Repository navigation
Release 5.1: PHP patches within the hour, signed images, PHP 8.6-rc, and more - #740
Open
jaydrogers wants to merge 13 commits into
Open
jaydrogers wants to merge 13 commits into
jaydrogers wants to merge 13 commits into
Conversation
`set -oe` without an option name makes /bin/sh print every shell option to stdout. Anything reading a helper's output got that dump first, such as the watcher URL lookup and the php.net checksum lookup. Use `set -e` (and `set -eu` in the s6 installer). Thanks to @tomschlick for spotting this in #726. Co-authored-by: Tom Schlick <tom@schlick.email>
Move each version that ships in an image (s6-overlay, php-fpm-healthcheck, the extension installer, FrankenPHP, Go, watcher, phpredis) into a `dependencies` block in php-versions-base-config.yml. CI and dev.sh pass the block as build args of the same name, and the Dockerfiles declare them without defaults so a missing pin fails the build. Build redis from its GitHub source, with its liblzf submodule fetched separately, so no default build step depends on PECL. Pin watcher instead of downloading the latest release.
Stop waiting for Docker Hub's php images. A new build-php-base phase runs prepare-php-base.sh, which takes docker-library/php at a pinned commit, sets the PHP version, URL, and php.net SHA256, and removes `pecl update-channels`. Everything else matches the official images. Each base compiles once without the build cache, so OS security fixes ship on the next run, and is saved to the Depot Registry. The variations build on it through BASE_IMAGE. get-php-versions.sh no longer checks Docker Hub, and a pinned patch_versions now replaces php.net's. Release candidates such as 8.6-rc build from php.net's release-candidates feed, and php_base_overrides lets a minor version change a variation's upstream variant. PHP 8.1 builds from the last docker-library commit that had it.
The compiled PHP bases install current Debian and Alpine packages, so they already ship the patched libbrotli for CVE-2026-111497. FrankenPHP's Bookworm Brotli build stays, because cbrotli needs libbrotli 1.1 or newer.
Replace Dependabot and get-nginx-versions.sh with Renovate. It reads the `# renovate:` comments in the base config and the lint workflow, checks each OS's NGINX package on nginx.org, groups GitHub Actions monthly, and merges the weekly docker-library/php bump once every check passes. Every other pin waits for a manual merge.
A base job whose runner dropped reports cancelled, not failure, so builds still ran and failed on a base image that was never saved. Build only when the base phase succeeded or was skipped (fork PRs).
…lpine 3.23 and 3.24, Bookworm, and Trixie from the newest release candidate php.net lists. FrankenPHP uses the cli base, since docker-library builds every 8.6 image with ZTS. Upgrade install-php-extensions to 2.12.6 for its PHP 8.6 support. phpredis 6.3.0 does not compile on PHP 8.6, so 8.6 builds phpredis at 810984b, the last develop commit before an added build option that install-php-extensions answers out of order."
…ION with FRANKENPHP_VERSION for synchronized updates
Deploying serversideup-php with
|
| Latest commit: |
382cae8
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://1f55da09.serversideup-php.pages.dev |
| Branch Preview URL: | https://release-improve-builds.serversideup-php.pages.dev |
Contributor
Images for PR #740
No images were published from this run. View the run for details. All images with sizesSizes are compressed, per architecture.
Updated on every push to this PR. |
…es (#741) * Split image tests into one file per feature area Move the checks in scripts/test-image.sh into scripts/tests/image/ with shared helpers in lib.sh and PHP fixtures as real files. Every test runs even after one fails, and TEST_ONLY runs a single area. No checks were added or changed. * Test Laravel automations, startup scripts, set-id, and SSL modes Add laravel-automations.sh (a stand-in artisan records each command), entrypoint.sh, permissions.sh, and SSL mixed mode and HTTPS redirect tests. requires now also skips a single test, and build_image builds a test image from the one under test. * Test trusted proxies, PHP-FPM pool variables, and shutdown Add trusted-proxy.sh, fpm.sh, and lifecycle.sh (replacing healthcheck.sh), which also checks that docker stop finishes before Docker kills the container. The s6 images skip that check, since they wait to be killed on purpose for zero-downtime deployments (#647). Add a skip helper.
…#742) * Split image tests into one file per feature area Move the checks in scripts/test-image.sh into scripts/tests/image/ with shared helpers in lib.sh and PHP fixtures as real files. Every test runs even after one fails, and TEST_ONLY runs a single area. No checks were added or changed. * Test Laravel automations, startup scripts, set-id, and SSL modes Add laravel-automations.sh (a stand-in artisan records each command), entrypoint.sh, permissions.sh, and SSL mixed mode and HTTPS redirect tests. requires now also skips a single test, and build_image builds a test image from the one under test. * Test trusted proxies, PHP-FPM pool variables, and shutdown Add trusted-proxy.sh, fpm.sh, and lifecycle.sh (replacing healthcheck.sh), which also checks that docker stop finishes before Docker kills the container. The s6 images skip that check, since they wait to be killed on purpose for zero-downtime deployments (#647). Add a skip helper. * Add release watcher, image signing, and public vulnerability scanning * Simplifed scanning
jaydrogers
changed the title
jaydrogers
marked this pull request as ready for review
October 30, 2026 22:01
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
👨🔬 How to test
You can test this image using our serversideup/php-dev repository, which automatically builds on push to this PR.
View the available testing images →
🌎 Docs Preview
🤩 What's new
PHP security releases reach you within about an hour (#739, #742)
During the last critical PHP release (#721), we waited hours for Docker Hub's
phpimages, then PECL went down. We now compile PHP ourselves with the same Dockerfiles as the official images, so neither one can hold up a release. A new hourly check starts a build as soon as php.net lists a patch, on any day of the week.phpimages → PECL → wait for our next release or Tuesday rebuildEvery build also starts from current Debian and Alpine packages, so OS security fixes reach your image on the weekly rebuild (Tuesday 08:00 UTC). PHP 8.1 benefits most: its official images haven't been rebuilt since 2025.
Verify that an image came from us (#742)
Every image is now signed with cosign and ships with an SBOM (every package inside it) and build provenance (how and where it was built). Check an image before you run it:
cosign verify serversideup/php:8.5-cli \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-identity-regexp '^https://github\.com/serversideup/docker-php/\.github/workflows/service_publish-images\.yml@refs/(heads/main|tags/v.+)$'Images published before 5.1 have provenance but no signature or SBOM. See Verifying images.
Every image is scanned for vulnerabilities (#742)
After every production build, Grype scans each published image. The results are on each run's summary page. You can see the known vulnerabilities in any image without running a scanner yourself. See Vulnerability scanning.
PHP 8.6 release candidates (#739)
Test your app on PHP 8.6 before it ships. Every rebuild uses the newest release candidate on php.net.
🐛 Bug fixes
docker-php-serversideup-downloadprinted every shell option to stdout before the file when you didn't give it an output file (Compile PHP from source, drop PECL, and monitor dependencies with Renovate #739)🏗️ For contributors
scripts/conf/php-versions-base-config.yml, and Renovate replaces Dependabot to keep them current (Compile PHP from source, drop PECL, and monitor dependencies with Renovate #739)scripts/dev.sh --build-php-basebuilds exactly what CI builds. See How PHP is builtscripts/tests/image/, and every failure shows up in one run. New tests cover Laravel automations, startup scripts, SSL modes, trusted proxies, PHP-FPM pool variables, file permissions, and shutdown (Split image tests into one file per feature area and test more features #741)