install TokuDB engine + if [ -n "$INIT_TOKUDB" ]; then + ps-admin --docker --enable-tokudb -u root -p $MYSQL_ROOT_PASSWORD + fi + if [ -n "$INIT_ROCKSDB" ]; then + ps-admin --enable-rocksdb -u root -p $MYSQL_ROOT_PASSWORD + fi + + if [ ! -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + MYSQL_ROOT_PASSWORD="$(pwmake 128)" + echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD" + fi + + rootCreate= + # default root to listen for connections from anywhere + file_env 'MYSQL_ROOT_HOST' '%' + if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then + # no, we don't care if read finds a terminating character in this heredoc + # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151 + read -r -d '' rootCreate <<-EOSQL || true + CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ; + EOSQL + fi + + "${mysql[@]}" <<-EOSQL + -- What's done in this file shouldn't be replicated + -- or products like mysql-fabric won't work + SET @@SESSION.SQL_LOG_BIN=0; + + DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'mysql.infoschema', 'mysql.session', 'root') OR host NOT IN ('localhost') ; + ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ; + ${rootCreate} + DROP DATABASE IF EXISTS test ; + FLUSH PRIVILEGES ; + EOSQL + + if [ ! -z "$MYSQL_ROOT_PASSWORD" ]; then + mysql+=( -p"${MYSQL_ROOT_PASSWORD}" ) + fi + + file_env 'MYSQL_DATABASE' + if [ "$MYSQL_DATABASE" ]; then + echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" | "${mysql[@]}" + mysql+=( "$MYSQL_DATABASE" ) + fi + + file_env 'MYSQL_USER' + file_env 'MYSQL_PASSWORD' + if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then + echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" | "${mysql[@]}" + + if [ "$MYSQL_DATABASE" ]; then + echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}" + fi + + echo 'FLUSH PRIVILEGES ;' | "${mysql[@]}" + fi + + echo + ls /docker-entrypoint-initdb.d/ > /dev/null + for f in /docker-entrypoint-initdb.d/*; do + process_init_file "$f" "${mysql[@]}" + done + + if [ ! -z "$MYSQL_ONETIME_PASSWORD" ]; then + "${mysql[@]}" <<-EOSQL + ALTER USER 'root'@'%' PASSWORD EXPIRE; + EOSQL + fi + if ! kill -s TERM "$pid" || ! wait "$pid"; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + echo + echo 'MySQL init process done. Ready for start up.' + echo + fi + + # exit when MYSQL_INIT_ONLY environment variable is set to avoid starting mysqld + if [ ! -z "$MYSQL_INIT_ONLY" ]; then + echo 'Initialization complete, now exiting!' + exit 0 + fi +fi + +if [ ! -z "${PERCONA_INSTANCE_ID}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -i ${PERCONA_INSTANCE_ID}" +fi + +if [ ! -z "${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -j ${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" +fi + +if [ ! -z "${PERCONA_SEND_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -t ${PERCONA_SEND_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -t 7" +fi + +if [ ! -z "${PERCONA_CONNECT_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -c ${PERCONA_CONNECT_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -c 2" +fi + +/call-home.sh -f "PRODUCT_FAMILY_PS" -v "${PS_TELEMETRY_VERSION}" -d "DOCKER" ${CALL_HOME_OPTIONAL_PARAMS} &> /dev/null || : + +exec "$@" diff --git a/sources/percona844/ps-entry.sh b/sources/percona844/ps-entry.sh new file mode 100755 index 0000000..a7fe81b --- /dev/null +++ b/sources/percona844/ps-entry.sh @@ -0,0 +1,253 @@ +#!/bin/bash +set -eo pipefail +shopt -s nullglob +# if command starts with an option, prepend mysqld +if [ "${1:0:1}" = '-' ]; then + set -- mysqld "$@" +fi +# skip setup if they want an option that stops mysqld +wantHelp= +for arg; do + case "$arg" in + -'?'|--help|--print-defaults|-V|--version) + wantHelp=1 + break + ;; + esac +done + +# usage: file_env VAR [DEFAULT] +# ie: file_env 'XYZ_DB_PASSWORD' 'example' +# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of +# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature) +file_env() { + local var="$1" + local fileVar="${var}_FILE" + local def="${2:-}" + if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then + echo >&2 "error: both $var and $fileVar are set (but are exclusive)" + exit 1 + fi + local val="$def" + if [ "${!var:-}" ]; then + val="${!var}" + elif [ "${!fileVar:-}" ]; then + val="$(< "${!fileVar}")" + fi + export "$var"="$val" + unset "$fileVar" +} + +# usage: process_init_file FILENAME MYSQLCOMMAND... +# ie: process_init_file foo.sh mysql -uroot +# (process a single initializer file, based on its extension. we define this +# function here, so that initializer scripts (*.sh) can use the same logic, +# potentially recursively, or override the logic used in subsequent calls) +process_init_file() { + local f="$1"; shift + local mysql=( "$@" ) + + case "$f" in + *.sh) echo "$0: running $f"; . "$f" ;; + *.sql) echo "$0: running $f"; "${mysql[@]}" < "$f"; echo ;; + *.sql.gz) echo "$0: running $f"; gunzip -c "$f" | "${mysql[@]}"; echo ;; + *) echo "$0: ignoring $f" ;; + esac + echo +} + +_check_config() { + toRun=( "$@" --verbose --help ) + if ! errors="$("${toRun[@]}" 2>&1 >/dev/null)"; then + cat >&2 <<-EOM + + ERROR: mysqld failed while attempting to check config + command was: "${toRun[*]}" + + $errors + EOM + exit 1 + fi +} + +# Fetch value from server config +# We use mysqld --verbose --help instead of my_print_defaults because the +# latter only show values present in config files, and not server defaults +_get_config() { + local conf="$1"; shift + "$@" --verbose --help --log-bin-index="$(mktemp -u)" 2>/dev/null \ + | awk '$1 == "'"$conf"'" && /^[^ \t]/ { sub(/^[^ \t]+[ \t]+/, ""); print; exit }' + # match "datadir /some/path with/spaces in/it here" but not "--xyz=abc\n datadir (xyz)" +} + +if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then + # still need to check config, container may have started with --user + _check_config "$@" + + if [ -n "$INIT_TOKUDB" ]; then + export LD_PRELOAD=/usr/lib64/libjemalloc.so.1 + fi + # Get config + DATADIR="$(_get_config 'datadir' "$@")" + + if [ ! -d "$DATADIR/mysql" ]; then + file_env 'MYSQL_ROOT_PASSWORD' + if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + echo >&2 'error: database is uninitialized and password option is not specified ' + echo >&2 ' You need to specify one of MYSQL_ROOT_PASSWORD, MYSQL_ALLOW_EMPTY_PASSWORD and MYSQL_RANDOM_ROOT_PASSWORD' + exit 1 + fi + + mkdir -p "$DATADIR" + + echo 'Initializing database' + "$@" --initialize-insecure + echo 'Database initialized' + + if command -v mysql_ssl_rsa_setup > /dev/null && [ ! -e "$DATADIR/server-key.pem" ]; then + # https://github.com/mysql/mysql-server/blob/23032807537d8dd8ee4ec1c4d40f0633cd4e12f9/packaging/deb-in/extra/mysql-systemd-start#L81-L84 + echo 'Initializing certificates' + mysql_ssl_rsa_setup --datadir="$DATADIR" + echo 'Certificates initialized' + fi + + SOCKET="$(_get_config 'socket' "$@")" + "$@" --skip-networking --socket="${SOCKET}" & + pid="$!" + + mysql=( mysql --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" --password="" ) + + for i in {120..0}; do + if echo 'SELECT 1' | "${mysql[@]}" &> /dev/null; then + break + fi + echo 'MySQL init process in progress...' + sleep 1 + done + if [ "$i" = 0 ]; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + if [ -z "$MYSQL_INITDB_SKIP_TZINFO" ]; then + ( + echo "SET @@SESSION.SQL_LOG_BIN = off;" + # sed is for https://bugs.mysql.com/bug.php?id=20545 + mysql_tzinfo_to_sql /usr/share/zoneinfo | sed 's/Local time zone must be set--see zic manual page/FCTY/' + ) | "${mysql[@]}" mysql + fi + + # install TokuDB engine + if [ -n "$INIT_TOKUDB" ]; then + ps-admin --docker --enable-tokudb -u root -p $MYSQL_ROOT_PASSWORD + fi + if [ -n "$INIT_ROCKSDB" ]; then + ps-admin --enable-rocksdb -u root -p $MYSQL_ROOT_PASSWORD + fi + + if [ ! -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + MYSQL_ROOT_PASSWORD="$(pwmake 128)" + echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD" + fi + + rootCreate= + # default root to listen for connections from anywhere + file_env 'MYSQL_ROOT_HOST' '%' + if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then + # no, we don't care if read finds a terminating character in this heredoc + # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151 + read -r -d '' rootCreate <<-EOSQL || true + CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ; + EOSQL + fi + + "${mysql[@]}" <<-EOSQL + -- What's done in this file shouldn't be replicated + -- or products like mysql-fabric won't work + SET @@SESSION.SQL_LOG_BIN=0; + + DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'mysql.infoschema', 'mysql.session', 'root') OR host NOT IN ('localhost') ; + ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ; + ${rootCreate} + DROP DATABASE IF EXISTS test ; + FLUSH PRIVILEGES ; + EOSQL + + if [ ! -z "$MYSQL_ROOT_PASSWORD" ]; then + mysql+=( -p"${MYSQL_ROOT_PASSWORD}" ) + fi + + file_env 'MYSQL_DATABASE' + if [ "$MYSQL_DATABASE" ]; then + echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" | "${mysql[@]}" + mysql+=( "$MYSQL_DATABASE" ) + fi + + file_env 'MYSQL_USER' + file_env 'MYSQL_PASSWORD' + if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then + echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" | "${mysql[@]}" + + if [ "$MYSQL_DATABASE" ]; then + echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}" + fi + + echo 'FLUSH PRIVILEGES ;' | "${mysql[@]}" + fi + + echo + ls /docker-entrypoint-initdb.d/ > /dev/null + for f in /docker-entrypoint-initdb.d/*; do + process_init_file "$f" "${mysql[@]}" + done + + if [ ! -z "$MYSQL_ONETIME_PASSWORD" ]; then + "${mysql[@]}" <<-EOSQL + ALTER USER 'root'@'%' PASSWORD EXPIRE; + EOSQL + fi + if ! kill -s TERM "$pid" || ! wait "$pid"; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + echo + echo 'MySQL init process done. Ready for start up.' + echo + fi + + # exit when MYSQL_INIT_ONLY environment variable is set to avoid starting mysqld + if [ ! -z "$MYSQL_INIT_ONLY" ]; then + echo 'Initialization complete, now exiting!' + exit 0 + fi +fi + +if [ ! -z "${PERCONA_INSTANCE_ID}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -i ${PERCONA_INSTANCE_ID}" +fi + +if [ ! -z "${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -j ${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" +fi + +if [ ! -z "${PERCONA_SEND_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -t ${PERCONA_SEND_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -t 7" +fi + +if [ ! -z "${PERCONA_CONNECT_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -c ${PERCONA_CONNECT_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -c 2" +fi + +if [[ ${PERCONA_TELEMETRY_DISABLE} -ne "0" ]]; then + exec "$@" --percona_telemetry_disable=1 +else + /usr/bin/telemetry-agent-supervisor.sh & + exec "$@" +fi diff --git a/sources/percona844/telemetry-agent-supervisor.sh b/sources/percona844/telemetry-agent-supervisor.sh new file mode 100755 index 0000000..6ad026e --- /dev/null +++ b/sources/percona844/telemetry-agent-supervisor.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +# phase-0 telemetry +/call-home.sh -f "PRODUCT_FAMILY_PS" -v "${PS_TELEMETRY_VERSION}" -d "DOCKER" ${CALL_HOME_OPTIONAL_PARAMS} &> /dev/null || : + +# phase-1 telemetry +for i in {1..3}; do + /usr/bin/percona-telemetry-agent >> /var/log/percona/telemetry-agent.log 2>> /var/log/percona/telemetry-agent-error.log + if [ $? -eq 0 ]; then + break + fi + sleep 5 +done +sleep infinity diff --git a/sources/percona845/Dockerfile b/sources/percona845/Dockerfile new file mode 100644 index 0000000..3339bbb --- /dev/null +++ b/sources/percona845/Dockerfile @@ -0,0 +1,140 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +ENV PS_VERSION 8.4.5-5.1 +ENV MYSQL_SHELL_VERSION 8.4.5-1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.4.5-5-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 +# Do not report during Docker image creation. +# Note that doing so, would create telemetry config file +# which would prevent reporting when new container is started. +# If we want to track Docker image creation as well, +# remove telemetry config file after installing packages! +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + percona-release disable all; \ + percona-release enable ps-84-lts ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/j/jemalloc-5.2.1-2.el9.x86_64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/g/gflags-2.2.2-9.el9.x86_64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + #microdnf -y install epel-release; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona845/Dockerfile-dockerhub b/sources/percona845/Dockerfile-dockerhub new file mode 100644 index 0000000..cc221ff --- /dev/null +++ b/sources/percona845/Dockerfile-dockerhub @@ -0,0 +1,128 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +ENV PS_VERSION 8.4.5-5.1 +ENV MYSQL_SHELL_VERSION 8.4.5-1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.4.5-5-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 +# Do not report during Docker image creation. +# Note that doing so, would create telemetry config file +# which would prevent reporting when new container is started. +# If we want to track Docker image creation as well, +# remove telemetry config file after installing packages! +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + percona-release disable all; \ + percona-release enable ps-84-lts ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/j/jemalloc-5.2.1-2.el9.x86_64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/g/gflags-2.2.2-9.el9.x86_64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + #microdnf -y install epel-release; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry-dockerhub.sh /docker-entrypoint.sh +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona845/Dockerfile.aarch64 b/sources/percona845/Dockerfile.aarch64 new file mode 100644 index 0000000..191a73e --- /dev/null +++ b/sources/percona845/Dockerfile.aarch64 @@ -0,0 +1,137 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +ENV PS_VERSION 8.4.5-5.1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.4.5-5-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +# Do not report during Docker image creation. +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + #yum -y install epel-release; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + sed -i "s|x86_64|x86_64 aarch64|" /usr/bin/percona-release; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + #microdnf -y module disable mysql; \ + percona-release disable all; \ + percona-release enable ps-84-lts ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + rm -rf /tmp/percona-*; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/j/jemalloc-5.2.1-2.el9.aarch64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/g/gflags-2.2.2-9.el9.aarch64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-telemetry-agent; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ + +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona845/README-build.md b/sources/percona845/README-build.md new file mode 100644 index 0000000..b801e9a --- /dev/null +++ b/sources/percona845/README-build.md @@ -0,0 +1,40 @@ +Build image + + `docker build -t percona-server Dockerfile` + +or + + `docker build -t percona-server Dockerfile` + +Tag image + + `docker tag percona/percona-server:8.4` + +Push to hub + + `docker push percona/percona-server:8.4` + +Usage +===== + + vi ./docker-compose.yml + percona: + image: percona/percona-server:latest + name: perconaserver + environment: + MYSQL_ROOT_PASSWORD: secret + ports: + - "3306" + volumes: + # create volumes for use + - /var/log/mysql + - /var/lib/mysql + # bind mount my local my.cnf + # - $PWD/my.cnf:/etc/my.cnf + command: + # Workaround for no my.cnf in image + - '--user=mysql' + 7) Start the container from cli + docker-compose up + 8) Check status + docker-compose ps diff --git a/sources/percona845/README.md b/sources/percona845/README.md new file mode 100644 index 0000000..b0a254a --- /dev/null +++ b/sources/percona845/README.md @@ -0,0 +1,158 @@ +![logo](https://www.percona.com/wp-content/uploads/2023/03/font-1.jpg) + +# What is Percona Server? + +Percona Server is an enhanced drop-in replacement for MySQL. With Percona Server, your queries will run faster and more consistently. You will consolidate servers on powerful hardware and will delay sharding, or avoid it entirely. + +For more information and related downloads for Percona Server and other Percona products, please visit http://www.percona.com. + +# Percona Server Docker Images + +These are the only official Percona Server Docker images, created and maintained by the Percona team. The image has the Percona Fractal Tree based storage engine `TokuDB` enabled. The available versions are: + + Percona Server 8.4.5-5.1 (tag: 8.4) + +Images are updated when new releases are published. + +# How to Use the Images + +## Start a Percona Server Instance + +Start a Percona Server container as follows: + + docker run --name container-name -e MYSQL_ROOT_PASSWORD=secret -d percona/percona-server:tag + +Where `container-name` is the name you want to assign to your container, `secret` is the password to be set for the root user and `tag` is the tag specifying the version you want. See the list above for relevant tags, or look at the [full list of tags](https://registry.hub.docker.com/u/percona/percona-server/tags/manage/). + +## Connect to Percona Server from an Application in Another Docker Container + +This image exposes the standard MySQL port (3306), so container linking makes the instance available to other containers. Start other containers like this in order to link it to the Percona Server container: + + docker run --name app-container-name --link container-name -d app-that-uses-mysql + +## Connect to Percona Server from the MySQL Command Line Client + +The following command starts another container instance and runs the `mysql` command line client against your original container, allowing you to execute SQL statements against your database: + + docker run -it --link container-name --rm percona/percona-server:tag mysql -h container-name -P 3306 -uroot -psecret' + +where `container-name` is the name of your database container. + +# Environment Variables + +When you start a Percona Server container, you can adjust the configuration of the instance by passing one or more environment variables on the `docker run` command line. Do note that none of the variables below will have any effect if you start the container with a data directory that already contains a database: any pre-existing database will always be left untouched on container startup. + +Most of the variables listed below are optional, but one of the variables `MYSQL_ROOT_PASSWORD`, `MYSQL_ALLOW_EMPTY_PASSWORD`, `MYSQL_RANDOM_ROOT_PASSWORD` must be given. + +## `MYSQL_ROOT_PASSWORD` + +This variable specifies a password that will be set for the root superuser account. In the above example, it was set to `secret`. **NOTE:** Setting the MySQL root user password on the command line is insecure. + +## `MYSQL_ROOT_PASSWORD_FILE` + +This variable specifies a file that will be read for the root user account. This can be a mounted file when you run your container. This can also be used in the scope of the Docker Secrets (Swarm mode) functionality. + +## `MYSQL_RANDOM_ROOT_PASSWORD` + +When this variable is set to `yes`, a random password for the server's root user will be generated. The password will be printed to stdout in the container, and it can be obtained by using the command `docker logs container-name`. + +## `MYSQL_ONETIME_PASSWORD` + +This variable is optional. When set to `yes`, the root user's password will be set as expired, and must be changed before we can login normally. This is only supported by version 5.6 or newer. + +## `MYSQL_DATABASE` + +This variable is optional. It allows you to specify the name of a database to be created on image startup. If a user/password was supplied (see below) then that user will be granted superuser access (corresponding to GRANT ALL) to this database. + +## `MYSQL_USER`, `MYSQL_PASSWORD` + +These variables are optional, used in conjunction to create a new user and set that user's password. This user will be granted superuser permissions (see above) for the database specified by the `MYSQL_DATABASE` variable. Both variables are required for a user to be created. + +Do note that there is no need to use this mechanism to create the `root` superuser, that user gets created by default with the password set by either of the mechanisms (given or generated) discussed above. + +## `MYSQL_ALLOW_EMPTY_PASSWORD` + +Set to `yes` to allow the container to be started with a blank password for the root user. **NOTE:** Setting this variable to `yes` is not recommended unless you really know what you are doing, since this will leave your instance completely unprotected, allowing anyone to gain complete superuser access. + +## `INIT_TOKUDB` + +Set to `1` to allow the container to be started with enabled TOKUDB engine. + +## `INIT_ROCKSDB` + +Set to `1` to allow the container to be started with enabled ROCKSDB engine. + +## `MYSQL_INIT_ONLY` + +Set to `1` will skip starting the `mysqld` process and will run only the initialization part if MySQL was not initialized before. + +# Notes, Tips, Gotchas + +## Secure Container Startup + +In many use cases, employing the `MYSQL_ROOT_PASSWORD` variable to specify the MySQL root user password on initial container startup is insecure. Instead, to keep your setup as secure as possible, we strongly recommend using the `MYSQL_RANDOM_ROOT_PASSWORD` option. To further secure your instance, we also recommend using the `MYSQL_ONETIME_PASSWORD` variable if you use version 5.6 or higher. + +## Where to Store Data + +There are many two ways to store data used by applications that run in Docker containers. We maintain our usual stance and encourage users to investigate the options and use the method that best suits their use case. Here are some of the options available: + +* Let Docker manage the storage of your database data by writing the database files to disk on the host system using its own internal volume management. The current solutions, devicemapper, aufs and overlayfs have negative performance records. +* Create a data directory on the host system (outside the container on high performance storage) and mount this to a directory visible from inside the container. This places the database files in a known location on the host system, and makes it easy for tools and applications on the host system to access the files. The user needs to make sure that the directory exists, and that permissions and other security mechanisms on the host system are set up correctly. + +The Docker documentation is a good starting point for understanding the different storage options and variations, and there are multiple blog and forum postings that discuss and give advice in this area. We will simply show the basic procedure here for the latter option above: + +1. Create a data directory on a suitable volume on your host system, e.g. `/local/datadir`. +2. Start your container like this: + +``` + docker run --name container-name -v /local/datadir:/var/lib/mysql -e MYSQL_ROOT_PASSWORD=secret -d percona/percona-server:tag +``` + +The `-v /local/datadir:/var/lib/mysql` part of the command mounts the `/local/datadir` directory from the underlying host system as `/var/lib/mysql` inside the container, where MySQL by default will write its data files. + +Note that users on systems with SELinux enabled may experience problems with this. The current workaround is to assign the relevant SELinux policy type to the new data directory so that the container will be allowed to access it: + + chcon -Rt svirt_sandbox_file_t /local/datadir + +## Existing Data + +If you start your MySQL container instance with a data directory that already contains a data (specifically, a `mysql` subdirectory where all our system tables live), the `$MYSQL_ROOT_PASSWORD` variable should be omitted from the `docker run` command. + +## Port forwarding + +Docker allows mapping of ports on the container to ports on the host system by using the -p option. If you start the container as follows, you can connect to the database by connecting your client to a port on the host machine. This can greatly simplfy consolidating many instances to a single host. In this example port 6603, the we use the address of the Docker host to connect to the TCP port the Docker deamon is forwarding from: + + docker run --name container-name `-p 6603:3306` -d percona/percona-server + mysql -h docker_host_ip -P 6603 + +## Passing options to the server + +You can pass arbitrary command line options to the MySQL server by appending them to the `run command`: + + docker run --name my-container-name -d percona/percona-server --option1=value --option2=value + +In this case, the values of option1 and option2 will be passed directly to the server when it is started. The following command will for instance start your container with UTF-8 as the default setting for character set and collation for all databases in MySQL: + + docker run --name container-name -d percona/percona-server --character-set-server=utf8 --collation-server=utf8_general_ci + +## Using a Custom Percona Server Config File + +The Percona Server startup configuration in these Docker images is specified in the file `/etc/my.cnf`. If you want to customize this configuration for your own purposes, you can create your alternative configuration file in a directory on the host machine and then mount this file in the appropriate location inside the Percona Server container, effectively replacing the standard configuration file. + +If you want to base your changes on the standard configuration file, start your Percona Server container in the standard way described above, then do: + + docker exec -it my-container-name cat /etc/my.cnf > /my/custom/config-file + +... where `/my/custom/config-file` is the path and name of the new configuration file. Then start a new Percona Server container like this: + + docker run --name my-new-container-name -v /my/custom/config-file:/etc/my.cnf -e MYSQL_ROOT_PASSWORD=my-secret-pw -d percona/percona-server:tag + +This will start a new Percona Server container `my-new-container-name` where the Percona Server instance uses the startup options specified in `/my/custom/config-file`. + +# Supported Docker Versions + +These images are officially supported by the MySQL team on Docker version 1.9. Support for older versions (down to 1.0) is provided on a best-effort basis, but we strongly recommend running on the most recent version, since that is assumed for parts of the documentation above. + +# User Feedback + +We welcome your feedback! diff --git a/sources/percona845/docker-compose.yml b/sources/percona845/docker-compose.yml new file mode 100644 index 0000000..5061086 --- /dev/null +++ b/sources/percona845/docker-compose.yml @@ -0,0 +1,33 @@ +version: '2' +services: + percona-server: + image: percona/percona-server:8.4 + environment: + MYSQL_ROOT_PASSWORD: secret + ports: + - "3306" + volumes: + # create volumes for use + - /var/lib/mysql + # bind mount my local my.cnf + # - $PWD/my.cnf:/etc/my.cnf.d/my.cnf + +# uncomment sections below if you want to enable PMM +# pmm-server: +# image: percona/pmm-server:latest +# ports: +# - "443:443" +# environment: +# - SERVER_USER=pmm +# - SERVER_PASSWORD=pmm +# pmm-client-ps: +# image: perconalab/pmm-client:latest +# environment: +# - PMM_SERVER=pmm-server:443 +# - PMM_USER=pmm +# - PMM_PASSWORD=pmm +# - DB_TYPE=mysql +# - DB_HOST=percona-server +# - DB_PORT=3306 +# - DB_USER=root +# - DB_PASSWORD=secret diff --git a/sources/percona845/ps-entry-dockerhub.sh b/sources/percona845/ps-entry-dockerhub.sh new file mode 100755 index 0000000..9f08ef1 --- /dev/null +++ b/sources/percona845/ps-entry-dockerhub.sh @@ -0,0 +1,250 @@ +#!/bin/bash +set -eo pipefail +shopt -s nullglob +# if command starts with an option, prepend mysqld +if [ "${1:0:1}" = '-' ]; then + set -- mysqld "$@" +fi +# skip setup if they want an option that stops mysqld +wantHelp= +for arg; do + case "$arg" in + -'?'|--help|--print-defaults|-V|--version) + wantHelp=1 + break + ;; + esac +done + +# usage: file_env VAR [DEFAULT] +# ie: file_env 'XYZ_DB_PASSWORD' 'example' +# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of +# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature) +file_env() { + local var="$1" + local fileVar="${var}_FILE" + local def="${2:-}" + if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then + echo >&2 "error: both $var and $fileVar are set (but are exclusive)" + exit 1 + fi + local val="$def" + if [ "${!var:-}" ]; then + val="${!var}" + elif [ "${!fileVar:-}" ]; then + val="$(< "${!fileVar}")" + fi + export "$var"="$val" + unset "$fileVar" +} + +# usage: process_init_file FILENAME MYSQLCOMMAND... +# ie: process_init_file foo.sh mysql -uroot +# (process a single initializer file, based on its extension. we define this +# function here, so that initializer scripts (*.sh) can use the same logic, +# potentially recursively, or override the logic used in subsequent calls) +process_init_file() { + local f="$1"; shift + local mysql=( "$@" ) + + case "$f" in + *.sh) echo "$0: running $f"; . "$f" ;; + *.sql) echo "$0: running $f"; "${mysql[@]}" < "$f"; echo ;; + *.sql.gz) echo "$0: running $f"; gunzip -c "$f" | "${mysql[@]}"; echo ;; + *) echo "$0: ignoring $f" ;; + esac + echo +} + +_check_config() { + toRun=( "$@" --verbose --help ) + if ! errors="$("${toRun[@]}" 2>&1 >/dev/null)"; then + cat >&2 <<-EOM + + ERROR: mysqld failed while attempting to check config + command was: "${toRun[*]}" + + $errors + EOM + exit 1 + fi +} + +# Fetch value from server config +# We use mysqld --verbose --help instead of my_print_defaults because the +# latter only show values present in config files, and not server defaults +_get_config() { + local conf="$1"; shift + "$@" --verbose --help --log-bin-index="$(mktemp -u)" 2>/dev/null \ + | awk '$1 == "'"$conf"'" && /^[^ \t]/ { sub(/^[^ \t]+[ \t]+/, ""); print; exit }' + # match "datadir /some/path with/spaces in/it here" but not "--xyz=abc\n datadir (xyz)" +} + +if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then + # still need to check config, container may have started with --user + _check_config "$@" + + if [ -n "$INIT_TOKUDB" ]; then + export LD_PRELOAD=/usr/lib64/libjemalloc.so.1 + fi + # Get config + DATADIR="$(_get_config 'datadir' "$@")" + + if [ ! -d "$DATADIR/mysql" ]; then + file_env 'MYSQL_ROOT_PASSWORD' + if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + echo >&2 'error: database is uninitialized and password option is not specified ' + echo >&2 ' You need to specify one of MYSQL_ROOT_PASSWORD, MYSQL_ALLOW_EMPTY_PASSWORD and MYSQL_RANDOM_ROOT_PASSWORD' + exit 1 + fi + + mkdir -p "$DATADIR" + + echo 'Initializing database' + "$@" --initialize-insecure + echo 'Database initialized' + + if command -v mysql_ssl_rsa_setup > /dev/null && [ ! -e "$DATADIR/server-key.pem" ]; then + # https://github.com/mysql/mysql-server/blob/23032807537d8dd8ee4ec1c4d40f0633cd4e12f9/packaging/deb-in/extra/mysql-systemd-start#L81-L84 + echo 'Initializing certificates' + mysql_ssl_rsa_setup --datadir="$DATADIR" + echo 'Certificates initialized' + fi + + SOCKET="$(_get_config 'socket' "$@")" + "$@" --skip-networking --socket="${SOCKET}" & + pid="$!" + + mysql=( mysql --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" --password="" ) + + for i in {120..0}; do + if echo 'SELECT 1' | "${mysql[@]}" &> /dev/null; then + break + fi + echo 'MySQL init process in progress...' + sleep 1 + done + if [ "$i" = 0 ]; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + if [ -z "$MYSQL_INITDB_SKIP_TZINFO" ]; then + ( + echo "SET @@SESSION.SQL_LOG_BIN = off;" + # sed is for https://bugs.mysql.com/bug.php?id=20545 + mysql_tzinfo_to_sql /usr/share/zoneinfo | sed 's/Local time zone must be set--see zic manual page/FCTY/' + ) | "${mysql[@]}" mysql + fi + + # install TokuDB engine + if [ -n "$INIT_TOKUDB" ]; then + ps-admin --docker --enable-tokudb -u root -p $MYSQL_ROOT_PASSWORD + fi + if [ -n "$INIT_ROCKSDB" ]; then + ps-admin --enable-rocksdb -u root -p $MYSQL_ROOT_PASSWORD + fi + + if [ ! -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + MYSQL_ROOT_PASSWORD="$(pwmake 128)" + echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD" + fi + + rootCreate= + # default root to listen for connections from anywhere + file_env 'MYSQL_ROOT_HOST' '%' + if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then + # no, we don't care if read finds a terminating character in this heredoc + # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151 + read -r -d '' rootCreate <<-EOSQL || true + CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ; + EOSQL + fi + + "${mysql[@]}" <<-EOSQL + -- What's done in this file shouldn't be replicated + -- or products like mysql-fabric won't work + SET @@SESSION.SQL_LOG_BIN=0; + + DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'mysql.infoschema', 'mysql.session', 'root') OR host NOT IN ('localhost') ; + ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ; + ${rootCreate} + DROP DATABASE IF EXISTS test ; + FLUSH PRIVILEGES ; + EOSQL + + if [ ! -z "$MYSQL_ROOT_PASSWORD" ]; then + mysql+=( -p"${MYSQL_ROOT_PASSWORD}" ) + fi + + file_env 'MYSQL_DATABASE' + if [ "$MYSQL_DATABASE" ]; then + echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" | "${mysql[@]}" + mysql+=( "$MYSQL_DATABASE" ) + fi + + file_env 'MYSQL_USER' + file_env 'MYSQL_PASSWORD' + if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then + echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" | "${mysql[@]}" + + if [ "$MYSQL_DATABASE" ]; then + echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}" + fi + + echo 'FLUSH PRIVILEGES ;' | "${mysql[@]}" + fi + + echo + ls /docker-entrypoint-initdb.d/ > /dev/null + for f in /docker-entrypoint-initdb.d/*; do + process_init_file "$f" "${mysql[@]}" + done + + if [ ! -z "$MYSQL_ONETIME_PASSWORD" ]; then + "${mysql[@]}" <<-EOSQL + ALTER USER 'root'@'%' PASSWORD EXPIRE; + EOSQL + fi + if ! kill -s TERM "$pid" || ! wait "$pid"; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + echo + echo 'MySQL init process done. Ready for start up.' + echo + fi + + # exit when MYSQL_INIT_ONLY environment variable is set to avoid starting mysqld + if [ ! -z "$MYSQL_INIT_ONLY" ]; then + echo 'Initialization complete, now exiting!' + exit 0 + fi +fi + +if [ ! -z "${PERCONA_INSTANCE_ID}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -i ${PERCONA_INSTANCE_ID}" +fi + +if [ ! -z "${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -j ${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" +fi + +if [ ! -z "${PERCONA_SEND_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -t ${PERCONA_SEND_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -t 7" +fi + +if [ ! -z "${PERCONA_CONNECT_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -c ${PERCONA_CONNECT_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -c 2" +fi + +/call-home.sh -f "PRODUCT_FAMILY_PS" -v "${PS_TELEMETRY_VERSION}" -d "DOCKER" ${CALL_HOME_OPTIONAL_PARAMS} &> /dev/null || : + +exec "$@" diff --git a/sources/percona845/ps-entry.sh b/sources/percona845/ps-entry.sh new file mode 100755 index 0000000..a7fe81b --- /dev/null +++ b/sources/percona845/ps-entry.sh @@ -0,0 +1,253 @@ +#!/bin/bash +set -eo pipefail +shopt -s nullglob +# if command starts with an option, prepend mysqld +if [ "${1:0:1}" = '-' ]; then + set -- mysqld "$@" +fi +# skip setup if they want an option that stops mysqld +wantHelp= +for arg; do + case "$arg" in + -'?'|--help|--print-defaults|-V|--version) + wantHelp=1 + break + ;; + esac +done + +# usage: file_env VAR [DEFAULT] +# ie: file_env 'XYZ_DB_PASSWORD' 'example' +# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of +# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature) +file_env() { + local var="$1" + local fileVar="${var}_FILE" + local def="${2:-}" + if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then + echo >&2 "error: both $var and $fileVar are set (but are exclusive)" + exit 1 + fi + local val="$def" + if [ "${!var:-}" ]; then + val="${!var}" + elif [ "${!fileVar:-}" ]; then + val="$(< "${!fileVar}")" + fi + export "$var"="$val" + unset "$fileVar" +} + +# usage: process_init_file FILENAME MYSQLCOMMAND... +# ie: process_init_file foo.sh mysql -uroot +# (process a single initializer file, based on its extension. we define this +# function here, so that initializer scripts (*.sh) can use the same logic, +# potentially recursively, or override the logic used in subsequent calls) +process_init_file() { + local f="$1"; shift + local mysql=( "$@" ) + + case "$f" in + *.sh) echo "$0: running $f"; . "$f" ;; + *.sql) echo "$0: running $f"; "${mysql[@]}" < "$f"; echo ;; + *.sql.gz) echo "$0: running $f"; gunzip -c "$f" | "${mysql[@]}"; echo ;; + *) echo "$0: ignoring $f" ;; + esac + echo +} + +_check_config() { + toRun=( "$@" --verbose --help ) + if ! errors="$("${toRun[@]}" 2>&1 >/dev/null)"; then + cat >&2 <<-EOM + + ERROR: mysqld failed while attempting to check config + command was: "${toRun[*]}" + + $errors + EOM + exit 1 + fi +} + +# Fetch value from server config +# We use mysqld --verbose --help instead of my_print_defaults because the +# latter only show values present in config files, and not server defaults +_get_config() { + local conf="$1"; shift + "$@" --verbose --help --log-bin-index="$(mktemp -u)" 2>/dev/null \ + | awk '$1 == "'"$conf"'" && /^[^ \t]/ { sub(/^[^ \t]+[ \t]+/, ""); print; exit }' + # match "datadir /some/path with/spaces in/it here" but not "--xyz=abc\n datadir (xyz)" +} + +if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then + # still need to check config, container may have started with --user + _check_config "$@" + + if [ -n "$INIT_TOKUDB" ]; then + export LD_PRELOAD=/usr/lib64/libjemalloc.so.1 + fi + # Get config + DATADIR="$(_get_config 'datadir' "$@")" + + if [ ! -d "$DATADIR/mysql" ]; then + file_env 'MYSQL_ROOT_PASSWORD' + if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + echo >&2 'error: database is uninitialized and password option is not specified ' + echo >&2 ' You need to specify one of MYSQL_ROOT_PASSWORD, MYSQL_ALLOW_EMPTY_PASSWORD and MYSQL_RANDOM_ROOT_PASSWORD' + exit 1 + fi + + mkdir -p "$DATADIR" + + echo 'Initializing database' + "$@" --initialize-insecure + echo 'Database initialized' + + if command -v mysql_ssl_rsa_setup > /dev/null && [ ! -e "$DATADIR/server-key.pem" ]; then + # https://github.com/mysql/mysql-server/blob/23032807537d8dd8ee4ec1c4d40f0633cd4e12f9/packaging/deb-in/extra/mysql-systemd-start#L81-L84 + echo 'Initializing certificates' + mysql_ssl_rsa_setup --datadir="$DATADIR" + echo 'Certificates initialized' + fi + + SOCKET="$(_get_config 'socket' "$@")" + "$@" --skip-networking --socket="${SOCKET}" & + pid="$!" + + mysql=( mysql --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" --password="" ) + + for i in {120..0}; do + if echo 'SELECT 1' | "${mysql[@]}" &> /dev/null; then + break + fi + echo 'MySQL init process in progress...' + sleep 1 + done + if [ "$i" = 0 ]; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + if [ -z "$MYSQL_INITDB_SKIP_TZINFO" ]; then + ( + echo "SET @@SESSION.SQL_LOG_BIN = off;" + # sed is for https://bugs.mysql.com/bug.php?id=20545 + mysql_tzinfo_to_sql /usr/share/zoneinfo | sed 's/Local time zone must be set--see zic manual page/FCTY/' + ) | "${mysql[@]}" mysql + fi + + # install TokuDB engine + if [ -n "$INIT_TOKUDB" ]; then + ps-admin --docker --enable-tokudb -u root -p $MYSQL_ROOT_PASSWORD + fi + if [ -n "$INIT_ROCKSDB" ]; then + ps-admin --enable-rocksdb -u root -p $MYSQL_ROOT_PASSWORD + fi + + if [ ! -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + MYSQL_ROOT_PASSWORD="$(pwmake 128)" + echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD" + fi + + rootCreate= + # default root to listen for connections from anywhere + file_env 'MYSQL_ROOT_HOST' '%' + if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then + # no, we don't care if read finds a terminating character in this heredoc + # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151 + read -r -d '' rootCreate <<-EOSQL || true + CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ; + EOSQL + fi + + "${mysql[@]}" <<-EOSQL + -- What's done in this file shouldn't be replicated + -- or products like mysql-fabric won't work + SET @@SESSION.SQL_LOG_BIN=0; + + DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'mysql.infoschema', 'mysql.session', 'root') OR host NOT IN ('localhost') ; + ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ; + ${rootCreate} + DROP DATABASE IF EXISTS test ; + FLUSH PRIVILEGES ; + EOSQL + + if [ ! -z "$MYSQL_ROOT_PASSWORD" ]; then + mysql+=( -p"${MYSQL_ROOT_PASSWORD}" ) + fi + + file_env 'MYSQL_DATABASE' + if [ "$MYSQL_DATABASE" ]; then + echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" | "${mysql[@]}" + mysql+=( "$MYSQL_DATABASE" ) + fi + + file_env 'MYSQL_USER' + file_env 'MYSQL_PASSWORD' + if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then + echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" | "${mysql[@]}" + + if [ "$MYSQL_DATABASE" ]; then + echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}" + fi + + echo 'FLUSH PRIVILEGES ;' | "${mysql[@]}" + fi + + echo + ls /docker-entrypoint-initdb.d/ > /dev/null + for f in /docker-entrypoint-initdb.d/*; do + process_init_file "$f" "${mysql[@]}" + done + + if [ ! -z "$MYSQL_ONETIME_PASSWORD" ]; then + "${mysql[@]}" <<-EOSQL + ALTER USER 'root'@'%' PASSWORD EXPIRE; + EOSQL + fi + if ! kill -s TERM "$pid" || ! wait "$pid"; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + echo + echo 'MySQL init process done. Ready for start up.' + echo + fi + + # exit when MYSQL_INIT_ONLY environment variable is set to avoid starting mysqld + if [ ! -z "$MYSQL_INIT_ONLY" ]; then + echo 'Initialization complete, now exiting!' + exit 0 + fi +fi + +if [ ! -z "${PERCONA_INSTANCE_ID}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -i ${PERCONA_INSTANCE_ID}" +fi + +if [ ! -z "${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -j ${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" +fi + +if [ ! -z "${PERCONA_SEND_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -t ${PERCONA_SEND_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -t 7" +fi + +if [ ! -z "${PERCONA_CONNECT_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -c ${PERCONA_CONNECT_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -c 2" +fi + +if [[ ${PERCONA_TELEMETRY_DISABLE} -ne "0" ]]; then + exec "$@" --percona_telemetry_disable=1 +else + /usr/bin/telemetry-agent-supervisor.sh & + exec "$@" +fi diff --git a/sources/percona845/telemetry-agent-supervisor.sh b/sources/percona845/telemetry-agent-supervisor.sh new file mode 100755 index 0000000..6ad026e --- /dev/null +++ b/sources/percona845/telemetry-agent-supervisor.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +# phase-0 telemetry +/call-home.sh -f "PRODUCT_FAMILY_PS" -v "${PS_TELEMETRY_VERSION}" -d "DOCKER" ${CALL_HOME_OPTIONAL_PARAMS} &> /dev/null || : + +# phase-1 telemetry +for i in {1..3}; do + /usr/bin/percona-telemetry-agent >> /var/log/percona/telemetry-agent.log 2>> /var/log/percona/telemetry-agent-error.log + if [ $? -eq 0 ]; then + break + fi + sleep 5 +done +sleep infinity diff --git a/sources/percona846/Dockerfile b/sources/percona846/Dockerfile new file mode 100644 index 0000000..9709397 --- /dev/null +++ b/sources/percona846/Dockerfile @@ -0,0 +1,141 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +ENV PS_VERSION 8.4.6-6.1 +ENV MYSQL_SHELL_VERSION 8.4.6-1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.4.6-6-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 +# Do not report during Docker image creation. +# Note that doing so, would create telemetry config file +# which would prevent reporting when new container is started. +# If we want to track Docker image creation as well, +# remove telemetry config file after installing packages! +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + percona-release disable all; \ + percona-release enable ps-84-lts ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/j/jemalloc-5.2.1-2.el9.x86_64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/g/gflags-2.2.2-9.el9.x86_64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + #microdnf -y install epel-release; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +COPY dockerdir/ / +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona846/Dockerfile-dockerhub b/sources/percona846/Dockerfile-dockerhub new file mode 100644 index 0000000..b4b76fa --- /dev/null +++ b/sources/percona846/Dockerfile-dockerhub @@ -0,0 +1,128 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +ENV PS_VERSION 8.4.3-3.1 +ENV MYSQL_SHELL_VERSION 8.4.3-1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.4.3-3-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 +# Do not report during Docker image creation. +# Note that doing so, would create telemetry config file +# which would prevent reporting when new container is started. +# If we want to track Docker image creation as well, +# remove telemetry config file after installing packages! +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + percona-release disable all; \ + percona-release enable ps-84-lts ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/j/jemalloc-5.2.1-2.el9.x86_64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/g/gflags-2.2.2-9.el9.x86_64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + #microdnf -y install epel-release; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry-dockerhub.sh /docker-entrypoint.sh +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona846/Dockerfile.aarch64 b/sources/percona846/Dockerfile.aarch64 new file mode 100644 index 0000000..ef2cbe8 --- /dev/null +++ b/sources/percona846/Dockerfile.aarch64 @@ -0,0 +1,142 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +ENV PS_VERSION 8.4.6-6.1 +ENV MYSQL_SHELL_VERSION 8.4.6-1 +ENV OS_VER el9 +ENV FULL_PERCONA_VERSION "$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION "$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO testing +ENV PS_TELEMETRY_VERSION 8.4.6-6-1 +ENV CALL_HOME_DOWNLOAD_SHA256 5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256 fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION 0.1 + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +# Do not report during Docker image creation. +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + #yum -y install epel-release; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + sed -i "s|x86_64|x86_64 aarch64|" /usr/bin/percona-release; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + #microdnf -y module disable mysql; \ + percona-release disable all; \ + percona-release enable ps-84-lts ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + rm -rf /tmp/percona-*; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/j/jemalloc-5.2.1-2.el9.aarch64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/g/gflags-2.2.2-9.el9.aarch64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION} \ + percona-telemetry-agent; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ + +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +COPY dockerdir/ / +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona846/README-build.md b/sources/percona846/README-build.md new file mode 100644 index 0000000..b801e9a --- /dev/null +++ b/sources/percona846/README-build.md @@ -0,0 +1,40 @@ +Build image + + `docker build -t percona-server Dockerfile` + +or + + `docker build -t percona-server Dockerfile` + +Tag image + + `docker tag percona/percona-server:8.4` + +Push to hub + + `docker push percona/percona-server:8.4` + +Usage +===== + + vi ./docker-compose.yml + percona: + image: percona/percona-server:latest + name: perconaserver + environment: + MYSQL_ROOT_PASSWORD: secret + ports: + - "3306" + volumes: + # create volumes for use + - /var/log/mysql + - /var/lib/mysql + # bind mount my local my.cnf + # - $PWD/my.cnf:/etc/my.cnf + command: + # Workaround for no my.cnf in image + - '--user=mysql' + 7) Start the container from cli + docker-compose up + 8) Check status + docker-compose ps diff --git a/sources/percona846/README.md b/sources/percona846/README.md new file mode 100644 index 0000000..035721b --- /dev/null +++ b/sources/percona846/README.md @@ -0,0 +1,158 @@ +![logo](https://www.percona.com/wp-content/uploads/2023/03/font-1.jpg) + +# What is Percona Server? + +Percona Server is an enhanced drop-in replacement for MySQL. With Percona Server, your queries will run faster and more consistently. You will consolidate servers on powerful hardware and will delay sharding, or avoid it entirely. + +For more information and related downloads for Percona Server and other Percona products, please visit http://www.percona.com. + +# Percona Server Docker Images + +These are the only official Percona Server Docker images, created and maintained by the Percona team. The image has the Percona Fractal Tree based storage engine `TokuDB` enabled. The available versions are: + + Percona Server 8.4.3-3.1 (tag: 8.4) + +Images are updated when new releases are published. + +# How to Use the Images + +## Start a Percona Server Instance + +Start a Percona Server container as follows: + + docker run --name container-name -e MYSQL_ROOT_PASSWORD=secret -d percona/percona-server:tag + +Where `container-name` is the name you want to assign to your container, `secret` is the password to be set for the root user and `tag` is the tag specifying the version you want. See the list above for relevant tags, or look at the [full list of tags](https://registry.hub.docker.com/u/percona/percona-server/tags/manage/). + +## Connect to Percona Server from an Application in Another Docker Container + +This image exposes the standard MySQL port (3306), so container linking makes the instance available to other containers. Start other containers like this in order to link it to the Percona Server container: + + docker run --name app-container-name --link container-name -d app-that-uses-mysql + +## Connect to Percona Server from the MySQL Command Line Client + +The following command starts another container instance and runs the `mysql` command line client against your original container, allowing you to execute SQL statements against your database: + + docker run -it --link container-name --rm percona/percona-server:tag mysql -h container-name -P 3306 -uroot -psecret' + +where `container-name` is the name of your database container. + +# Environment Variables + +When you start a Percona Server container, you can adjust the configuration of the instance by passing one or more environment variables on the `docker run` command line. Do note that none of the variables below will have any effect if you start the container with a data directory that already contains a database: any pre-existing database will always be left untouched on container startup. + +Most of the variables listed below are optional, but one of the variables `MYSQL_ROOT_PASSWORD`, `MYSQL_ALLOW_EMPTY_PASSWORD`, `MYSQL_RANDOM_ROOT_PASSWORD` must be given. + +## `MYSQL_ROOT_PASSWORD` + +This variable specifies a password that will be set for the root superuser account. In the above example, it was set to `secret`. **NOTE:** Setting the MySQL root user password on the command line is insecure. + +## `MYSQL_ROOT_PASSWORD_FILE` + +This variable specifies a file that will be read for the root user account. This can be a mounted file when you run your container. This can also be used in the scope of the Docker Secrets (Swarm mode) functionality. + +## `MYSQL_RANDOM_ROOT_PASSWORD` + +When this variable is set to `yes`, a random password for the server's root user will be generated. The password will be printed to stdout in the container, and it can be obtained by using the command `docker logs container-name`. + +## `MYSQL_ONETIME_PASSWORD` + +This variable is optional. When set to `yes`, the root user's password will be set as expired, and must be changed before we can login normally. This is only supported by version 5.6 or newer. + +## `MYSQL_DATABASE` + +This variable is optional. It allows you to specify the name of a database to be created on image startup. If a user/password was supplied (see below) then that user will be granted superuser access (corresponding to GRANT ALL) to this database. + +## `MYSQL_USER`, `MYSQL_PASSWORD` + +These variables are optional, used in conjunction to create a new user and set that user's password. This user will be granted superuser permissions (see above) for the database specified by the `MYSQL_DATABASE` variable. Both variables are required for a user to be created. + +Do note that there is no need to use this mechanism to create the `root` superuser, that user gets created by default with the password set by either of the mechanisms (given or generated) discussed above. + +## `MYSQL_ALLOW_EMPTY_PASSWORD` + +Set to `yes` to allow the container to be started with a blank password for the root user. **NOTE:** Setting this variable to `yes` is not recommended unless you really know what you are doing, since this will leave your instance completely unprotected, allowing anyone to gain complete superuser access. + +## `INIT_TOKUDB` + +Set to `1` to allow the container to be started with enabled TOKUDB engine. + +## `INIT_ROCKSDB` + +Set to `1` to allow the container to be started with enabled ROCKSDB engine. + +## `MYSQL_INIT_ONLY` + +Set to `1` will skip starting the `mysqld` process and will run only the initialization part if MySQL was not initialized before. + +# Notes, Tips, Gotchas + +## Secure Container Startup + +In many use cases, employing the `MYSQL_ROOT_PASSWORD` variable to specify the MySQL root user password on initial container startup is insecure. Instead, to keep your setup as secure as possible, we strongly recommend using the `MYSQL_RANDOM_ROOT_PASSWORD` option. To further secure your instance, we also recommend using the `MYSQL_ONETIME_PASSWORD` variable if you use version 5.6 or higher. + +## Where to Store Data + +There are many two ways to store data used by applications that run in Docker containers. We maintain our usual stance and encourage users to investigate the options and use the method that best suits their use case. Here are some of the options available: + +* Let Docker manage the storage of your database data by writing the database files to disk on the host system using its own internal volume management. The current solutions, devicemapper, aufs and overlayfs have negative performance records. +* Create a data directory on the host system (outside the container on high performance storage) and mount this to a directory visible from inside the container. This places the database files in a known location on the host system, and makes it easy for tools and applications on the host system to access the files. The user needs to make sure that the directory exists, and that permissions and other security mechanisms on the host system are set up correctly. + +The Docker documentation is a good starting point for understanding the different storage options and variations, and there are multiple blog and forum postings that discuss and give advice in this area. We will simply show the basic procedure here for the latter option above: + +1. Create a data directory on a suitable volume on your host system, e.g. `/local/datadir`. +2. Start your container like this: + +``` + docker run --name container-name -v /local/datadir:/var/lib/mysql -e MYSQL_ROOT_PASSWORD=secret -d percona/percona-server:tag +``` + +The `-v /local/datadir:/var/lib/mysql` part of the command mounts the `/local/datadir` directory from the underlying host system as `/var/lib/mysql` inside the container, where MySQL by default will write its data files. + +Note that users on systems with SELinux enabled may experience problems with this. The current workaround is to assign the relevant SELinux policy type to the new data directory so that the container will be allowed to access it: + + chcon -Rt svirt_sandbox_file_t /local/datadir + +## Existing Data + +If you start your MySQL container instance with a data directory that already contains a data (specifically, a `mysql` subdirectory where all our system tables live), the `$MYSQL_ROOT_PASSWORD` variable should be omitted from the `docker run` command. + +## Port forwarding + +Docker allows mapping of ports on the container to ports on the host system by using the -p option. If you start the container as follows, you can connect to the database by connecting your client to a port on the host machine. This can greatly simplfy consolidating many instances to a single host. In this example port 6603, the we use the address of the Docker host to connect to the TCP port the Docker deamon is forwarding from: + + docker run --name container-name `-p 6603:3306` -d percona/percona-server + mysql -h docker_host_ip -P 6603 + +## Passing options to the server + +You can pass arbitrary command line options to the MySQL server by appending them to the `run command`: + + docker run --name my-container-name -d percona/percona-server --option1=value --option2=value + +In this case, the values of option1 and option2 will be passed directly to the server when it is started. The following command will for instance start your container with UTF-8 as the default setting for character set and collation for all databases in MySQL: + + docker run --name container-name -d percona/percona-server --character-set-server=utf8 --collation-server=utf8_general_ci + +## Using a Custom Percona Server Config File + +The Percona Server startup configuration in these Docker images is specified in the file `/etc/my.cnf`. If you want to customize this configuration for your own purposes, you can create your alternative configuration file in a directory on the host machine and then mount this file in the appropriate location inside the Percona Server container, effectively replacing the standard configuration file. + +If you want to base your changes on the standard configuration file, start your Percona Server container in the standard way described above, then do: + + docker exec -it my-container-name cat /etc/my.cnf > /my/custom/config-file + +... where `/my/custom/config-file` is the path and name of the new configuration file. Then start a new Percona Server container like this: + + docker run --name my-new-container-name -v /my/custom/config-file:/etc/my.cnf -e MYSQL_ROOT_PASSWORD=my-secret-pw -d percona/percona-server:tag + +This will start a new Percona Server container `my-new-container-name` where the Percona Server instance uses the startup options specified in `/my/custom/config-file`. + +# Supported Docker Versions + +These images are officially supported by the MySQL team on Docker version 1.9. Support for older versions (down to 1.0) is provided on a best-effort basis, but we strongly recommend running on the most recent version, since that is assumed for parts of the documentation above. + +# User Feedback + +We welcome your feedback! diff --git a/sources/percona846/docker-compose.yml b/sources/percona846/docker-compose.yml new file mode 100644 index 0000000..5061086 --- /dev/null +++ b/sources/percona846/docker-compose.yml @@ -0,0 +1,33 @@ +version: '2' +services: + percona-server: + image: percona/percona-server:8.4 + environment: + MYSQL_ROOT_PASSWORD: secret + ports: + - "3306" + volumes: + # create volumes for use + - /var/lib/mysql + # bind mount my local my.cnf + # - $PWD/my.cnf:/etc/my.cnf.d/my.cnf + +# uncomment sections below if you want to enable PMM +# pmm-server: +# image: percona/pmm-server:latest +# ports: +# - "443:443" +# environment: +# - SERVER_USER=pmm +# - SERVER_PASSWORD=pmm +# pmm-client-ps: +# image: perconalab/pmm-client:latest +# environment: +# - PMM_SERVER=pmm-server:443 +# - PMM_USER=pmm +# - PMM_PASSWORD=pmm +# - DB_TYPE=mysql +# - DB_HOST=percona-server +# - DB_PORT=3306 +# - DB_USER=root +# - DB_PASSWORD=secret diff --git a/sources/percona846/dockerdir/usr/lib64/mysql/plugin/component_keyring_vault.cnf b/sources/percona846/dockerdir/usr/lib64/mysql/plugin/component_keyring_vault.cnf new file mode 100644 index 0000000..ee11ada --- /dev/null +++ b/sources/percona846/dockerdir/usr/lib64/mysql/plugin/component_keyring_vault.cnf @@ -0,0 +1 @@ +{ "read_local_config": true } diff --git a/sources/percona846/dockerdir/usr/sbin/mysqld.my b/sources/percona846/dockerdir/usr/sbin/mysqld.my new file mode 100644 index 0000000..b4956e3 --- /dev/null +++ b/sources/percona846/dockerdir/usr/sbin/mysqld.my @@ -0,0 +1 @@ +{ "read_local_manifest": true } diff --git a/sources/percona846/ps-entry-dockerhub.sh b/sources/percona846/ps-entry-dockerhub.sh new file mode 100755 index 0000000..9f08ef1 --- /dev/null +++ b/sources/percona846/ps-entry-dockerhub.sh @@ -0,0 +1,250 @@ +#!/bin/bash +set -eo pipefail +shopt -s nullglob +# if command starts with an option, prepend mysqld +if [ "${1:0:1}" = '-' ]; then + set -- mysqld "$@" +fi +# skip setup if they want an option that stops mysqld +wantHelp= +for arg; do + case "$arg" in + -'?'|--help|--print-defaults|-V|--version) + wantHelp=1 + break + ;; + esac +done + +# usage: file_env VAR [DEFAULT] +# ie: file_env 'XYZ_DB_PASSWORD' 'example' +# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of +# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature) +file_env() { + local var="$1" + local fileVar="${var}_FILE" + local def="${2:-}" + if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then + echo >&2 "error: both $var and $fileVar are set (but are exclusive)" + exit 1 + fi + local val="$def" + if [ "${!var:-}" ]; then + val="${!var}" + elif [ "${!fileVar:-}" ]; then + val="$(< "${!fileVar}")" + fi + export "$var"="$val" + unset "$fileVar" +} + +# usage: process_init_file FILENAME MYSQLCOMMAND... +# ie: process_init_file foo.sh mysql -uroot +# (process a single initializer file, based on its extension. we define this +# function here, so that initializer scripts (*.sh) can use the same logic, +# potentially recursively, or override the logic used in subsequent calls) +process_init_file() { + local f="$1"; shift + local mysql=( "$@" ) + + case "$f" in + *.sh) echo "$0: running $f"; . "$f" ;; + *.sql) echo "$0: running $f"; "${mysql[@]}" < "$f"; echo ;; + *.sql.gz) echo "$0: running $f"; gunzip -c "$f" | "${mysql[@]}"; echo ;; + *) echo "$0: ignoring $f" ;; + esac + echo +} + +_check_config() { + toRun=( "$@" --verbose --help ) + if ! errors="$("${toRun[@]}" 2>&1 >/dev/null)"; then + cat >&2 <<-EOM + + ERROR: mysqld failed while attempting to check config + command was: "${toRun[*]}" + + $errors + EOM + exit 1 + fi +} + +# Fetch value from server config +# We use mysqld --verbose --help instead of my_print_defaults because the +# latter only show values present in config files, and not server defaults +_get_config() { + local conf="$1"; shift + "$@" --verbose --help --log-bin-index="$(mktemp -u)" 2>/dev/null \ + | awk '$1 == "'"$conf"'" && /^[^ \t]/ { sub(/^[^ \t]+[ \t]+/, ""); print; exit }' + # match "datadir /some/path with/spaces in/it here" but not "--xyz=abc\n datadir (xyz)" +} + +if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then + # still need to check config, container may have started with --user + _check_config "$@" + + if [ -n "$INIT_TOKUDB" ]; then + export LD_PRELOAD=/usr/lib64/libjemalloc.so.1 + fi + # Get config + DATADIR="$(_get_config 'datadir' "$@")" + + if [ ! -d "$DATADIR/mysql" ]; then + file_env 'MYSQL_ROOT_PASSWORD' + if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + echo >&2 'error: database is uninitialized and password option is not specified ' + echo >&2 ' You need to specify one of MYSQL_ROOT_PASSWORD, MYSQL_ALLOW_EMPTY_PASSWORD and MYSQL_RANDOM_ROOT_PASSWORD' + exit 1 + fi + + mkdir -p "$DATADIR" + + echo 'Initializing database' + "$@" --initialize-insecure + echo 'Database initialized' + + if command -v mysql_ssl_rsa_setup > /dev/null && [ ! -e "$DATADIR/server-key.pem" ]; then + # https://github.com/mysql/mysql-server/blob/23032807537d8dd8ee4ec1c4d40f0633cd4e12f9/packaging/deb-in/extra/mysql-systemd-start#L81-L84 + echo 'Initializing certificates' + mysql_ssl_rsa_setup --datadir="$DATADIR" + echo 'Certificates initialized' + fi + + SOCKET="$(_get_config 'socket' "$@")" + "$@" --skip-networking --socket="${SOCKET}" & + pid="$!" + + mysql=( mysql --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" --password="" ) + + for i in {120..0}; do + if echo 'SELECT 1' | "${mysql[@]}" &> /dev/null; then + break + fi + echo 'MySQL init process in progress...' + sleep 1 + done + if [ "$i" = 0 ]; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + if [ -z "$MYSQL_INITDB_SKIP_TZINFO" ]; then + ( + echo "SET @@SESSION.SQL_LOG_BIN = off;" + # sed is for https://bugs.mysql.com/bug.php?id=20545 + mysql_tzinfo_to_sql /usr/share/zoneinfo | sed 's/Local time zone must be set--see zic manual page/FCTY/' + ) | "${mysql[@]}" mysql + fi + + # install TokuDB engine + if [ -n "$INIT_TOKUDB" ]; then + ps-admin --docker --enable-tokudb -u root -p $MYSQL_ROOT_PASSWORD + fi + if [ -n "$INIT_ROCKSDB" ]; then + ps-admin --enable-rocksdb -u root -p $MYSQL_ROOT_PASSWORD + fi + + if [ ! -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + MYSQL_ROOT_PASSWORD="$(pwmake 128)" + echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD" + fi + + rootCreate= + # default root to listen for connections from anywhere + file_env 'MYSQL_ROOT_HOST' '%' + if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then + # no, we don't care if read finds a terminating character in this heredoc + # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151 + read -r -d '' rootCreate <<-EOSQL || true + CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ; + EOSQL + fi + + "${mysql[@]}" <<-EOSQL + -- What's done in this file shouldn't be replicated + -- or products like mysql-fabric won't work + SET @@SESSION.SQL_LOG_BIN=0; + + DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'mysql.infoschema', 'mysql.session', 'root') OR host NOT IN ('localhost') ; + ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ; + ${rootCreate} + DROP DATABASE IF EXISTS test ; + FLUSH PRIVILEGES ; + EOSQL + + if [ ! -z "$MYSQL_ROOT_PASSWORD" ]; then + mysql+=( -p"${MYSQL_ROOT_PASSWORD}" ) + fi + + file_env 'MYSQL_DATABASE' + if [ "$MYSQL_DATABASE" ]; then + echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" | "${mysql[@]}" + mysql+=( "$MYSQL_DATABASE" ) + fi + + file_env 'MYSQL_USER' + file_env 'MYSQL_PASSWORD' + if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then + echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" | "${mysql[@]}" + + if [ "$MYSQL_DATABASE" ]; then + echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}" + fi + + echo 'FLUSH PRIVILEGES ;' | "${mysql[@]}" + fi + + echo + ls /docker-entrypoint-initdb.d/ > /dev/null + for f in /docker-entrypoint-initdb.d/*; do + process_init_file "$f" "${mysql[@]}" + done + + if [ ! -z "$MYSQL_ONETIME_PASSWORD" ]; then + "${mysql[@]}" <<-EOSQL + ALTER USER 'root'@'%' PASSWORD EXPIRE; + EOSQL + fi + if ! kill -s TERM "$pid" || ! wait "$pid"; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + echo + echo 'MySQL init process done. Ready for start up.' + echo + fi + + # exit when MYSQL_INIT_ONLY environment variable is set to avoid starting mysqld + if [ ! -z "$MYSQL_INIT_ONLY" ]; then + echo 'Initialization complete, now exiting!' + exit 0 + fi +fi + +if [ ! -z "${PERCONA_INSTANCE_ID}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -i ${PERCONA_INSTANCE_ID}" +fi + +if [ ! -z "${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -j ${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" +fi + +if [ ! -z "${PERCONA_SEND_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -t ${PERCONA_SEND_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -t 7" +fi + +if [ ! -z "${PERCONA_CONNECT_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -c ${PERCONA_CONNECT_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -c 2" +fi + +/call-home.sh -f "PRODUCT_FAMILY_PS" -v "${PS_TELEMETRY_VERSION}" -d "DOCKER" ${CALL_HOME_OPTIONAL_PARAMS} &> /dev/null || : + +exec "$@" diff --git a/sources/percona846/ps-entry.sh b/sources/percona846/ps-entry.sh new file mode 100755 index 0000000..a7fe81b --- /dev/null +++ b/sources/percona846/ps-entry.sh @@ -0,0 +1,253 @@ +#!/bin/bash +set -eo pipefail +shopt -s nullglob +# if command starts with an option, prepend mysqld +if [ "${1:0:1}" = '-' ]; then + set -- mysqld "$@" +fi +# skip setup if they want an option that stops mysqld +wantHelp= +for arg; do + case "$arg" in + -'?'|--help|--print-defaults|-V|--version) + wantHelp=1 + break + ;; + esac +done + +# usage: file_env VAR [DEFAULT] +# ie: file_env 'XYZ_DB_PASSWORD' 'example' +# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of +# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature) +file_env() { + local var="$1" + local fileVar="${var}_FILE" + local def="${2:-}" + if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then + echo >&2 "error: both $var and $fileVar are set (but are exclusive)" + exit 1 + fi + local val="$def" + if [ "${!var:-}" ]; then + val="${!var}" + elif [ "${!fileVar:-}" ]; then + val="$(< "${!fileVar}")" + fi + export "$var"="$val" + unset "$fileVar" +} + +# usage: process_init_file FILENAME MYSQLCOMMAND... +# ie: process_init_file foo.sh mysql -uroot +# (process a single initializer file, based on its extension. we define this +# function here, so that initializer scripts (*.sh) can use the same logic, +# potentially recursively, or override the logic used in subsequent calls) +process_init_file() { + local f="$1"; shift + local mysql=( "$@" ) + + case "$f" in + *.sh) echo "$0: running $f"; . "$f" ;; + *.sql) echo "$0: running $f"; "${mysql[@]}" < "$f"; echo ;; + *.sql.gz) echo "$0: running $f"; gunzip -c "$f" | "${mysql[@]}"; echo ;; + *) echo "$0: ignoring $f" ;; + esac + echo +} + +_check_config() { + toRun=( "$@" --verbose --help ) + if ! errors="$("${toRun[@]}" 2>&1 >/dev/null)"; then + cat >&2 <<-EOM + + ERROR: mysqld failed while attempting to check config + command was: "${toRun[*]}" + + $errors + EOM + exit 1 + fi +} + +# Fetch value from server config +# We use mysqld --verbose --help instead of my_print_defaults because the +# latter only show values present in config files, and not server defaults +_get_config() { + local conf="$1"; shift + "$@" --verbose --help --log-bin-index="$(mktemp -u)" 2>/dev/null \ + | awk '$1 == "'"$conf"'" && /^[^ \t]/ { sub(/^[^ \t]+[ \t]+/, ""); print; exit }' + # match "datadir /some/path with/spaces in/it here" but not "--xyz=abc\n datadir (xyz)" +} + +if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then + # still need to check config, container may have started with --user + _check_config "$@" + + if [ -n "$INIT_TOKUDB" ]; then + export LD_PRELOAD=/usr/lib64/libjemalloc.so.1 + fi + # Get config + DATADIR="$(_get_config 'datadir' "$@")" + + if [ ! -d "$DATADIR/mysql" ]; then + file_env 'MYSQL_ROOT_PASSWORD' + if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + echo >&2 'error: database is uninitialized and password option is not specified ' + echo >&2 ' You need to specify one of MYSQL_ROOT_PASSWORD, MYSQL_ALLOW_EMPTY_PASSWORD and MYSQL_RANDOM_ROOT_PASSWORD' + exit 1 + fi + + mkdir -p "$DATADIR" + + echo 'Initializing database' + "$@" --initialize-insecure + echo 'Database initialized' + + if command -v mysql_ssl_rsa_setup > /dev/null && [ ! -e "$DATADIR/server-key.pem" ]; then + # https://github.com/mysql/mysql-server/blob/23032807537d8dd8ee4ec1c4d40f0633cd4e12f9/packaging/deb-in/extra/mysql-systemd-start#L81-L84 + echo 'Initializing certificates' + mysql_ssl_rsa_setup --datadir="$DATADIR" + echo 'Certificates initialized' + fi + + SOCKET="$(_get_config 'socket' "$@")" + "$@" --skip-networking --socket="${SOCKET}" & + pid="$!" + + mysql=( mysql --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" --password="" ) + + for i in {120..0}; do + if echo 'SELECT 1' | "${mysql[@]}" &> /dev/null; then + break + fi + echo 'MySQL init process in progress...' + sleep 1 + done + if [ "$i" = 0 ]; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + if [ -z "$MYSQL_INITDB_SKIP_TZINFO" ]; then + ( + echo "SET @@SESSION.SQL_LOG_BIN = off;" + # sed is for https://bugs.mysql.com/bug.php?id=20545 + mysql_tzinfo_to_sql /usr/share/zoneinfo | sed 's/Local time zone must be set--see zic manual page/FCTY/' + ) | "${mysql[@]}" mysql + fi + + # install TokuDB engine + if [ -n "$INIT_TOKUDB" ]; then + ps-admin --docker --enable-tokudb -u root -p $MYSQL_ROOT_PASSWORD + fi + if [ -n "$INIT_ROCKSDB" ]; then + ps-admin --enable-rocksdb -u root -p $MYSQL_ROOT_PASSWORD + fi + + if [ ! -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + MYSQL_ROOT_PASSWORD="$(pwmake 128)" + echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD" + fi + + rootCreate= + # default root to listen for connections from anywhere + file_env 'MYSQL_ROOT_HOST' '%' + if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then + # no, we don't care if read finds a terminating character in this heredoc + # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151 + read -r -d '' rootCreate <<-EOSQL || true + CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ; + EOSQL + fi + + "${mysql[@]}" <<-EOSQL + -- What's done in this file shouldn't be replicated + -- or products like mysql-fabric won't work + SET @@SESSION.SQL_LOG_BIN=0; + + DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'mysql.infoschema', 'mysql.session', 'root') OR host NOT IN ('localhost') ; + ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ; + ${rootCreate} + DROP DATABASE IF EXISTS test ; + FLUSH PRIVILEGES ; + EOSQL + + if [ ! -z "$MYSQL_ROOT_PASSWORD" ]; then + mysql+=( -p"${MYSQL_ROOT_PASSWORD}" ) + fi + + file_env 'MYSQL_DATABASE' + if [ "$MYSQL_DATABASE" ]; then + echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" | "${mysql[@]}" + mysql+=( "$MYSQL_DATABASE" ) + fi + + file_env 'MYSQL_USER' + file_env 'MYSQL_PASSWORD' + if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then + echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" | "${mysql[@]}" + + if [ "$MYSQL_DATABASE" ]; then + echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}" + fi + + echo 'FLUSH PRIVILEGES ;' | "${mysql[@]}" + fi + + echo + ls /docker-entrypoint-initdb.d/ > /dev/null + for f in /docker-entrypoint-initdb.d/*; do + process_init_file "$f" "${mysql[@]}" + done + + if [ ! -z "$MYSQL_ONETIME_PASSWORD" ]; then + "${mysql[@]}" <<-EOSQL + ALTER USER 'root'@'%' PASSWORD EXPIRE; + EOSQL + fi + if ! kill -s TERM "$pid" || ! wait "$pid"; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + echo + echo 'MySQL init process done. Ready for start up.' + echo + fi + + # exit when MYSQL_INIT_ONLY environment variable is set to avoid starting mysqld + if [ ! -z "$MYSQL_INIT_ONLY" ]; then + echo 'Initialization complete, now exiting!' + exit 0 + fi +fi + +if [ ! -z "${PERCONA_INSTANCE_ID}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -i ${PERCONA_INSTANCE_ID}" +fi + +if [ ! -z "${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -j ${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" +fi + +if [ ! -z "${PERCONA_SEND_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -t ${PERCONA_SEND_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -t 7" +fi + +if [ ! -z "${PERCONA_CONNECT_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -c ${PERCONA_CONNECT_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -c 2" +fi + +if [[ ${PERCONA_TELEMETRY_DISABLE} -ne "0" ]]; then + exec "$@" --percona_telemetry_disable=1 +else + /usr/bin/telemetry-agent-supervisor.sh & + exec "$@" +fi diff --git a/sources/percona846/telemetry-agent-supervisor.sh b/sources/percona846/telemetry-agent-supervisor.sh new file mode 100755 index 0000000..6ad026e --- /dev/null +++ b/sources/percona846/telemetry-agent-supervisor.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +# phase-0 telemetry +/call-home.sh -f "PRODUCT_FAMILY_PS" -v "${PS_TELEMETRY_VERSION}" -d "DOCKER" ${CALL_HOME_OPTIONAL_PARAMS} &> /dev/null || : + +# phase-1 telemetry +for i in {1..3}; do + /usr/bin/percona-telemetry-agent >> /var/log/percona/telemetry-agent.log 2>> /var/log/percona/telemetry-agent-error.log + if [ $? -eq 0 ]; then + break + fi + sleep 5 +done +sleep infinity diff --git a/sources/percona847/Dockerfile b/sources/percona847/Dockerfile new file mode 100644 index 0000000..399e6a5 --- /dev/null +++ b/sources/percona847/Dockerfile @@ -0,0 +1,153 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL name="Percona Server" \ + release="8.4" \ + vendor="Percona" \ + summary="Percona Server database server" \ + description="Percona Server is a fast, stable and true multi-user, multi-threaded SQL \ + database server. SQL (Structured Query Language) is the most popular database \ + query language in the world. The main goals of Percona Server are speed, \ + robustness and ease of use." \ + maintainer="Percona Development " + +LABEL org.opencontainers.image.authors="info@percona.com" + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +ENV PS_VERSION=8.4.7-7.1 +ENV MYSQL_SHELL_VERSION=8.4.7-1 +ENV OS_VER=el9 +ENV FULL_PERCONA_VERSION="$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION="$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO=release +ENV PS_TELEMETRY_VERSION=8.4.7-7-1 +ENV CALL_HOME_DOWNLOAD_SHA256=5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256=fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION=0.1 +# Do not report during Docker image creation. +# Note that doing so, would create telemetry config file +# which would prevent reporting when new container is started. +# If we want to track Docker image creation as well, +# remove telemetry config file after installing packages! +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + percona-release disable all; \ + percona-release enable ps-84-lts ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/j/jemalloc-5.2.1-2.el9.x86_64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/g/gflags-2.2.2-9.el9.x86_64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + #microdnf -y install epel-release; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +COPY LICENSE /licenses/LICENSE.Dockerfile + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +COPY dockerdir/ / +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona847/Dockerfile-dockerhub b/sources/percona847/Dockerfile-dockerhub new file mode 100644 index 0000000..0496950 --- /dev/null +++ b/sources/percona847/Dockerfile-dockerhub @@ -0,0 +1,128 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL org.opencontainers.image.authors="info@percona.com" + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +ENV PS_VERSION=8.4.7-7.1 +ENV MYSQL_SHELL_VERSION=8.4.7-1 +ENV OS_VER=el9 +ENV FULL_PERCONA_VERSION="$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION="$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO=release +ENV PS_TELEMETRY_VERSION=8.4.7-7-1 +ENV CALL_HOME_DOWNLOAD_SHA256=5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256=fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION=0.1 +# Do not report during Docker image creation. +# Note that doing so, would create telemetry config file +# which would prevent reporting when new container is started. +# If we want to track Docker image creation as well, +# remove telemetry config file after installing packages! +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + percona-release disable all; \ + percona-release enable ps-84-lts ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/j/jemalloc-5.2.1-2.el9.x86_64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/g/gflags-2.2.2-9.el9.x86_64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + #microdnf -y install epel-release; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry-dockerhub.sh /docker-entrypoint.sh +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona847/Dockerfile-mysqlsh-upstream b/sources/percona847/Dockerfile-mysqlsh-upstream new file mode 100644 index 0000000..e109a82 --- /dev/null +++ b/sources/percona847/Dockerfile-mysqlsh-upstream @@ -0,0 +1,153 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL name="Percona Server" \ + release="8.4" \ + vendor="Percona" \ + summary="Percona Server database server" \ + description="Percona Server is a fast, stable and true multi-user, multi-threaded SQL \ + database server. SQL (Structured Query Language) is the most popular database \ + query language in the world. The main goals of Percona Server are speed, \ + robustness and ease of use." \ + maintainer="Percona Development " + +LABEL org.opencontainers.image.authors="info@percona.com" + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +ENV PS_VERSION=8.4.7-7.1 +ENV MYSQL_SHELL_VERSION=8.4.7-1 +ENV OS_VER=el9 +ENV FULL_PERCONA_VERSION="$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION="$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO=release +ENV PS_TELEMETRY_VERSION=8.4.7-7-1 +ENV CALL_HOME_DOWNLOAD_SHA256=5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256=fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION=0.1 +# Do not report during Docker image creation. +# Note that doing so, would create telemetry config file +# which would prevent reporting when new container is started. +# If we want to track Docker image creation as well, +# remove telemetry config file after installing packages! +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils libssh; \ + rpm -i /tmp/percona-release.rpm; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + percona-release disable all; \ + percona-release enable ps-84-lts ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/j/jemalloc-5.2.1-2.el9.x86_64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/x86_64/Packages/g/gflags-2.2.2-9.el9.x86_64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + curl -Lf -o /tmp/mysql-shell.rpm https://dev.mysql.com/get/Downloads/MySQL-Shell/mysql-shell-${MYSQL_SHELL_VERSION}.el9.x86_64.rpm; \ + rpm -i /tmp/mysql-shell.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm /tmp/mysql-shell.rpm + +RUN set -ex; \ + #microdnf -y install epel-release; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + #percona-server-tokudb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION}; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +COPY LICENSE /licenses/LICENSE.Dockerfile + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +COPY dockerdir/ / +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona847/Dockerfile-mysqlsh-upstream.aarch64 b/sources/percona847/Dockerfile-mysqlsh-upstream.aarch64 new file mode 100644 index 0000000..e2ece1c --- /dev/null +++ b/sources/percona847/Dockerfile-mysqlsh-upstream.aarch64 @@ -0,0 +1,154 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL name="Percona Server" \ + release="8.4" \ + vendor="Percona" \ + summary="Percona Server database server" \ + description="Percona Server is a fast, stable and true multi-user, multi-threaded SQL \ + database server. SQL (Structured Query Language) is the most popular database \ + query language in the world. The main goals of Percona Server are speed, \ + robustness and ease of use." \ + maintainer="Percona Development " + +LABEL org.opencontainers.image.authors="info@percona.com" + +ENV PS_VERSION=8.4.7-7.1 +ENV MYSQL_SHELL_VERSION=8.4.7-1 +ENV OS_VER=el9 +ENV FULL_PERCONA_VERSION="$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION="$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO=release +ENV PS_TELEMETRY_VERSION=8.4.7-7-1 +ENV CALL_HOME_DOWNLOAD_SHA256=5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256=fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION=0.1 + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +# Do not report during Docker image creation. +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + #yum -y install epel-release; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils libssh; \ + rpm -i /tmp/percona-release.rpm; \ + sed -i "s|x86_64|x86_64 aarch64|" /usr/bin/percona-release; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + #microdnf -y module disable mysql; \ + percona-release disable all; \ + percona-release enable ps-84-lts ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + rm -rf /tmp/percona-*; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/j/jemalloc-5.2.1-2.el9.aarch64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/g/gflags-2.2.2-9.el9.aarch64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + curl -Lf -o /tmp/mysql-shell.rpm https://dev.mysql.com/get/Downloads/MySQL-Shell/mysql-shell-${MYSQL_SHELL_VERSION}.el9.aarch64.rpm; \ + rpm -i /tmp/mysql-shell.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm /tmp/mysql-shell.rpm + +RUN set -ex; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-telemetry-agent; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ + +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +COPY LICENSE /licenses/LICENSE.Dockerfile + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +COPY dockerdir/ / +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona847/Dockerfile.aarch64 b/sources/percona847/Dockerfile.aarch64 new file mode 100644 index 0000000..c97611f --- /dev/null +++ b/sources/percona847/Dockerfile.aarch64 @@ -0,0 +1,154 @@ +# This Dockerfile should be used for docker official repo + +# https://github.com/docker-library/official-images: +# No official images can be derived from, or depend on, non-official images +# with the following notable exceptions... +FROM redhat/ubi9-minimal + +LABEL name="Percona Server" \ + release="8.4" \ + vendor="Percona" \ + summary="Percona Server database server" \ + description="Percona Server is a fast, stable and true multi-user, multi-threaded SQL \ + database server. SQL (Structured Query Language) is the most popular database \ + query language in the world. The main goals of Percona Server are speed, \ + robustness and ease of use." \ + maintainer="Percona Development " + +LABEL org.opencontainers.image.authors="info@percona.com" + +ENV PS_VERSION=8.4.7-7.1 +ENV MYSQL_SHELL_VERSION=8.4.7-1 +ENV OS_VER=el9 +ENV FULL_PERCONA_VERSION="$PS_VERSION.$OS_VER" +ENV FULL_MYSQL_SHELL_VERSION="$MYSQL_SHELL_VERSION.$OS_VER" +ENV PS_REPO=release +ENV PS_TELEMETRY_VERSION=8.4.7-7-1 +ENV CALL_HOME_DOWNLOAD_SHA256=5e84d2f1a5d57f44c46e6a1f16794d649d3de09fe8021f0294bc321c89e51068 +ENV KEY_RPM_DOWNLOAD_SHA256=fcf0eab4f05a1c0de6363ac4b707600a27a9d774e9b491059e59e6921b255a84 +ENV CALL_HOME_VERSION=0.1 + +# It is intentionally used another UID, to have backward compatibility with +# the previous image versions published on Docker Hub +RUN set -ex; \ + #groupdel input; \ + #userdel systemd-coredump; \ + groupadd -g 1001 mysql; \ + useradd -u 1001 -r -g 1001 -s /sbin/nologin \ + -m -c "Default Application User" mysql + +# Do not report during Docker image creation. +ARG PERCONA_TELEMETRY_DISABLE=1 + +# check repository package signature in secure way +RUN set -ex; \ + #yum -y install epel-release; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 4D1BB29D63D98E422B2113B19334A25F8507EFA5 99DB70FAE1D7CE227FB6488205B555B38483C65D; \ + gpg --batch --export --armor 4D1BB29D63D98E422B2113B19334A25F8507EFA5 > ${GNUPGHOME}/PERCONA-PACKAGING-KEY; \ + gpg --batch --export --armor 99DB70FAE1D7CE227FB6488205B555B38483C65D > ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + rpmkeys --import ${GNUPGHOME}/PERCONA-PACKAGING-KEY ${GNUPGHOME}/RPM-GPG-KEY-centosofficial; \ + curl -Lf -o /tmp/percona-release.rpm https://repo.percona.com/yum/percona-release-latest.noarch.rpm; \ + rpmkeys --checksig /tmp/percona-release.rpm; \ + microdnf install -y findutils; \ + rpm -i /tmp/percona-release.rpm; \ + sed -i "s|x86_64|x86_64 aarch64|" /usr/bin/percona-release; \ + rm -rf "$GNUPGHOME" /tmp/percona-release.rpm; \ + rpm --import /etc/pki/rpm-gpg/PERCONA-PACKAGING-KEY; \ + #microdnf -y module disable mysql; \ + percona-release disable all; \ + percona-release enable ps-84-lts ${PS_REPO}; \ + percona-release enable telemetry ${PS_REPO}; \ + percona-release enable mysql-shell ${PS_REPO}; \ + rm -rf /tmp/percona-*; \ + curl -O https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9; \ + echo "$KEY_RPM_DOWNLOAD_SHA256 RPM-GPG-KEY-EPEL-9" | sha256sum --strict --check; \ + rpm --import RPM-GPG-KEY-EPEL-9; \ + curl -Lf -o /tmp/jemalloc.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/j/jemalloc-5.2.1-2.el9.aarch64.rpm; \ + curl -Lf -o /tmp/gflags.rpm https://rpmfind.net/linux/epel/9/Everything/aarch64/Packages/g/gflags-2.2.2-9.el9.aarch64.rpm; \ + rpmkeys --checksig /tmp/gflags.rpm /tmp/jemalloc.rpm; \ + rpm -i /tmp/jemalloc.rpm; \ + rpm -i /tmp/gflags.rpm; \ + rm -f /tmp/gflags.rpm /tmp/jemalloc.rpm + +RUN set -ex; \ + rpm -e --nodeps tzdata; \ + microdnf -y install \ + hostname \ + tzdata \ + jemalloc \ + which \ + cracklib-dicts \ + tar \ + policycoreutils; \ + microdnf -y update \ + #glibc \ + libnghttp2 \ + openssh \ + python3-setuptools-wheel \ + krb5-libs \ + pam \ + python3; \ + \ + microdnf -y install \ + percona-server-server-${FULL_PERCONA_VERSION} \ + percona-server-rocksdb-${FULL_PERCONA_VERSION} \ + percona-server-devel-${FULL_PERCONA_VERSION} \ + percona-icu-data-files-${FULL_PERCONA_VERSION} \ + percona-mysql-shell-${FULL_MYSQL_SHELL_VERSION} \ + percona-telemetry-agent; \ + microdnf clean all; \ + rm -rf /var/cache/dnf /var/cache/yum /var/lib/mysql + +# purge and re-create /var/lib/mysql with appropriate ownership +RUN set -ex; \ + /usr/bin/install -m 0775 -o mysql -g root -d /var/lib/mysql /var/run/mysqld /docker-entrypoint-initdb.d; \ +# comment out a few problematic configuration values + find /etc/my.cnf /etc/my.cnf.d -name '*.cnf' -print0 \ + | xargs -0 grep -lZE '^(bind-address|log|user)' \ + | xargs -rt -0 sed -Ei 's/^(bind-address|log|user)/#&/'; \ +# don't reverse lookup hostnames, they are usually another container + echo '!includedir /etc/my.cnf.d' >> /etc/my.cnf; \ + printf '[mysqld]\nhost_cache_size=0\nskip-name-resolve\n' > /etc/my.cnf.d/docker.cnf; \ + +# TokuDB modifications + /usr/bin/install -m 0664 -o mysql -g root /dev/null /etc/sysconfig/mysql; \ + echo "LD_PRELOAD=/usr/lib64/libjemalloc.so.1" >> /etc/sysconfig/mysql; \ + echo "THP_SETTING=never" >> /etc/sysconfig/mysql; \ +# allow to change config files + chown -R mysql:root /etc/my.cnf /etc/my.cnf.d; \ + chmod -R ug+rwX /etc/my.cnf /etc/my.cnf.d + +COPY LICENSE /licenses/LICENSE.Dockerfile + +VOLUME ["/var/lib/mysql", "/var/log/mysql"] + +RUN set -eux; \ + curl -fL "https://github.com/Percona-Lab/telemetry-agent/archive/refs/tags/phase-$CALL_HOME_VERSION.tar.gz" -o "phase-$CALL_HOME_VERSION.tar.gz"; \ + echo "$CALL_HOME_DOWNLOAD_SHA256 phase-$CALL_HOME_VERSION.tar.gz" | sha256sum --strict --check; \ + tar -xvf phase-$CALL_HOME_VERSION.tar.gz; \ + cp telemetry-agent-phase-$CALL_HOME_VERSION/call-home.sh .;\ + rm -rf telemetry-agent-phase-$CALL_HOME_VERSION phase-$CALL_HOME_VERSION.tar.gz; \ + chmod a+rx /call-home.sh; \ + mkdir -p /usr/local/percona; \ + chown mysql:mysql /usr/local/percona +ENV CALL_HOME_OPTIONAL_PARAMS=" -s ${OS_VER}" + +COPY ps-entry.sh /docker-entrypoint.sh +COPY telemetry-agent-supervisor.sh /usr/bin/ +COPY dockerdir/ / +RUN set -ex; \ + chown mysql /usr/bin/telemetry-agent-supervisor.sh; \ + chown mysql /usr/bin/percona-telemetry-agent; \ + chown mysql /usr/local/percona/telemetry/history; \ + chmod ug+rwx /usr/bin/telemetry-agent-supervisor.sh; \ + chmod -R go+w /var/log/percona +ENV PERCONA_TELEMETRY_CHECK_INTERVAL=86400 +ENV PERCONA_TELEMETRY_HISTORY_KEEP_INTERVAL=604800 +ENV PERCONA_TELEMETRY_RESEND_INTERVAL=60 +ENV PERCONA_TELEMETRY_URL=https://check.percona.com/v1/telemetry/GenericReport +ENTRYPOINT ["/docker-entrypoint.sh"] + +USER mysql +EXPOSE 3306 33060 +CMD ["mysqld"] diff --git a/sources/percona847/LICENSE b/sources/percona847/LICENSE new file mode 100644 index 0000000..2399231 --- /dev/null +++ b/sources/percona847/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright 2018 Percona, LLC + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/sources/percona847/README-build.md b/sources/percona847/README-build.md new file mode 100644 index 0000000..b801e9a --- /dev/null +++ b/sources/percona847/README-build.md @@ -0,0 +1,40 @@ +Build image + + `docker build -t percona-server Dockerfile` + +or + + `docker build -t percona-server Dockerfile` + +Tag image + + `docker tag percona/percona-server:8.4` + +Push to hub + + `docker push percona/percona-server:8.4` + +Usage +===== + + vi ./docker-compose.yml + percona: + image: percona/percona-server:latest + name: perconaserver + environment: + MYSQL_ROOT_PASSWORD: secret + ports: + - "3306" + volumes: + # create volumes for use + - /var/log/mysql + - /var/lib/mysql + # bind mount my local my.cnf + # - $PWD/my.cnf:/etc/my.cnf + command: + # Workaround for no my.cnf in image + - '--user=mysql' + 7) Start the container from cli + docker-compose up + 8) Check status + docker-compose ps diff --git a/sources/percona847/README.md b/sources/percona847/README.md new file mode 100644 index 0000000..035721b --- /dev/null +++ b/sources/percona847/README.md @@ -0,0 +1,158 @@ +![logo](https://www.percona.com/wp-content/uploads/2023/03/font-1.jpg) + +# What is Percona Server? + +Percona Server is an enhanced drop-in replacement for MySQL. With Percona Server, your queries will run faster and more consistently. You will consolidate servers on powerful hardware and will delay sharding, or avoid it entirely. + +For more information and related downloads for Percona Server and other Percona products, please visit http://www.percona.com. + +# Percona Server Docker Images + +These are the only official Percona Server Docker images, created and maintained by the Percona team. The image has the Percona Fractal Tree based storage engine `TokuDB` enabled. The available versions are: + + Percona Server 8.4.3-3.1 (tag: 8.4) + +Images are updated when new releases are published. + +# How to Use the Images + +## Start a Percona Server Instance + +Start a Percona Server container as follows: + + docker run --name container-name -e MYSQL_ROOT_PASSWORD=secret -d percona/percona-server:tag + +Where `container-name` is the name you want to assign to your container, `secret` is the password to be set for the root user and `tag` is the tag specifying the version you want. See the list above for relevant tags, or look at the [full list of tags](https://registry.hub.docker.com/u/percona/percona-server/tags/manage/). + +## Connect to Percona Server from an Application in Another Docker Container + +This image exposes the standard MySQL port (3306), so container linking makes the instance available to other containers. Start other containers like this in order to link it to the Percona Server container: + + docker run --name app-container-name --link container-name -d app-that-uses-mysql + +## Connect to Percona Server from the MySQL Command Line Client + +The following command starts another container instance and runs the `mysql` command line client against your original container, allowing you to execute SQL statements against your database: + + docker run -it --link container-name --rm percona/percona-server:tag mysql -h container-name -P 3306 -uroot -psecret' + +where `container-name` is the name of your database container. + +# Environment Variables + +When you start a Percona Server container, you can adjust the configuration of the instance by passing one or more environment variables on the `docker run` command line. Do note that none of the variables below will have any effect if you start the container with a data directory that already contains a database: any pre-existing database will always be left untouched on container startup. + +Most of the variables listed below are optional, but one of the variables `MYSQL_ROOT_PASSWORD`, `MYSQL_ALLOW_EMPTY_PASSWORD`, `MYSQL_RANDOM_ROOT_PASSWORD` must be given. + +## `MYSQL_ROOT_PASSWORD` + +This variable specifies a password that will be set for the root superuser account. In the above example, it was set to `secret`. **NOTE:** Setting the MySQL root user password on the command line is insecure. + +## `MYSQL_ROOT_PASSWORD_FILE` + +This variable specifies a file that will be read for the root user account. This can be a mounted file when you run your container. This can also be used in the scope of the Docker Secrets (Swarm mode) functionality. + +## `MYSQL_RANDOM_ROOT_PASSWORD` + +When this variable is set to `yes`, a random password for the server's root user will be generated. The password will be printed to stdout in the container, and it can be obtained by using the command `docker logs container-name`. + +## `MYSQL_ONETIME_PASSWORD` + +This variable is optional. When set to `yes`, the root user's password will be set as expired, and must be changed before we can login normally. This is only supported by version 5.6 or newer. + +## `MYSQL_DATABASE` + +This variable is optional. It allows you to specify the name of a database to be created on image startup. If a user/password was supplied (see below) then that user will be granted superuser access (corresponding to GRANT ALL) to this database. + +## `MYSQL_USER`, `MYSQL_PASSWORD` + +These variables are optional, used in conjunction to create a new user and set that user's password. This user will be granted superuser permissions (see above) for the database specified by the `MYSQL_DATABASE` variable. Both variables are required for a user to be created. + +Do note that there is no need to use this mechanism to create the `root` superuser, that user gets created by default with the password set by either of the mechanisms (given or generated) discussed above. + +## `MYSQL_ALLOW_EMPTY_PASSWORD` + +Set to `yes` to allow the container to be started with a blank password for the root user. **NOTE:** Setting this variable to `yes` is not recommended unless you really know what you are doing, since this will leave your instance completely unprotected, allowing anyone to gain complete superuser access. + +## `INIT_TOKUDB` + +Set to `1` to allow the container to be started with enabled TOKUDB engine. + +## `INIT_ROCKSDB` + +Set to `1` to allow the container to be started with enabled ROCKSDB engine. + +## `MYSQL_INIT_ONLY` + +Set to `1` will skip starting the `mysqld` process and will run only the initialization part if MySQL was not initialized before. + +# Notes, Tips, Gotchas + +## Secure Container Startup + +In many use cases, employing the `MYSQL_ROOT_PASSWORD` variable to specify the MySQL root user password on initial container startup is insecure. Instead, to keep your setup as secure as possible, we strongly recommend using the `MYSQL_RANDOM_ROOT_PASSWORD` option. To further secure your instance, we also recommend using the `MYSQL_ONETIME_PASSWORD` variable if you use version 5.6 or higher. + +## Where to Store Data + +There are many two ways to store data used by applications that run in Docker containers. We maintain our usual stance and encourage users to investigate the options and use the method that best suits their use case. Here are some of the options available: + +* Let Docker manage the storage of your database data by writing the database files to disk on the host system using its own internal volume management. The current solutions, devicemapper, aufs and overlayfs have negative performance records. +* Create a data directory on the host system (outside the container on high performance storage) and mount this to a directory visible from inside the container. This places the database files in a known location on the host system, and makes it easy for tools and applications on the host system to access the files. The user needs to make sure that the directory exists, and that permissions and other security mechanisms on the host system are set up correctly. + +The Docker documentation is a good starting point for understanding the different storage options and variations, and there are multiple blog and forum postings that discuss and give advice in this area. We will simply show the basic procedure here for the latter option above: + +1. Create a data directory on a suitable volume on your host system, e.g. `/local/datadir`. +2. Start your container like this: + +``` + docker run --name container-name -v /local/datadir:/var/lib/mysql -e MYSQL_ROOT_PASSWORD=secret -d percona/percona-server:tag +``` + +The `-v /local/datadir:/var/lib/mysql` part of the command mounts the `/local/datadir` directory from the underlying host system as `/var/lib/mysql` inside the container, where MySQL by default will write its data files. + +Note that users on systems with SELinux enabled may experience problems with this. The current workaround is to assign the relevant SELinux policy type to the new data directory so that the container will be allowed to access it: + + chcon -Rt svirt_sandbox_file_t /local/datadir + +## Existing Data + +If you start your MySQL container instance with a data directory that already contains a data (specifically, a `mysql` subdirectory where all our system tables live), the `$MYSQL_ROOT_PASSWORD` variable should be omitted from the `docker run` command. + +## Port forwarding + +Docker allows mapping of ports on the container to ports on the host system by using the -p option. If you start the container as follows, you can connect to the database by connecting your client to a port on the host machine. This can greatly simplfy consolidating many instances to a single host. In this example port 6603, the we use the address of the Docker host to connect to the TCP port the Docker deamon is forwarding from: + + docker run --name container-name `-p 6603:3306` -d percona/percona-server + mysql -h docker_host_ip -P 6603 + +## Passing options to the server + +You can pass arbitrary command line options to the MySQL server by appending them to the `run command`: + + docker run --name my-container-name -d percona/percona-server --option1=value --option2=value + +In this case, the values of option1 and option2 will be passed directly to the server when it is started. The following command will for instance start your container with UTF-8 as the default setting for character set and collation for all databases in MySQL: + + docker run --name container-name -d percona/percona-server --character-set-server=utf8 --collation-server=utf8_general_ci + +## Using a Custom Percona Server Config File + +The Percona Server startup configuration in these Docker images is specified in the file `/etc/my.cnf`. If you want to customize this configuration for your own purposes, you can create your alternative configuration file in a directory on the host machine and then mount this file in the appropriate location inside the Percona Server container, effectively replacing the standard configuration file. + +If you want to base your changes on the standard configuration file, start your Percona Server container in the standard way described above, then do: + + docker exec -it my-container-name cat /etc/my.cnf > /my/custom/config-file + +... where `/my/custom/config-file` is the path and name of the new configuration file. Then start a new Percona Server container like this: + + docker run --name my-new-container-name -v /my/custom/config-file:/etc/my.cnf -e MYSQL_ROOT_PASSWORD=my-secret-pw -d percona/percona-server:tag + +This will start a new Percona Server container `my-new-container-name` where the Percona Server instance uses the startup options specified in `/my/custom/config-file`. + +# Supported Docker Versions + +These images are officially supported by the MySQL team on Docker version 1.9. Support for older versions (down to 1.0) is provided on a best-effort basis, but we strongly recommend running on the most recent version, since that is assumed for parts of the documentation above. + +# User Feedback + +We welcome your feedback! diff --git a/sources/percona847/docker-compose.yml b/sources/percona847/docker-compose.yml new file mode 100644 index 0000000..5061086 --- /dev/null +++ b/sources/percona847/docker-compose.yml @@ -0,0 +1,33 @@ +version: '2' +services: + percona-server: + image: percona/percona-server:8.4 + environment: + MYSQL_ROOT_PASSWORD: secret + ports: + - "3306" + volumes: + # create volumes for use + - /var/lib/mysql + # bind mount my local my.cnf + # - $PWD/my.cnf:/etc/my.cnf.d/my.cnf + +# uncomment sections below if you want to enable PMM +# pmm-server: +# image: percona/pmm-server:latest +# ports: +# - "443:443" +# environment: +# - SERVER_USER=pmm +# - SERVER_PASSWORD=pmm +# pmm-client-ps: +# image: perconalab/pmm-client:latest +# environment: +# - PMM_SERVER=pmm-server:443 +# - PMM_USER=pmm +# - PMM_PASSWORD=pmm +# - DB_TYPE=mysql +# - DB_HOST=percona-server +# - DB_PORT=3306 +# - DB_USER=root +# - DB_PASSWORD=secret diff --git a/sources/percona847/dockerdir/usr/lib64/mysql/plugin/component_keyring_vault.cnf b/sources/percona847/dockerdir/usr/lib64/mysql/plugin/component_keyring_vault.cnf new file mode 100644 index 0000000..ee11ada --- /dev/null +++ b/sources/percona847/dockerdir/usr/lib64/mysql/plugin/component_keyring_vault.cnf @@ -0,0 +1 @@ +{ "read_local_config": true } diff --git a/sources/percona847/dockerdir/usr/sbin/mysqld.my b/sources/percona847/dockerdir/usr/sbin/mysqld.my new file mode 100644 index 0000000..b4956e3 --- /dev/null +++ b/sources/percona847/dockerdir/usr/sbin/mysqld.my @@ -0,0 +1 @@ +{ "read_local_manifest": true } diff --git a/sources/percona847/ps-entry-dockerhub.sh b/sources/percona847/ps-entry-dockerhub.sh new file mode 100755 index 0000000..9f08ef1 --- /dev/null +++ b/sources/percona847/ps-entry-dockerhub.sh @@ -0,0 +1,250 @@ +#!/bin/bash +set -eo pipefail +shopt -s nullglob +# if command starts with an option, prepend mysqld +if [ "${1:0:1}" = '-' ]; then + set -- mysqld "$@" +fi +# skip setup if they want an option that stops mysqld +wantHelp= +for arg; do + case "$arg" in + -'?'|--help|--print-defaults|-V|--version) + wantHelp=1 + break + ;; + esac +done + +# usage: file_env VAR [DEFAULT] +# ie: file_env 'XYZ_DB_PASSWORD' 'example' +# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of +# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature) +file_env() { + local var="$1" + local fileVar="${var}_FILE" + local def="${2:-}" + if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then + echo >&2 "error: both $var and $fileVar are set (but are exclusive)" + exit 1 + fi + local val="$def" + if [ "${!var:-}" ]; then + val="${!var}" + elif [ "${!fileVar:-}" ]; then + val="$(< "${!fileVar}")" + fi + export "$var"="$val" + unset "$fileVar" +} + +# usage: process_init_file FILENAME MYSQLCOMMAND... +# ie: process_init_file foo.sh mysql -uroot +# (process a single initializer file, based on its extension. we define this +# function here, so that initializer scripts (*.sh) can use the same logic, +# potentially recursively, or override the logic used in subsequent calls) +process_init_file() { + local f="$1"; shift + local mysql=( "$@" ) + + case "$f" in + *.sh) echo "$0: running $f"; . "$f" ;; + *.sql) echo "$0: running $f"; "${mysql[@]}" < "$f"; echo ;; + *.sql.gz) echo "$0: running $f"; gunzip -c "$f" | "${mysql[@]}"; echo ;; + *) echo "$0: ignoring $f" ;; + esac + echo +} + +_check_config() { + toRun=( "$@" --verbose --help ) + if ! errors="$("${toRun[@]}" 2>&1 >/dev/null)"; then + cat >&2 <<-EOM + + ERROR: mysqld failed while attempting to check config + command was: "${toRun[*]}" + + $errors + EOM + exit 1 + fi +} + +# Fetch value from server config +# We use mysqld --verbose --help instead of my_print_defaults because the +# latter only show values present in config files, and not server defaults +_get_config() { + local conf="$1"; shift + "$@" --verbose --help --log-bin-index="$(mktemp -u)" 2>/dev/null \ + | awk '$1 == "'"$conf"'" && /^[^ \t]/ { sub(/^[^ \t]+[ \t]+/, ""); print; exit }' + # match "datadir /some/path with/spaces in/it here" but not "--xyz=abc\n datadir (xyz)" +} + +if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then + # still need to check config, container may have started with --user + _check_config "$@" + + if [ -n "$INIT_TOKUDB" ]; then + export LD_PRELOAD=/usr/lib64/libjemalloc.so.1 + fi + # Get config + DATADIR="$(_get_config 'datadir' "$@")" + + if [ ! -d "$DATADIR/mysql" ]; then + file_env 'MYSQL_ROOT_PASSWORD' + if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + echo >&2 'error: database is uninitialized and password option is not specified ' + echo >&2 ' You need to specify one of MYSQL_ROOT_PASSWORD, MYSQL_ALLOW_EMPTY_PASSWORD and MYSQL_RANDOM_ROOT_PASSWORD' + exit 1 + fi + + mkdir -p "$DATADIR" + + echo 'Initializing database' + "$@" --initialize-insecure + echo 'Database initialized' + + if command -v mysql_ssl_rsa_setup > /dev/null && [ ! -e "$DATADIR/server-key.pem" ]; then + # https://github.com/mysql/mysql-server/blob/23032807537d8dd8ee4ec1c4d40f0633cd4e12f9/packaging/deb-in/extra/mysql-systemd-start#L81-L84 + echo 'Initializing certificates' + mysql_ssl_rsa_setup --datadir="$DATADIR" + echo 'Certificates initialized' + fi + + SOCKET="$(_get_config 'socket' "$@")" + "$@" --skip-networking --socket="${SOCKET}" & + pid="$!" + + mysql=( mysql --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" --password="" ) + + for i in {120..0}; do + if echo 'SELECT 1' | "${mysql[@]}" &> /dev/null; then + break + fi + echo 'MySQL init process in progress...' + sleep 1 + done + if [ "$i" = 0 ]; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + if [ -z "$MYSQL_INITDB_SKIP_TZINFO" ]; then + ( + echo "SET @@SESSION.SQL_LOG_BIN = off;" + # sed is for https://bugs.mysql.com/bug.php?id=20545 + mysql_tzinfo_to_sql /usr/share/zoneinfo | sed 's/Local time zone must be set--see zic manual page/FCTY/' + ) | "${mysql[@]}" mysql + fi + + # install TokuDB engine + if [ -n "$INIT_TOKUDB" ]; then + ps-admin --docker --enable-tokudb -u root -p $MYSQL_ROOT_PASSWORD + fi + if [ -n "$INIT_ROCKSDB" ]; then + ps-admin --enable-rocksdb -u root -p $MYSQL_ROOT_PASSWORD + fi + + if [ ! -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + MYSQL_ROOT_PASSWORD="$(pwmake 128)" + echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD" + fi + + rootCreate= + # default root to listen for connections from anywhere + file_env 'MYSQL_ROOT_HOST' '%' + if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then + # no, we don't care if read finds a terminating character in this heredoc + # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151 + read -r -d '' rootCreate <<-EOSQL || true + CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ; + EOSQL + fi + + "${mysql[@]}" <<-EOSQL + -- What's done in this file shouldn't be replicated + -- or products like mysql-fabric won't work + SET @@SESSION.SQL_LOG_BIN=0; + + DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'mysql.infoschema', 'mysql.session', 'root') OR host NOT IN ('localhost') ; + ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ; + ${rootCreate} + DROP DATABASE IF EXISTS test ; + FLUSH PRIVILEGES ; + EOSQL + + if [ ! -z "$MYSQL_ROOT_PASSWORD" ]; then + mysql+=( -p"${MYSQL_ROOT_PASSWORD}" ) + fi + + file_env 'MYSQL_DATABASE' + if [ "$MYSQL_DATABASE" ]; then + echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" | "${mysql[@]}" + mysql+=( "$MYSQL_DATABASE" ) + fi + + file_env 'MYSQL_USER' + file_env 'MYSQL_PASSWORD' + if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then + echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" | "${mysql[@]}" + + if [ "$MYSQL_DATABASE" ]; then + echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}" + fi + + echo 'FLUSH PRIVILEGES ;' | "${mysql[@]}" + fi + + echo + ls /docker-entrypoint-initdb.d/ > /dev/null + for f in /docker-entrypoint-initdb.d/*; do + process_init_file "$f" "${mysql[@]}" + done + + if [ ! -z "$MYSQL_ONETIME_PASSWORD" ]; then + "${mysql[@]}" <<-EOSQL + ALTER USER 'root'@'%' PASSWORD EXPIRE; + EOSQL + fi + if ! kill -s TERM "$pid" || ! wait "$pid"; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + echo + echo 'MySQL init process done. Ready for start up.' + echo + fi + + # exit when MYSQL_INIT_ONLY environment variable is set to avoid starting mysqld + if [ ! -z "$MYSQL_INIT_ONLY" ]; then + echo 'Initialization complete, now exiting!' + exit 0 + fi +fi + +if [ ! -z "${PERCONA_INSTANCE_ID}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -i ${PERCONA_INSTANCE_ID}" +fi + +if [ ! -z "${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -j ${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" +fi + +if [ ! -z "${PERCONA_SEND_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -t ${PERCONA_SEND_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -t 7" +fi + +if [ ! -z "${PERCONA_CONNECT_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -c ${PERCONA_CONNECT_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -c 2" +fi + +/call-home.sh -f "PRODUCT_FAMILY_PS" -v "${PS_TELEMETRY_VERSION}" -d "DOCKER" ${CALL_HOME_OPTIONAL_PARAMS} &> /dev/null || : + +exec "$@" diff --git a/sources/percona847/ps-entry.sh b/sources/percona847/ps-entry.sh new file mode 100755 index 0000000..a7fe81b --- /dev/null +++ b/sources/percona847/ps-entry.sh @@ -0,0 +1,253 @@ +#!/bin/bash +set -eo pipefail +shopt -s nullglob +# if command starts with an option, prepend mysqld +if [ "${1:0:1}" = '-' ]; then + set -- mysqld "$@" +fi +# skip setup if they want an option that stops mysqld +wantHelp= +for arg; do + case "$arg" in + -'?'|--help|--print-defaults|-V|--version) + wantHelp=1 + break + ;; + esac +done + +# usage: file_env VAR [DEFAULT] +# ie: file_env 'XYZ_DB_PASSWORD' 'example' +# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of +# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature) +file_env() { + local var="$1" + local fileVar="${var}_FILE" + local def="${2:-}" + if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then + echo >&2 "error: both $var and $fileVar are set (but are exclusive)" + exit 1 + fi + local val="$def" + if [ "${!var:-}" ]; then + val="${!var}" + elif [ "${!fileVar:-}" ]; then + val="$(< "${!fileVar}")" + fi + export "$var"="$val" + unset "$fileVar" +} + +# usage: process_init_file FILENAME MYSQLCOMMAND... +# ie: process_init_file foo.sh mysql -uroot +# (process a single initializer file, based on its extension. we define this +# function here, so that initializer scripts (*.sh) can use the same logic, +# potentially recursively, or override the logic used in subsequent calls) +process_init_file() { + local f="$1"; shift + local mysql=( "$@" ) + + case "$f" in + *.sh) echo "$0: running $f"; . "$f" ;; + *.sql) echo "$0: running $f"; "${mysql[@]}" < "$f"; echo ;; + *.sql.gz) echo "$0: running $f"; gunzip -c "$f" | "${mysql[@]}"; echo ;; + *) echo "$0: ignoring $f" ;; + esac + echo +} + +_check_config() { + toRun=( "$@" --verbose --help ) + if ! errors="$("${toRun[@]}" 2>&1 >/dev/null)"; then + cat >&2 <<-EOM + + ERROR: mysqld failed while attempting to check config + command was: "${toRun[*]}" + + $errors + EOM + exit 1 + fi +} + +# Fetch value from server config +# We use mysqld --verbose --help instead of my_print_defaults because the +# latter only show values present in config files, and not server defaults +_get_config() { + local conf="$1"; shift + "$@" --verbose --help --log-bin-index="$(mktemp -u)" 2>/dev/null \ + | awk '$1 == "'"$conf"'" && /^[^ \t]/ { sub(/^[^ \t]+[ \t]+/, ""); print; exit }' + # match "datadir /some/path with/spaces in/it here" but not "--xyz=abc\n datadir (xyz)" +} + +if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then + # still need to check config, container may have started with --user + _check_config "$@" + + if [ -n "$INIT_TOKUDB" ]; then + export LD_PRELOAD=/usr/lib64/libjemalloc.so.1 + fi + # Get config + DATADIR="$(_get_config 'datadir' "$@")" + + if [ ! -d "$DATADIR/mysql" ]; then + file_env 'MYSQL_ROOT_PASSWORD' + if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + echo >&2 'error: database is uninitialized and password option is not specified ' + echo >&2 ' You need to specify one of MYSQL_ROOT_PASSWORD, MYSQL_ALLOW_EMPTY_PASSWORD and MYSQL_RANDOM_ROOT_PASSWORD' + exit 1 + fi + + mkdir -p "$DATADIR" + + echo 'Initializing database' + "$@" --initialize-insecure + echo 'Database initialized' + + if command -v mysql_ssl_rsa_setup > /dev/null && [ ! -e "$DATADIR/server-key.pem" ]; then + # https://github.com/mysql/mysql-server/blob/23032807537d8dd8ee4ec1c4d40f0633cd4e12f9/packaging/deb-in/extra/mysql-systemd-start#L81-L84 + echo 'Initializing certificates' + mysql_ssl_rsa_setup --datadir="$DATADIR" + echo 'Certificates initialized' + fi + + SOCKET="$(_get_config 'socket' "$@")" + "$@" --skip-networking --socket="${SOCKET}" & + pid="$!" + + mysql=( mysql --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" --password="" ) + + for i in {120..0}; do + if echo 'SELECT 1' | "${mysql[@]}" &> /dev/null; then + break + fi + echo 'MySQL init process in progress...' + sleep 1 + done + if [ "$i" = 0 ]; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + if [ -z "$MYSQL_INITDB_SKIP_TZINFO" ]; then + ( + echo "SET @@SESSION.SQL_LOG_BIN = off;" + # sed is for https://bugs.mysql.com/bug.php?id=20545 + mysql_tzinfo_to_sql /usr/share/zoneinfo | sed 's/Local time zone must be set--see zic manual page/FCTY/' + ) | "${mysql[@]}" mysql + fi + + # install TokuDB engine + if [ -n "$INIT_TOKUDB" ]; then + ps-admin --docker --enable-tokudb -u root -p $MYSQL_ROOT_PASSWORD + fi + if [ -n "$INIT_ROCKSDB" ]; then + ps-admin --enable-rocksdb -u root -p $MYSQL_ROOT_PASSWORD + fi + + if [ ! -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then + MYSQL_ROOT_PASSWORD="$(pwmake 128)" + echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD" + fi + + rootCreate= + # default root to listen for connections from anywhere + file_env 'MYSQL_ROOT_HOST' '%' + if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then + # no, we don't care if read finds a terminating character in this heredoc + # https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151 + read -r -d '' rootCreate <<-EOSQL || true + CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ; + EOSQL + fi + + "${mysql[@]}" <<-EOSQL + -- What's done in this file shouldn't be replicated + -- or products like mysql-fabric won't work + SET @@SESSION.SQL_LOG_BIN=0; + + DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'mysql.infoschema', 'mysql.session', 'root') OR host NOT IN ('localhost') ; + ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ; + GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ; + ${rootCreate} + DROP DATABASE IF EXISTS test ; + FLUSH PRIVILEGES ; + EOSQL + + if [ ! -z "$MYSQL_ROOT_PASSWORD" ]; then + mysql+=( -p"${MYSQL_ROOT_PASSWORD}" ) + fi + + file_env 'MYSQL_DATABASE' + if [ "$MYSQL_DATABASE" ]; then + echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" | "${mysql[@]}" + mysql+=( "$MYSQL_DATABASE" ) + fi + + file_env 'MYSQL_USER' + file_env 'MYSQL_PASSWORD' + if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then + echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" | "${mysql[@]}" + + if [ "$MYSQL_DATABASE" ]; then + echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}" + fi + + echo 'FLUSH PRIVILEGES ;' | "${mysql[@]}" + fi + + echo + ls /docker-entrypoint-initdb.d/ > /dev/null + for f in /docker-entrypoint-initdb.d/*; do + process_init_file "$f" "${mysql[@]}" + done + + if [ ! -z "$MYSQL_ONETIME_PASSWORD" ]; then + "${mysql[@]}" <<-EOSQL + ALTER USER 'root'@'%' PASSWORD EXPIRE; + EOSQL + fi + if ! kill -s TERM "$pid" || ! wait "$pid"; then + echo >&2 'MySQL init process failed.' + exit 1 + fi + + echo + echo 'MySQL init process done. Ready for start up.' + echo + fi + + # exit when MYSQL_INIT_ONLY environment variable is set to avoid starting mysqld + if [ ! -z "$MYSQL_INIT_ONLY" ]; then + echo 'Initialization complete, now exiting!' + exit 0 + fi +fi + +if [ ! -z "${PERCONA_INSTANCE_ID}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -i ${PERCONA_INSTANCE_ID}" +fi + +if [ ! -z "${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -j ${PERCONA_TELEMETRY_CONFIG_FILE_PATH}" +fi + +if [ ! -z "${PERCONA_SEND_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -t ${PERCONA_SEND_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -t 7" +fi + +if [ ! -z "${PERCONA_CONNECT_TIMEOUT}" ]; then + CALL_HOME_OPTIONAL_PARAMS+=" -c ${PERCONA_CONNECT_TIMEOUT}" +else + CALL_HOME_OPTIONAL_PARAMS+=" -c 2" +fi + +if [[ ${PERCONA_TELEMETRY_DISABLE} -ne "0" ]]; then + exec "$@" --percona_telemetry_disable=1 +else + /usr/bin/telemetry-agent-supervisor.sh & + exec "$@" +fi diff --git a/sources/percona847/telemetry-agent-supervisor.sh b/sources/percona847/telemetry-agent-supervisor.sh new file mode 100755 index 0000000..6ad026e --- /dev/null +++ b/sources/percona847/telemetry-agent-supervisor.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +# phase-0 telemetry +/call-home.sh -f "PRODUCT_FAMILY_PS" -v "${PS_TELEMETRY_VERSION}" -d "DOCKER" ${CALL_HOME_OPTIONAL_PARAMS} &> /dev/null || : + +# phase-1 telemetry +for i in {1..3}; do + /usr/bin/percona-telemetry-agent >> /var/log/percona/telemetry-agent.log 2>> /var/log/percona/telemetry-agent-error.log + if [ $? -eq 0 ]; then + break + fi + sleep 5 +done +sleep infinity diff --git a/sources/php8227/Dockerfile b/sources/php8227/Dockerfile new file mode 100644 index 0000000..3567253 --- /dev/null +++ b/sources/php8227/Dockerfile @@ -0,0 +1,263 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS 39B641343D8C104B2B146DC3F9C39DC0B9698544 E60913E4DF209907D8E30D96659A97C9CF2A795A 1198C0117593497A5EC5C199286AF1F9897469DC + +ENV PHP_VERSION 8.2.27 +ENV PHP_URL="https://www.php.net/distributions/php-8.2.27.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.2.27.tar.xz.asc" +ENV PHP_SHA256="3eec91294d8c09b3df80b39ec36d574ed9b05de4c8afcb25fa215d48f9ecbc6b" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + if [ -n "$PHP_ASC_URL" ]; then \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + fi; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ +# bundled pcre does not support JIT on riscv64 until 10.41 (php 8.3+) +# https://github.com/PCRE2Project/pcre2/commits/pcre2-10.41/src/sljit/sljitNativeRISCV_64.c +# https://github.com/php/php-src/tree/php-8.3.0/ext/pcre/pcre2lib + $(test "$gnuArch" = 'riscv64-linux-musl' && echo '--without-pcre-jit') \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8227/docker-php-entrypoint b/sources/php8227/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8227/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8227/docker-php-ext-configure b/sources/php8227/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8227/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8227/docker-php-ext-enable b/sources/php8227/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8227/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8227/docker-php-ext-install b/sources/php8227/docker-php-ext-install new file mode 100755 index 0000000..aa0b96c --- /dev/null +++ b/sources/php8227/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8227/docker-php-source b/sources/php8227/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8227/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8228/Dockerfile b/sources/php8228/Dockerfile new file mode 100644 index 0000000..3140493 --- /dev/null +++ b/sources/php8228/Dockerfile @@ -0,0 +1,263 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS 39B641343D8C104B2B146DC3F9C39DC0B9698544 E60913E4DF209907D8E30D96659A97C9CF2A795A 1198C0117593497A5EC5C199286AF1F9897469DC + +ENV PHP_VERSION 8.2.28 +ENV PHP_URL="https://www.php.net/distributions/php-8.2.28.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.2.28.tar.xz.asc" +ENV PHP_SHA256="af8c9153153a7f489153b7a74f2f29a5ee36f5cb2c6c6929c98411a577e89c91" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + if [ -n "$PHP_ASC_URL" ]; then \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + fi; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ +# bundled pcre does not support JIT on riscv64 until 10.41 (php 8.3+) +# https://github.com/PCRE2Project/pcre2/commits/pcre2-10.41/src/sljit/sljitNativeRISCV_64.c +# https://github.com/php/php-src/tree/php-8.3.0/ext/pcre/pcre2lib + $(test "$gnuArch" = 'riscv64-linux-musl' && echo '--without-pcre-jit') \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8228/docker-php-entrypoint b/sources/php8228/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8228/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8228/docker-php-ext-configure b/sources/php8228/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8228/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8228/docker-php-ext-enable b/sources/php8228/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8228/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8228/docker-php-ext-install b/sources/php8228/docker-php-ext-install new file mode 100755 index 0000000..aa0b96c --- /dev/null +++ b/sources/php8228/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8228/docker-php-source b/sources/php8228/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8228/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8229/Dockerfile b/sources/php8229/Dockerfile new file mode 100644 index 0000000..c04718a --- /dev/null +++ b/sources/php8229/Dockerfile @@ -0,0 +1,266 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS 39B641343D8C104B2B146DC3F9C39DC0B9698544 E60913E4DF209907D8E30D96659A97C9CF2A795A 1198C0117593497A5EC5C199286AF1F9897469DC + +ENV PHP_VERSION 8.2.29 +ENV PHP_URL="https://www.php.net/distributions/php-8.2.29.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.2.29.tar.xz.asc" +ENV PHP_SHA256="475f991afd2d5b901fb410be407d929bc00c46285d3f439a02c59e8b6fe3589c" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + if [ -n "$PHP_ASC_URL" ]; then \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + fi; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ +# bundled pcre does not support JIT on riscv64 until 10.41 (php 8.3+) +# https://github.com/PCRE2Project/pcre2/commits/pcre2-10.41/src/sljit/sljitNativeRISCV_64.c +# https://github.com/php/php-src/tree/php-8.3.0/ext/pcre/pcre2lib + $(test "$gnuArch" = 'riscv64-linux-musl' && echo '--without-pcre-jit') \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required) +RUN docker-php-ext-enable opcache + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8229/docker-php-entrypoint b/sources/php8229/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8229/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8229/docker-php-ext-configure b/sources/php8229/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8229/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8229/docker-php-ext-enable b/sources/php8229/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8229/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8229/docker-php-ext-install b/sources/php8229/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php8229/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8229/docker-php-source b/sources/php8229/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8229/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8230/Dockerfile b/sources/php8230/Dockerfile new file mode 100644 index 0000000..93b4f21 --- /dev/null +++ b/sources/php8230/Dockerfile @@ -0,0 +1,264 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.22 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS 39B641343D8C104B2B146DC3F9C39DC0B9698544 E60913E4DF209907D8E30D96659A97C9CF2A795A 1198C0117593497A5EC5C199286AF1F9897469DC + +ENV PHP_VERSION 8.2.30 +ENV PHP_URL="https://www.php.net/distributions/php-8.2.30.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.2.30.tar.xz.asc" +ENV PHP_SHA256="bc90523e17af4db46157e75d0c9ef0b9d0030b0514e62c26ba7b513b8c4eb015" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ +# bundled pcre does not support JIT on riscv64 until 10.41 (php 8.3+) +# https://github.com/PCRE2Project/pcre2/commits/pcre2-10.41/src/sljit/sljitNativeRISCV_64.c +# https://github.com/php/php-src/tree/php-8.3.0/ext/pcre/pcre2lib + $(test "$gnuArch" = 'riscv64-linux-musl' && echo '--without-pcre-jit') \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required) +RUN docker-php-ext-enable opcache + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8230/docker-php-entrypoint b/sources/php8230/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8230/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8230/docker-php-ext-configure b/sources/php8230/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8230/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8230/docker-php-ext-enable b/sources/php8230/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8230/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8230/docker-php-ext-install b/sources/php8230/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php8230/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8230/docker-php-source b/sources/php8230/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8230/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8321/Dockerfile b/sources/php8321/Dockerfile new file mode 100644 index 0000000..59ea23c --- /dev/null +++ b/sources/php8321/Dockerfile @@ -0,0 +1,259 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS 1198C0117593497A5EC5C199286AF1F9897469DC C28D937575603EB4ABB725861C0779DC5C0A9DE4 AFD8691FDAEDF03BDF6E460563F15A9B715376CA + +ENV PHP_VERSION 8.3.21 +ENV PHP_URL="https://www.php.net/distributions/php-8.3.21.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.3.21.tar.xz.asc" +ENV PHP_SHA256="4dfb329f209a552c3716394fc123bb62e80a468b55ce27fc8cb0fd5f30b9dcd6" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + if [ -n "$PHP_ASC_URL" ]; then \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + fi; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8321/docker-php-entrypoint b/sources/php8321/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8321/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8321/docker-php-ext-configure b/sources/php8321/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8321/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8321/docker-php-ext-enable b/sources/php8321/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8321/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8321/docker-php-ext-install b/sources/php8321/docker-php-ext-install new file mode 100755 index 0000000..aa0b96c --- /dev/null +++ b/sources/php8321/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8321/docker-php-source b/sources/php8321/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8321/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8322/Dockerfile b/sources/php8322/Dockerfile new file mode 100644 index 0000000..efe7408 --- /dev/null +++ b/sources/php8322/Dockerfile @@ -0,0 +1,259 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS 1198C0117593497A5EC5C199286AF1F9897469DC C28D937575603EB4ABB725861C0779DC5C0A9DE4 AFD8691FDAEDF03BDF6E460563F15A9B715376CA + +ENV PHP_VERSION 8.3.22 +ENV PHP_URL="https://www.php.net/distributions/php-8.3.22.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.3.22.tar.xz.asc" +ENV PHP_SHA256="66c86889059bd27ccf460590ca48fcaf3261349cc9bdba2023ac6a265beabf36" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + if [ -n "$PHP_ASC_URL" ]; then \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + fi; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8322/docker-php-entrypoint b/sources/php8322/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8322/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8322/docker-php-ext-configure b/sources/php8322/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8322/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8322/docker-php-ext-enable b/sources/php8322/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8322/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8322/docker-php-ext-install b/sources/php8322/docker-php-ext-install new file mode 100755 index 0000000..aa0b96c --- /dev/null +++ b/sources/php8322/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8322/docker-php-source b/sources/php8322/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8322/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8323/Dockerfile b/sources/php8323/Dockerfile new file mode 100644 index 0000000..e7b7d19 --- /dev/null +++ b/sources/php8323/Dockerfile @@ -0,0 +1,262 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS 1198C0117593497A5EC5C199286AF1F9897469DC C28D937575603EB4ABB725861C0779DC5C0A9DE4 AFD8691FDAEDF03BDF6E460563F15A9B715376CA + +ENV PHP_VERSION 8.3.23 +ENV PHP_URL="https://www.php.net/distributions/php-8.3.23.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.3.23.tar.xz.asc" +ENV PHP_SHA256="08be64700f703bca6ff1284bf1fdaffa37ae1b9734b6559f8350248e8960a6db" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + if [ -n "$PHP_ASC_URL" ]; then \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + fi; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required) +RUN docker-php-ext-enable opcache + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8323/docker-php-entrypoint b/sources/php8323/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8323/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8323/docker-php-ext-configure b/sources/php8323/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8323/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8323/docker-php-ext-enable b/sources/php8323/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8323/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8323/docker-php-ext-install b/sources/php8323/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php8323/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8323/docker-php-source b/sources/php8323/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8323/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8324/Dockerfile b/sources/php8324/Dockerfile new file mode 100644 index 0000000..39e82a1 --- /dev/null +++ b/sources/php8324/Dockerfile @@ -0,0 +1,260 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS 1198C0117593497A5EC5C199286AF1F9897469DC C28D937575603EB4ABB725861C0779DC5C0A9DE4 AFD8691FDAEDF03BDF6E460563F15A9B715376CA + +ENV PHP_VERSION 8.3.24 +ENV PHP_URL="https://www.php.net/distributions/php-8.3.24.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.3.24.tar.xz.asc" +ENV PHP_SHA256="388ee5fd111097e97bae439bff46aec4ea27f816d3f0c2cb5490a41410d44251" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required) +RUN docker-php-ext-enable opcache + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8324/docker-php-entrypoint b/sources/php8324/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8324/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8324/docker-php-ext-configure b/sources/php8324/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8324/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8324/docker-php-ext-enable b/sources/php8324/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8324/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8324/docker-php-ext-install b/sources/php8324/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php8324/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8324/docker-php-source b/sources/php8324/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8324/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8325/Dockerfile b/sources/php8325/Dockerfile new file mode 100644 index 0000000..3900ab0 --- /dev/null +++ b/sources/php8325/Dockerfile @@ -0,0 +1,260 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS 1198C0117593497A5EC5C199286AF1F9897469DC C28D937575603EB4ABB725861C0779DC5C0A9DE4 AFD8691FDAEDF03BDF6E460563F15A9B715376CA + +ENV PHP_VERSION 8.3.25 +ENV PHP_URL="https://www.php.net/distributions/php-8.3.25.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.3.25.tar.xz.asc" +ENV PHP_SHA256="187b61bb795015adacf53f8c55b44414a63777ec19a776b75fb88614506c0d37" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required) +RUN docker-php-ext-enable opcache + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8325/docker-php-entrypoint b/sources/php8325/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8325/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8325/docker-php-ext-configure b/sources/php8325/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8325/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8325/docker-php-ext-enable b/sources/php8325/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8325/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8325/docker-php-ext-install b/sources/php8325/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php8325/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8325/docker-php-source b/sources/php8325/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8325/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8326/Dockerfile b/sources/php8326/Dockerfile new file mode 100644 index 0000000..877cbc8 --- /dev/null +++ b/sources/php8326/Dockerfile @@ -0,0 +1,260 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS 1198C0117593497A5EC5C199286AF1F9897469DC C28D937575603EB4ABB725861C0779DC5C0A9DE4 AFD8691FDAEDF03BDF6E460563F15A9B715376CA + +ENV PHP_VERSION 8.3.26 +ENV PHP_URL="https://www.php.net/distributions/php-8.3.26.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.3.26.tar.xz.asc" +ENV PHP_SHA256="2f522eefa02c400c94610d07f25c4fd4c771f95e4a1f55102332ccb40663cbd2" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required) +RUN docker-php-ext-enable opcache + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8326/docker-php-entrypoint b/sources/php8326/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8326/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8326/docker-php-ext-configure b/sources/php8326/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8326/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8326/docker-php-ext-enable b/sources/php8326/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8326/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8326/docker-php-ext-install b/sources/php8326/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php8326/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8326/docker-php-source b/sources/php8326/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8326/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8327/Dockerfile b/sources/php8327/Dockerfile new file mode 100644 index 0000000..d407a51 --- /dev/null +++ b/sources/php8327/Dockerfile @@ -0,0 +1,260 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS 1198C0117593497A5EC5C199286AF1F9897469DC C28D937575603EB4ABB725861C0779DC5C0A9DE4 AFD8691FDAEDF03BDF6E460563F15A9B715376CA + +ENV PHP_VERSION 8.3.27 +ENV PHP_URL="https://www.php.net/distributions/php-8.3.27.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.3.27.tar.xz.asc" +ENV PHP_SHA256="c15a09a9d199437144ecfef7d712ec4ca5c6820cf34acc24cc8489dd0cee41ba" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required) +RUN docker-php-ext-enable opcache + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8327/docker-php-entrypoint b/sources/php8327/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8327/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8327/docker-php-ext-configure b/sources/php8327/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8327/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8327/docker-php-ext-enable b/sources/php8327/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8327/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8327/docker-php-ext-install b/sources/php8327/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php8327/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8327/docker-php-source b/sources/php8327/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8327/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8328/Dockerfile b/sources/php8328/Dockerfile new file mode 100644 index 0000000..aedcf43 --- /dev/null +++ b/sources/php8328/Dockerfile @@ -0,0 +1,260 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS 1198C0117593497A5EC5C199286AF1F9897469DC C28D937575603EB4ABB725861C0779DC5C0A9DE4 AFD8691FDAEDF03BDF6E460563F15A9B715376CA + +ENV PHP_VERSION 8.3.28 +ENV PHP_URL="https://www.php.net/distributions/php-8.3.28.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.3.28.tar.xz.asc" +ENV PHP_SHA256="25e3860f30198a386242891c0bf9e2955931f7b666b96c3e3103d36a2a322326" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required) +RUN docker-php-ext-enable opcache + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8328/docker-php-entrypoint b/sources/php8328/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8328/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8328/docker-php-ext-configure b/sources/php8328/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8328/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8328/docker-php-ext-enable b/sources/php8328/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8328/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8328/docker-php-ext-install b/sources/php8328/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php8328/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8328/docker-php-source b/sources/php8328/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8328/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8329/Dockerfile b/sources/php8329/Dockerfile new file mode 100644 index 0000000..9ebe528 --- /dev/null +++ b/sources/php8329/Dockerfile @@ -0,0 +1,260 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.22 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS 1198C0117593497A5EC5C199286AF1F9897469DC C28D937575603EB4ABB725861C0779DC5C0A9DE4 AFD8691FDAEDF03BDF6E460563F15A9B715376CA + +ENV PHP_VERSION 8.3.29 +ENV PHP_URL="https://www.php.net/distributions/php-8.3.29.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.3.29.tar.xz.asc" +ENV PHP_SHA256="f7950ca034b15a78f5de9f1b22f4d9bad1dd497114d175cb1672a4ca78077af5" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required) +RUN docker-php-ext-enable opcache + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8329/docker-php-entrypoint b/sources/php8329/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8329/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8329/docker-php-ext-configure b/sources/php8329/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8329/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8329/docker-php-ext-enable b/sources/php8329/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8329/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8329/docker-php-ext-install b/sources/php8329/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php8329/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8329/docker-php-source b/sources/php8329/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8329/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8330/Dockerfile b/sources/php8330/Dockerfile new file mode 100644 index 0000000..0bb9e31 --- /dev/null +++ b/sources/php8330/Dockerfile @@ -0,0 +1,258 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.22 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS 1198C0117593497A5EC5C199286AF1F9897469DC C28D937575603EB4ABB725861C0779DC5C0A9DE4 AFD8691FDAEDF03BDF6E460563F15A9B715376CA + +ENV PHP_VERSION 8.3.30 +ENV PHP_URL="https://www.php.net/distributions/php-8.3.30.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.3.30.tar.xz.asc" +ENV PHP_SHA256="67f084d36852daab6809561a7c8023d130ca07fc6af8fb040684dd1414934d48" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + test "$PHP_INI_DIR" != "${PHP_INI_DIR%/php}"; \ + ./configure \ + --build="$gnuArch" \ + --sysconfdir="${PHP_INI_DIR%/php}" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required) +RUN docker-php-ext-enable opcache + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd "${PHP_INI_DIR%/php}"; \ + \ + cp -v php-fpm.conf.default php-fpm.conf; \ + cp -v php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + \ + # comment out localhost-only listen address + grep -E '^listen = 127.0.0.1:9000' php-fpm.d/www.conf; \ + sed -ri 's/^(listen = 127.0.0.1:9000)/;\1/' php-fpm.d/www.conf; \ + grep -E '^;listen = 127.0.0.1:9000' php-fpm.d/www.conf; \ + \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + echo; \ + echo '; default listen adddress for easy override in later php-fpm.d/*.conf files'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8330/docker-php-entrypoint b/sources/php8330/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8330/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8330/docker-php-ext-configure b/sources/php8330/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8330/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8330/docker-php-ext-enable b/sources/php8330/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8330/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8330/docker-php-ext-install b/sources/php8330/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php8330/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8330/docker-php-source b/sources/php8330/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8330/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8410/Dockerfile b/sources/php8410/Dockerfile new file mode 100644 index 0000000..b77a453 --- /dev/null +++ b/sources/php8410/Dockerfile @@ -0,0 +1,262 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS AFD8691FDAEDF03BDF6E460563F15A9B715376CA 9D7F99A0CB8F05C8A6958D6256A97AF7600A39A6 0616E93D95AF471243E26761770426E17EBBB3DD + +ENV PHP_VERSION 8.4.10 +ENV PHP_URL="https://www.php.net/distributions/php-8.4.10.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.4.10.tar.xz.asc" +ENV PHP_SHA256="14983a9ef8800e6bc2d920739fd386054402f7976ca9cd7f711509496f0d2632" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + if [ -n "$PHP_ASC_URL" ]; then \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + fi; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required) +RUN docker-php-ext-enable opcache + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8410/docker-php-entrypoint b/sources/php8410/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8410/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8410/docker-php-ext-configure b/sources/php8410/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8410/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8410/docker-php-ext-enable b/sources/php8410/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8410/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8410/docker-php-ext-install b/sources/php8410/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php8410/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8410/docker-php-source b/sources/php8410/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8410/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8411/Dockerfile b/sources/php8411/Dockerfile new file mode 100644 index 0000000..ece7198 --- /dev/null +++ b/sources/php8411/Dockerfile @@ -0,0 +1,260 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.22 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS AFD8691FDAEDF03BDF6E460563F15A9B715376CA 9D7F99A0CB8F05C8A6958D6256A97AF7600A39A6 0616E93D95AF471243E26761770426E17EBBB3DD + +ENV PHP_VERSION 8.4.11 +ENV PHP_URL="https://www.php.net/distributions/php-8.4.11.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.4.11.tar.xz.asc" +ENV PHP_SHA256="04cd331380a8683a5c2503938eb51764d48d507c53ad4208d2c82e0eed779a00" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required) +RUN docker-php-ext-enable opcache + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8411/docker-php-entrypoint b/sources/php8411/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8411/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8411/docker-php-ext-configure b/sources/php8411/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8411/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8411/docker-php-ext-enable b/sources/php8411/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8411/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8411/docker-php-ext-install b/sources/php8411/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php8411/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8411/docker-php-source b/sources/php8411/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8411/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8412/Dockerfile b/sources/php8412/Dockerfile new file mode 100644 index 0000000..c7f0f9a --- /dev/null +++ b/sources/php8412/Dockerfile @@ -0,0 +1,260 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.22 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS AFD8691FDAEDF03BDF6E460563F15A9B715376CA 9D7F99A0CB8F05C8A6958D6256A97AF7600A39A6 0616E93D95AF471243E26761770426E17EBBB3DD + +ENV PHP_VERSION 8.4.12 +ENV PHP_URL="https://www.php.net/distributions/php-8.4.12.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.4.12.tar.xz.asc" +ENV PHP_SHA256="c1b7978cbb5054eed6c749bde4444afc16a3f2268101fb70a7d5d9b1083b12ad" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required) +RUN docker-php-ext-enable opcache + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8412/docker-php-entrypoint b/sources/php8412/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8412/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8412/docker-php-ext-configure b/sources/php8412/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8412/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8412/docker-php-ext-enable b/sources/php8412/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8412/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8412/docker-php-ext-install b/sources/php8412/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php8412/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8412/docker-php-source b/sources/php8412/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8412/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8413/Dockerfile b/sources/php8413/Dockerfile new file mode 100644 index 0000000..77489f5 --- /dev/null +++ b/sources/php8413/Dockerfile @@ -0,0 +1,260 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.22 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS AFD8691FDAEDF03BDF6E460563F15A9B715376CA 9D7F99A0CB8F05C8A6958D6256A97AF7600A39A6 0616E93D95AF471243E26761770426E17EBBB3DD + +ENV PHP_VERSION 8.4.13 +ENV PHP_URL="https://www.php.net/distributions/php-8.4.13.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.4.13.tar.xz.asc" +ENV PHP_SHA256="b4f27adf30bcf262eacf93c78250dd811980f20f3b90d79a3dc11248681842df" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required) +RUN docker-php-ext-enable opcache + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8413/docker-php-entrypoint b/sources/php8413/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8413/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8413/docker-php-ext-configure b/sources/php8413/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8413/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8413/docker-php-ext-enable b/sources/php8413/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8413/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8413/docker-php-ext-install b/sources/php8413/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php8413/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8413/docker-php-source b/sources/php8413/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8413/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8414/Dockerfile b/sources/php8414/Dockerfile new file mode 100644 index 0000000..78a2376 --- /dev/null +++ b/sources/php8414/Dockerfile @@ -0,0 +1,260 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.22 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS AFD8691FDAEDF03BDF6E460563F15A9B715376CA 9D7F99A0CB8F05C8A6958D6256A97AF7600A39A6 0616E93D95AF471243E26761770426E17EBBB3DD + +ENV PHP_VERSION 8.4.14 +ENV PHP_URL="https://www.php.net/distributions/php-8.4.14.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.4.14.tar.xz.asc" +ENV PHP_SHA256="bac90ee7cf738e814c89b6b27d4d2c4b70e50942a420837e1a22f5fd5f9867a3" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required) +RUN docker-php-ext-enable opcache + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8414/docker-php-entrypoint b/sources/php8414/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8414/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8414/docker-php-ext-configure b/sources/php8414/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8414/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8414/docker-php-ext-enable b/sources/php8414/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8414/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8414/docker-php-ext-install b/sources/php8414/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php8414/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8414/docker-php-source b/sources/php8414/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8414/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8415/Dockerfile b/sources/php8415/Dockerfile new file mode 100644 index 0000000..b838d74 --- /dev/null +++ b/sources/php8415/Dockerfile @@ -0,0 +1,260 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.22 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS AFD8691FDAEDF03BDF6E460563F15A9B715376CA 9D7F99A0CB8F05C8A6958D6256A97AF7600A39A6 0616E93D95AF471243E26761770426E17EBBB3DD + +ENV PHP_VERSION 8.4.15 +ENV PHP_URL="https://www.php.net/distributions/php-8.4.15.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.4.15.tar.xz.asc" +ENV PHP_SHA256="a060684f614b8344f9b34c334b6ba8db1177555997edb5b1aceab0a4b807da7e" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required) +RUN docker-php-ext-enable opcache + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8415/docker-php-entrypoint b/sources/php8415/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8415/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8415/docker-php-ext-configure b/sources/php8415/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8415/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8415/docker-php-ext-enable b/sources/php8415/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8415/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8415/docker-php-ext-install b/sources/php8415/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php8415/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8415/docker-php-source b/sources/php8415/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8415/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8416/Dockerfile b/sources/php8416/Dockerfile new file mode 100644 index 0000000..64719f5 --- /dev/null +++ b/sources/php8416/Dockerfile @@ -0,0 +1,260 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.22 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS AFD8691FDAEDF03BDF6E460563F15A9B715376CA 9D7F99A0CB8F05C8A6958D6256A97AF7600A39A6 0616E93D95AF471243E26761770426E17EBBB3DD + +ENV PHP_VERSION 8.4.16 +ENV PHP_URL="https://www.php.net/distributions/php-8.4.16.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.4.16.tar.xz.asc" +ENV PHP_SHA256="f66f8f48db34e9e29f7bfd6901178e9cf4a1b163e6e497716dfcb8f88bcfae30" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required) +RUN docker-php-ext-enable opcache + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8416/docker-php-entrypoint b/sources/php8416/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8416/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8416/docker-php-ext-configure b/sources/php8416/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8416/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8416/docker-php-ext-enable b/sources/php8416/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8416/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8416/docker-php-ext-install b/sources/php8416/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php8416/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8416/docker-php-source b/sources/php8416/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8416/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8417/Dockerfile b/sources/php8417/Dockerfile new file mode 100644 index 0000000..4411fd3 --- /dev/null +++ b/sources/php8417/Dockerfile @@ -0,0 +1,258 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.22 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS AFD8691FDAEDF03BDF6E460563F15A9B715376CA 9D7F99A0CB8F05C8A6958D6256A97AF7600A39A6 0616E93D95AF471243E26761770426E17EBBB3DD + +ENV PHP_VERSION 8.4.17 +ENV PHP_URL="https://www.php.net/distributions/php-8.4.17.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.4.17.tar.xz.asc" +ENV PHP_SHA256="28b234e347286158cae921d61283eb1169d89bc9d2e5f5976567260ff38b0bfa" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + test "$PHP_INI_DIR" != "${PHP_INI_DIR%/php}"; \ + ./configure \ + --build="$gnuArch" \ + --sysconfdir="${PHP_INI_DIR%/php}" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required) +RUN docker-php-ext-enable opcache + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd "${PHP_INI_DIR%/php}"; \ + \ + cp -v php-fpm.conf.default php-fpm.conf; \ + cp -v php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + \ + # comment out localhost-only listen address + grep -E '^listen = 127.0.0.1:9000' php-fpm.d/www.conf; \ + sed -ri 's/^(listen = 127.0.0.1:9000)/;\1/' php-fpm.d/www.conf; \ + grep -E '^;listen = 127.0.0.1:9000' php-fpm.d/www.conf; \ + \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + echo; \ + echo '; default listen adddress for easy override in later php-fpm.d/*.conf files'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8417/docker-php-entrypoint b/sources/php8417/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8417/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8417/docker-php-ext-configure b/sources/php8417/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8417/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8417/docker-php-ext-enable b/sources/php8417/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8417/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8417/docker-php-ext-install b/sources/php8417/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php8417/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8417/docker-php-source b/sources/php8417/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8417/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php8418/Dockerfile b/sources/php8418/Dockerfile new file mode 100644 index 0000000..62d1799 --- /dev/null +++ b/sources/php8418/Dockerfile @@ -0,0 +1,261 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.22 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS AFD8691FDAEDF03BDF6E460563F15A9B715376CA 9D7F99A0CB8F05C8A6958D6256A97AF7600A39A6 0616E93D95AF471243E26761770426E17EBBB3DD + +ENV PHP_VERSION 8.4.18 +ENV PHP_URL="https://www.php.net/distributions/php-8.4.18.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.4.18.tar.xz.asc" +ENV PHP_SHA256="957a9b19b4a8e965ee0cc788ca74333bfffaadc206b58611b6cd3cc8b2f40110" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + test "$PHP_INI_DIR" != "${PHP_INI_DIR%/php}"; \ + ./configure \ + --build="$gnuArch" \ + --sysconfdir="${PHP_INI_DIR%/php}" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required) +RUN docker-php-ext-enable opcache + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd "${PHP_INI_DIR%/php}"; \ + \ + cp -v php-fpm.conf.default php-fpm.conf; \ + cp -v php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + \ + # comment out localhost-only listen address + grep -E '^listen = 127.0.0.1:9000' php-fpm.d/www.conf; \ + sed -ri 's/^(listen = 127.0.0.1:9000)/;\1/' php-fpm.d/www.conf; \ + grep -E '^;listen = 127.0.0.1:9000' php-fpm.d/www.conf; \ + \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + echo; \ + echo '; default listen address for easy override in later php-fpm.d/*.conf files'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '; the [www] ini section below is for backwards compatibility and will be removed in 8.6+'; \ + echo '[www]'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php8418/docker-php-entrypoint b/sources/php8418/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php8418/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php8418/docker-php-ext-configure b/sources/php8418/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php8418/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php8418/docker-php-ext-enable b/sources/php8418/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php8418/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php8418/docker-php-ext-install b/sources/php8418/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php8418/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php8418/docker-php-source b/sources/php8418/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php8418/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php847/Dockerfile b/sources/php847/Dockerfile new file mode 100644 index 0000000..f819d0b --- /dev/null +++ b/sources/php847/Dockerfile @@ -0,0 +1,259 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS AFD8691FDAEDF03BDF6E460563F15A9B715376CA 9D7F99A0CB8F05C8A6958D6256A97AF7600A39A6 0616E93D95AF471243E26761770426E17EBBB3DD + +ENV PHP_VERSION 8.4.7 +ENV PHP_URL="https://www.php.net/distributions/php-8.4.7.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.4.7.tar.xz.asc" +ENV PHP_SHA256="e29f4c23be2816ed005aa3f06bbb8eae0f22cc133863862e893515fc841e65e3" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + if [ -n "$PHP_ASC_URL" ]; then \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + fi; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php847/docker-php-entrypoint b/sources/php847/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php847/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php847/docker-php-ext-configure b/sources/php847/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php847/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php847/docker-php-ext-enable b/sources/php847/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php847/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php847/docker-php-ext-install b/sources/php847/docker-php-ext-install new file mode 100755 index 0000000..aa0b96c --- /dev/null +++ b/sources/php847/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php847/docker-php-source b/sources/php847/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php847/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php848/Dockerfile b/sources/php848/Dockerfile new file mode 100644 index 0000000..3f9c2eb --- /dev/null +++ b/sources/php848/Dockerfile @@ -0,0 +1,259 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS AFD8691FDAEDF03BDF6E460563F15A9B715376CA 9D7F99A0CB8F05C8A6958D6256A97AF7600A39A6 0616E93D95AF471243E26761770426E17EBBB3DD + +ENV PHP_VERSION 8.4.8 +ENV PHP_URL="https://www.php.net/distributions/php-8.4.8.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.4.8.tar.xz.asc" +ENV PHP_SHA256="aa6a4d330b47eacd83e351658ba8c47747a1e4356456219cfb6d75e7838da091" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + if [ -n "$PHP_ASC_URL" ]; then \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + fi; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php848/docker-php-entrypoint b/sources/php848/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php848/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php848/docker-php-ext-configure b/sources/php848/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php848/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php848/docker-php-ext-enable b/sources/php848/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php848/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php848/docker-php-ext-install b/sources/php848/docker-php-ext-install new file mode 100755 index 0000000..aa0b96c --- /dev/null +++ b/sources/php848/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php848/docker-php-source b/sources/php848/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php848/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php850/Dockerfile b/sources/php850/Dockerfile new file mode 100644 index 0000000..105702c --- /dev/null +++ b/sources/php850/Dockerfile @@ -0,0 +1,257 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.22 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS 1198C0117593497A5EC5C199286AF1F9897469DC 49D9AF6BC72A80D6691719C8AA23F5BE9C7097D4 D95C03BC702BE9515344AE3374E44BC9067701A5 + +ENV PHP_VERSION 8.5.0 +ENV PHP_URL="https://www.php.net/distributions/php-8.5.0.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.5.0.tar.xz.asc" +ENV PHP_SHA256="39cb6e4acd679b574d3d3276f148213e935fc25f90403eb84fb1b836a806ef1e" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php850/docker-php-entrypoint b/sources/php850/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php850/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php850/docker-php-ext-configure b/sources/php850/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php850/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php850/docker-php-ext-enable b/sources/php850/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php850/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php850/docker-php-ext-install b/sources/php850/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php850/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php850/docker-php-source b/sources/php850/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php850/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php851/Dockerfile b/sources/php851/Dockerfile new file mode 100644 index 0000000..d9704c0 --- /dev/null +++ b/sources/php851/Dockerfile @@ -0,0 +1,257 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.22 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS 1198C0117593497A5EC5C199286AF1F9897469DC 49D9AF6BC72A80D6691719C8AA23F5BE9C7097D4 D95C03BC702BE9515344AE3374E44BC9067701A5 + +ENV PHP_VERSION 8.5.1 +ENV PHP_URL="https://www.php.net/distributions/php-8.5.1.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.5.1.tar.xz.asc" +ENV PHP_SHA256="3f5bf99ce81201f526d25e288eddb2cfa111d068950d1e9a869530054ff98815" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + ./configure \ + --build="$gnuArch" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd /usr/local/etc; \ + if [ -d php-fpm.d ]; then \ + # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" + sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ + cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + else \ + # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency + mkdir php-fpm.d; \ + cp php-fpm.conf.default php-fpm.d/www.conf; \ + { \ + echo '[global]'; \ + echo 'include=etc/php-fpm.d/*.conf'; \ + } | tee php-fpm.conf; \ + fi; \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '[www]'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php851/docker-php-entrypoint b/sources/php851/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php851/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php851/docker-php-ext-configure b/sources/php851/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php851/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php851/docker-php-ext-enable b/sources/php851/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php851/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php851/docker-php-ext-install b/sources/php851/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php851/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php851/docker-php-source b/sources/php851/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php851/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php852/Dockerfile b/sources/php852/Dockerfile new file mode 100644 index 0000000..46d6aef --- /dev/null +++ b/sources/php852/Dockerfile @@ -0,0 +1,255 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.22 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS 1198C0117593497A5EC5C199286AF1F9897469DC 49D9AF6BC72A80D6691719C8AA23F5BE9C7097D4 D95C03BC702BE9515344AE3374E44BC9067701A5 + +ENV PHP_VERSION 8.5.2 +ENV PHP_URL="https://www.php.net/distributions/php-8.5.2.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.5.2.tar.xz.asc" +ENV PHP_SHA256="cb75a9b00a2806f7390dd64858ef42a47b443b3475769c8af6af33a18b1381f1" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + test "$PHP_INI_DIR" != "${PHP_INI_DIR%/php}"; \ + ./configure \ + --build="$gnuArch" \ + --sysconfdir="${PHP_INI_DIR%/php}" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd "${PHP_INI_DIR%/php}"; \ + \ + cp -v php-fpm.conf.default php-fpm.conf; \ + cp -v php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + \ + # comment out localhost-only listen address + grep -E '^listen = 127.0.0.1:9000' php-fpm.d/www.conf; \ + sed -ri 's/^(listen = 127.0.0.1:9000)/;\1/' php-fpm.d/www.conf; \ + grep -E '^;listen = 127.0.0.1:9000' php-fpm.d/www.conf; \ + \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + echo; \ + echo '; default listen adddress for easy override in later php-fpm.d/*.conf files'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php852/docker-php-entrypoint b/sources/php852/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php852/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php852/docker-php-ext-configure b/sources/php852/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php852/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php852/docker-php-ext-enable b/sources/php852/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php852/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php852/docker-php-ext-install b/sources/php852/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php852/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php852/docker-php-source b/sources/php852/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php852/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/php853/Dockerfile b/sources/php853/Dockerfile new file mode 100644 index 0000000..7a24235 --- /dev/null +++ b/sources/php853/Dockerfile @@ -0,0 +1,258 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.22 + +# dependencies required for running "phpize" +# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed) +ENV PHPIZE_DEPS \ + autoconf \ + dpkg-dev dpkg \ + file \ + g++ \ + gcc \ + libc-dev \ + make \ + pkgconf \ + re2c + +# persistent / runtime deps +RUN apk add --no-cache \ + ca-certificates \ + curl \ + openssl \ + tar \ + xz + +# ensure www-data user exists +RUN set -eux; \ + adduser -u 82 -D -S -G www-data www-data +# 82 is the standard uid/gid for "www-data" in Alpine +# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable +# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable + +ENV PHP_INI_DIR /usr/local/etc/php +RUN set -eux; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ +# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) + [ ! -d /var/www/html ]; \ + mkdir -p /var/www/html; \ + chown www-data:www-data /var/www/html; \ + chmod 1777 /var/www/html + +# Apply stack smash protection to functions using local buffers and alloca() +# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) +# Enable optimization (-O2) +# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) +# https://github.com/docker-library/php/issues/272 +# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php) +ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64" +ENV PHP_CPPFLAGS="$PHP_CFLAGS" +ENV PHP_LDFLAGS="-Wl,-O1 -pie" + +ENV GPG_KEYS 1198C0117593497A5EC5C199286AF1F9897469DC 49D9AF6BC72A80D6691719C8AA23F5BE9C7097D4 D95C03BC702BE9515344AE3374E44BC9067701A5 + +ENV PHP_VERSION 8.5.3 +ENV PHP_URL="https://www.php.net/distributions/php-8.5.3.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.5.3.tar.xz.asc" +ENV PHP_SHA256="ce65725b8af07356b69a6046d21487040b11f2acfde786de38b2bfb712c36eb9" + +RUN set -eux; \ + \ + apk add --no-cache --virtual .fetch-deps gnupg; \ + \ + mkdir -p /usr/src; \ + cd /usr/src; \ + \ + curl -fsSL -o php.tar.xz "$PHP_URL"; \ + \ + if [ -n "$PHP_SHA256" ]; then \ + echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ + fi; \ + \ + curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \ + export GNUPGHOME="$(mktemp -d)"; \ + for key in $GPG_KEYS; do \ + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ + done; \ + gpg --batch --verify php.tar.xz.asc php.tar.xz; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME"; \ + \ + apk del --no-network .fetch-deps + +COPY docker-php-source /usr/local/bin/ + +RUN set -eux; \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + argon2-dev \ + coreutils \ + curl-dev \ + gnu-libiconv-dev \ + libsodium-dev \ + libxml2-dev \ + linux-headers \ + oniguruma-dev \ + openssl-dev \ + readline-dev \ + sqlite-dev \ + ; \ + \ +# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php) + rm -vf /usr/include/iconv.h; \ + \ + export \ + CFLAGS="$PHP_CFLAGS" \ + CPPFLAGS="$PHP_CPPFLAGS" \ + LDFLAGS="$PHP_LDFLAGS" \ +# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511 + PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \ + PHP_UNAME='Linux - Docker' \ + ; \ + docker-php-source extract; \ + cd /usr/src/php; \ + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + test "$PHP_INI_DIR" != "${PHP_INI_DIR%/php}"; \ + ./configure \ + --build="$gnuArch" \ + --sysconfdir="${PHP_INI_DIR%/php}" \ + --with-config-file-path="$PHP_INI_DIR" \ + --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ + \ +# make sure invalid --configure-flags are fatal errors instead of just warnings + --enable-option-checking=fatal \ + \ +# https://github.com/docker-library/php/issues/439 + --with-mhash \ + \ +# https://github.com/docker-library/php/issues/822 + --with-pic \ + \ +# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) + --enable-mbstring \ +# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself) + --enable-mysqlnd \ +# https://wiki.php.net/rfc/argon2_password_hash + --with-password-argon2 \ +# https://wiki.php.net/rfc/libsodium + --with-sodium=shared \ +# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109) + --with-pdo-sqlite=/usr \ + --with-sqlite3=/usr \ + \ + --with-curl \ + --with-iconv=/usr \ + --with-openssl \ + --with-readline \ + --with-zlib \ + \ +# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.") + --disable-phpdbg \ + \ +# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear") + --with-pear \ + \ + \ + --disable-cgi \ + \ + --enable-fpm \ + --with-fpm-user=www-data \ + --with-fpm-group=www-data \ + ; \ + make -j "$(nproc)"; \ + find -type f -name '*.a' -delete; \ + make install; \ + find \ + /usr/local \ + -type f \ + -perm '/0111' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : \ + ' -- '{}' + \ + ; \ + make clean; \ + \ +# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) + cp -v php.ini-* "$PHP_INI_DIR/"; \ + \ + cd /; \ + docker-php-source delete; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-cache $runDeps; \ + \ + apk del --no-network .build-deps; \ + \ +# update pecl channel definitions https://github.com/docker-library/php/issues/443 + pecl update-channels; \ + rm -rf /tmp/pear ~/.pearrc; \ + \ +# smoke test + php --version + +COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ + +# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598) +RUN docker-php-ext-enable sodium + +ENTRYPOINT ["docker-php-entrypoint"] +WORKDIR /var/www/html + +RUN set -eux; \ + cd "${PHP_INI_DIR%/php}"; \ + \ + cp -v php-fpm.conf.default php-fpm.conf; \ + cp -v php-fpm.d/www.conf.default php-fpm.d/www.conf; \ + \ + # comment out localhost-only listen address + grep -E '^listen = 127.0.0.1:9000' php-fpm.d/www.conf; \ + sed -ri 's/^(listen = 127.0.0.1:9000)/;\1/' php-fpm.d/www.conf; \ + grep -E '^;listen = 127.0.0.1:9000' php-fpm.d/www.conf; \ + \ + { \ + echo '[global]'; \ + echo 'error_log = /proc/self/fd/2'; \ + echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \ + echo; \ + echo '[www]'; \ + echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \ + echo '; https://bugs.php.net/bug.php?id=73886'; \ + echo 'access.log = /proc/self/fd/2'; \ + echo; \ + echo 'clear_env = no'; \ + echo; \ + echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ + echo 'catch_workers_output = yes'; \ + echo 'decorate_workers_output = no'; \ + echo; \ + echo '; default listen address for easy override in later php-fpm.d/*.conf files'; \ + echo 'listen = 9000'; \ + } | tee php-fpm.d/docker.conf; \ + { \ + echo '[global]'; \ + echo 'daemonize = no'; \ + echo; \ + echo '; the [www] ini section below is for backwards compatibility and will be removed in 8.6+'; \ + echo '[www]'; \ + } | tee php-fpm.d/zz-docker.conf; \ + mkdir -p "$PHP_INI_DIR/conf.d"; \ + { \ + echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \ + echo 'fastcgi.logging = Off'; \ + } > "$PHP_INI_DIR/conf.d/docker-fpm.ini" + +# Override stop signal to stop process gracefully +# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163 +STOPSIGNAL SIGQUIT + +EXPOSE 9000 +CMD ["php-fpm"] diff --git a/sources/php853/docker-php-entrypoint b/sources/php853/docker-php-entrypoint new file mode 100755 index 0000000..86343d8 --- /dev/null +++ b/sources/php853/docker-php-entrypoint @@ -0,0 +1,9 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +if [ "${1#-}" != "$1" ]; then + set -- php-fpm "$@" +fi + +exec "$@" diff --git a/sources/php853/docker-php-ext-configure b/sources/php853/docker-php-ext-configure new file mode 100755 index 0000000..34fc133 --- /dev/null +++ b/sources/php853/docker-php-ext-configure @@ -0,0 +1,69 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 ext-name [configure flags]" + echo " ie: $0 gd --with-jpeg-dir=/usr/local/something" + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +ext="$1" +if [ -z "$ext" ] || [ ! -d "$ext" ]; then + usage >&2 + exit 1 +fi +shift + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual .phpize-deps-configure $PHPIZE_DEPS + fi +fi + +if command -v dpkg-architecture > /dev/null; then + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" + set -- --build="$gnuArch" "$@" +fi + +cd "$ext" +phpize +./configure --enable-option-checking=fatal "$@" diff --git a/sources/php853/docker-php-ext-enable b/sources/php853/docker-php-ext-enable new file mode 100755 index 0000000..41d20bb --- /dev/null +++ b/sources/php853/docker-php-ext-enable @@ -0,0 +1,121 @@ +#!/bin/sh +set -e + +extDir="$(php -d 'display_errors=stderr' -r 'echo ini_get("extension_dir");')" +cd "$extDir" + +usage() { + echo "usage: $0 [options] module-name [module-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 --ini-name 0-apc.ini apcu apc" + echo + echo 'Possible values for module-name:' + find -maxdepth 1 \ + -type f \ + -name '*.so' \ + -exec basename '{}' ';' \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?' --long 'help,ini-name:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +modules= +for module; do + if [ -z "$module" ]; then + continue + fi + if ! [ -f "$module" ] && ! [ -f "$module.so" ]; then + echo >&2 "error: '$module' does not exist" + echo >&2 + usage >&2 + exit 1 + fi + modules="$modules $module" +done + +if [ -z "$modules" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if \ + [ -n "$PHPIZE_DEPS" ] \ + && ! apk info --installed .phpize-deps > /dev/null \ + && ! apk info --installed .phpize-deps-configure > /dev/null \ + ; then + apk add --no-cache --virtual '.docker-php-ext-enable-deps' binutils + apkDel='.docker-php-ext-enable-deps' + fi +fi + +for module in $modules; do + moduleFile="$module" + if [ -f "$module.so" ] && ! [ -f "$module" ]; then + moduleFile="$module.so" + fi + if readelf --wide --syms "$moduleFile" | grep -q ' zend_extension_entry$'; then + # https://wiki.php.net/internals/extensions#loading_zend_extensions + line="zend_extension=$module" + else + line="extension=$module" + fi + + ext="$(basename "$module")" + ext="${ext%.*}" + if php -d 'display_errors=stderr' -r 'exit(extension_loaded("'"$ext"'") ? 0 : 1);'; then + # this isn't perfect, but it's better than nothing + # (for example, 'opcache.so' presents inside PHP as 'Zend OPcache', not 'opcache') + echo >&2 + echo >&2 "warning: $ext ($module) is already loaded!" + echo >&2 + continue + fi + + case "$iniName" in + /*) + # allow an absolute path + ini="$iniName" + ;; + *) + ini="$PHP_INI_DIR/conf.d/${iniName:-"docker-php-ext-$ext.ini"}" + ;; + esac + if ! grep -qFx -e "$line" -e "$line.so" "$ini" 2>/dev/null; then + echo "$line" >> "$ini" + fi +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi diff --git a/sources/php853/docker-php-ext-install b/sources/php853/docker-php-ext-install new file mode 100755 index 0000000..fbf4484 --- /dev/null +++ b/sources/php853/docker-php-ext-install @@ -0,0 +1,143 @@ +#!/bin/sh +set -e + +# prefer user supplied CFLAGS, but default to our PHP_CFLAGS +: ${CFLAGS:=$PHP_CFLAGS} +: ${CPPFLAGS:=$PHP_CPPFLAGS} +: ${LDFLAGS:=$PHP_LDFLAGS} +export CFLAGS CPPFLAGS LDFLAGS + +srcExists= +if [ -d /usr/src/php ]; then + srcExists=1 +fi +docker-php-source extract +if [ -z "$srcExists" ]; then + touch /usr/src/php/.docker-delete-me +fi + +cd /usr/src/php/ext + +usage() { + echo "usage: $0 [-jN] [--ini-name file.ini] ext-name [ext-name ...]" + echo " ie: $0 gd mysqli" + echo " $0 pdo pdo_mysql" + echo " $0 -j5 gd mbstring mysqli pdo pdo_mysql shmop" + echo + echo 'if custom ./configure arguments are necessary, see docker-php-ext-configure' + echo + echo 'Possible values for ext-name:' + find . \ + -mindepth 2 \ + -maxdepth 2 \ + -type f \ + -name 'config.m4' \ + | xargs -n1 dirname \ + | xargs -n1 basename \ + | sort \ + | xargs + echo + echo 'Some of the above modules are already compiled into PHP; please check' + echo 'the output of "php -i" to see which modules are already loaded.' +} + +opts="$(getopt -o 'h?j:' --long 'help,ini-name:,jobs:' -- "$@" || { usage >&2 && false; })" +eval set -- "$opts" + +j=1 +iniName= +while true; do + flag="$1" + shift + case "$flag" in + --help|-h|'-?') usage && exit 0 ;; + --ini-name) iniName="$1" && shift ;; + --jobs|-j) j="$1" && shift ;; + --) break ;; + *) + { + echo "error: unknown flag: $flag" + usage + } >&2 + exit 1 + ;; + esac +done + +exts= +for ext; do + if [ -z "$ext" ]; then + continue + fi + if [ ! -d "$ext" ]; then + echo >&2 "error: $PWD/$ext does not exist" + echo >&2 + usage >&2 + exit 1 + fi + exts="$exts $ext" +done + +if [ -z "$exts" ]; then + usage >&2 + exit 1 +fi + +pm='unknown' +if [ -e /lib/apk/db/installed ]; then + pm='apk' +fi + +apkDel= +if [ "$pm" = 'apk' ]; then + if [ -n "$PHPIZE_DEPS" ]; then + if apk info --installed .phpize-deps-configure > /dev/null; then + apkDel='.phpize-deps-configure' + elif ! apk info --installed .phpize-deps > /dev/null; then + apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS + apkDel='.phpize-deps' + fi + fi +fi + +popDir="$PWD" +for ext in $exts; do + cd "$ext" + + [ -e Makefile ] || docker-php-ext-configure "$ext" + + make -j"$j" + + if ! php -n -d 'display_errors=stderr' -r 'exit(ZEND_DEBUG_BUILD ? 0 : 1);' > /dev/null; then + # only "strip" modules if we aren't using a debug build of PHP + # (none of our builds are debug builds, but PHP might be recompiled with "--enable-debug" configure option) + # https://github.com/docker-library/php/issues/1268 + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec sh -euxc ' \ + strip --strip-all "$@" || : + ' -- '{}' + + fi + + make -j"$j" install + + find modules \ + -maxdepth 1 \ + -name '*.so' \ + -exec basename '{}' '.so' ';' \ + | xargs -r docker-php-ext-enable ${iniName:+--ini-name "$iniName"} + + make -j"$j" clean + + cd "$popDir" +done + +if [ "$pm" = 'apk' ] && [ -n "$apkDel" ]; then + apk del --no-network $apkDel +fi + +if [ -e /usr/src/php/.docker-delete-me ]; then + docker-php-source delete +fi diff --git a/sources/php853/docker-php-source b/sources/php853/docker-php-source new file mode 100755 index 0000000..9033d24 --- /dev/null +++ b/sources/php853/docker-php-source @@ -0,0 +1,34 @@ +#!/bin/sh +set -e + +dir=/usr/src/php + +usage() { + echo "usage: $0 COMMAND" + echo + echo "Manage php source tarball lifecycle." + echo + echo "Commands:" + echo " extract extract php source tarball into directory $dir if not already done." + echo " delete delete extracted php source located into $dir if not already done." + echo +} + +case "$1" in + extract) + mkdir -p "$dir" + if [ ! -f "$dir/.docker-extracted" ]; then + tar -Jxf /usr/src/php.tar.xz -C "$dir" --strip-components=1 + touch "$dir/.docker-extracted" + fi + ;; + + delete) + rm -rf "$dir" + ;; + + *) + usage + exit 1 + ;; +esac diff --git a/sources/redis7210/Dockerfile b/sources/redis7210/Dockerfile new file mode 100644 index 0000000..20dfcf8 --- /dev/null +++ b/sources/redis7210/Dockerfile @@ -0,0 +1,141 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ + ; + +# grab gosu for easy step-down from root +# https://github.com/tianon/gosu/releases +ENV GOSU_VERSION 1.17 +RUN set -eux; \ + apk add --no-cache --virtual .gosu-fetch gnupg; \ + arch="$(apk --print-arch)"; \ + case "$arch" in \ + 'x86_64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64'; sha256='bbc4136d03ab138b1ad66fa4fc051bafc6cc7ffae632b069a53657279a450de3' ;; \ + 'aarch64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-arm64'; sha256='c3805a85d17f4454c23d7059bcb97e1ec1af272b90126e79ed002342de08389b' ;; \ + 'armhf') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-armhf'; sha256='e5866286277ff2a2159fb9196fea13e0a59d3f1091ea46ddb985160b94b6841b' ;; \ + 'x86') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-i386'; sha256='087dbb8fe479537e64f9c86fa49ff3b41dee1cbd28739a19aaef83dc8186b1ca' ;; \ + 'ppc64le') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-ppc64el'; sha256='1891acdcfa70046818ab6ed3c52b9d42fa10fbb7b340eb429c8c7849691dbd76' ;; \ + 'riscv64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-riscv64'; sha256='38a6444b57adce135c42d5a3689f616fc7803ddc7a07ff6f946f2ebc67a26ba6' ;; \ + 's390x') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-s390x'; sha256='69873bab588192f760547ca1f75b27cfcf106e9f7403fee6fd0600bc914979d0' ;; \ + 'armv7') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-armhf'; sha256='e5866286277ff2a2159fb9196fea13e0a59d3f1091ea46ddb985160b94b6841b' ;; \ + *) echo >&2 "error: unsupported gosu architecture: '$arch'"; exit 1 ;; \ + esac; \ + wget -O /usr/local/bin/gosu.asc "$url.asc"; \ + wget -O /usr/local/bin/gosu "$url"; \ + echo "$sha256 */usr/local/bin/gosu" | sha256sum -c -; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \ + gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \ + apk del --no-network .gosu-fetch; \ + chmod +x /usr/local/bin/gosu; \ + gosu --version; \ + gosu nobody true + +ENV REDIS_VERSION 7.2.10 +ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-7.2.10.tar.gz +ENV REDIS_DOWNLOAD_SHA e576ad54bc53770649c556933ecd555b975e3dac422e46356102436a437b43c7 + +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ +# install real "wget" to avoid: +# + wget -O redis.tar.gz https://download.redis.io/releases/redis-x.y.z.tar.gz +# Connecting to download.redis.io (45.60.121.1:80) +# wget: bad header line: XxhODalH: btu; path=/; Max-Age=900 + wget \ + ; \ + \ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ + export BUILD_TLS=yes; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + apk del --no-network .build-deps; \ + \ + redis-cli --version; \ + redis-server --version + +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] diff --git a/sources/redis7210/docker-entrypoint.sh b/sources/redis7210/docker-entrypoint.sh new file mode 100755 index 0000000..30406a5 --- /dev/null +++ b/sources/redis7210/docker-entrypoint.sh @@ -0,0 +1,24 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi + +# allow the container to be started with `--user` +if [ "$1" = 'redis-server' -a "$(id -u)" = '0' ]; then + find . \! -user redis -exec chown redis '{}' + + exec gosu redis "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +exec "$@" diff --git a/sources/redis7211/Dockerfile b/sources/redis7211/Dockerfile new file mode 100644 index 0000000..4aa7533 --- /dev/null +++ b/sources/redis7211/Dockerfile @@ -0,0 +1,141 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ + ; + +# grab gosu for easy step-down from root +# https://github.com/tianon/gosu/releases +ENV GOSU_VERSION 1.17 +RUN set -eux; \ + apk add --no-cache --virtual .gosu-fetch gnupg; \ + arch="$(apk --print-arch)"; \ + case "$arch" in \ + 'x86_64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64'; sha256='bbc4136d03ab138b1ad66fa4fc051bafc6cc7ffae632b069a53657279a450de3' ;; \ + 'aarch64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-arm64'; sha256='c3805a85d17f4454c23d7059bcb97e1ec1af272b90126e79ed002342de08389b' ;; \ + 'armhf') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-armhf'; sha256='e5866286277ff2a2159fb9196fea13e0a59d3f1091ea46ddb985160b94b6841b' ;; \ + 'x86') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-i386'; sha256='087dbb8fe479537e64f9c86fa49ff3b41dee1cbd28739a19aaef83dc8186b1ca' ;; \ + 'ppc64le') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-ppc64el'; sha256='1891acdcfa70046818ab6ed3c52b9d42fa10fbb7b340eb429c8c7849691dbd76' ;; \ + 'riscv64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-riscv64'; sha256='38a6444b57adce135c42d5a3689f616fc7803ddc7a07ff6f946f2ebc67a26ba6' ;; \ + 's390x') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-s390x'; sha256='69873bab588192f760547ca1f75b27cfcf106e9f7403fee6fd0600bc914979d0' ;; \ + 'armv7') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-armhf'; sha256='e5866286277ff2a2159fb9196fea13e0a59d3f1091ea46ddb985160b94b6841b' ;; \ + *) echo >&2 "error: unsupported gosu architecture: '$arch'"; exit 1 ;; \ + esac; \ + wget -O /usr/local/bin/gosu.asc "$url.asc"; \ + wget -O /usr/local/bin/gosu "$url"; \ + echo "$sha256 */usr/local/bin/gosu" | sha256sum -c -; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \ + gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \ + apk del --no-network .gosu-fetch; \ + chmod +x /usr/local/bin/gosu; \ + gosu --version; \ + gosu nobody true + +ENV REDIS_VERSION 7.2.11 +ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-7.2.11.tar.gz +ENV REDIS_DOWNLOAD_SHA 2f9886eca68d30114ad6a01da65631f8007d802fd3e6c9fac711251e6390323d + +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ +# install real "wget" to avoid: +# + wget -O redis.tar.gz https://download.redis.io/releases/redis-x.y.z.tar.gz +# Connecting to download.redis.io (45.60.121.1:80) +# wget: bad header line: XxhODalH: btu; path=/; Max-Age=900 + wget \ + ; \ + \ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ + export BUILD_TLS=yes; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + apk del --no-network .build-deps; \ + \ + redis-cli --version; \ + redis-server --version + +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] diff --git a/sources/redis7211/docker-entrypoint.sh b/sources/redis7211/docker-entrypoint.sh new file mode 100755 index 0000000..30406a5 --- /dev/null +++ b/sources/redis7211/docker-entrypoint.sh @@ -0,0 +1,24 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi + +# allow the container to be started with `--user` +if [ "$1" = 'redis-server' -a "$(id -u)" = '0' ]; then + find . \! -user redis -exec chown redis '{}' + + exec gosu redis "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +exec "$@" diff --git a/sources/redis7212/Dockerfile b/sources/redis7212/Dockerfile new file mode 100644 index 0000000..fd9a651 --- /dev/null +++ b/sources/redis7212/Dockerfile @@ -0,0 +1,141 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ + ; + +# grab gosu for easy step-down from root +# https://github.com/tianon/gosu/releases +ENV GOSU_VERSION 1.17 +RUN set -eux; \ + apk add --no-cache --virtual .gosu-fetch gnupg; \ + arch="$(apk --print-arch)"; \ + case "$arch" in \ + 'x86_64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64'; sha256='bbc4136d03ab138b1ad66fa4fc051bafc6cc7ffae632b069a53657279a450de3' ;; \ + 'aarch64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-arm64'; sha256='c3805a85d17f4454c23d7059bcb97e1ec1af272b90126e79ed002342de08389b' ;; \ + 'armhf') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-armhf'; sha256='e5866286277ff2a2159fb9196fea13e0a59d3f1091ea46ddb985160b94b6841b' ;; \ + 'x86') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-i386'; sha256='087dbb8fe479537e64f9c86fa49ff3b41dee1cbd28739a19aaef83dc8186b1ca' ;; \ + 'ppc64le') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-ppc64el'; sha256='1891acdcfa70046818ab6ed3c52b9d42fa10fbb7b340eb429c8c7849691dbd76' ;; \ + 'riscv64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-riscv64'; sha256='38a6444b57adce135c42d5a3689f616fc7803ddc7a07ff6f946f2ebc67a26ba6' ;; \ + 's390x') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-s390x'; sha256='69873bab588192f760547ca1f75b27cfcf106e9f7403fee6fd0600bc914979d0' ;; \ + 'armv7') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-armhf'; sha256='e5866286277ff2a2159fb9196fea13e0a59d3f1091ea46ddb985160b94b6841b' ;; \ + *) echo >&2 "error: unsupported gosu architecture: '$arch'"; exit 1 ;; \ + esac; \ + wget -O /usr/local/bin/gosu.asc "$url.asc"; \ + wget -O /usr/local/bin/gosu "$url"; \ + echo "$sha256 */usr/local/bin/gosu" | sha256sum -c -; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \ + gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \ + apk del --no-network .gosu-fetch; \ + chmod +x /usr/local/bin/gosu; \ + gosu --version; \ + gosu nobody true + +ENV REDIS_VERSION 7.2.12 +ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-7.2.12.tar.gz +ENV REDIS_DOWNLOAD_SHA 97c60478a7c777ac914ca9d87a7e88ba265926456107e758c62d8f971d0196bc + +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ +# install real "wget" to avoid: +# + wget -O redis.tar.gz https://download.redis.io/releases/redis-x.y.z.tar.gz +# Connecting to download.redis.io (45.60.121.1:80) +# wget: bad header line: XxhODalH: btu; path=/; Max-Age=900 + wget \ + ; \ + \ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ + export BUILD_TLS=yes; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + apk del --no-network .build-deps; \ + \ + redis-cli --version; \ + redis-server --version + +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] diff --git a/sources/redis7212/docker-entrypoint.sh b/sources/redis7212/docker-entrypoint.sh new file mode 100755 index 0000000..30406a5 --- /dev/null +++ b/sources/redis7212/docker-entrypoint.sh @@ -0,0 +1,24 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi + +# allow the container to be started with `--user` +if [ "$1" = 'redis-server' -a "$(id -u)" = '0' ]; then + find . \! -user redis -exec chown redis '{}' + + exec gosu redis "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +exec "$@" diff --git a/sources/redis727/Dockerfile b/sources/redis727/Dockerfile new file mode 100644 index 0000000..ce72457 --- /dev/null +++ b/sources/redis727/Dockerfile @@ -0,0 +1,141 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ + ; + +# grab gosu for easy step-down from root +# https://github.com/tianon/gosu/releases +ENV GOSU_VERSION 1.17 +RUN set -eux; \ + apk add --no-cache --virtual .gosu-fetch gnupg; \ + arch="$(apk --print-arch)"; \ + case "$arch" in \ + 'x86_64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64'; sha256='bbc4136d03ab138b1ad66fa4fc051bafc6cc7ffae632b069a53657279a450de3' ;; \ + 'aarch64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-arm64'; sha256='c3805a85d17f4454c23d7059bcb97e1ec1af272b90126e79ed002342de08389b' ;; \ + 'armhf') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-armhf'; sha256='e5866286277ff2a2159fb9196fea13e0a59d3f1091ea46ddb985160b94b6841b' ;; \ + 'x86') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-i386'; sha256='087dbb8fe479537e64f9c86fa49ff3b41dee1cbd28739a19aaef83dc8186b1ca' ;; \ + 'ppc64le') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-ppc64el'; sha256='1891acdcfa70046818ab6ed3c52b9d42fa10fbb7b340eb429c8c7849691dbd76' ;; \ + 'riscv64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-riscv64'; sha256='38a6444b57adce135c42d5a3689f616fc7803ddc7a07ff6f946f2ebc67a26ba6' ;; \ + 's390x') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-s390x'; sha256='69873bab588192f760547ca1f75b27cfcf106e9f7403fee6fd0600bc914979d0' ;; \ + 'armv7') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-armhf'; sha256='e5866286277ff2a2159fb9196fea13e0a59d3f1091ea46ddb985160b94b6841b' ;; \ + *) echo >&2 "error: unsupported gosu architecture: '$arch'"; exit 1 ;; \ + esac; \ + wget -O /usr/local/bin/gosu.asc "$url.asc"; \ + wget -O /usr/local/bin/gosu "$url"; \ + echo "$sha256 */usr/local/bin/gosu" | sha256sum -c -; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \ + gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \ + apk del --no-network .gosu-fetch; \ + chmod +x /usr/local/bin/gosu; \ + gosu --version; \ + gosu nobody true + +ENV REDIS_VERSION 7.2.7 +ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-7.2.7.tar.gz +ENV REDIS_DOWNLOAD_SHA 72c081e3b8cfae7144273d26d76736f08319000af46c01515cad5d29765cead5 + +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ +# install real "wget" to avoid: +# + wget -O redis.tar.gz https://download.redis.io/releases/redis-x.y.z.tar.gz +# Connecting to download.redis.io (45.60.121.1:80) +# wget: bad header line: XxhODalH: btu; path=/; Max-Age=900 + wget \ + ; \ + \ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ + export BUILD_TLS=yes; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + apk del --no-network .build-deps; \ + \ + redis-cli --version; \ + redis-server --version + +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] diff --git a/sources/redis727/docker-entrypoint.sh b/sources/redis727/docker-entrypoint.sh new file mode 100755 index 0000000..30406a5 --- /dev/null +++ b/sources/redis727/docker-entrypoint.sh @@ -0,0 +1,24 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi + +# allow the container to be started with `--user` +if [ "$1" = 'redis-server' -a "$(id -u)" = '0' ]; then + find . \! -user redis -exec chown redis '{}' + + exec gosu redis "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +exec "$@" diff --git a/sources/redis728/Dockerfile b/sources/redis728/Dockerfile new file mode 100644 index 0000000..ecc983c --- /dev/null +++ b/sources/redis728/Dockerfile @@ -0,0 +1,141 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ + ; + +# grab gosu for easy step-down from root +# https://github.com/tianon/gosu/releases +ENV GOSU_VERSION 1.17 +RUN set -eux; \ + apk add --no-cache --virtual .gosu-fetch gnupg; \ + arch="$(apk --print-arch)"; \ + case "$arch" in \ + 'x86_64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64'; sha256='bbc4136d03ab138b1ad66fa4fc051bafc6cc7ffae632b069a53657279a450de3' ;; \ + 'aarch64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-arm64'; sha256='c3805a85d17f4454c23d7059bcb97e1ec1af272b90126e79ed002342de08389b' ;; \ + 'armhf') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-armhf'; sha256='e5866286277ff2a2159fb9196fea13e0a59d3f1091ea46ddb985160b94b6841b' ;; \ + 'x86') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-i386'; sha256='087dbb8fe479537e64f9c86fa49ff3b41dee1cbd28739a19aaef83dc8186b1ca' ;; \ + 'ppc64le') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-ppc64el'; sha256='1891acdcfa70046818ab6ed3c52b9d42fa10fbb7b340eb429c8c7849691dbd76' ;; \ + 'riscv64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-riscv64'; sha256='38a6444b57adce135c42d5a3689f616fc7803ddc7a07ff6f946f2ebc67a26ba6' ;; \ + 's390x') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-s390x'; sha256='69873bab588192f760547ca1f75b27cfcf106e9f7403fee6fd0600bc914979d0' ;; \ + 'armv7') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-armhf'; sha256='e5866286277ff2a2159fb9196fea13e0a59d3f1091ea46ddb985160b94b6841b' ;; \ + *) echo >&2 "error: unsupported gosu architecture: '$arch'"; exit 1 ;; \ + esac; \ + wget -O /usr/local/bin/gosu.asc "$url.asc"; \ + wget -O /usr/local/bin/gosu "$url"; \ + echo "$sha256 */usr/local/bin/gosu" | sha256sum -c -; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \ + gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \ + apk del --no-network .gosu-fetch; \ + chmod +x /usr/local/bin/gosu; \ + gosu --version; \ + gosu nobody true + +ENV REDIS_VERSION 7.2.8 +ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-7.2.8.tar.gz +ENV REDIS_DOWNLOAD_SHA 6be4fdfcdb2e5ac91454438246d00842d2671f792673390e742dfcaf1bf01574 + +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ +# install real "wget" to avoid: +# + wget -O redis.tar.gz https://download.redis.io/releases/redis-x.y.z.tar.gz +# Connecting to download.redis.io (45.60.121.1:80) +# wget: bad header line: XxhODalH: btu; path=/; Max-Age=900 + wget \ + ; \ + \ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ + export BUILD_TLS=yes; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + apk del --no-network .build-deps; \ + \ + redis-cli --version; \ + redis-server --version + +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] diff --git a/sources/redis728/docker-entrypoint.sh b/sources/redis728/docker-entrypoint.sh new file mode 100755 index 0000000..30406a5 --- /dev/null +++ b/sources/redis728/docker-entrypoint.sh @@ -0,0 +1,24 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi + +# allow the container to be started with `--user` +if [ "$1" = 'redis-server' -a "$(id -u)" = '0' ]; then + find . \! -user redis -exec chown redis '{}' + + exec gosu redis "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +exec "$@" diff --git a/sources/redis729/Dockerfile b/sources/redis729/Dockerfile new file mode 100644 index 0000000..7439886 --- /dev/null +++ b/sources/redis729/Dockerfile @@ -0,0 +1,141 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ + ; + +# grab gosu for easy step-down from root +# https://github.com/tianon/gosu/releases +ENV GOSU_VERSION 1.17 +RUN set -eux; \ + apk add --no-cache --virtual .gosu-fetch gnupg; \ + arch="$(apk --print-arch)"; \ + case "$arch" in \ + 'x86_64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64'; sha256='bbc4136d03ab138b1ad66fa4fc051bafc6cc7ffae632b069a53657279a450de3' ;; \ + 'aarch64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-arm64'; sha256='c3805a85d17f4454c23d7059bcb97e1ec1af272b90126e79ed002342de08389b' ;; \ + 'armhf') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-armhf'; sha256='e5866286277ff2a2159fb9196fea13e0a59d3f1091ea46ddb985160b94b6841b' ;; \ + 'x86') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-i386'; sha256='087dbb8fe479537e64f9c86fa49ff3b41dee1cbd28739a19aaef83dc8186b1ca' ;; \ + 'ppc64le') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-ppc64el'; sha256='1891acdcfa70046818ab6ed3c52b9d42fa10fbb7b340eb429c8c7849691dbd76' ;; \ + 'riscv64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-riscv64'; sha256='38a6444b57adce135c42d5a3689f616fc7803ddc7a07ff6f946f2ebc67a26ba6' ;; \ + 's390x') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-s390x'; sha256='69873bab588192f760547ca1f75b27cfcf106e9f7403fee6fd0600bc914979d0' ;; \ + 'armv7') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-armhf'; sha256='e5866286277ff2a2159fb9196fea13e0a59d3f1091ea46ddb985160b94b6841b' ;; \ + *) echo >&2 "error: unsupported gosu architecture: '$arch'"; exit 1 ;; \ + esac; \ + wget -O /usr/local/bin/gosu.asc "$url.asc"; \ + wget -O /usr/local/bin/gosu "$url"; \ + echo "$sha256 */usr/local/bin/gosu" | sha256sum -c -; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \ + gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \ + apk del --no-network .gosu-fetch; \ + chmod +x /usr/local/bin/gosu; \ + gosu --version; \ + gosu nobody true + +ENV REDIS_VERSION 7.2.9 +ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-7.2.9.tar.gz +ENV REDIS_DOWNLOAD_SHA 2343cc49db3beb9d2925a44e13032805a608821a58f25bd874c84881115a20b7 + +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ +# install real "wget" to avoid: +# + wget -O redis.tar.gz https://download.redis.io/releases/redis-x.y.z.tar.gz +# Connecting to download.redis.io (45.60.121.1:80) +# wget: bad header line: XxhODalH: btu; path=/; Max-Age=900 + wget \ + ; \ + \ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ + export BUILD_TLS=yes; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + apk del --no-network .build-deps; \ + \ + redis-cli --version; \ + redis-server --version + +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] diff --git a/sources/redis729/docker-entrypoint.sh b/sources/redis729/docker-entrypoint.sh new file mode 100755 index 0000000..30406a5 --- /dev/null +++ b/sources/redis729/docker-entrypoint.sh @@ -0,0 +1,24 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi + +# allow the container to be started with `--user` +if [ "$1" = 'redis-server' -a "$(id -u)" = '0' ]; then + find . \! -user redis -exec chown redis '{}' + + exec gosu redis "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +exec "$@" diff --git a/sources/redis744/Dockerfile b/sources/redis744/Dockerfile new file mode 100644 index 0000000..b5b0d0b --- /dev/null +++ b/sources/redis744/Dockerfile @@ -0,0 +1,141 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ + ; + +# grab gosu for easy step-down from root +# https://github.com/tianon/gosu/releases +ENV GOSU_VERSION 1.17 +RUN set -eux; \ + apk add --no-cache --virtual .gosu-fetch gnupg; \ + arch="$(apk --print-arch)"; \ + case "$arch" in \ + 'x86_64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64'; sha256='bbc4136d03ab138b1ad66fa4fc051bafc6cc7ffae632b069a53657279a450de3' ;; \ + 'aarch64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-arm64'; sha256='c3805a85d17f4454c23d7059bcb97e1ec1af272b90126e79ed002342de08389b' ;; \ + 'armhf') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-armhf'; sha256='e5866286277ff2a2159fb9196fea13e0a59d3f1091ea46ddb985160b94b6841b' ;; \ + 'x86') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-i386'; sha256='087dbb8fe479537e64f9c86fa49ff3b41dee1cbd28739a19aaef83dc8186b1ca' ;; \ + 'ppc64le') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-ppc64el'; sha256='1891acdcfa70046818ab6ed3c52b9d42fa10fbb7b340eb429c8c7849691dbd76' ;; \ + 'riscv64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-riscv64'; sha256='38a6444b57adce135c42d5a3689f616fc7803ddc7a07ff6f946f2ebc67a26ba6' ;; \ + 's390x') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-s390x'; sha256='69873bab588192f760547ca1f75b27cfcf106e9f7403fee6fd0600bc914979d0' ;; \ + 'armv7') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-armhf'; sha256='e5866286277ff2a2159fb9196fea13e0a59d3f1091ea46ddb985160b94b6841b' ;; \ + *) echo >&2 "error: unsupported gosu architecture: '$arch'"; exit 1 ;; \ + esac; \ + wget -O /usr/local/bin/gosu.asc "$url.asc"; \ + wget -O /usr/local/bin/gosu "$url"; \ + echo "$sha256 */usr/local/bin/gosu" | sha256sum -c -; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \ + gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \ + apk del --no-network .gosu-fetch; \ + chmod +x /usr/local/bin/gosu; \ + gosu --version; \ + gosu nobody true + +ENV REDIS_VERSION 7.4.4 +ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-7.4.4.tar.gz +ENV REDIS_DOWNLOAD_SHA 985c465146453f4d79912e70b2dc516577a1667cbf9b0420a0c87878fcc6f32f + +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ +# install real "wget" to avoid: +# + wget -O redis.tar.gz https://download.redis.io/releases/redis-x.y.z.tar.gz +# Connecting to download.redis.io (45.60.121.1:80) +# wget: bad header line: XxhODalH: btu; path=/; Max-Age=900 + wget \ + ; \ + \ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ + export BUILD_TLS=yes; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + apk del --no-network .build-deps; \ + \ + redis-cli --version; \ + redis-server --version + +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] diff --git a/sources/redis744/docker-entrypoint.sh b/sources/redis744/docker-entrypoint.sh new file mode 100755 index 0000000..30406a5 --- /dev/null +++ b/sources/redis744/docker-entrypoint.sh @@ -0,0 +1,24 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi + +# allow the container to be started with `--user` +if [ "$1" = 'redis-server' -a "$(id -u)" = '0' ]; then + find . \! -user redis -exec chown redis '{}' + + exec gosu redis "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +exec "$@" diff --git a/sources/redis745/Dockerfile b/sources/redis745/Dockerfile new file mode 100644 index 0000000..1a0e34d --- /dev/null +++ b/sources/redis745/Dockerfile @@ -0,0 +1,141 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ + ; + +# grab gosu for easy step-down from root +# https://github.com/tianon/gosu/releases +ENV GOSU_VERSION 1.17 +RUN set -eux; \ + apk add --no-cache --virtual .gosu-fetch gnupg; \ + arch="$(apk --print-arch)"; \ + case "$arch" in \ + 'x86_64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64'; sha256='bbc4136d03ab138b1ad66fa4fc051bafc6cc7ffae632b069a53657279a450de3' ;; \ + 'aarch64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-arm64'; sha256='c3805a85d17f4454c23d7059bcb97e1ec1af272b90126e79ed002342de08389b' ;; \ + 'armhf') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-armhf'; sha256='e5866286277ff2a2159fb9196fea13e0a59d3f1091ea46ddb985160b94b6841b' ;; \ + 'x86') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-i386'; sha256='087dbb8fe479537e64f9c86fa49ff3b41dee1cbd28739a19aaef83dc8186b1ca' ;; \ + 'ppc64le') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-ppc64el'; sha256='1891acdcfa70046818ab6ed3c52b9d42fa10fbb7b340eb429c8c7849691dbd76' ;; \ + 'riscv64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-riscv64'; sha256='38a6444b57adce135c42d5a3689f616fc7803ddc7a07ff6f946f2ebc67a26ba6' ;; \ + 's390x') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-s390x'; sha256='69873bab588192f760547ca1f75b27cfcf106e9f7403fee6fd0600bc914979d0' ;; \ + 'armv7') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-armhf'; sha256='e5866286277ff2a2159fb9196fea13e0a59d3f1091ea46ddb985160b94b6841b' ;; \ + *) echo >&2 "error: unsupported gosu architecture: '$arch'"; exit 1 ;; \ + esac; \ + wget -O /usr/local/bin/gosu.asc "$url.asc"; \ + wget -O /usr/local/bin/gosu "$url"; \ + echo "$sha256 */usr/local/bin/gosu" | sha256sum -c -; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \ + gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \ + apk del --no-network .gosu-fetch; \ + chmod +x /usr/local/bin/gosu; \ + gosu --version; \ + gosu nobody true + +ENV REDIS_VERSION 7.4.5 +ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-7.4.5.tar.gz +ENV REDIS_DOWNLOAD_SHA 00bb280528f5d7934bec8ab309b8125088c209131e10609cb1563b91365633bb + +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ +# install real "wget" to avoid: +# + wget -O redis.tar.gz https://download.redis.io/releases/redis-x.y.z.tar.gz +# Connecting to download.redis.io (45.60.121.1:80) +# wget: bad header line: XxhODalH: btu; path=/; Max-Age=900 + wget \ + ; \ + \ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ + export BUILD_TLS=yes; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + apk del --no-network .build-deps; \ + \ + redis-cli --version; \ + redis-server --version + +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] diff --git a/sources/redis745/docker-entrypoint.sh b/sources/redis745/docker-entrypoint.sh new file mode 100755 index 0000000..30406a5 --- /dev/null +++ b/sources/redis745/docker-entrypoint.sh @@ -0,0 +1,24 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi + +# allow the container to be started with `--user` +if [ "$1" = 'redis-server' -a "$(id -u)" = '0' ]; then + find . \! -user redis -exec chown redis '{}' + + exec gosu redis "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +exec "$@" diff --git a/sources/redis746/Dockerfile b/sources/redis746/Dockerfile new file mode 100644 index 0000000..ea69ba5 --- /dev/null +++ b/sources/redis746/Dockerfile @@ -0,0 +1,141 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ + ; + +# grab gosu for easy step-down from root +# https://github.com/tianon/gosu/releases +ENV GOSU_VERSION 1.17 +RUN set -eux; \ + apk add --no-cache --virtual .gosu-fetch gnupg; \ + arch="$(apk --print-arch)"; \ + case "$arch" in \ + 'x86_64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64'; sha256='bbc4136d03ab138b1ad66fa4fc051bafc6cc7ffae632b069a53657279a450de3' ;; \ + 'aarch64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-arm64'; sha256='c3805a85d17f4454c23d7059bcb97e1ec1af272b90126e79ed002342de08389b' ;; \ + 'armhf') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-armhf'; sha256='e5866286277ff2a2159fb9196fea13e0a59d3f1091ea46ddb985160b94b6841b' ;; \ + 'x86') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-i386'; sha256='087dbb8fe479537e64f9c86fa49ff3b41dee1cbd28739a19aaef83dc8186b1ca' ;; \ + 'ppc64le') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-ppc64el'; sha256='1891acdcfa70046818ab6ed3c52b9d42fa10fbb7b340eb429c8c7849691dbd76' ;; \ + 'riscv64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-riscv64'; sha256='38a6444b57adce135c42d5a3689f616fc7803ddc7a07ff6f946f2ebc67a26ba6' ;; \ + 's390x') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-s390x'; sha256='69873bab588192f760547ca1f75b27cfcf106e9f7403fee6fd0600bc914979d0' ;; \ + 'armv7') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-armhf'; sha256='e5866286277ff2a2159fb9196fea13e0a59d3f1091ea46ddb985160b94b6841b' ;; \ + *) echo >&2 "error: unsupported gosu architecture: '$arch'"; exit 1 ;; \ + esac; \ + wget -O /usr/local/bin/gosu.asc "$url.asc"; \ + wget -O /usr/local/bin/gosu "$url"; \ + echo "$sha256 */usr/local/bin/gosu" | sha256sum -c -; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \ + gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \ + apk del --no-network .gosu-fetch; \ + chmod +x /usr/local/bin/gosu; \ + gosu --version; \ + gosu nobody true + +ENV REDIS_VERSION 7.4.6 +ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-7.4.6.tar.gz +ENV REDIS_DOWNLOAD_SHA 73b94484e00fb4c2440b490dc4021142fb0b6efc8b64c6329c10d24f0b531c99 + +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ +# install real "wget" to avoid: +# + wget -O redis.tar.gz https://download.redis.io/releases/redis-x.y.z.tar.gz +# Connecting to download.redis.io (45.60.121.1:80) +# wget: bad header line: XxhODalH: btu; path=/; Max-Age=900 + wget \ + ; \ + \ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ + export BUILD_TLS=yes; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + apk del --no-network .build-deps; \ + \ + redis-cli --version; \ + redis-server --version + +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] diff --git a/sources/redis746/docker-entrypoint.sh b/sources/redis746/docker-entrypoint.sh new file mode 100755 index 0000000..30406a5 --- /dev/null +++ b/sources/redis746/docker-entrypoint.sh @@ -0,0 +1,24 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi + +# allow the container to be started with `--user` +if [ "$1" = 'redis-server' -a "$(id -u)" = '0' ]; then + find . \! -user redis -exec chown redis '{}' + + exec gosu redis "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +exec "$@" diff --git a/sources/redis747/Dockerfile b/sources/redis747/Dockerfile new file mode 100644 index 0000000..fd1aafb --- /dev/null +++ b/sources/redis747/Dockerfile @@ -0,0 +1,141 @@ +# +# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" +# +# PLEASE DO NOT EDIT IT DIRECTLY. +# + +FROM alpine:3.21 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ + ; + +# grab gosu for easy step-down from root +# https://github.com/tianon/gosu/releases +ENV GOSU_VERSION 1.17 +RUN set -eux; \ + apk add --no-cache --virtual .gosu-fetch gnupg; \ + arch="$(apk --print-arch)"; \ + case "$arch" in \ + 'x86_64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64'; sha256='bbc4136d03ab138b1ad66fa4fc051bafc6cc7ffae632b069a53657279a450de3' ;; \ + 'aarch64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-arm64'; sha256='c3805a85d17f4454c23d7059bcb97e1ec1af272b90126e79ed002342de08389b' ;; \ + 'armhf') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-armhf'; sha256='e5866286277ff2a2159fb9196fea13e0a59d3f1091ea46ddb985160b94b6841b' ;; \ + 'x86') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-i386'; sha256='087dbb8fe479537e64f9c86fa49ff3b41dee1cbd28739a19aaef83dc8186b1ca' ;; \ + 'ppc64le') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-ppc64el'; sha256='1891acdcfa70046818ab6ed3c52b9d42fa10fbb7b340eb429c8c7849691dbd76' ;; \ + 'riscv64') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-riscv64'; sha256='38a6444b57adce135c42d5a3689f616fc7803ddc7a07ff6f946f2ebc67a26ba6' ;; \ + 's390x') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-s390x'; sha256='69873bab588192f760547ca1f75b27cfcf106e9f7403fee6fd0600bc914979d0' ;; \ + 'armv7') url='https://github.com/tianon/gosu/releases/download/1.17/gosu-armhf'; sha256='e5866286277ff2a2159fb9196fea13e0a59d3f1091ea46ddb985160b94b6841b' ;; \ + *) echo >&2 "error: unsupported gosu architecture: '$arch'"; exit 1 ;; \ + esac; \ + wget -O /usr/local/bin/gosu.asc "$url.asc"; \ + wget -O /usr/local/bin/gosu "$url"; \ + echo "$sha256 */usr/local/bin/gosu" | sha256sum -c -; \ + export GNUPGHOME="$(mktemp -d)"; \ + gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \ + gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \ + gpgconf --kill all; \ + rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \ + apk del --no-network .gosu-fetch; \ + chmod +x /usr/local/bin/gosu; \ + gosu --version; \ + gosu nobody true + +ENV REDIS_VERSION 7.4.7 +ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-7.4.7.tar.gz +ENV REDIS_DOWNLOAD_SHA c97e57b0df330a9e091cacff012bebe763c275398cf36ff44cdba876814b595b + +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ +# install real "wget" to avoid: +# + wget -O redis.tar.gz https://download.redis.io/releases/redis-x.y.z.tar.gz +# Connecting to download.redis.io (45.60.121.1:80) +# wget: bad header line: XxhODalH: btu; path=/; Max-Age=900 + wget \ + ; \ + \ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ + export BUILD_TLS=yes; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + apk del --no-network .build-deps; \ + \ + redis-cli --version; \ + redis-server --version + +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] diff --git a/sources/redis747/docker-entrypoint.sh b/sources/redis747/docker-entrypoint.sh new file mode 100755 index 0000000..30406a5 --- /dev/null +++ b/sources/redis747/docker-entrypoint.sh @@ -0,0 +1,24 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi + +# allow the container to be started with `--user` +if [ "$1" = 'redis-server' -a "$(id -u)" = '0' ]; then + find . \! -user redis -exec chown redis '{}' + + exec gosu redis "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +exec "$@" diff --git a/sources/redis802/Dockerfile b/sources/redis802/Dockerfile new file mode 100644 index 0000000..92649b7 --- /dev/null +++ b/sources/redis802/Dockerfile @@ -0,0 +1,149 @@ +FROM alpine:3.21 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ +# we need setpriv package as busybox provides very limited functionality + setpriv \ + ; +ENV REDIS_DOWNLOAD_URL=https://github.com/redis/redis/archive/refs/tags/8.0.2.tar.gz +ENV REDIS_DOWNLOAD_SHA=caf3c0069f06fc84c5153bd2a348b204c578de80490c73857bee01d9b5d7401f +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ + g++; \ + \ + arch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \ + case "$arch" in \ + 'amd64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + 'arm64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + *) echo >&2 "Modules are NOT supported! unsupported architecture: '$arch'"; export BUILD_WITH_MODULES=no ;; \ + esac; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk add --no-cache --virtual .module-build-deps \ + autoconf \ + automake \ + bash \ + bsd-compat-headers \ + build-base \ + cargo \ + clang \ + clang18-libclang \ + cmake \ + curl \ + g++ \ + git \ + libffi-dev \ + libgcc \ + libtool \ + openssh \ + openssl \ + py-virtualenv \ + py3-cryptography \ + py3-pip \ + py3-virtualenv \ + python3 \ + python3-dev \ + rsync \ + tar \ + unzip \ + which \ + xsimd \ + xz; \ + fi; \ + \ +# install required python packages for RedisJSON module + pip install -q --upgrade setuptools && pip install -q --upgrade pip && PIP_BREAK_SYSTEM_PACKAGES=1 pip install -q addict toml jinja2 ramp-packer ;\ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ + export BUILD_TLS=yes; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + make -C /usr/src/redis/modules/redisjson get_source; \ + sed -i 's/^RUST_FLAGS=$/RUST_FLAGS += -C target-feature=-crt-static/' /usr/src/redis/modules/redisjson/src/Makefile ; \ + grep -E 'RUST_FLAGS' /usr/src/redis/modules/redisjson/src/Makefile; \ + fi; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + make -C /usr/src/redis distclean; \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk del --no-network .module-build-deps; \ + fi; \ + apk del --no-network .build-deps; \ + rm -rf ~/.cache ~/.gitconfig; \ + \ + redis-cli --version; \ + redis-server --version; +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] diff --git a/sources/redis802/docker-entrypoint.sh b/sources/redis802/docker-entrypoint.sh new file mode 100755 index 0000000..476913d --- /dev/null +++ b/sources/redis802/docker-entrypoint.sh @@ -0,0 +1,184 @@ +#!/bin/sh +set -e + +SETPRIV="/usr/bin/setpriv --reuid redis --regid redis --clear-groups" +IS_REDIS_SENTINEL="" +IS_REDIS_SERVER="" +CONFIG="" + +SKIP_FIX_PERMS_NOTICE="Use SKIP_FIX_PERMS=1 to skip permission changes." + +# functions +has_cap() { + /usr/bin/setpriv -d | grep -q 'Capability bounding set:.*\b'"$1"'\b' +} + +check_for_sentinel() { + CMD="$1" + shift + if [ "$CMD" = '/usr/local/bin/redis-server' ]; then + for arg in "$@"; do + if [ "$arg" = "--sentinel" ]; then + return 0 + fi + done + fi + + if [ "$CMD" = '/usr/local/bin/redis-sentinel' ]; then + return 0 + fi + + return 1 +} + +# Note: Change permissions only in simple, default cases to avoid affecting +# unexpected or user-specific files. + +fix_data_dir_perms() { + # Expecting only *.rdb files and default appendonlydir; skip if others are found. + unknown_file="$(find . -mindepth 1 -maxdepth 1 \ + -not \( -name \*.rdb -or \( -type d -and -name appendonlydir \) \) \ + -print -quit)" + if [ -z "$unknown_file" ]; then + find . -print0 | fix_perms_and_owner rw + else + echo "Notice: Unknown file '$unknown_file' found in data dir. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + fi +} + +fix_config_perms() { + config="$1" + mode="$2" + + if [ ! -f "$config" ]; then + return 0 + fi + + confdir="$(dirname "$config")" + if [ ! -d "$confdir" ]; then + return 0 + fi + + # Expecting only the config file; skip if others are found. + pattern=$(printf "%s" "$(basename "$config")" | sed 's/[][?*]/\\&/g') + unknown_file=$(find "$confdir" -mindepth 1 -maxdepth 1 -not -name "$pattern" -print -quit) + + if [ -z "$unknown_file" ]; then + printf '%s\0%s\0' "$confdir" "$config" | fix_perms_and_owner "$mode" + else + echo "Notice: Unknown file '$unknown_file' found in '$confdir'. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + + fi +} + +fix_perms_and_owner() { + mode="$1" + + # shellcheck disable=SC3045 + while IFS= read -r -d '' file; do + if [ "$mode" = "rw" ] && $SETPRIV test -r "$file" -a -w "$file"; then + continue + elif [ "$mode" = "r" ] && $SETPRIV test -r "$file"; then + continue + fi + new_mode=$mode + if [ -d "$file" ]; then + new_mode=${mode}x + fi + err=$(chown redis "$file" 2>&1) || echo "Warning: cannot change owner to 'redis' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + err=$(chmod "u+$new_mode" "$file" 2>&1) || echo "Warning: cannot change mode to 'u+$new_mode' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + done +} + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi +CMD=$(command -v "$1" 2>/dev/null || :) + +if [ "$(readlink -f "$CMD")" = '/usr/local/bin/redis-server' ]; then + IS_REDIS_SERVER=1 +fi + +if check_for_sentinel "$CMD" "$@"; then + IS_REDIS_SENTINEL=1 +fi + +# if is server and its first arg is not an option then it's a config +if [ "$IS_REDIS_SERVER" ] && [ "${2#-}" = "$2" ]; then + CONFIG="$2" +fi + +# drop privileges only if +# we are starting either server or sentinel +# our uid is 0 (container started without explicit --user) +# and we have capabilities required to drop privs +if [ "$IS_REDIS_SERVER" ] && [ -z "$SKIP_DROP_PRIVS" ] && [ "$(id -u)" = '0' ] && has_cap setuid && has_cap setgid; then + if [ -z "$SKIP_FIX_PERMS" ]; then + # fix permissions + if [ "$IS_REDIS_SENTINEL" ]; then + fix_config_perms "$CONFIG" rw + else + fix_data_dir_perms + fix_config_perms "$CONFIG" r + fi + fi + + CAPS_TO_KEEP="" + if has_cap sys_resource; then + # we have sys_resource capability, keep it available for redis + # as redis may use it to increase open files limit + CAPS_TO_KEEP=",+sys_resource" + fi + exec $SETPRIV \ + --nnp \ + --inh-caps=-all$CAPS_TO_KEEP \ + --ambient-caps=-all$CAPS_TO_KEEP \ + --bounding-set=-all$CAPS_TO_KEEP \ + "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +if [ "$IS_REDIS_SERVER" ] && ! [ "$IS_REDIS_SENTINEL" ]; then + echo "Starting Redis Server" + modules_dir="/usr/local/lib/redis/modules/" + + if [ ! -d "$modules_dir" ]; then + echo "Warning: Default Redis modules directory $modules_dir does not exist." + elif [ -n "$(ls -A $modules_dir 2>/dev/null)" ]; then + for module in "$modules_dir"/*.so; + do + if [ ! -s "$module" ]; then + echo "Skipping module $module: file has no size." + continue + fi + + if [ -d "$module" ]; then + echo "Skipping module $module: is a directory." + continue + fi + + if [ ! -r "$module" ]; then + echo "Skipping module $module: file is not readable." + continue + fi + + if [ ! -x "$module" ]; then + echo "Warning: Module $module is not executable." + continue + fi + + set -- "$@" --loadmodule "$module" + done + fi +fi + +exec "$@" diff --git a/sources/redis803/Dockerfile b/sources/redis803/Dockerfile new file mode 100644 index 0000000..e1b8143 --- /dev/null +++ b/sources/redis803/Dockerfile @@ -0,0 +1,149 @@ +FROM alpine:3.21 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ +# we need setpriv package as busybox provides very limited functionality + setpriv \ + ; +ENV REDIS_DOWNLOAD_URL=https://github.com/redis/redis/archive/refs/tags/8.0.3.tar.gz +ENV REDIS_DOWNLOAD_SHA=2467b9608ecbcc2c0d27397c0c2406b499b6f68bc08ac9f6380b1faf2113ae6f +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ + g++; \ + \ + arch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \ + case "$arch" in \ + 'amd64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + 'arm64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + *) echo >&2 "Modules are NOT supported! unsupported architecture: '$arch'"; export BUILD_WITH_MODULES=no ;; \ + esac; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk add --no-cache --virtual .module-build-deps \ + autoconf \ + automake \ + bash \ + bsd-compat-headers \ + build-base \ + cargo \ + clang \ + clang18-libclang \ + cmake \ + curl \ + g++ \ + git \ + libffi-dev \ + libgcc \ + libtool \ + openssh \ + openssl \ + py-virtualenv \ + py3-cryptography \ + py3-pip \ + py3-virtualenv \ + python3 \ + python3-dev \ + rsync \ + tar \ + unzip \ + which \ + xsimd \ + xz; \ + fi; \ + \ +# install required python packages for RedisJSON module + pip install -q --upgrade setuptools && pip install -q --upgrade pip && PIP_BREAK_SYSTEM_PACKAGES=1 pip install -q addict toml jinja2 ramp-packer ;\ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ + export BUILD_TLS=yes; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + make -C /usr/src/redis/modules/redisjson get_source; \ + sed -i 's/^RUST_FLAGS=$/RUST_FLAGS += -C target-feature=-crt-static/' /usr/src/redis/modules/redisjson/src/Makefile ; \ + grep -E 'RUST_FLAGS' /usr/src/redis/modules/redisjson/src/Makefile; \ + fi; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + make -C /usr/src/redis distclean; \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk del --no-network .module-build-deps; \ + fi; \ + apk del --no-network .build-deps; \ + rm -rf ~/.cache ~/.gitconfig; \ + \ + redis-cli --version; \ + redis-server --version; +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] diff --git a/sources/redis803/docker-entrypoint.sh b/sources/redis803/docker-entrypoint.sh new file mode 100755 index 0000000..476913d --- /dev/null +++ b/sources/redis803/docker-entrypoint.sh @@ -0,0 +1,184 @@ +#!/bin/sh +set -e + +SETPRIV="/usr/bin/setpriv --reuid redis --regid redis --clear-groups" +IS_REDIS_SENTINEL="" +IS_REDIS_SERVER="" +CONFIG="" + +SKIP_FIX_PERMS_NOTICE="Use SKIP_FIX_PERMS=1 to skip permission changes." + +# functions +has_cap() { + /usr/bin/setpriv -d | grep -q 'Capability bounding set:.*\b'"$1"'\b' +} + +check_for_sentinel() { + CMD="$1" + shift + if [ "$CMD" = '/usr/local/bin/redis-server' ]; then + for arg in "$@"; do + if [ "$arg" = "--sentinel" ]; then + return 0 + fi + done + fi + + if [ "$CMD" = '/usr/local/bin/redis-sentinel' ]; then + return 0 + fi + + return 1 +} + +# Note: Change permissions only in simple, default cases to avoid affecting +# unexpected or user-specific files. + +fix_data_dir_perms() { + # Expecting only *.rdb files and default appendonlydir; skip if others are found. + unknown_file="$(find . -mindepth 1 -maxdepth 1 \ + -not \( -name \*.rdb -or \( -type d -and -name appendonlydir \) \) \ + -print -quit)" + if [ -z "$unknown_file" ]; then + find . -print0 | fix_perms_and_owner rw + else + echo "Notice: Unknown file '$unknown_file' found in data dir. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + fi +} + +fix_config_perms() { + config="$1" + mode="$2" + + if [ ! -f "$config" ]; then + return 0 + fi + + confdir="$(dirname "$config")" + if [ ! -d "$confdir" ]; then + return 0 + fi + + # Expecting only the config file; skip if others are found. + pattern=$(printf "%s" "$(basename "$config")" | sed 's/[][?*]/\\&/g') + unknown_file=$(find "$confdir" -mindepth 1 -maxdepth 1 -not -name "$pattern" -print -quit) + + if [ -z "$unknown_file" ]; then + printf '%s\0%s\0' "$confdir" "$config" | fix_perms_and_owner "$mode" + else + echo "Notice: Unknown file '$unknown_file' found in '$confdir'. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + + fi +} + +fix_perms_and_owner() { + mode="$1" + + # shellcheck disable=SC3045 + while IFS= read -r -d '' file; do + if [ "$mode" = "rw" ] && $SETPRIV test -r "$file" -a -w "$file"; then + continue + elif [ "$mode" = "r" ] && $SETPRIV test -r "$file"; then + continue + fi + new_mode=$mode + if [ -d "$file" ]; then + new_mode=${mode}x + fi + err=$(chown redis "$file" 2>&1) || echo "Warning: cannot change owner to 'redis' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + err=$(chmod "u+$new_mode" "$file" 2>&1) || echo "Warning: cannot change mode to 'u+$new_mode' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + done +} + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi +CMD=$(command -v "$1" 2>/dev/null || :) + +if [ "$(readlink -f "$CMD")" = '/usr/local/bin/redis-server' ]; then + IS_REDIS_SERVER=1 +fi + +if check_for_sentinel "$CMD" "$@"; then + IS_REDIS_SENTINEL=1 +fi + +# if is server and its first arg is not an option then it's a config +if [ "$IS_REDIS_SERVER" ] && [ "${2#-}" = "$2" ]; then + CONFIG="$2" +fi + +# drop privileges only if +# we are starting either server or sentinel +# our uid is 0 (container started without explicit --user) +# and we have capabilities required to drop privs +if [ "$IS_REDIS_SERVER" ] && [ -z "$SKIP_DROP_PRIVS" ] && [ "$(id -u)" = '0' ] && has_cap setuid && has_cap setgid; then + if [ -z "$SKIP_FIX_PERMS" ]; then + # fix permissions + if [ "$IS_REDIS_SENTINEL" ]; then + fix_config_perms "$CONFIG" rw + else + fix_data_dir_perms + fix_config_perms "$CONFIG" r + fi + fi + + CAPS_TO_KEEP="" + if has_cap sys_resource; then + # we have sys_resource capability, keep it available for redis + # as redis may use it to increase open files limit + CAPS_TO_KEEP=",+sys_resource" + fi + exec $SETPRIV \ + --nnp \ + --inh-caps=-all$CAPS_TO_KEEP \ + --ambient-caps=-all$CAPS_TO_KEEP \ + --bounding-set=-all$CAPS_TO_KEEP \ + "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +if [ "$IS_REDIS_SERVER" ] && ! [ "$IS_REDIS_SENTINEL" ]; then + echo "Starting Redis Server" + modules_dir="/usr/local/lib/redis/modules/" + + if [ ! -d "$modules_dir" ]; then + echo "Warning: Default Redis modules directory $modules_dir does not exist." + elif [ -n "$(ls -A $modules_dir 2>/dev/null)" ]; then + for module in "$modules_dir"/*.so; + do + if [ ! -s "$module" ]; then + echo "Skipping module $module: file has no size." + continue + fi + + if [ -d "$module" ]; then + echo "Skipping module $module: is a directory." + continue + fi + + if [ ! -r "$module" ]; then + echo "Skipping module $module: file is not readable." + continue + fi + + if [ ! -x "$module" ]; then + echo "Warning: Module $module is not executable." + continue + fi + + set -- "$@" --loadmodule "$module" + done + fi +fi + +exec "$@" diff --git a/sources/redis804/Dockerfile b/sources/redis804/Dockerfile new file mode 100644 index 0000000..f84cbe6 --- /dev/null +++ b/sources/redis804/Dockerfile @@ -0,0 +1,149 @@ +FROM alpine:3.21 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ +# we need setpriv package as busybox provides very limited functionality + setpriv \ + ; +ENV REDIS_DOWNLOAD_URL=https://github.com/redis/redis/archive/refs/tags/8.0.4.tar.gz +ENV REDIS_DOWNLOAD_SHA=aadd6b0aac9ea0178b3c9a1a78469f2085752f743d563feba639d2e2c69c7ad1 +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ + g++; \ + \ + arch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \ + case "$arch" in \ + 'amd64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + 'arm64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + *) echo >&2 "Modules are NOT supported! unsupported architecture: '$arch'"; export BUILD_WITH_MODULES=no ;; \ + esac; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk add --no-cache --virtual .module-build-deps \ + autoconf \ + automake \ + bash \ + bsd-compat-headers \ + build-base \ + cargo \ + clang \ + clang18-libclang \ + cmake \ + curl \ + g++ \ + git \ + libffi-dev \ + libgcc \ + libtool \ + openssh \ + openssl \ + py-virtualenv \ + py3-cryptography \ + py3-pip \ + py3-virtualenv \ + python3 \ + python3-dev \ + rsync \ + tar \ + unzip \ + which \ + xsimd \ + xz; \ + fi; \ + \ +# install required python packages for RedisJSON module + pip install -q --upgrade setuptools && pip install -q --upgrade pip && PIP_BREAK_SYSTEM_PACKAGES=1 pip install -q addict toml jinja2 ramp-packer ;\ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ + export BUILD_TLS=yes; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + make -C /usr/src/redis/modules/redisjson get_source; \ + sed -i 's/^RUST_FLAGS=$/RUST_FLAGS += -C target-feature=-crt-static/' /usr/src/redis/modules/redisjson/src/Makefile ; \ + grep -E 'RUST_FLAGS' /usr/src/redis/modules/redisjson/src/Makefile; \ + fi; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + make -C /usr/src/redis distclean; \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk del --no-network .module-build-deps; \ + fi; \ + apk del --no-network .build-deps; \ + rm -rf ~/.cache ~/.gitconfig; \ + \ + redis-cli --version; \ + redis-server --version; +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] diff --git a/sources/redis804/docker-entrypoint.sh b/sources/redis804/docker-entrypoint.sh new file mode 100755 index 0000000..476913d --- /dev/null +++ b/sources/redis804/docker-entrypoint.sh @@ -0,0 +1,184 @@ +#!/bin/sh +set -e + +SETPRIV="/usr/bin/setpriv --reuid redis --regid redis --clear-groups" +IS_REDIS_SENTINEL="" +IS_REDIS_SERVER="" +CONFIG="" + +SKIP_FIX_PERMS_NOTICE="Use SKIP_FIX_PERMS=1 to skip permission changes." + +# functions +has_cap() { + /usr/bin/setpriv -d | grep -q 'Capability bounding set:.*\b'"$1"'\b' +} + +check_for_sentinel() { + CMD="$1" + shift + if [ "$CMD" = '/usr/local/bin/redis-server' ]; then + for arg in "$@"; do + if [ "$arg" = "--sentinel" ]; then + return 0 + fi + done + fi + + if [ "$CMD" = '/usr/local/bin/redis-sentinel' ]; then + return 0 + fi + + return 1 +} + +# Note: Change permissions only in simple, default cases to avoid affecting +# unexpected or user-specific files. + +fix_data_dir_perms() { + # Expecting only *.rdb files and default appendonlydir; skip if others are found. + unknown_file="$(find . -mindepth 1 -maxdepth 1 \ + -not \( -name \*.rdb -or \( -type d -and -name appendonlydir \) \) \ + -print -quit)" + if [ -z "$unknown_file" ]; then + find . -print0 | fix_perms_and_owner rw + else + echo "Notice: Unknown file '$unknown_file' found in data dir. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + fi +} + +fix_config_perms() { + config="$1" + mode="$2" + + if [ ! -f "$config" ]; then + return 0 + fi + + confdir="$(dirname "$config")" + if [ ! -d "$confdir" ]; then + return 0 + fi + + # Expecting only the config file; skip if others are found. + pattern=$(printf "%s" "$(basename "$config")" | sed 's/[][?*]/\\&/g') + unknown_file=$(find "$confdir" -mindepth 1 -maxdepth 1 -not -name "$pattern" -print -quit) + + if [ -z "$unknown_file" ]; then + printf '%s\0%s\0' "$confdir" "$config" | fix_perms_and_owner "$mode" + else + echo "Notice: Unknown file '$unknown_file' found in '$confdir'. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + + fi +} + +fix_perms_and_owner() { + mode="$1" + + # shellcheck disable=SC3045 + while IFS= read -r -d '' file; do + if [ "$mode" = "rw" ] && $SETPRIV test -r "$file" -a -w "$file"; then + continue + elif [ "$mode" = "r" ] && $SETPRIV test -r "$file"; then + continue + fi + new_mode=$mode + if [ -d "$file" ]; then + new_mode=${mode}x + fi + err=$(chown redis "$file" 2>&1) || echo "Warning: cannot change owner to 'redis' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + err=$(chmod "u+$new_mode" "$file" 2>&1) || echo "Warning: cannot change mode to 'u+$new_mode' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + done +} + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi +CMD=$(command -v "$1" 2>/dev/null || :) + +if [ "$(readlink -f "$CMD")" = '/usr/local/bin/redis-server' ]; then + IS_REDIS_SERVER=1 +fi + +if check_for_sentinel "$CMD" "$@"; then + IS_REDIS_SENTINEL=1 +fi + +# if is server and its first arg is not an option then it's a config +if [ "$IS_REDIS_SERVER" ] && [ "${2#-}" = "$2" ]; then + CONFIG="$2" +fi + +# drop privileges only if +# we are starting either server or sentinel +# our uid is 0 (container started without explicit --user) +# and we have capabilities required to drop privs +if [ "$IS_REDIS_SERVER" ] && [ -z "$SKIP_DROP_PRIVS" ] && [ "$(id -u)" = '0' ] && has_cap setuid && has_cap setgid; then + if [ -z "$SKIP_FIX_PERMS" ]; then + # fix permissions + if [ "$IS_REDIS_SENTINEL" ]; then + fix_config_perms "$CONFIG" rw + else + fix_data_dir_perms + fix_config_perms "$CONFIG" r + fi + fi + + CAPS_TO_KEEP="" + if has_cap sys_resource; then + # we have sys_resource capability, keep it available for redis + # as redis may use it to increase open files limit + CAPS_TO_KEEP=",+sys_resource" + fi + exec $SETPRIV \ + --nnp \ + --inh-caps=-all$CAPS_TO_KEEP \ + --ambient-caps=-all$CAPS_TO_KEEP \ + --bounding-set=-all$CAPS_TO_KEEP \ + "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +if [ "$IS_REDIS_SERVER" ] && ! [ "$IS_REDIS_SENTINEL" ]; then + echo "Starting Redis Server" + modules_dir="/usr/local/lib/redis/modules/" + + if [ ! -d "$modules_dir" ]; then + echo "Warning: Default Redis modules directory $modules_dir does not exist." + elif [ -n "$(ls -A $modules_dir 2>/dev/null)" ]; then + for module in "$modules_dir"/*.so; + do + if [ ! -s "$module" ]; then + echo "Skipping module $module: file has no size." + continue + fi + + if [ -d "$module" ]; then + echo "Skipping module $module: is a directory." + continue + fi + + if [ ! -r "$module" ]; then + echo "Skipping module $module: file is not readable." + continue + fi + + if [ ! -x "$module" ]; then + echo "Warning: Module $module is not executable." + continue + fi + + set -- "$@" --loadmodule "$module" + done + fi +fi + +exec "$@" diff --git a/sources/redis805/Dockerfile b/sources/redis805/Dockerfile new file mode 100644 index 0000000..7107707 --- /dev/null +++ b/sources/redis805/Dockerfile @@ -0,0 +1,149 @@ +FROM alpine:3.21 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ +# we need setpriv package as busybox provides very limited functionality + setpriv \ + ; +ENV REDIS_DOWNLOAD_URL=https://github.com/redis/redis/archive/refs/tags/8.0.5.tar.gz +ENV REDIS_DOWNLOAD_SHA=1e8beff55b0c798429ca4fc4c62e064000f37c8b7e9742ab4ebd4edfc3888417 +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ + g++; \ + \ + arch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \ + case "$arch" in \ + 'amd64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + 'arm64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + *) echo >&2 "Modules are NOT supported! unsupported architecture: '$arch'"; export BUILD_WITH_MODULES=no ;; \ + esac; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk add --no-cache --virtual .module-build-deps \ + autoconf \ + automake \ + bash \ + bsd-compat-headers \ + build-base \ + cargo \ + clang \ + clang18-libclang \ + cmake \ + curl \ + g++ \ + git \ + libffi-dev \ + libgcc \ + libtool \ + openssh \ + openssl \ + py-virtualenv \ + py3-cryptography \ + py3-pip \ + py3-virtualenv \ + python3 \ + python3-dev \ + rsync \ + tar \ + unzip \ + which \ + xsimd \ + xz; \ + fi; \ + \ +# install required python packages for RedisJSON module + pip install -q --upgrade setuptools && pip install -q --upgrade pip && PIP_BREAK_SYSTEM_PACKAGES=1 pip install -q addict toml jinja2 ramp-packer ;\ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ + export BUILD_TLS=yes; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + make -C /usr/src/redis/modules/redisjson get_source; \ + sed -i 's/^RUST_FLAGS=$/RUST_FLAGS += -C target-feature=-crt-static/' /usr/src/redis/modules/redisjson/src/Makefile ; \ + grep -E 'RUST_FLAGS' /usr/src/redis/modules/redisjson/src/Makefile; \ + fi; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + make -C /usr/src/redis distclean; \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk del --no-network .module-build-deps; \ + fi; \ + apk del --no-network .build-deps; \ + rm -rf ~/.cache ~/.gitconfig; \ + \ + redis-cli --version; \ + redis-server --version; +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] diff --git a/sources/redis805/docker-entrypoint.sh b/sources/redis805/docker-entrypoint.sh new file mode 100755 index 0000000..476913d --- /dev/null +++ b/sources/redis805/docker-entrypoint.sh @@ -0,0 +1,184 @@ +#!/bin/sh +set -e + +SETPRIV="/usr/bin/setpriv --reuid redis --regid redis --clear-groups" +IS_REDIS_SENTINEL="" +IS_REDIS_SERVER="" +CONFIG="" + +SKIP_FIX_PERMS_NOTICE="Use SKIP_FIX_PERMS=1 to skip permission changes." + +# functions +has_cap() { + /usr/bin/setpriv -d | grep -q 'Capability bounding set:.*\b'"$1"'\b' +} + +check_for_sentinel() { + CMD="$1" + shift + if [ "$CMD" = '/usr/local/bin/redis-server' ]; then + for arg in "$@"; do + if [ "$arg" = "--sentinel" ]; then + return 0 + fi + done + fi + + if [ "$CMD" = '/usr/local/bin/redis-sentinel' ]; then + return 0 + fi + + return 1 +} + +# Note: Change permissions only in simple, default cases to avoid affecting +# unexpected or user-specific files. + +fix_data_dir_perms() { + # Expecting only *.rdb files and default appendonlydir; skip if others are found. + unknown_file="$(find . -mindepth 1 -maxdepth 1 \ + -not \( -name \*.rdb -or \( -type d -and -name appendonlydir \) \) \ + -print -quit)" + if [ -z "$unknown_file" ]; then + find . -print0 | fix_perms_and_owner rw + else + echo "Notice: Unknown file '$unknown_file' found in data dir. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + fi +} + +fix_config_perms() { + config="$1" + mode="$2" + + if [ ! -f "$config" ]; then + return 0 + fi + + confdir="$(dirname "$config")" + if [ ! -d "$confdir" ]; then + return 0 + fi + + # Expecting only the config file; skip if others are found. + pattern=$(printf "%s" "$(basename "$config")" | sed 's/[][?*]/\\&/g') + unknown_file=$(find "$confdir" -mindepth 1 -maxdepth 1 -not -name "$pattern" -print -quit) + + if [ -z "$unknown_file" ]; then + printf '%s\0%s\0' "$confdir" "$config" | fix_perms_and_owner "$mode" + else + echo "Notice: Unknown file '$unknown_file' found in '$confdir'. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + + fi +} + +fix_perms_and_owner() { + mode="$1" + + # shellcheck disable=SC3045 + while IFS= read -r -d '' file; do + if [ "$mode" = "rw" ] && $SETPRIV test -r "$file" -a -w "$file"; then + continue + elif [ "$mode" = "r" ] && $SETPRIV test -r "$file"; then + continue + fi + new_mode=$mode + if [ -d "$file" ]; then + new_mode=${mode}x + fi + err=$(chown redis "$file" 2>&1) || echo "Warning: cannot change owner to 'redis' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + err=$(chmod "u+$new_mode" "$file" 2>&1) || echo "Warning: cannot change mode to 'u+$new_mode' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + done +} + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi +CMD=$(command -v "$1" 2>/dev/null || :) + +if [ "$(readlink -f "$CMD")" = '/usr/local/bin/redis-server' ]; then + IS_REDIS_SERVER=1 +fi + +if check_for_sentinel "$CMD" "$@"; then + IS_REDIS_SENTINEL=1 +fi + +# if is server and its first arg is not an option then it's a config +if [ "$IS_REDIS_SERVER" ] && [ "${2#-}" = "$2" ]; then + CONFIG="$2" +fi + +# drop privileges only if +# we are starting either server or sentinel +# our uid is 0 (container started without explicit --user) +# and we have capabilities required to drop privs +if [ "$IS_REDIS_SERVER" ] && [ -z "$SKIP_DROP_PRIVS" ] && [ "$(id -u)" = '0' ] && has_cap setuid && has_cap setgid; then + if [ -z "$SKIP_FIX_PERMS" ]; then + # fix permissions + if [ "$IS_REDIS_SENTINEL" ]; then + fix_config_perms "$CONFIG" rw + else + fix_data_dir_perms + fix_config_perms "$CONFIG" r + fi + fi + + CAPS_TO_KEEP="" + if has_cap sys_resource; then + # we have sys_resource capability, keep it available for redis + # as redis may use it to increase open files limit + CAPS_TO_KEEP=",+sys_resource" + fi + exec $SETPRIV \ + --nnp \ + --inh-caps=-all$CAPS_TO_KEEP \ + --ambient-caps=-all$CAPS_TO_KEEP \ + --bounding-set=-all$CAPS_TO_KEEP \ + "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +if [ "$IS_REDIS_SERVER" ] && ! [ "$IS_REDIS_SENTINEL" ]; then + echo "Starting Redis Server" + modules_dir="/usr/local/lib/redis/modules/" + + if [ ! -d "$modules_dir" ]; then + echo "Warning: Default Redis modules directory $modules_dir does not exist." + elif [ -n "$(ls -A $modules_dir 2>/dev/null)" ]; then + for module in "$modules_dir"/*.so; + do + if [ ! -s "$module" ]; then + echo "Skipping module $module: file has no size." + continue + fi + + if [ -d "$module" ]; then + echo "Skipping module $module: is a directory." + continue + fi + + if [ ! -r "$module" ]; then + echo "Skipping module $module: file is not readable." + continue + fi + + if [ ! -x "$module" ]; then + echo "Warning: Module $module is not executable." + continue + fi + + set -- "$@" --loadmodule "$module" + done + fi +fi + +exec "$@" diff --git a/sources/redis820/Dockerfile b/sources/redis820/Dockerfile new file mode 100644 index 0000000..abe94fc --- /dev/null +++ b/sources/redis820/Dockerfile @@ -0,0 +1,154 @@ +FROM alpine:3.22 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ +# we need setpriv package as busybox provides very limited functionality + setpriv \ + ; +ENV REDIS_DOWNLOAD_URL=https://github.com/redis/redis/archive/refs/tags/8.2.0.tar.gz +ENV REDIS_DOWNLOAD_SHA=c64219bdcba407d18c8dde1fb87b86945aebf75e60f5b44ff463785a962645ed +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ + g++; \ + \ + arch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \ + case "$arch" in \ + 'amd64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + 'arm64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + *) echo >&2 "Modules are NOT supported! unsupported architecture: '$arch'"; export BUILD_WITH_MODULES=no ;; \ + esac; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk add --no-cache --virtual .module-build-deps \ + autoconf \ + automake \ + bash \ + bsd-compat-headers \ + build-base \ + cargo \ + clang \ + clang-static \ + clang-libclang \ + cmake \ + curl \ + g++ \ + git \ + libffi-dev \ + libgcc \ + libtool \ + llvm-dev \ + ncurses-dev \ + openssh \ + openssl \ + py-virtualenv \ + py3-cryptography \ + py3-pip \ + py3-virtualenv \ + python3 \ + python3-dev \ + rsync \ + tar \ + unzip \ + which \ + xsimd \ + xz; \ + fi; \ + \ +# install required python packages for RedisJSON module + pip install -q --upgrade setuptools && pip install -q --upgrade pip && PIP_BREAK_SYSTEM_PACKAGES=1 pip install -q addict toml jinja2 ramp-packer ;\ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ +# Disable static linking the C runtime for RediSearch's rust submodule + export RUST_DYN_CRT=1; \ + export BUILD_TLS=yes; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + make -C /usr/src/redis/modules/redisjson get_source; \ + sed -i 's/^RUST_FLAGS=$/RUST_FLAGS += -C target-feature=-crt-static/' /usr/src/redis/modules/redisjson/src/Makefile ; \ + grep -E 'RUST_FLAGS' /usr/src/redis/modules/redisjson/src/Makefile; \ + fi; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + make -C /usr/src/redis distclean; \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk del --no-network .module-build-deps; \ + fi; \ + apk del --no-network .build-deps; \ + rm -rf ~/.cache ~/.gitconfig; \ + \ + redis-cli --version; \ + redis-server --version; +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] diff --git a/sources/redis820/docker-entrypoint.sh b/sources/redis820/docker-entrypoint.sh new file mode 100755 index 0000000..ddbd124 --- /dev/null +++ b/sources/redis820/docker-entrypoint.sh @@ -0,0 +1,184 @@ +#!/bin/sh +set -e + +SETPRIV="/bin/setpriv --reuid redis --regid redis --clear-groups" +IS_REDIS_SENTINEL="" +IS_REDIS_SERVER="" +CONFIG="" + +SKIP_FIX_PERMS_NOTICE="Use SKIP_FIX_PERMS=1 to skip permission changes." + +# functions +has_cap() { + /bin/setpriv -d | grep -q 'Capability bounding set:.*\b'"$1"'\b' +} + +check_for_sentinel() { + CMD="$1" + shift + if [ "$CMD" = '/usr/local/bin/redis-server' ]; then + for arg in "$@"; do + if [ "$arg" = "--sentinel" ]; then + return 0 + fi + done + fi + + if [ "$CMD" = '/usr/local/bin/redis-sentinel' ]; then + return 0 + fi + + return 1 +} + +# Note: Change permissions only in simple, default cases to avoid affecting +# unexpected or user-specific files. + +fix_data_dir_perms() { + # Expecting only *.rdb files and default appendonlydir; skip if others are found. + unknown_file="$(find . -mindepth 1 -maxdepth 1 \ + -not \( -name \*.rdb -or \( -type d -and -name appendonlydir \) \) \ + -print -quit)" + if [ -z "$unknown_file" ]; then + find . -print0 | fix_perms_and_owner rw + else + echo "Notice: Unknown file '$unknown_file' found in data dir. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + fi +} + +fix_config_perms() { + config="$1" + mode="$2" + + if [ ! -f "$config" ]; then + return 0 + fi + + confdir="$(dirname "$config")" + if [ ! -d "$confdir" ]; then + return 0 + fi + + # Expecting only the config file; skip if others are found. + pattern=$(printf "%s" "$(basename "$config")" | sed 's/[][?*]/\\&/g') + unknown_file=$(find "$confdir" -mindepth 1 -maxdepth 1 -not -name "$pattern" -print -quit) + + if [ -z "$unknown_file" ]; then + printf '%s\0%s\0' "$confdir" "$config" | fix_perms_and_owner "$mode" + else + echo "Notice: Unknown file '$unknown_file' found in '$confdir'. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + + fi +} + +fix_perms_and_owner() { + mode="$1" + + # shellcheck disable=SC3045 + while IFS= read -r -d '' file; do + if [ "$mode" = "rw" ] && $SETPRIV test -r "$file" -a -w "$file"; then + continue + elif [ "$mode" = "r" ] && $SETPRIV test -r "$file"; then + continue + fi + new_mode=$mode + if [ -d "$file" ]; then + new_mode=${mode}x + fi + err=$(chown redis "$file" 2>&1) || echo "Warning: cannot change owner to 'redis' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + err=$(chmod "u+$new_mode" "$file" 2>&1) || echo "Warning: cannot change mode to 'u+$new_mode' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + done +} + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi +CMD=$(command -v "$1" 2>/dev/null || :) + +if [ "$(readlink -f "$CMD")" = '/usr/local/bin/redis-server' ]; then + IS_REDIS_SERVER=1 +fi + +if check_for_sentinel "$CMD" "$@"; then + IS_REDIS_SENTINEL=1 +fi + +# if is server and its first arg is not an option then it's a config +if [ "$IS_REDIS_SERVER" ] && [ "${2#-}" = "$2" ]; then + CONFIG="$2" +fi + +# drop privileges only if +# we are starting either server or sentinel +# our uid is 0 (container started without explicit --user) +# and we have capabilities required to drop privs +if [ "$IS_REDIS_SERVER" ] && [ -z "$SKIP_DROP_PRIVS" ] && [ "$(id -u)" = '0' ] && has_cap setuid && has_cap setgid; then + if [ -z "$SKIP_FIX_PERMS" ]; then + # fix permissions + if [ "$IS_REDIS_SENTINEL" ]; then + fix_config_perms "$CONFIG" rw + else + fix_data_dir_perms + fix_config_perms "$CONFIG" r + fi + fi + + CAPS_TO_KEEP="" + if has_cap sys_resource; then + # we have sys_resource capability, keep it available for redis + # as redis may use it to increase open files limit + CAPS_TO_KEEP=",+sys_resource" + fi + exec $SETPRIV \ + --nnp \ + --inh-caps=-all$CAPS_TO_KEEP \ + --ambient-caps=-all$CAPS_TO_KEEP \ + --bounding-set=-all$CAPS_TO_KEEP \ + "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +if [ "$IS_REDIS_SERVER" ] && ! [ "$IS_REDIS_SENTINEL" ]; then + echo "Starting Redis Server" + modules_dir="/usr/local/lib/redis/modules/" + + if [ ! -d "$modules_dir" ]; then + echo "Warning: Default Redis modules directory $modules_dir does not exist." + elif [ -n "$(ls -A $modules_dir 2>/dev/null)" ]; then + for module in "$modules_dir"/*.so; + do + if [ ! -s "$module" ]; then + echo "Skipping module $module: file has no size." + continue + fi + + if [ -d "$module" ]; then + echo "Skipping module $module: is a directory." + continue + fi + + if [ ! -r "$module" ]; then + echo "Skipping module $module: file is not readable." + continue + fi + + if [ ! -x "$module" ]; then + echo "Warning: Module $module is not executable." + continue + fi + + set -- "$@" --loadmodule "$module" + done + fi +fi + +exec "$@" diff --git a/sources/redis821/Dockerfile b/sources/redis821/Dockerfile new file mode 100644 index 0000000..e346340 --- /dev/null +++ b/sources/redis821/Dockerfile @@ -0,0 +1,154 @@ +FROM alpine:3.22 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ +# we need setpriv package as busybox provides very limited functionality + setpriv \ + ; +ENV REDIS_DOWNLOAD_URL=http://download.redis.io/releases/redis-8.2.1.tar.gz +ENV REDIS_DOWNLOAD_SHA=e2c1cb9dd4180a35b943b85dfc7dcdd42566cdbceca37d0d0b14c21731582d3e +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ + g++; \ + \ + arch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \ + case "$arch" in \ + 'amd64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + 'arm64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + *) echo >&2 "Modules are NOT supported! unsupported architecture: '$arch'"; export BUILD_WITH_MODULES=no ;; \ + esac; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk add --no-cache --virtual .module-build-deps \ + autoconf \ + automake \ + bash \ + bsd-compat-headers \ + build-base \ + cargo \ + clang \ + clang-static \ + clang-libclang \ + cmake \ + curl \ + g++ \ + git \ + libffi-dev \ + libgcc \ + libtool \ + llvm-dev \ + ncurses-dev \ + openssh \ + openssl \ + py-virtualenv \ + py3-cryptography \ + py3-pip \ + py3-virtualenv \ + python3 \ + python3-dev \ + rsync \ + tar \ + unzip \ + which \ + xsimd \ + xz; \ + fi; \ + \ +# install required python packages for RedisJSON module + pip install -q --upgrade setuptools && pip install -q --upgrade pip && PIP_BREAK_SYSTEM_PACKAGES=1 pip install -q addict toml jinja2 ramp-packer ;\ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ +# Disable static linking the C runtime for RediSearch's rust submodule + export RUST_DYN_CRT=1; \ + export BUILD_TLS=yes; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + make -C /usr/src/redis/modules/redisjson get_source; \ + sed -i 's/^RUST_FLAGS=$/RUST_FLAGS += -C target-feature=-crt-static/' /usr/src/redis/modules/redisjson/src/Makefile ; \ + grep -E 'RUST_FLAGS' /usr/src/redis/modules/redisjson/src/Makefile; \ + fi; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + make -C /usr/src/redis distclean; \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk del --no-network .module-build-deps; \ + fi; \ + apk del --no-network .build-deps; \ + rm -rf ~/.cache ~/.gitconfig; \ + \ + redis-cli --version; \ + redis-server --version; +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] diff --git a/sources/redis821/docker-entrypoint.sh b/sources/redis821/docker-entrypoint.sh new file mode 100755 index 0000000..ddbd124 --- /dev/null +++ b/sources/redis821/docker-entrypoint.sh @@ -0,0 +1,184 @@ +#!/bin/sh +set -e + +SETPRIV="/bin/setpriv --reuid redis --regid redis --clear-groups" +IS_REDIS_SENTINEL="" +IS_REDIS_SERVER="" +CONFIG="" + +SKIP_FIX_PERMS_NOTICE="Use SKIP_FIX_PERMS=1 to skip permission changes." + +# functions +has_cap() { + /bin/setpriv -d | grep -q 'Capability bounding set:.*\b'"$1"'\b' +} + +check_for_sentinel() { + CMD="$1" + shift + if [ "$CMD" = '/usr/local/bin/redis-server' ]; then + for arg in "$@"; do + if [ "$arg" = "--sentinel" ]; then + return 0 + fi + done + fi + + if [ "$CMD" = '/usr/local/bin/redis-sentinel' ]; then + return 0 + fi + + return 1 +} + +# Note: Change permissions only in simple, default cases to avoid affecting +# unexpected or user-specific files. + +fix_data_dir_perms() { + # Expecting only *.rdb files and default appendonlydir; skip if others are found. + unknown_file="$(find . -mindepth 1 -maxdepth 1 \ + -not \( -name \*.rdb -or \( -type d -and -name appendonlydir \) \) \ + -print -quit)" + if [ -z "$unknown_file" ]; then + find . -print0 | fix_perms_and_owner rw + else + echo "Notice: Unknown file '$unknown_file' found in data dir. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + fi +} + +fix_config_perms() { + config="$1" + mode="$2" + + if [ ! -f "$config" ]; then + return 0 + fi + + confdir="$(dirname "$config")" + if [ ! -d "$confdir" ]; then + return 0 + fi + + # Expecting only the config file; skip if others are found. + pattern=$(printf "%s" "$(basename "$config")" | sed 's/[][?*]/\\&/g') + unknown_file=$(find "$confdir" -mindepth 1 -maxdepth 1 -not -name "$pattern" -print -quit) + + if [ -z "$unknown_file" ]; then + printf '%s\0%s\0' "$confdir" "$config" | fix_perms_and_owner "$mode" + else + echo "Notice: Unknown file '$unknown_file' found in '$confdir'. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + + fi +} + +fix_perms_and_owner() { + mode="$1" + + # shellcheck disable=SC3045 + while IFS= read -r -d '' file; do + if [ "$mode" = "rw" ] && $SETPRIV test -r "$file" -a -w "$file"; then + continue + elif [ "$mode" = "r" ] && $SETPRIV test -r "$file"; then + continue + fi + new_mode=$mode + if [ -d "$file" ]; then + new_mode=${mode}x + fi + err=$(chown redis "$file" 2>&1) || echo "Warning: cannot change owner to 'redis' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + err=$(chmod "u+$new_mode" "$file" 2>&1) || echo "Warning: cannot change mode to 'u+$new_mode' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + done +} + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi +CMD=$(command -v "$1" 2>/dev/null || :) + +if [ "$(readlink -f "$CMD")" = '/usr/local/bin/redis-server' ]; then + IS_REDIS_SERVER=1 +fi + +if check_for_sentinel "$CMD" "$@"; then + IS_REDIS_SENTINEL=1 +fi + +# if is server and its first arg is not an option then it's a config +if [ "$IS_REDIS_SERVER" ] && [ "${2#-}" = "$2" ]; then + CONFIG="$2" +fi + +# drop privileges only if +# we are starting either server or sentinel +# our uid is 0 (container started without explicit --user) +# and we have capabilities required to drop privs +if [ "$IS_REDIS_SERVER" ] && [ -z "$SKIP_DROP_PRIVS" ] && [ "$(id -u)" = '0' ] && has_cap setuid && has_cap setgid; then + if [ -z "$SKIP_FIX_PERMS" ]; then + # fix permissions + if [ "$IS_REDIS_SENTINEL" ]; then + fix_config_perms "$CONFIG" rw + else + fix_data_dir_perms + fix_config_perms "$CONFIG" r + fi + fi + + CAPS_TO_KEEP="" + if has_cap sys_resource; then + # we have sys_resource capability, keep it available for redis + # as redis may use it to increase open files limit + CAPS_TO_KEEP=",+sys_resource" + fi + exec $SETPRIV \ + --nnp \ + --inh-caps=-all$CAPS_TO_KEEP \ + --ambient-caps=-all$CAPS_TO_KEEP \ + --bounding-set=-all$CAPS_TO_KEEP \ + "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +if [ "$IS_REDIS_SERVER" ] && ! [ "$IS_REDIS_SENTINEL" ]; then + echo "Starting Redis Server" + modules_dir="/usr/local/lib/redis/modules/" + + if [ ! -d "$modules_dir" ]; then + echo "Warning: Default Redis modules directory $modules_dir does not exist." + elif [ -n "$(ls -A $modules_dir 2>/dev/null)" ]; then + for module in "$modules_dir"/*.so; + do + if [ ! -s "$module" ]; then + echo "Skipping module $module: file has no size." + continue + fi + + if [ -d "$module" ]; then + echo "Skipping module $module: is a directory." + continue + fi + + if [ ! -r "$module" ]; then + echo "Skipping module $module: file is not readable." + continue + fi + + if [ ! -x "$module" ]; then + echo "Warning: Module $module is not executable." + continue + fi + + set -- "$@" --loadmodule "$module" + done + fi +fi + +exec "$@" diff --git a/sources/redis822/Dockerfile b/sources/redis822/Dockerfile new file mode 100644 index 0000000..4cd5997 --- /dev/null +++ b/sources/redis822/Dockerfile @@ -0,0 +1,154 @@ +FROM alpine:3.22 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ +# we need setpriv package as busybox provides very limited functionality + setpriv \ + ; +ENV REDIS_DOWNLOAD_URL=https://github.com/redis/redis/archive/refs/tags/8.2.2.tar.gz +ENV REDIS_DOWNLOAD_SHA=e355378d7f97efd06321fff881efc452a9673cc27b3a6d0dfd2a45fbcc83349c +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ + g++; \ + \ + arch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \ + case "$arch" in \ + 'amd64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + 'arm64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + *) echo >&2 "Modules are NOT supported! unsupported architecture: '$arch'"; export BUILD_WITH_MODULES=no ;; \ + esac; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk add --no-cache --virtual .module-build-deps \ + autoconf \ + automake \ + bash \ + bsd-compat-headers \ + build-base \ + cargo \ + clang \ + clang-static \ + clang-libclang \ + cmake \ + curl \ + g++ \ + git \ + libffi-dev \ + libgcc \ + libtool \ + llvm-dev \ + ncurses-dev \ + openssh \ + openssl \ + py-virtualenv \ + py3-cryptography \ + py3-pip \ + py3-virtualenv \ + python3 \ + python3-dev \ + rsync \ + tar \ + unzip \ + which \ + xsimd \ + xz; \ + fi; \ + \ +# install required python packages for RedisJSON module + pip install -q --upgrade setuptools && pip install -q --upgrade pip && PIP_BREAK_SYSTEM_PACKAGES=1 pip install -q addict toml jinja2 ramp-packer ;\ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ +# Disable static linking the C runtime for RediSearch's rust submodule + export RUST_DYN_CRT=1; \ + export BUILD_TLS=yes; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + make -C /usr/src/redis/modules/redisjson get_source; \ + sed -i 's/^RUST_FLAGS=$/RUST_FLAGS += -C target-feature=-crt-static/' /usr/src/redis/modules/redisjson/src/Makefile ; \ + grep -E 'RUST_FLAGS' /usr/src/redis/modules/redisjson/src/Makefile; \ + fi; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + make -C /usr/src/redis distclean; \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk del --no-network .module-build-deps; \ + fi; \ + apk del --no-network .build-deps; \ + rm -rf ~/.cache ~/.gitconfig; \ + \ + redis-cli --version; \ + redis-server --version; +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] diff --git a/sources/redis822/docker-entrypoint.sh b/sources/redis822/docker-entrypoint.sh new file mode 100755 index 0000000..ddbd124 --- /dev/null +++ b/sources/redis822/docker-entrypoint.sh @@ -0,0 +1,184 @@ +#!/bin/sh +set -e + +SETPRIV="/bin/setpriv --reuid redis --regid redis --clear-groups" +IS_REDIS_SENTINEL="" +IS_REDIS_SERVER="" +CONFIG="" + +SKIP_FIX_PERMS_NOTICE="Use SKIP_FIX_PERMS=1 to skip permission changes." + +# functions +has_cap() { + /bin/setpriv -d | grep -q 'Capability bounding set:.*\b'"$1"'\b' +} + +check_for_sentinel() { + CMD="$1" + shift + if [ "$CMD" = '/usr/local/bin/redis-server' ]; then + for arg in "$@"; do + if [ "$arg" = "--sentinel" ]; then + return 0 + fi + done + fi + + if [ "$CMD" = '/usr/local/bin/redis-sentinel' ]; then + return 0 + fi + + return 1 +} + +# Note: Change permissions only in simple, default cases to avoid affecting +# unexpected or user-specific files. + +fix_data_dir_perms() { + # Expecting only *.rdb files and default appendonlydir; skip if others are found. + unknown_file="$(find . -mindepth 1 -maxdepth 1 \ + -not \( -name \*.rdb -or \( -type d -and -name appendonlydir \) \) \ + -print -quit)" + if [ -z "$unknown_file" ]; then + find . -print0 | fix_perms_and_owner rw + else + echo "Notice: Unknown file '$unknown_file' found in data dir. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + fi +} + +fix_config_perms() { + config="$1" + mode="$2" + + if [ ! -f "$config" ]; then + return 0 + fi + + confdir="$(dirname "$config")" + if [ ! -d "$confdir" ]; then + return 0 + fi + + # Expecting only the config file; skip if others are found. + pattern=$(printf "%s" "$(basename "$config")" | sed 's/[][?*]/\\&/g') + unknown_file=$(find "$confdir" -mindepth 1 -maxdepth 1 -not -name "$pattern" -print -quit) + + if [ -z "$unknown_file" ]; then + printf '%s\0%s\0' "$confdir" "$config" | fix_perms_and_owner "$mode" + else + echo "Notice: Unknown file '$unknown_file' found in '$confdir'. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + + fi +} + +fix_perms_and_owner() { + mode="$1" + + # shellcheck disable=SC3045 + while IFS= read -r -d '' file; do + if [ "$mode" = "rw" ] && $SETPRIV test -r "$file" -a -w "$file"; then + continue + elif [ "$mode" = "r" ] && $SETPRIV test -r "$file"; then + continue + fi + new_mode=$mode + if [ -d "$file" ]; then + new_mode=${mode}x + fi + err=$(chown redis "$file" 2>&1) || echo "Warning: cannot change owner to 'redis' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + err=$(chmod "u+$new_mode" "$file" 2>&1) || echo "Warning: cannot change mode to 'u+$new_mode' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + done +} + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi +CMD=$(command -v "$1" 2>/dev/null || :) + +if [ "$(readlink -f "$CMD")" = '/usr/local/bin/redis-server' ]; then + IS_REDIS_SERVER=1 +fi + +if check_for_sentinel "$CMD" "$@"; then + IS_REDIS_SENTINEL=1 +fi + +# if is server and its first arg is not an option then it's a config +if [ "$IS_REDIS_SERVER" ] && [ "${2#-}" = "$2" ]; then + CONFIG="$2" +fi + +# drop privileges only if +# we are starting either server or sentinel +# our uid is 0 (container started without explicit --user) +# and we have capabilities required to drop privs +if [ "$IS_REDIS_SERVER" ] && [ -z "$SKIP_DROP_PRIVS" ] && [ "$(id -u)" = '0' ] && has_cap setuid && has_cap setgid; then + if [ -z "$SKIP_FIX_PERMS" ]; then + # fix permissions + if [ "$IS_REDIS_SENTINEL" ]; then + fix_config_perms "$CONFIG" rw + else + fix_data_dir_perms + fix_config_perms "$CONFIG" r + fi + fi + + CAPS_TO_KEEP="" + if has_cap sys_resource; then + # we have sys_resource capability, keep it available for redis + # as redis may use it to increase open files limit + CAPS_TO_KEEP=",+sys_resource" + fi + exec $SETPRIV \ + --nnp \ + --inh-caps=-all$CAPS_TO_KEEP \ + --ambient-caps=-all$CAPS_TO_KEEP \ + --bounding-set=-all$CAPS_TO_KEEP \ + "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +if [ "$IS_REDIS_SERVER" ] && ! [ "$IS_REDIS_SENTINEL" ]; then + echo "Starting Redis Server" + modules_dir="/usr/local/lib/redis/modules/" + + if [ ! -d "$modules_dir" ]; then + echo "Warning: Default Redis modules directory $modules_dir does not exist." + elif [ -n "$(ls -A $modules_dir 2>/dev/null)" ]; then + for module in "$modules_dir"/*.so; + do + if [ ! -s "$module" ]; then + echo "Skipping module $module: file has no size." + continue + fi + + if [ -d "$module" ]; then + echo "Skipping module $module: is a directory." + continue + fi + + if [ ! -r "$module" ]; then + echo "Skipping module $module: file is not readable." + continue + fi + + if [ ! -x "$module" ]; then + echo "Warning: Module $module is not executable." + continue + fi + + set -- "$@" --loadmodule "$module" + done + fi +fi + +exec "$@" diff --git a/sources/redis823/Dockerfile b/sources/redis823/Dockerfile new file mode 100644 index 0000000..b3e97b1 --- /dev/null +++ b/sources/redis823/Dockerfile @@ -0,0 +1,154 @@ +FROM alpine:3.22 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ +# we need setpriv package as busybox provides very limited functionality + setpriv \ + ; +ENV REDIS_DOWNLOAD_URL=https://github.com/redis/redis/archive/refs/tags/8.2.3.tar.gz +ENV REDIS_DOWNLOAD_SHA=42d4d3f037db92eea4437ba03f87627cd636ed15a1f2dde7af9650aa94b035d8 +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ + g++; \ + \ + arch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \ + case "$arch" in \ + 'amd64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + 'arm64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + *) echo >&2 "Modules are NOT supported! unsupported architecture: '$arch'"; export BUILD_WITH_MODULES=no ;; \ + esac; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk add --no-cache --virtual .module-build-deps \ + autoconf \ + automake \ + bash \ + bsd-compat-headers \ + build-base \ + cargo \ + clang \ + clang-static \ + clang-libclang \ + cmake \ + curl \ + g++ \ + git \ + libffi-dev \ + libgcc \ + libtool \ + llvm-dev \ + ncurses-dev \ + openssh \ + openssl \ + py-virtualenv \ + py3-cryptography \ + py3-pip \ + py3-virtualenv \ + python3 \ + python3-dev \ + rsync \ + tar \ + unzip \ + which \ + xsimd \ + xz; \ + fi; \ + \ +# install required python packages for RedisJSON module + pip install -q --upgrade setuptools && pip install -q --upgrade pip && PIP_BREAK_SYSTEM_PACKAGES=1 pip install -q addict toml jinja2 ramp-packer ;\ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ +# Disable static linking the C runtime for RediSearch's rust submodule + export RUST_DYN_CRT=1; \ + export BUILD_TLS=yes; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + make -C /usr/src/redis/modules/redisjson get_source; \ + sed -i 's/^RUST_FLAGS=$/RUST_FLAGS += -C target-feature=-crt-static/' /usr/src/redis/modules/redisjson/src/Makefile ; \ + grep -E 'RUST_FLAGS' /usr/src/redis/modules/redisjson/src/Makefile; \ + fi; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + make -C /usr/src/redis distclean; \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk del --no-network .module-build-deps; \ + fi; \ + apk del --no-network .build-deps; \ + rm -rf ~/.cache ~/.gitconfig; \ + \ + redis-cli --version; \ + redis-server --version; +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] diff --git a/sources/redis823/docker-entrypoint.sh b/sources/redis823/docker-entrypoint.sh new file mode 100755 index 0000000..ddbd124 --- /dev/null +++ b/sources/redis823/docker-entrypoint.sh @@ -0,0 +1,184 @@ +#!/bin/sh +set -e + +SETPRIV="/bin/setpriv --reuid redis --regid redis --clear-groups" +IS_REDIS_SENTINEL="" +IS_REDIS_SERVER="" +CONFIG="" + +SKIP_FIX_PERMS_NOTICE="Use SKIP_FIX_PERMS=1 to skip permission changes." + +# functions +has_cap() { + /bin/setpriv -d | grep -q 'Capability bounding set:.*\b'"$1"'\b' +} + +check_for_sentinel() { + CMD="$1" + shift + if [ "$CMD" = '/usr/local/bin/redis-server' ]; then + for arg in "$@"; do + if [ "$arg" = "--sentinel" ]; then + return 0 + fi + done + fi + + if [ "$CMD" = '/usr/local/bin/redis-sentinel' ]; then + return 0 + fi + + return 1 +} + +# Note: Change permissions only in simple, default cases to avoid affecting +# unexpected or user-specific files. + +fix_data_dir_perms() { + # Expecting only *.rdb files and default appendonlydir; skip if others are found. + unknown_file="$(find . -mindepth 1 -maxdepth 1 \ + -not \( -name \*.rdb -or \( -type d -and -name appendonlydir \) \) \ + -print -quit)" + if [ -z "$unknown_file" ]; then + find . -print0 | fix_perms_and_owner rw + else + echo "Notice: Unknown file '$unknown_file' found in data dir. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + fi +} + +fix_config_perms() { + config="$1" + mode="$2" + + if [ ! -f "$config" ]; then + return 0 + fi + + confdir="$(dirname "$config")" + if [ ! -d "$confdir" ]; then + return 0 + fi + + # Expecting only the config file; skip if others are found. + pattern=$(printf "%s" "$(basename "$config")" | sed 's/[][?*]/\\&/g') + unknown_file=$(find "$confdir" -mindepth 1 -maxdepth 1 -not -name "$pattern" -print -quit) + + if [ -z "$unknown_file" ]; then + printf '%s\0%s\0' "$confdir" "$config" | fix_perms_and_owner "$mode" + else + echo "Notice: Unknown file '$unknown_file' found in '$confdir'. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + + fi +} + +fix_perms_and_owner() { + mode="$1" + + # shellcheck disable=SC3045 + while IFS= read -r -d '' file; do + if [ "$mode" = "rw" ] && $SETPRIV test -r "$file" -a -w "$file"; then + continue + elif [ "$mode" = "r" ] && $SETPRIV test -r "$file"; then + continue + fi + new_mode=$mode + if [ -d "$file" ]; then + new_mode=${mode}x + fi + err=$(chown redis "$file" 2>&1) || echo "Warning: cannot change owner to 'redis' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + err=$(chmod "u+$new_mode" "$file" 2>&1) || echo "Warning: cannot change mode to 'u+$new_mode' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + done +} + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi +CMD=$(command -v "$1" 2>/dev/null || :) + +if [ "$(readlink -f "$CMD")" = '/usr/local/bin/redis-server' ]; then + IS_REDIS_SERVER=1 +fi + +if check_for_sentinel "$CMD" "$@"; then + IS_REDIS_SENTINEL=1 +fi + +# if is server and its first arg is not an option then it's a config +if [ "$IS_REDIS_SERVER" ] && [ "${2#-}" = "$2" ]; then + CONFIG="$2" +fi + +# drop privileges only if +# we are starting either server or sentinel +# our uid is 0 (container started without explicit --user) +# and we have capabilities required to drop privs +if [ "$IS_REDIS_SERVER" ] && [ -z "$SKIP_DROP_PRIVS" ] && [ "$(id -u)" = '0' ] && has_cap setuid && has_cap setgid; then + if [ -z "$SKIP_FIX_PERMS" ]; then + # fix permissions + if [ "$IS_REDIS_SENTINEL" ]; then + fix_config_perms "$CONFIG" rw + else + fix_data_dir_perms + fix_config_perms "$CONFIG" r + fi + fi + + CAPS_TO_KEEP="" + if has_cap sys_resource; then + # we have sys_resource capability, keep it available for redis + # as redis may use it to increase open files limit + CAPS_TO_KEEP=",+sys_resource" + fi + exec $SETPRIV \ + --nnp \ + --inh-caps=-all$CAPS_TO_KEEP \ + --ambient-caps=-all$CAPS_TO_KEEP \ + --bounding-set=-all$CAPS_TO_KEEP \ + "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +if [ "$IS_REDIS_SERVER" ] && ! [ "$IS_REDIS_SENTINEL" ]; then + echo "Starting Redis Server" + modules_dir="/usr/local/lib/redis/modules/" + + if [ ! -d "$modules_dir" ]; then + echo "Warning: Default Redis modules directory $modules_dir does not exist." + elif [ -n "$(ls -A $modules_dir 2>/dev/null)" ]; then + for module in "$modules_dir"/*.so; + do + if [ ! -s "$module" ]; then + echo "Skipping module $module: file has no size." + continue + fi + + if [ -d "$module" ]; then + echo "Skipping module $module: is a directory." + continue + fi + + if [ ! -r "$module" ]; then + echo "Skipping module $module: file is not readable." + continue + fi + + if [ ! -x "$module" ]; then + echo "Warning: Module $module is not executable." + continue + fi + + set -- "$@" --loadmodule "$module" + done + fi +fi + +exec "$@" diff --git a/sources/redis824/Dockerfile b/sources/redis824/Dockerfile new file mode 100644 index 0000000..ad7a2e7 --- /dev/null +++ b/sources/redis824/Dockerfile @@ -0,0 +1,154 @@ +FROM alpine:3.22 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ +# we need setpriv package as busybox provides very limited functionality + setpriv \ + ; +ARG REDIS_DOWNLOAD_URL=https://github.com/redis/redis/archive/refs/tags/8.2.4.tar.gz +ARG REDIS_DOWNLOAD_SHA=b9d7252b26af9738aa686681151b0e798ef8b4afc092a838b3de0a12a36b1542 +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ + g++; \ + \ + arch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \ + case "$arch" in \ + 'amd64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + 'arm64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + *) echo >&2 "Modules are NOT supported! unsupported architecture: '$arch'"; export BUILD_WITH_MODULES=no ;; \ + esac; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk add --no-cache --virtual .module-build-deps \ + autoconf \ + automake \ + bash \ + bsd-compat-headers \ + build-base \ + cargo \ + clang \ + clang-static \ + clang-libclang \ + cmake \ + curl \ + g++ \ + git \ + libffi-dev \ + libgcc \ + libtool \ + llvm-dev \ + ncurses-dev \ + openssh \ + openssl \ + py-virtualenv \ + py3-cryptography \ + py3-pip \ + py3-virtualenv \ + python3 \ + python3-dev \ + rsync \ + tar \ + unzip \ + which \ + xsimd \ + xz; \ + fi; \ + \ +# install required python packages for RedisJSON module + pip install -q --upgrade setuptools && pip install -q --upgrade pip && PIP_BREAK_SYSTEM_PACKAGES=1 pip install -q addict toml jinja2 ramp-packer ;\ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ +# Disable static linking the C runtime for RediSearch's rust submodule + export RUST_DYN_CRT=1; \ + export BUILD_TLS=yes; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + make -C /usr/src/redis/modules/redisjson get_source; \ + sed -i 's/^RUST_FLAGS=$/RUST_FLAGS += -C target-feature=-crt-static/' /usr/src/redis/modules/redisjson/src/Makefile ; \ + grep -E 'RUST_FLAGS' /usr/src/redis/modules/redisjson/src/Makefile; \ + fi; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + make -C /usr/src/redis distclean; \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk del --no-network .module-build-deps; \ + fi; \ + apk del --no-network .build-deps; \ + rm -rf ~/.cache ~/.gitconfig; \ + \ + redis-cli --version; \ + redis-server --version; +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] \ No newline at end of file diff --git a/sources/redis824/docker-entrypoint.sh b/sources/redis824/docker-entrypoint.sh new file mode 100755 index 0000000..ddbd124 --- /dev/null +++ b/sources/redis824/docker-entrypoint.sh @@ -0,0 +1,184 @@ +#!/bin/sh +set -e + +SETPRIV="/bin/setpriv --reuid redis --regid redis --clear-groups" +IS_REDIS_SENTINEL="" +IS_REDIS_SERVER="" +CONFIG="" + +SKIP_FIX_PERMS_NOTICE="Use SKIP_FIX_PERMS=1 to skip permission changes." + +# functions +has_cap() { + /bin/setpriv -d | grep -q 'Capability bounding set:.*\b'"$1"'\b' +} + +check_for_sentinel() { + CMD="$1" + shift + if [ "$CMD" = '/usr/local/bin/redis-server' ]; then + for arg in "$@"; do + if [ "$arg" = "--sentinel" ]; then + return 0 + fi + done + fi + + if [ "$CMD" = '/usr/local/bin/redis-sentinel' ]; then + return 0 + fi + + return 1 +} + +# Note: Change permissions only in simple, default cases to avoid affecting +# unexpected or user-specific files. + +fix_data_dir_perms() { + # Expecting only *.rdb files and default appendonlydir; skip if others are found. + unknown_file="$(find . -mindepth 1 -maxdepth 1 \ + -not \( -name \*.rdb -or \( -type d -and -name appendonlydir \) \) \ + -print -quit)" + if [ -z "$unknown_file" ]; then + find . -print0 | fix_perms_and_owner rw + else + echo "Notice: Unknown file '$unknown_file' found in data dir. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + fi +} + +fix_config_perms() { + config="$1" + mode="$2" + + if [ ! -f "$config" ]; then + return 0 + fi + + confdir="$(dirname "$config")" + if [ ! -d "$confdir" ]; then + return 0 + fi + + # Expecting only the config file; skip if others are found. + pattern=$(printf "%s" "$(basename "$config")" | sed 's/[][?*]/\\&/g') + unknown_file=$(find "$confdir" -mindepth 1 -maxdepth 1 -not -name "$pattern" -print -quit) + + if [ -z "$unknown_file" ]; then + printf '%s\0%s\0' "$confdir" "$config" | fix_perms_and_owner "$mode" + else + echo "Notice: Unknown file '$unknown_file' found in '$confdir'. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + + fi +} + +fix_perms_and_owner() { + mode="$1" + + # shellcheck disable=SC3045 + while IFS= read -r -d '' file; do + if [ "$mode" = "rw" ] && $SETPRIV test -r "$file" -a -w "$file"; then + continue + elif [ "$mode" = "r" ] && $SETPRIV test -r "$file"; then + continue + fi + new_mode=$mode + if [ -d "$file" ]; then + new_mode=${mode}x + fi + err=$(chown redis "$file" 2>&1) || echo "Warning: cannot change owner to 'redis' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + err=$(chmod "u+$new_mode" "$file" 2>&1) || echo "Warning: cannot change mode to 'u+$new_mode' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + done +} + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi +CMD=$(command -v "$1" 2>/dev/null || :) + +if [ "$(readlink -f "$CMD")" = '/usr/local/bin/redis-server' ]; then + IS_REDIS_SERVER=1 +fi + +if check_for_sentinel "$CMD" "$@"; then + IS_REDIS_SENTINEL=1 +fi + +# if is server and its first arg is not an option then it's a config +if [ "$IS_REDIS_SERVER" ] && [ "${2#-}" = "$2" ]; then + CONFIG="$2" +fi + +# drop privileges only if +# we are starting either server or sentinel +# our uid is 0 (container started without explicit --user) +# and we have capabilities required to drop privs +if [ "$IS_REDIS_SERVER" ] && [ -z "$SKIP_DROP_PRIVS" ] && [ "$(id -u)" = '0' ] && has_cap setuid && has_cap setgid; then + if [ -z "$SKIP_FIX_PERMS" ]; then + # fix permissions + if [ "$IS_REDIS_SENTINEL" ]; then + fix_config_perms "$CONFIG" rw + else + fix_data_dir_perms + fix_config_perms "$CONFIG" r + fi + fi + + CAPS_TO_KEEP="" + if has_cap sys_resource; then + # we have sys_resource capability, keep it available for redis + # as redis may use it to increase open files limit + CAPS_TO_KEEP=",+sys_resource" + fi + exec $SETPRIV \ + --nnp \ + --inh-caps=-all$CAPS_TO_KEEP \ + --ambient-caps=-all$CAPS_TO_KEEP \ + --bounding-set=-all$CAPS_TO_KEEP \ + "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +if [ "$IS_REDIS_SERVER" ] && ! [ "$IS_REDIS_SENTINEL" ]; then + echo "Starting Redis Server" + modules_dir="/usr/local/lib/redis/modules/" + + if [ ! -d "$modules_dir" ]; then + echo "Warning: Default Redis modules directory $modules_dir does not exist." + elif [ -n "$(ls -A $modules_dir 2>/dev/null)" ]; then + for module in "$modules_dir"/*.so; + do + if [ ! -s "$module" ]; then + echo "Skipping module $module: file has no size." + continue + fi + + if [ -d "$module" ]; then + echo "Skipping module $module: is a directory." + continue + fi + + if [ ! -r "$module" ]; then + echo "Skipping module $module: file is not readable." + continue + fi + + if [ ! -x "$module" ]; then + echo "Warning: Module $module is not executable." + continue + fi + + set -- "$@" --loadmodule "$module" + done + fi +fi + +exec "$@" diff --git a/sources/redis840/Dockerfile b/sources/redis840/Dockerfile new file mode 100644 index 0000000..5b36cd1 --- /dev/null +++ b/sources/redis840/Dockerfile @@ -0,0 +1,154 @@ +FROM alpine:3.22 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ +# we need setpriv package as busybox provides very limited functionality + setpriv \ + ; +ENV REDIS_DOWNLOAD_URL=https://github.com/redis/redis/archive/refs/tags/8.4.0.tar.gz +ENV REDIS_DOWNLOAD_SHA=b947d9015622669b5bee8ec954f658b3278d42dbefae23a92d9b7704bfe143f9 +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ + g++; \ + \ + arch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \ + case "$arch" in \ + 'amd64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + 'arm64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + *) echo >&2 "Modules are NOT supported! unsupported architecture: '$arch'"; export BUILD_WITH_MODULES=no ;; \ + esac; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk add --no-cache --virtual .module-build-deps \ + autoconf \ + automake \ + bash \ + bsd-compat-headers \ + build-base \ + cargo \ + clang \ + clang-static \ + clang-libclang \ + cmake \ + curl \ + g++ \ + git \ + libffi-dev \ + libgcc \ + libtool \ + llvm-dev \ + ncurses-dev \ + openssh \ + openssl \ + py-virtualenv \ + py3-cryptography \ + py3-pip \ + py3-virtualenv \ + python3 \ + python3-dev \ + rsync \ + tar \ + unzip \ + which \ + xsimd \ + xz; \ + fi; \ + \ +# install required python packages for RedisJSON module + pip install -q --upgrade setuptools && pip install -q --upgrade pip && PIP_BREAK_SYSTEM_PACKAGES=1 pip install -q addict toml jinja2 ramp-packer ;\ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ +# Disable static linking the C runtime for RediSearch's rust submodule + export RUST_DYN_CRT=1; \ + export BUILD_TLS=yes; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + make -C /usr/src/redis/modules/redisjson get_source; \ + sed -i 's/^RUST_FLAGS=$/RUST_FLAGS += -C target-feature=-crt-static/' /usr/src/redis/modules/redisjson/src/Makefile ; \ + grep -E 'RUST_FLAGS' /usr/src/redis/modules/redisjson/src/Makefile; \ + fi; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + make -C /usr/src/redis distclean; \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk del --no-network .module-build-deps; \ + fi; \ + apk del --no-network .build-deps; \ + rm -rf ~/.cache ~/.gitconfig; \ + \ + redis-cli --version; \ + redis-server --version; +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] diff --git a/sources/redis840/docker-entrypoint.sh b/sources/redis840/docker-entrypoint.sh new file mode 100755 index 0000000..ddbd124 --- /dev/null +++ b/sources/redis840/docker-entrypoint.sh @@ -0,0 +1,184 @@ +#!/bin/sh +set -e + +SETPRIV="/bin/setpriv --reuid redis --regid redis --clear-groups" +IS_REDIS_SENTINEL="" +IS_REDIS_SERVER="" +CONFIG="" + +SKIP_FIX_PERMS_NOTICE="Use SKIP_FIX_PERMS=1 to skip permission changes." + +# functions +has_cap() { + /bin/setpriv -d | grep -q 'Capability bounding set:.*\b'"$1"'\b' +} + +check_for_sentinel() { + CMD="$1" + shift + if [ "$CMD" = '/usr/local/bin/redis-server' ]; then + for arg in "$@"; do + if [ "$arg" = "--sentinel" ]; then + return 0 + fi + done + fi + + if [ "$CMD" = '/usr/local/bin/redis-sentinel' ]; then + return 0 + fi + + return 1 +} + +# Note: Change permissions only in simple, default cases to avoid affecting +# unexpected or user-specific files. + +fix_data_dir_perms() { + # Expecting only *.rdb files and default appendonlydir; skip if others are found. + unknown_file="$(find . -mindepth 1 -maxdepth 1 \ + -not \( -name \*.rdb -or \( -type d -and -name appendonlydir \) \) \ + -print -quit)" + if [ -z "$unknown_file" ]; then + find . -print0 | fix_perms_and_owner rw + else + echo "Notice: Unknown file '$unknown_file' found in data dir. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + fi +} + +fix_config_perms() { + config="$1" + mode="$2" + + if [ ! -f "$config" ]; then + return 0 + fi + + confdir="$(dirname "$config")" + if [ ! -d "$confdir" ]; then + return 0 + fi + + # Expecting only the config file; skip if others are found. + pattern=$(printf "%s" "$(basename "$config")" | sed 's/[][?*]/\\&/g') + unknown_file=$(find "$confdir" -mindepth 1 -maxdepth 1 -not -name "$pattern" -print -quit) + + if [ -z "$unknown_file" ]; then + printf '%s\0%s\0' "$confdir" "$config" | fix_perms_and_owner "$mode" + else + echo "Notice: Unknown file '$unknown_file' found in '$confdir'. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + + fi +} + +fix_perms_and_owner() { + mode="$1" + + # shellcheck disable=SC3045 + while IFS= read -r -d '' file; do + if [ "$mode" = "rw" ] && $SETPRIV test -r "$file" -a -w "$file"; then + continue + elif [ "$mode" = "r" ] && $SETPRIV test -r "$file"; then + continue + fi + new_mode=$mode + if [ -d "$file" ]; then + new_mode=${mode}x + fi + err=$(chown redis "$file" 2>&1) || echo "Warning: cannot change owner to 'redis' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + err=$(chmod "u+$new_mode" "$file" 2>&1) || echo "Warning: cannot change mode to 'u+$new_mode' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + done +} + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi +CMD=$(command -v "$1" 2>/dev/null || :) + +if [ "$(readlink -f "$CMD")" = '/usr/local/bin/redis-server' ]; then + IS_REDIS_SERVER=1 +fi + +if check_for_sentinel "$CMD" "$@"; then + IS_REDIS_SENTINEL=1 +fi + +# if is server and its first arg is not an option then it's a config +if [ "$IS_REDIS_SERVER" ] && [ "${2#-}" = "$2" ]; then + CONFIG="$2" +fi + +# drop privileges only if +# we are starting either server or sentinel +# our uid is 0 (container started without explicit --user) +# and we have capabilities required to drop privs +if [ "$IS_REDIS_SERVER" ] && [ -z "$SKIP_DROP_PRIVS" ] && [ "$(id -u)" = '0' ] && has_cap setuid && has_cap setgid; then + if [ -z "$SKIP_FIX_PERMS" ]; then + # fix permissions + if [ "$IS_REDIS_SENTINEL" ]; then + fix_config_perms "$CONFIG" rw + else + fix_data_dir_perms + fix_config_perms "$CONFIG" r + fi + fi + + CAPS_TO_KEEP="" + if has_cap sys_resource; then + # we have sys_resource capability, keep it available for redis + # as redis may use it to increase open files limit + CAPS_TO_KEEP=",+sys_resource" + fi + exec $SETPRIV \ + --nnp \ + --inh-caps=-all$CAPS_TO_KEEP \ + --ambient-caps=-all$CAPS_TO_KEEP \ + --bounding-set=-all$CAPS_TO_KEEP \ + "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +if [ "$IS_REDIS_SERVER" ] && ! [ "$IS_REDIS_SENTINEL" ]; then + echo "Starting Redis Server" + modules_dir="/usr/local/lib/redis/modules/" + + if [ ! -d "$modules_dir" ]; then + echo "Warning: Default Redis modules directory $modules_dir does not exist." + elif [ -n "$(ls -A $modules_dir 2>/dev/null)" ]; then + for module in "$modules_dir"/*.so; + do + if [ ! -s "$module" ]; then + echo "Skipping module $module: file has no size." + continue + fi + + if [ -d "$module" ]; then + echo "Skipping module $module: is a directory." + continue + fi + + if [ ! -r "$module" ]; then + echo "Skipping module $module: file is not readable." + continue + fi + + if [ ! -x "$module" ]; then + echo "Warning: Module $module is not executable." + continue + fi + + set -- "$@" --loadmodule "$module" + done + fi +fi + +exec "$@" diff --git a/sources/redis841/Dockerfile b/sources/redis841/Dockerfile new file mode 100644 index 0000000..f0c0910 --- /dev/null +++ b/sources/redis841/Dockerfile @@ -0,0 +1,154 @@ +FROM alpine:3.22 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ +# we need setpriv package as busybox provides very limited functionality + setpriv \ + ; +ARG REDIS_DOWNLOAD_URL=https://github.com/redis/redis/archive/refs/tags/8.4.1.tar.gz +ARG REDIS_DOWNLOAD_SHA=b5edf7a234bbd11c8effb75bf0e50f1470c7f4b29898d596e2a7e88621af4912 +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ + g++; \ + \ + arch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \ + case "$arch" in \ + 'amd64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + 'arm64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + *) echo >&2 "Modules are NOT supported! unsupported architecture: '$arch'"; export BUILD_WITH_MODULES=no ;; \ + esac; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk add --no-cache --virtual .module-build-deps \ + autoconf \ + automake \ + bash \ + bsd-compat-headers \ + build-base \ + cargo \ + clang \ + clang-static \ + clang-libclang \ + cmake \ + curl \ + g++ \ + git \ + libffi-dev \ + libgcc \ + libtool \ + llvm-dev \ + ncurses-dev \ + openssh \ + openssl \ + py-virtualenv \ + py3-cryptography \ + py3-pip \ + py3-virtualenv \ + python3 \ + python3-dev \ + rsync \ + tar \ + unzip \ + which \ + xsimd \ + xz; \ + fi; \ + \ +# install required python packages for RedisJSON module + pip install -q --upgrade setuptools && pip install -q --upgrade pip && PIP_BREAK_SYSTEM_PACKAGES=1 pip install -q addict toml jinja2 ramp-packer ;\ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ +# Disable static linking the C runtime for RediSearch's rust submodule + export RUST_DYN_CRT=1; \ + export BUILD_TLS=yes; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + make -C /usr/src/redis/modules/redisjson get_source; \ + sed -i 's/^RUST_FLAGS=$/RUST_FLAGS += -C target-feature=-crt-static/' /usr/src/redis/modules/redisjson/src/Makefile ; \ + grep -E 'RUST_FLAGS' /usr/src/redis/modules/redisjson/src/Makefile; \ + fi; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + make -C /usr/src/redis distclean; \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk del --no-network .module-build-deps; \ + fi; \ + apk del --no-network .build-deps; \ + rm -rf ~/.cache ~/.gitconfig; \ + \ + redis-cli --version; \ + redis-server --version; +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] \ No newline at end of file diff --git a/sources/redis841/docker-entrypoint.sh b/sources/redis841/docker-entrypoint.sh new file mode 100755 index 0000000..ddbd124 --- /dev/null +++ b/sources/redis841/docker-entrypoint.sh @@ -0,0 +1,184 @@ +#!/bin/sh +set -e + +SETPRIV="/bin/setpriv --reuid redis --regid redis --clear-groups" +IS_REDIS_SENTINEL="" +IS_REDIS_SERVER="" +CONFIG="" + +SKIP_FIX_PERMS_NOTICE="Use SKIP_FIX_PERMS=1 to skip permission changes." + +# functions +has_cap() { + /bin/setpriv -d | grep -q 'Capability bounding set:.*\b'"$1"'\b' +} + +check_for_sentinel() { + CMD="$1" + shift + if [ "$CMD" = '/usr/local/bin/redis-server' ]; then + for arg in "$@"; do + if [ "$arg" = "--sentinel" ]; then + return 0 + fi + done + fi + + if [ "$CMD" = '/usr/local/bin/redis-sentinel' ]; then + return 0 + fi + + return 1 +} + +# Note: Change permissions only in simple, default cases to avoid affecting +# unexpected or user-specific files. + +fix_data_dir_perms() { + # Expecting only *.rdb files and default appendonlydir; skip if others are found. + unknown_file="$(find . -mindepth 1 -maxdepth 1 \ + -not \( -name \*.rdb -or \( -type d -and -name appendonlydir \) \) \ + -print -quit)" + if [ -z "$unknown_file" ]; then + find . -print0 | fix_perms_and_owner rw + else + echo "Notice: Unknown file '$unknown_file' found in data dir. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + fi +} + +fix_config_perms() { + config="$1" + mode="$2" + + if [ ! -f "$config" ]; then + return 0 + fi + + confdir="$(dirname "$config")" + if [ ! -d "$confdir" ]; then + return 0 + fi + + # Expecting only the config file; skip if others are found. + pattern=$(printf "%s" "$(basename "$config")" | sed 's/[][?*]/\\&/g') + unknown_file=$(find "$confdir" -mindepth 1 -maxdepth 1 -not -name "$pattern" -print -quit) + + if [ -z "$unknown_file" ]; then + printf '%s\0%s\0' "$confdir" "$config" | fix_perms_and_owner "$mode" + else + echo "Notice: Unknown file '$unknown_file' found in '$confdir'. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + + fi +} + +fix_perms_and_owner() { + mode="$1" + + # shellcheck disable=SC3045 + while IFS= read -r -d '' file; do + if [ "$mode" = "rw" ] && $SETPRIV test -r "$file" -a -w "$file"; then + continue + elif [ "$mode" = "r" ] && $SETPRIV test -r "$file"; then + continue + fi + new_mode=$mode + if [ -d "$file" ]; then + new_mode=${mode}x + fi + err=$(chown redis "$file" 2>&1) || echo "Warning: cannot change owner to 'redis' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + err=$(chmod "u+$new_mode" "$file" 2>&1) || echo "Warning: cannot change mode to 'u+$new_mode' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + done +} + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi +CMD=$(command -v "$1" 2>/dev/null || :) + +if [ "$(readlink -f "$CMD")" = '/usr/local/bin/redis-server' ]; then + IS_REDIS_SERVER=1 +fi + +if check_for_sentinel "$CMD" "$@"; then + IS_REDIS_SENTINEL=1 +fi + +# if is server and its first arg is not an option then it's a config +if [ "$IS_REDIS_SERVER" ] && [ "${2#-}" = "$2" ]; then + CONFIG="$2" +fi + +# drop privileges only if +# we are starting either server or sentinel +# our uid is 0 (container started without explicit --user) +# and we have capabilities required to drop privs +if [ "$IS_REDIS_SERVER" ] && [ -z "$SKIP_DROP_PRIVS" ] && [ "$(id -u)" = '0' ] && has_cap setuid && has_cap setgid; then + if [ -z "$SKIP_FIX_PERMS" ]; then + # fix permissions + if [ "$IS_REDIS_SENTINEL" ]; then + fix_config_perms "$CONFIG" rw + else + fix_data_dir_perms + fix_config_perms "$CONFIG" r + fi + fi + + CAPS_TO_KEEP="" + if has_cap sys_resource; then + # we have sys_resource capability, keep it available for redis + # as redis may use it to increase open files limit + CAPS_TO_KEEP=",+sys_resource" + fi + exec $SETPRIV \ + --nnp \ + --inh-caps=-all$CAPS_TO_KEEP \ + --ambient-caps=-all$CAPS_TO_KEEP \ + --bounding-set=-all$CAPS_TO_KEEP \ + "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +if [ "$IS_REDIS_SERVER" ] && ! [ "$IS_REDIS_SENTINEL" ]; then + echo "Starting Redis Server" + modules_dir="/usr/local/lib/redis/modules/" + + if [ ! -d "$modules_dir" ]; then + echo "Warning: Default Redis modules directory $modules_dir does not exist." + elif [ -n "$(ls -A $modules_dir 2>/dev/null)" ]; then + for module in "$modules_dir"/*.so; + do + if [ ! -s "$module" ]; then + echo "Skipping module $module: file has no size." + continue + fi + + if [ -d "$module" ]; then + echo "Skipping module $module: is a directory." + continue + fi + + if [ ! -r "$module" ]; then + echo "Skipping module $module: file is not readable." + continue + fi + + if [ ! -x "$module" ]; then + echo "Warning: Module $module is not executable." + continue + fi + + set -- "$@" --loadmodule "$module" + done + fi +fi + +exec "$@" diff --git a/sources/redis860/Dockerfile b/sources/redis860/Dockerfile new file mode 100644 index 0000000..3ef93c7 --- /dev/null +++ b/sources/redis860/Dockerfile @@ -0,0 +1,154 @@ +FROM alpine:3.23 + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN set -eux; \ +# alpine already has a gid 999, so we'll use the next id + addgroup -S -g 1000 redis; \ + adduser -S -G redis -u 999 redis + +# runtime dependencies +RUN set -eux; \ + apk add --no-cache \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata \ +# we need setpriv package as busybox provides very limited functionality + setpriv \ + ; +ARG REDIS_DOWNLOAD_URL=https://github.com/redis/redis/archive/refs/tags/8.6.0.tar.gz +ARG REDIS_DOWNLOAD_SHA=74261ece988fd2e1526e5aea9f8b9853217d71e2ef2dafaa624ed9579b5f4317 +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ + g++; \ + \ + arch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \ + case "$arch" in \ + 'amd64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + 'arm64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \ + *) echo >&2 "Modules are NOT supported! unsupported architecture: '$arch'"; export BUILD_WITH_MODULES=no ;; \ + esac; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk add --no-cache --virtual .module-build-deps \ + autoconf \ + automake \ + bash \ + bsd-compat-headers \ + build-base \ + cargo \ + clang21 \ + clang21-static \ + clang21-libclang \ + cmake \ + curl \ + g++ \ + git \ + libffi-dev \ + libgcc \ + libtool \ + llvm21-dev \ + ncurses-dev \ + openssh \ + openssl \ + py-virtualenv \ + py3-cryptography \ + py3-pip \ + py3-virtualenv \ + python3 \ + python3-dev \ + rsync \ + tar \ + unzip \ + which \ + xsimd \ + xz; \ + fi; \ + \ +# install required python packages for RedisJSON module + pip install -q --upgrade setuptools && pip install -q --upgrade pip && PIP_BREAK_SYSTEM_PACKAGES=1 pip install -q addict toml jinja2 ramp-packer ;\ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ +# Disable static linking the C runtime for RediSearch's rust submodule + export RUST_DYN_CRT=1; \ + export PATH="/usr/lib/llvm21/bin:$PATH"; \ + export BUILD_TLS=yes; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + make -C /usr/src/redis/modules/redisjson get_source; \ + sed -i 's/^RUST_FLAGS=$/RUST_FLAGS += -C target-feature=-crt-static/' /usr/src/redis/modules/redisjson/src/Makefile ; \ + grep -E 'RUST_FLAGS' /usr/src/redis/modules/redisjson/src/Makefile; \ + fi; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + make -C /usr/src/redis distclean; \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + if [ "$BUILD_WITH_MODULES" = "yes" ]; then \ + apk del --no-network .module-build-deps; \ + fi; \ + apk del --no-network .build-deps; \ + rm -rf ~/.cache ~/.gitconfig; \ + \ + redis-cli --version; \ + redis-server --version; +RUN mkdir /data && chown redis:redis /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/ +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] \ No newline at end of file diff --git a/sources/redis860/docker-entrypoint.sh b/sources/redis860/docker-entrypoint.sh new file mode 100755 index 0000000..ddbd124 --- /dev/null +++ b/sources/redis860/docker-entrypoint.sh @@ -0,0 +1,184 @@ +#!/bin/sh +set -e + +SETPRIV="/bin/setpriv --reuid redis --regid redis --clear-groups" +IS_REDIS_SENTINEL="" +IS_REDIS_SERVER="" +CONFIG="" + +SKIP_FIX_PERMS_NOTICE="Use SKIP_FIX_PERMS=1 to skip permission changes." + +# functions +has_cap() { + /bin/setpriv -d | grep -q 'Capability bounding set:.*\b'"$1"'\b' +} + +check_for_sentinel() { + CMD="$1" + shift + if [ "$CMD" = '/usr/local/bin/redis-server' ]; then + for arg in "$@"; do + if [ "$arg" = "--sentinel" ]; then + return 0 + fi + done + fi + + if [ "$CMD" = '/usr/local/bin/redis-sentinel' ]; then + return 0 + fi + + return 1 +} + +# Note: Change permissions only in simple, default cases to avoid affecting +# unexpected or user-specific files. + +fix_data_dir_perms() { + # Expecting only *.rdb files and default appendonlydir; skip if others are found. + unknown_file="$(find . -mindepth 1 -maxdepth 1 \ + -not \( -name \*.rdb -or \( -type d -and -name appendonlydir \) \) \ + -print -quit)" + if [ -z "$unknown_file" ]; then + find . -print0 | fix_perms_and_owner rw + else + echo "Notice: Unknown file '$unknown_file' found in data dir. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + fi +} + +fix_config_perms() { + config="$1" + mode="$2" + + if [ ! -f "$config" ]; then + return 0 + fi + + confdir="$(dirname "$config")" + if [ ! -d "$confdir" ]; then + return 0 + fi + + # Expecting only the config file; skip if others are found. + pattern=$(printf "%s" "$(basename "$config")" | sed 's/[][?*]/\\&/g') + unknown_file=$(find "$confdir" -mindepth 1 -maxdepth 1 -not -name "$pattern" -print -quit) + + if [ -z "$unknown_file" ]; then + printf '%s\0%s\0' "$confdir" "$config" | fix_perms_and_owner "$mode" + else + echo "Notice: Unknown file '$unknown_file' found in '$confdir'. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE" + + fi +} + +fix_perms_and_owner() { + mode="$1" + + # shellcheck disable=SC3045 + while IFS= read -r -d '' file; do + if [ "$mode" = "rw" ] && $SETPRIV test -r "$file" -a -w "$file"; then + continue + elif [ "$mode" = "r" ] && $SETPRIV test -r "$file"; then + continue + fi + new_mode=$mode + if [ -d "$file" ]; then + new_mode=${mode}x + fi + err=$(chown redis "$file" 2>&1) || echo "Warning: cannot change owner to 'redis' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + err=$(chmod "u+$new_mode" "$file" 2>&1) || echo "Warning: cannot change mode to 'u+$new_mode' for '$file': $err. $SKIP_FIX_PERMS_NOTICE" + done +} + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi +CMD=$(command -v "$1" 2>/dev/null || :) + +if [ "$(readlink -f "$CMD")" = '/usr/local/bin/redis-server' ]; then + IS_REDIS_SERVER=1 +fi + +if check_for_sentinel "$CMD" "$@"; then + IS_REDIS_SENTINEL=1 +fi + +# if is server and its first arg is not an option then it's a config +if [ "$IS_REDIS_SERVER" ] && [ "${2#-}" = "$2" ]; then + CONFIG="$2" +fi + +# drop privileges only if +# we are starting either server or sentinel +# our uid is 0 (container started without explicit --user) +# and we have capabilities required to drop privs +if [ "$IS_REDIS_SERVER" ] && [ -z "$SKIP_DROP_PRIVS" ] && [ "$(id -u)" = '0' ] && has_cap setuid && has_cap setgid; then + if [ -z "$SKIP_FIX_PERMS" ]; then + # fix permissions + if [ "$IS_REDIS_SENTINEL" ]; then + fix_config_perms "$CONFIG" rw + else + fix_data_dir_perms + fix_config_perms "$CONFIG" r + fi + fi + + CAPS_TO_KEEP="" + if has_cap sys_resource; then + # we have sys_resource capability, keep it available for redis + # as redis may use it to increase open files limit + CAPS_TO_KEEP=",+sys_resource" + fi + exec $SETPRIV \ + --nnp \ + --inh-caps=-all$CAPS_TO_KEEP \ + --ambient-caps=-all$CAPS_TO_KEEP \ + --bounding-set=-all$CAPS_TO_KEEP \ + "$0" "$@" +fi + +# set an appropriate umask (if one isn't set already) +# - https://github.com/docker-library/redis/issues/305 +# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37 +um="$(umask)" +if [ "$um" = '0022' ]; then + umask 0077 +fi + +if [ "$IS_REDIS_SERVER" ] && ! [ "$IS_REDIS_SENTINEL" ]; then + echo "Starting Redis Server" + modules_dir="/usr/local/lib/redis/modules/" + + if [ ! -d "$modules_dir" ]; then + echo "Warning: Default Redis modules directory $modules_dir does not exist." + elif [ -n "$(ls -A $modules_dir 2>/dev/null)" ]; then + for module in "$modules_dir"/*.so; + do + if [ ! -s "$module" ]; then + echo "Skipping module $module: file has no size." + continue + fi + + if [ -d "$module" ]; then + echo "Skipping module $module: is a directory." + continue + fi + + if [ ! -r "$module" ]; then + echo "Skipping module $module: file is not readable." + continue + fi + + if [ ! -x "$module" ]; then + echo "Warning: Module $module is not executable." + continue + fi + + set -- "$@" --loadmodule "$module" + done + fi +fi + +exec "$@"