Switch to Debian bookworm + sury PHP 7.4 for security fixes
The official php:7.4-apache image is frozen at 7.4.33 (Nov 2022) on Debian 11. deb.sury.org still ships patched 7.4 builds, including the fix for CVE-2026-109618/109619. Moodle and PHP version stay the same. Also replace the Moosh zip download (404 on moodle.org) with a build of the same 1.25 release from GitHub. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
root
+49
-51
@@ -1,64 +1,62 @@
|
|||||||
FROM php:7.4-apache
|
FROM debian:bookworm-slim
|
||||||
|
|
||||||
# Install system dependencies
|
# PHP 7.4 from deb.sury.org: the official php:7.4-apache image is frozen at 7.4.33
|
||||||
RUN apt-get update && apt-get install -y \
|
# (2022), while sury keeps backporting security fixes (e.g. CVE-2026-109618/109619)
|
||||||
|
ENV DEBIAN_FRONTEND=noninteractive
|
||||||
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
gnupg \
|
||||||
|
&& curl -fsSL https://packages.sury.org/php/apt.gpg -o /usr/share/keyrings/sury-php.gpg \
|
||||||
|
&& echo "deb [signed-by=/usr/share/keyrings/sury-php.gpg] https://packages.sury.org/php/ bookworm main" \
|
||||||
|
> /etc/apt/sources.list.d/sury-php.list \
|
||||||
|
&& rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
|
# Install Apache, PHP 7.4 with the extensions Moodle needs, and tools
|
||||||
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||||
|
apache2 \
|
||||||
|
libapache2-mod-php7.4 \
|
||||||
|
php7.4-cli \
|
||||||
|
php7.4-curl \
|
||||||
|
php7.4-gd \
|
||||||
|
php7.4-imagick \
|
||||||
|
php7.4-intl \
|
||||||
|
php7.4-mbstring \
|
||||||
|
php7.4-mysql \
|
||||||
|
php7.4-opcache \
|
||||||
|
php7.4-readline \
|
||||||
|
php7.4-redis \
|
||||||
|
php7.4-soap \
|
||||||
|
php7.4-sqlite3 \
|
||||||
|
php7.4-xml \
|
||||||
|
php7.4-xmlrpc \
|
||||||
|
php7.4-zip \
|
||||||
git \
|
git \
|
||||||
unzip \
|
unzip \
|
||||||
nano \
|
nano \
|
||||||
curl \
|
|
||||||
wget \
|
wget \
|
||||||
cron \
|
cron \
|
||||||
libpng-dev \
|
&& rm -rf /var/lib/apt/lists/* \
|
||||||
libjpeg-dev \
|
&& ln -s /usr/bin/php7.4 /usr/local/bin/php
|
||||||
libfreetype6-dev \
|
|
||||||
libxml2-dev \
|
|
||||||
libzip-dev \
|
|
||||||
libonig-dev \
|
|
||||||
libicu-dev \
|
|
||||||
libxslt-dev \
|
|
||||||
libmcrypt-dev \
|
|
||||||
zlib1g-dev \
|
|
||||||
libssl-dev \
|
|
||||||
libcurl4-openssl-dev \
|
|
||||||
libpq-dev \
|
|
||||||
libmagickwand-dev \
|
|
||||||
--no-install-recommends \
|
|
||||||
&& rm -rf /var/lib/apt/lists/*
|
|
||||||
|
|
||||||
# Install PHP extensions (fast method)
|
# Apache: same behaviour as the official php:apache image
|
||||||
ADD https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions /usr/local/bin/
|
COPY apache-php.conf /etc/apache2/conf-available/docker-php.conf
|
||||||
|
RUN a2enconf docker-php \
|
||||||
|
&& a2enmod rewrite headers \
|
||||||
|
&& ln -sfT /dev/stdout /var/log/apache2/access.log \
|
||||||
|
&& ln -sfT /dev/stderr /var/log/apache2/error.log \
|
||||||
|
&& ln -sfT /dev/stdout /var/log/apache2/other_vhosts_access.log
|
||||||
|
|
||||||
RUN chmod +x /usr/local/bin/install-php-extensions
|
# Install Moosh 1.25 (same release as the old moodle.org zip, which is gone)
|
||||||
|
RUN git clone -q --depth 1 -b 1.25 https://github.com/tmuras/moosh.git /opt/moosh && \
|
||||||
RUN install-php-extensions \
|
curl -fsSL https://getcomposer.org/download/2.2.25/composer.phar -o /tmp/composer.phar && \
|
||||||
gd \
|
cd /opt/moosh && php /tmp/composer.phar install -q --no-dev --no-interaction && \
|
||||||
intl \
|
rm /tmp/composer.phar && \
|
||||||
mbstring \
|
ln -s /opt/moosh/moosh.php /usr/local/bin/moosh
|
||||||
xml \
|
|
||||||
xmlrpc \
|
|
||||||
soap \
|
|
||||||
zip \
|
|
||||||
pdo_mysql \
|
|
||||||
mysqli \
|
|
||||||
opcache \
|
|
||||||
xsl \
|
|
||||||
curl \
|
|
||||||
exif \
|
|
||||||
redis \
|
|
||||||
imagick
|
|
||||||
|
|
||||||
# Enable Apache mods
|
|
||||||
RUN a2enmod rewrite headers
|
|
||||||
|
|
||||||
# Install Moosh
|
|
||||||
RUN cd /opt && \
|
|
||||||
wget https://moodle.org/plugins/download.php/33902/moosh_moodle45_2024111400.zip && \
|
|
||||||
unzip moosh_moodle45_2024111400.zip && \
|
|
||||||
ln -s /opt/moosh/moosh.php /usr/local/bin/moosh && \
|
|
||||||
rm moosh_moodle45_2024111400.zip
|
|
||||||
|
|
||||||
# PHP config
|
# PHP config
|
||||||
COPY moodle-php.ini /usr/local/etc/php/conf.d/moodle-php.ini
|
COPY moodle-php.ini /etc/php/7.4/apache2/conf.d/90-moodle.ini
|
||||||
|
COPY moodle-php.ini /etc/php/7.4/cli/conf.d/90-moodle.ini
|
||||||
|
|
||||||
# Moodle data dir
|
# Moodle data dir
|
||||||
RUN mkdir -p /var/www/moodledata && \
|
RUN mkdir -p /var/www/moodledata && \
|
||||||
|
|||||||
@@ -0,0 +1,11 @@
|
|||||||
|
<FilesMatch \.php$>
|
||||||
|
SetHandler application/x-httpd-php
|
||||||
|
</FilesMatch>
|
||||||
|
|
||||||
|
DirectoryIndex disabled
|
||||||
|
DirectoryIndex index.php index.html
|
||||||
|
|
||||||
|
<Directory /var/www/>
|
||||||
|
Options -Indexes
|
||||||
|
AllowOverride All
|
||||||
|
</Directory>
|
||||||
Reference in New Issue
Block a user