Switch to Debian bookworm + sury PHP 7.4 for security fixes
The official php:7.4-apache image is frozen at 7.4.33 (Nov 2022) on Debian 11. deb.sury.org still ships patched 7.4 builds, including the fix for CVE-2026-109618/109619. Moodle and PHP version stay the same. Also replace the Moosh zip download (404 on moodle.org) with a build of the same 1.25 release from GitHub. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
root
+50
-52
@@ -1,64 +1,62 @@
|
||||
FROM php:7.4-apache
|
||||
FROM debian:bookworm-slim
|
||||
|
||||
# Install system dependencies
|
||||
RUN apt-get update && apt-get install -y \
|
||||
# PHP 7.4 from deb.sury.org: the official php:7.4-apache image is frozen at 7.4.33
|
||||
# (2022), while sury keeps backporting security fixes (e.g. CVE-2026-109618/109619)
|
||||
ENV DEBIAN_FRONTEND=noninteractive
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
ca-certificates \
|
||||
curl \
|
||||
gnupg \
|
||||
&& curl -fsSL https://packages.sury.org/php/apt.gpg -o /usr/share/keyrings/sury-php.gpg \
|
||||
&& echo "deb [signed-by=/usr/share/keyrings/sury-php.gpg] https://packages.sury.org/php/ bookworm main" \
|
||||
> /etc/apt/sources.list.d/sury-php.list \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Install Apache, PHP 7.4 with the extensions Moodle needs, and tools
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
apache2 \
|
||||
libapache2-mod-php7.4 \
|
||||
php7.4-cli \
|
||||
php7.4-curl \
|
||||
php7.4-gd \
|
||||
php7.4-imagick \
|
||||
php7.4-intl \
|
||||
php7.4-mbstring \
|
||||
php7.4-mysql \
|
||||
php7.4-opcache \
|
||||
php7.4-readline \
|
||||
php7.4-redis \
|
||||
php7.4-soap \
|
||||
php7.4-sqlite3 \
|
||||
php7.4-xml \
|
||||
php7.4-xmlrpc \
|
||||
php7.4-zip \
|
||||
git \
|
||||
unzip \
|
||||
nano \
|
||||
curl \
|
||||
wget \
|
||||
cron \
|
||||
libpng-dev \
|
||||
libjpeg-dev \
|
||||
libfreetype6-dev \
|
||||
libxml2-dev \
|
||||
libzip-dev \
|
||||
libonig-dev \
|
||||
libicu-dev \
|
||||
libxslt-dev \
|
||||
libmcrypt-dev \
|
||||
zlib1g-dev \
|
||||
libssl-dev \
|
||||
libcurl4-openssl-dev \
|
||||
libpq-dev \
|
||||
libmagickwand-dev \
|
||||
--no-install-recommends \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
&& rm -rf /var/lib/apt/lists/* \
|
||||
&& ln -s /usr/bin/php7.4 /usr/local/bin/php
|
||||
|
||||
# Install PHP extensions (fast method)
|
||||
ADD https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions /usr/local/bin/
|
||||
# Apache: same behaviour as the official php:apache image
|
||||
COPY apache-php.conf /etc/apache2/conf-available/docker-php.conf
|
||||
RUN a2enconf docker-php \
|
||||
&& a2enmod rewrite headers \
|
||||
&& ln -sfT /dev/stdout /var/log/apache2/access.log \
|
||||
&& ln -sfT /dev/stderr /var/log/apache2/error.log \
|
||||
&& ln -sfT /dev/stdout /var/log/apache2/other_vhosts_access.log
|
||||
|
||||
RUN chmod +x /usr/local/bin/install-php-extensions
|
||||
|
||||
RUN install-php-extensions \
|
||||
gd \
|
||||
intl \
|
||||
mbstring \
|
||||
xml \
|
||||
xmlrpc \
|
||||
soap \
|
||||
zip \
|
||||
pdo_mysql \
|
||||
mysqli \
|
||||
opcache \
|
||||
xsl \
|
||||
curl \
|
||||
exif \
|
||||
redis \
|
||||
imagick
|
||||
|
||||
# Enable Apache mods
|
||||
RUN a2enmod rewrite headers
|
||||
|
||||
# Install Moosh
|
||||
RUN cd /opt && \
|
||||
wget https://moodle.org/plugins/download.php/33902/moosh_moodle45_2024111400.zip && \
|
||||
unzip moosh_moodle45_2024111400.zip && \
|
||||
ln -s /opt/moosh/moosh.php /usr/local/bin/moosh && \
|
||||
rm moosh_moodle45_2024111400.zip
|
||||
# Install Moosh 1.25 (same release as the old moodle.org zip, which is gone)
|
||||
RUN git clone -q --depth 1 -b 1.25 https://github.com/tmuras/moosh.git /opt/moosh && \
|
||||
curl -fsSL https://getcomposer.org/download/2.2.25/composer.phar -o /tmp/composer.phar && \
|
||||
cd /opt/moosh && php /tmp/composer.phar install -q --no-dev --no-interaction && \
|
||||
rm /tmp/composer.phar && \
|
||||
ln -s /opt/moosh/moosh.php /usr/local/bin/moosh
|
||||
|
||||
# PHP config
|
||||
COPY moodle-php.ini /usr/local/etc/php/conf.d/moodle-php.ini
|
||||
COPY moodle-php.ini /etc/php/7.4/apache2/conf.d/90-moodle.ini
|
||||
COPY moodle-php.ini /etc/php/7.4/cli/conf.d/90-moodle.ini
|
||||
|
||||
# Moodle data dir
|
||||
RUN mkdir -p /var/www/moodledata && \
|
||||
@@ -76,4 +74,4 @@ RUN chmod +x /usr/local/bin/start.sh
|
||||
|
||||
WORKDIR /var/www/html
|
||||
|
||||
ENTRYPOINT ["/usr/local/bin/start.sh"]
|
||||
ENTRYPOINT ["/usr/local/bin/start.sh"]
|
||||
|
||||
@@ -0,0 +1,11 @@
|
||||
<FilesMatch \.php$>
|
||||
SetHandler application/x-httpd-php
|
||||
</FilesMatch>
|
||||
|
||||
DirectoryIndex disabled
|
||||
DirectoryIndex index.php index.html
|
||||
|
||||
<Directory /var/www/>
|
||||
Options -Indexes
|
||||
AllowOverride All
|
||||
</Directory>
|
||||
Reference in New Issue
Block a user