Who was here for the 2026 Github Actions Watch Party

[Inskioo]

Breaking history here.

[Roszakos]

Does anyone know when will the new images appear on dockerhub?

[julian-d]

Special thanks to @jnoordsij @LaurentGoderre @DanielEScherzer

[AndrewCMD]

Updates going live rn <3

[JoSchrader]

I can not pull it. Is that expected right after release of a container image on docker hub?

docker pull php:8.4.27-fpm =>
"Error response from daemon: no matching manifest for linux/amd64/v3 in the manifest list entries: no match for platform in manifest: not found"

https://hub.docker.com/layers/library/php/8.4.27-fpm/images/sha256-eb37f58646a901dc7727cf448cae36daaefaba79de33b5058dab79aa4c04aefb

[Roszakos]

Same here

[AndrewCMD]

same only 8.6 is build fully :S

[tianon]

Sorry, had a deploy glitch - updated tags are pushing now.

[codedbyjake]

Noice

[jsokol]

Did this deploy glitch affect the php:8.5-apache tag?

docker run --pull=always --rm --entrypoint php php:8.5-apache -v

Continues to show PHP v8.5.11

[Spice-King]

The 8.5.12 tags have yet to be pushed, so continue to wait.

Never mind, they just showed up.

[tianon]

Yep, pushes are still actively in-progress (PHP has a very large matrix)

[jsokol]

I just wanted to say that you all are amazing. While others are complaining about the time it is taking, I respect the efforts of all of the people doing this work behind the scenes. Thank you.

[ccchapman]

Waiting for 8.3.36-fpm-alpine3.24 on arm64.

[tianon]

Yeah had another glitch - they're up now.

[ivalkenburg]

Now if only PECL could work.   😂

[derickr]

We're having a large influx of requests — please switch to using PIE if you can.

[kasperbasse]

When can we expect a arm64 version of 8.3.36-fpm-alpine3.24 ?

[tianon]

Had another glitch, it's up now.

[adamjgriffith]

I'm curious if we can see the pipelines that are building these images?

[yosifkit]

Our FAQ gives an overview of the process: https://github.com/docker-library/faq/blob/ce1a70af72a522f8638d6bffd930ef3252de7837/README.md#an-images-source-changed-in-git-now-what with links to the job definitions. You can see all the jobs on the build server, but if too many people check it (like happened earlier today), then it hampers our ability to check and proactively trigger or retry certain jobs.

[Mc-Mido]

Hi, what about AWS ECR push ? 🤔

[yosifkit]

They are currently mirrored once they are pushed to https://hub.docker.com/_/php by some internal automation. And indeed, are already there: https://gallery.ecr.aws/docker/library/php

[Mc-Mido]

@yosifkit yes tags are here but there isn't image, manifest is empty

[yosifkit]

Ah, it looks like we are hitting ECR limits again, so mirroring pushes failed. See also #1611 (comment)

[tianon]

We have an active dialogue going with AWS and are working to mirror the images appropriately (and they're available from Docker Hub in the meantime).

[tianon]

The images in our ECR Public mirror for library/php are now up-to-date. 👍

[gavinjohnson-crowdcube]

Hope there's going to be a retro into the time it took from the fixes to be merged to the time for the updated docker images to be pushed to dockerhub.

[jdreesen]

they don’t get early source code access so things are done live

As far as I know, they did get early access but were unable to build from a closed source, so they had to wait until it was publicly available—unlike the ~100 other vendors that prepared their package early to be released on time.

[tianon]

We did not have advance access to any patches or source code. We had advance notice that a security release was dropping, and we miscommunicated on the severity. We are definitely looking into ways to improve the processes in the future.

(For some added context, we build, from source, each of the 5 supported versions of PHP across 4 different variants, across 2 different base distros, across 2 different versions of each distro, across 8 different architectures, so there's going to be some delay inherent in that process no matter the infrastructure.)

[DanielEScherzer]

I didn't realize that you didn't have advanced access to the tarballs - if you had that advanced access (i.e. if you had the code that I pushed in php/web-php-distributions@2ca733e...1e6d110) would you have been able to build things earlier? Wondering in case it happens again

[tianon]

A good question! It's honestly not something we have a good process for right now, but it is something we've thought a lot about over the years, and I think we've got a reasonable path to doing something sane here:

• for severe embargos, we could accept private dist files, but we can't build the stock upstream Dockerfiles as-is because they want to pull from the official public upstream locations (which are often TLS'd these days, so we can't MitM them in order to make clean "correct" builds)

• however, it's not actually critical that the builds we publish are the 100% final builds, just that they are correct, so we could pre-build and stage modified builds so that we can publish those right away to "stop the bleed"

• then we can take whatever time we need to update the builds properly/officially from the officially published sources so that the provenance is correct

Building a real process for something like this is one of our priorities from this event. 👍 ❤️

[DanielEScherzer]

Okay, feel free to reach out to me and I can connect you with the people who decide on the embargo distributions when you want to work on this

[Inskioo]

Honestly, the work you do as open source maintainers is a thankless and difficult one, and I worry about how much harder it is becoming with LLMs ripping apart every open source software and finding exceptionally novel exploits, not even considering the time to exploit of tool assisted threat actors.

It's a hard world we're moving into, and I thank you for your tireless work. I hope we're all able to come together and create new ways of protecting what we've collectively spent decades creating.