Update docker.elastic.co/logstash/logstash-oss Docker tag to v8.19.24

- Remove root-only FPM user configuration from entrypoint.sh (moved to Dockerfile build time)
- Remove Redis session configuration from entrypoint.sh (handled by Symfony services)
- Remove cache directory permission adjustments (unnecessary with proper ownership)
- Set file ownership to www-data:www-data at build time using COPY --chown
- Create required directories and set ownership in single RUN layer
- Switch to www-data USER before CMD
- Remove PHP_FPM_USER, PHP_FPM_GROUP, SESSION_LIFETIME environment variables
- Add docker/ directory to .dockerignore

.changes/2.13.6.md

@@ -0,0 +1,3 @@
+## 2.13.6 - 2026-10-26
+### DX
+* Run container as www-data user instead of root

.changes/unreleased/Release-renovate-1793671528058.yaml

@@ -0,0 +1,7 @@
+kind: Release
+body: |
+  - docker.elastic.co/logstash/logstash-oss: 8.1.0-amd64 ->  8.19.24-amd64
+
+time: 2026-11-03T02:05:28+00:00
+custom:
+  Issue: ""

.gitignore

@@ -1,4 +1,4 @@
-
+docker/
 ###> symfony/framework-bundle ###
 /.env.local
 /.env.local.php

CHANGELOG.md

@@ -6,6 +6,10 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 2.13.6 - 2026-10-26
+### DX
+* Run container as www-data user instead of root
+
 ## 2.13.5 - 2026-10-21
 ### Security
 * Update with patch for php vulnerability

Dockerfile

@@ -1,31 +1,38 @@
 FROM chill/base-image:8.4-edge
 
-# copy directories
+# copy directories with ownership for the unprivileged runtime user
+COPY --chown=www-data:www-data ./bin    /var/www/app/bin/.
+COPY --chown=www-data:www-data ./composer.* /var/www/app/
+COPY --chown=www-data:www-data ./config    /var/www/app/config/.
+COPY --chown=www-data:www-data ./migrations /var/www/app/migrations/.
+COPY --chown=www-data:www-data ./public    /var/www/app/public/.
+COPY --chown=www-data:www-data ./src    /var/www/app/src/.
+COPY --chown=www-data:www-data ./templates /var/www/app/templates/.
+COPY --chown=www-data:www-data ./translations /var/www/app/translations/.
+COPY --chown=www-data:www-data ./vendor /var/www/app/vendor/.
 
-COPY ./bin    /var/www/app/bin/.
-COPY ./composer.* /var/www/app/
-COPY ./config    /var/www/app/config/.
-COPY ./migrations /var/www/app/migrations/.
-COPY ./public    /var/www/app/public/.
-COPY ./src    /var/www/app/src/.
-COPY ./templates /var/www/app/templates/.
-COPY ./translations /var/www/app/translations/.
-COPY ./vendor /var/www/app/vendor/.
-
-COPY ./.env /var/www/app/.env
+COPY --chown=www-data:www-data ./.env /var/www/app/.env
 
 # import the manifest.json file
-COPY ./public/build/manifest.json /var/www/app/public/build/manifest.json
+COPY --chown=www-data:www-data ./public/build/manifest.json /var/www/app/public/build/manifest.json
 
-ADD ./entrypoint.sh /.
+COPY ./entrypoint.sh /entrypoint.sh
 
-RUN chmod +x /entrypoint.sh
+# - mark entrypoint executable
+# - declare the FPM pool user/group at build time (was previously written by entrypoint.sh as root)
+# - prepare writable Symfony var/ and COMPOSER_HOME directories for the unprivileged runtime user
+RUN chmod +x /entrypoint.sh \
+    && printf '[www]\nuser=www-data\ngroup=www-data\n' > /usr/local/etc/php-fpm.d/zz-user.conf \
+    && mkdir -p /var/www/app/var/cache /var/www/app/var/log /var/www/app/.composer \
+    && chown -R www-data:www-data /var/www/app/var /var/www/app/.composer \
+    && chown www-data:www-data /var/www/app
+# php-fpm listens on 9000 by default (unprivileged port)
+EXPOSE 9000
+
+USER www-data
 
 ENTRYPOINT ["/entrypoint.sh"]
 
-ENV PHP_FPM_USER=www-data \
-    PHP_FPM_GROUP=www-data \
-    COMPOSER_HOME=/var/www/app/.composer \
-    SESSION_LIFETIME=10800
+ENV COMPOSER_HOME=/var/www/app/.composer
 
 CMD [ "php-fpm" ]

docker/logstash/Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.elastic.co/logstash/logstash-oss:8.1.0-amd64
+FROM docker.elastic.co/logstash/logstash-oss:8.19.24-amd64@sha256:8f8dbaa380e0e92c731fd3764a62f54b63cb0942793be48dd40db35869a434d0
 
 RUN \
   bin/logstash-plugin install logstash-output-gelf \

entrypoint.sh

@@ -16,23 +16,6 @@ else
   echo "we assume the database is ready";
 fi
 
-
-if [ $(id -u) = "0" ]; then
-  { \
-    echo "[www]"; \
-    echo ""; \
-    echo "user=${PHP_FPM_USER}"; \
-    echo "group=${PHP_FPM_GROUP}"; \
-  } > /usr/local/etc/php-fpm.d/zz-user.conf
-fi
-
-{ \
-    echo ""; \
-    echo "session.save_handler = redis" ; \
-    echo "session.save_path = \"tcp://${REDIS_HOST}:${REDIS_PORT}?db=10\"" ; \
-    echo "session.gc_maxlifetime = ${SESSION_LIFETIME}" ; \
-} >> /usr/local/etc/php/conf.d/custom.ini
-
 if [ "${APP_ENV}" = "prod" ]; then
   composer dump-env "${APP_ENV}"
   chmod +r /var/www/app/.env.local.php
@@ -48,8 +31,6 @@ fi
 if [ "${CLEAR_CACHE}" != "false" ]; then
   #prepare cache
   php /var/www/app/bin/console cache:clear --no-warmup
-  chgrp ${PHP_FPM_GROUP} /var/www/app/var/cache -R && chmod g+rw /var/www/app/var/cache -R
-  chgrp ${PHP_FPM_GROUP} /var/www/app/var/log   -R && chmod g+rw /var/www/app/var/log   -R
 fi
 
 exec "${@}"