Switch to Debian bookworm + sury PHP 7.4 for security fixes

The official php:7.4-apache image is frozen at 7.4.33 (Nov 2022) on
Debian 11. deb.sury.org still ships patched 7.4 builds, including the
fix for CVE-2026-109618/109619. Moodle and PHP version stay the same.

Also replace the Moosh zip download (404 on moodle.org) with a build of
the same 1.25 release from GitHub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -1,64 +1,62 @@
-FROM php:7.4-apache
+FROM debian:bookworm-slim
 
-# Install system dependencies
-RUN apt-get update && apt-get install -y \
+# PHP 7.4 from deb.sury.org: the official php:7.4-apache image is frozen at 7.4.33
+# (2022), while sury keeps backporting security fixes (e.g. CVE-2026-109618/109619)
+ENV DEBIAN_FRONTEND=noninteractive
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    gnupg \
+ && curl -fsSL https://packages.sury.org/php/apt.gpg -o /usr/share/keyrings/sury-php.gpg \
+ && echo "deb [signed-by=/usr/share/keyrings/sury-php.gpg] https://packages.sury.org/php/ bookworm main" \
+    > /etc/apt/sources.list.d/sury-php.list \
+ && rm -rf /var/lib/apt/lists/*
+
+# Install Apache, PHP 7.4 with the extensions Moodle needs, and tools
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    apache2 \
+    libapache2-mod-php7.4 \
+    php7.4-cli \
+    php7.4-curl \
+    php7.4-gd \
+    php7.4-imagick \
+    php7.4-intl \
+    php7.4-mbstring \
+    php7.4-mysql \
+    php7.4-opcache \
+    php7.4-readline \
+    php7.4-redis \
+    php7.4-soap \
+    php7.4-sqlite3 \
+    php7.4-xml \
+    php7.4-xmlrpc \
+    php7.4-zip \
     git \
     unzip \
     nano \
-    curl \
     wget \
     cron \
-    libpng-dev \
-    libjpeg-dev \
-    libfreetype6-dev \
-    libxml2-dev \
-    libzip-dev \
-    libonig-dev \
-    libicu-dev \
-    libxslt-dev \
-    libmcrypt-dev \
-    zlib1g-dev \
-    libssl-dev \
-    libcurl4-openssl-dev \
-    libpq-dev \
-    libmagickwand-dev \
-    --no-install-recommends \
- && rm -rf /var/lib/apt/lists/*
+ && rm -rf /var/lib/apt/lists/* \
+ && ln -s /usr/bin/php7.4 /usr/local/bin/php
 
-# Install PHP extensions (fast method)
-ADD https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions /usr/local/bin/
+# Apache: same behaviour as the official php:apache image
+COPY apache-php.conf /etc/apache2/conf-available/docker-php.conf
+RUN a2enconf docker-php \
+ && a2enmod rewrite headers \
+ && ln -sfT /dev/stdout /var/log/apache2/access.log \
+ && ln -sfT /dev/stderr /var/log/apache2/error.log \
+ && ln -sfT /dev/stdout /var/log/apache2/other_vhosts_access.log
 
-RUN chmod +x /usr/local/bin/install-php-extensions
-
-RUN install-php-extensions \
-    gd \
-    intl \
-    mbstring \
-    xml \
-    xmlrpc \
-    soap \
-    zip \
-    pdo_mysql \
-    mysqli \
-    opcache \
-    xsl \
-    curl \
-    exif \
-    redis \
-    imagick
-
-# Enable Apache mods
-RUN a2enmod rewrite headers
-
-# Install Moosh
-RUN cd /opt && \
-    wget https://moodle.org/plugins/download.php/33902/moosh_moodle45_2024111400.zip && \
-    unzip moosh_moodle45_2024111400.zip && \
-    ln -s /opt/moosh/moosh.php /usr/local/bin/moosh && \
-    rm moosh_moodle45_2024111400.zip
+# Install Moosh 1.25 (same release as the old moodle.org zip, which is gone)
+RUN git clone -q --depth 1 -b 1.25 https://github.com/tmuras/moosh.git /opt/moosh && \
+    curl -fsSL https://getcomposer.org/download/2.2.25/composer.phar -o /tmp/composer.phar && \
+    cd /opt/moosh && php /tmp/composer.phar install -q --no-dev --no-interaction && \
+    rm /tmp/composer.phar && \
+    ln -s /opt/moosh/moosh.php /usr/local/bin/moosh
 
 # PHP config
-COPY moodle-php.ini /usr/local/etc/php/conf.d/moodle-php.ini
+COPY moodle-php.ini /etc/php/7.4/apache2/conf.d/90-moodle.ini
+COPY moodle-php.ini /etc/php/7.4/cli/conf.d/90-moodle.ini
 
 # Moodle data dir
 RUN mkdir -p /var/www/moodledata && \
@@ -76,4 +74,4 @@ RUN chmod +x /usr/local/bin/start.sh
 
 WORKDIR /var/www/html
 
-ENTRYPOINT ["/usr/local/bin/start.sh"]
+ENTRYPOINT ["/usr/local/bin/start.sh"]