Pin dependencies

- Remove root-only FPM user configuration from entrypoint.sh (moved to Dockerfile build time)
- Remove Redis session configuration from entrypoint.sh (handled by Symfony services)
- Remove cache directory permission adjustments (unnecessary with proper ownership)
- Set file ownership to www-data:www-data at build time using COPY --chown
- Create required directories and set ownership in single RUN layer
- Switch to www-data USER before CMD
- Remove PHP_FPM_USER, PHP_FPM_GROUP, SESSION_LIFETIME environment variables
- Add docker/ directory to .dockerignore

.changes/2.13.5.md

@@ -0,0 +1,3 @@
+## 2.13.5 - 2026-10-21
+### Security
+* Update with patch for php vulnerability

.changes/2.13.6.md

@@ -0,0 +1,3 @@
+## 2.13.6 - 2026-10-26
+### DX
+* Run container as www-data user instead of root

.changes/unreleased/Release-renovate-1794103503982.yaml

@@ -2,15 +2,14 @@ kind: Release
 body: |
   - axllent/mailpit:  ->  
   - chill/base-image: 8.4-edge ->  8.4-edge
-  - composer: 2 ->  2
+  - chill/base-image: 8.4-edge ->  8.4-edge
   - docker.elastic.co/logstash/logstash-oss: 8.1.0-amd64 ->  8.1.0-amd64
   - gitea.champs-libres.be/chill-project/chill-skeleton-basic/base-image: latest ->  latest
   - intl-messageformat: ^10.5.11 ->  10.7.18
   - nginx:  ->  
-  - php: 8.4-fpm-alpine ->  8.4-fpm-alpine
   - redis:  ->  
   - registry.gitlab.com/champs-libres/public/relatorio-tornado/app: latest ->  latest
 
-time: 2026-10-13T02:02:59+00:00
+time: 2026-11-08T02:05:03+00:00
 custom:
   Issue: ""

.gitea/workflows/release/build-image.yaml

@@ -19,7 +19,7 @@ jobs:
           password: ${{ secrets.OVH_REGISTRY_PASSWORD }}
 
       - name: Install Dependencies and Build Assets
-        uses: docker://chill/base-image:8.4-edge@sha256:d966b01691c0cdc10c01de80e7744b27353d79eaeba4e00873f846fb23c94379
+        uses: docker://chill/base-image:8.4-edge@sha256:2b2f849dbcf99e664191adbf648f8b1190ab5f3ae2bf79c0303efc383ee00fa9
         env:
           APP_ENV: prod
         with:

.gitignore

@@ -1,4 +1,4 @@
-
+docker/
 ###> symfony/framework-bundle ###
 /.env.local
 /.env.local.php

CHANGELOG.md

@@ -6,6 +6,14 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 2.13.6 - 2026-10-26
+### DX
+* Run container as www-data user instead of root
+
+## 2.13.5 - 2026-10-21
+### Security
+* Update with patch for php vulnerability
+
 ## 2.13.4 - 2026-09-17
 ### DX
 * Fix Dockerfile permissions to be able to write to the whole /var/www/app/ directory 

Dockerfile

@@ -1,112 +1,38 @@
-FROM php:8.4-fpm-alpine@sha256:78cd8de9970a9cd6ff4d98860a94eb5bf37dd2d5776b4785562dbfad01c29d5a AS chill_base_php82
+FROM chill/base-image:8.4-edge@sha256:2b2f849dbcf99e664191adbf648f8b1190ab5f3ae2bf79c0303efc383ee00fa9
 
-ENV POSTGRES_VERSION=16
+# copy directories with ownership for the unprivileged runtime user
+COPY --chown=www-data:www-data ./bin    /var/www/app/bin/.
+COPY --chown=www-data:www-data ./composer.* /var/www/app/
+COPY --chown=www-data:www-data ./config    /var/www/app/config/.
+COPY --chown=www-data:www-data ./migrations /var/www/app/migrations/.
+COPY --chown=www-data:www-data ./public    /var/www/app/public/.
+COPY --chown=www-data:www-data ./src    /var/www/app/src/.
+COPY --chown=www-data:www-data ./templates /var/www/app/templates/.
+COPY --chown=www-data:www-data ./translations /var/www/app/translations/.
+COPY --chown=www-data:www-data ./vendor /var/www/app/vendor/.
 
-# default UID for the PHP user
+COPY --chown=www-data:www-data ./.env /var/www/app/.env
-ARG UID=1000
-ARG GID=1000
-
-# install php extensions and deps
-# apk add --no-cache --update --virtual rabbitmq-c-dev rabbitmq-c-utils gcc g++ make autoconf  && pecl install amqp
-RUN apk update && apk add --no-cache \
-    wget gnupg \
-    libpq-dev \
-    icu-dev icu-libs icu-data-full \
-    oniguruma-dev \
-    libzip libzip-dev \
-    linux-headers \
-    gcc g++ make autoconf \
-    bash git \
-    rabbitmq-c rabbitmq-c-dev \
-    && docker-php-ext-install pdo_pgsql intl mbstring zip bcmath exif sockets \
-    && git clone https://github.com/nikic/php-ast.git \
-    && cd php-ast \
-    && phpize \
-    && ./configure \
-    && make install \
-    && echo 'extension=ast.so' > /usr/local/etc/php/php.ini \
-    && cd .. && rm -rf php-ast \
-    && pecl install redis \
-    && docker-php-ext-enable redis \
-    && pecl install amqp \
-    && docker-php-ext-enable amqp \
-    && apk add libpng-dev libjpeg-turbo-dev freetype-dev \
-    && docker-php-ext-configure gd --with-freetype --with-jpeg \
-    && docker-php-ext-install -j$(nproc) gd \
-    && apk add postgresql${POSTGRES_VERSION}-client \
-    && apk del --purge wget gnupg libpq-dev icu-dev oniguruma-dev libzip-dev linux-headers gcc g++ make autoconf
-
-RUN { \
-    echo ""; \
-    echo "memory_limit = 512M"; \
-    echo ""; \
-    } >> /usr/local/etc/php/conf.d/memory_limit.ini
-
-RUN { \
-    echo ""; \
-    echo "[Date]"; \
-    echo "date.timezone = Europe/Brussels"; \
-    echo ""; \
-    } >> /usr/local/etc/php/conf.d/date.ini
-
-# temporary fix, while php-cs-fixer has conflict dependencies
-# with chill
-RUN curl -o /usr/local/bin/php-cs-fixer https://cs.symfony.com/download/php-cs-fixer-v3.phar \
-    && chmod +x /usr/local/bin/php-cs-fixer
-# to make php-cs-fixer works with php 8.2
-ENV PHP_CS_FIXER_IGNORE_ENV=1
-
-COPY --from=composer:2@sha256:af98f42dfff7c68ba8d53c2164fd9fde1087b7d449514baa38c418b1f6bc4bac /usr/bin/composer /usr/bin/composer
-ENV COMPOSER_ALLOW_SUPERUSER=1
-ENV COMPOSER_MEMORY_LIMIT=-1
-
-# shell bash preference
-RUN sed -i " \
-    s|root:x:0:0:root:/root:/bin/ash|root:x:0:0:root:/root:/bin/bash|g; \
-    s|postgres:x:70:70:PostgreSQL user:/var/lib/postgresql:/bin/sh|postgres:x:70:70:PostgreSQL user:/var/lib/postgresql:/bin/bash|g" \
-    /etc/passwd
-
-# chmod on redis.so
-RUN chmod 755 -R /usr/local/lib/php/extensions/
-
-WORKDIR /var/www/app
-
-CMD ["php-fpm"]
-
-FROM chill_base_php82 AS chill_php82
-
-# copy directories
-
-COPY ./bin    /var/www/app/bin/.
-COPY ./composer.* /var/www/app/
-COPY ./config    /var/www/app/config/.
-COPY ./migrations /var/www/app/migrations/.
-COPY ./public    /var/www/app/public/.
-COPY ./src    /var/www/app/src/.
-COPY ./templates /var/www/app/templates/.
-COPY ./translations /var/www/app/translations/.
-COPY ./vendor /var/www/app/vendor/.
-
-COPY ./.env /var/www/app/.env
 
 # import the manifest.json file
-COPY ./public/build/manifest.json /var/www/app/public/build/manifest.json
+COPY --chown=www-data:www-data ./public/build/manifest.json /var/www/app/public/build/manifest.json
 
-ADD ./entrypoint.sh /.
+COPY ./entrypoint.sh /entrypoint.sh
 
-RUN chmod +x /entrypoint.sh
+# - mark entrypoint executable
+# - declare the FPM pool user/group at build time (was previously written by entrypoint.sh as root)
+# - prepare writable Symfony var/ and COMPOSER_HOME directories for the unprivileged runtime user
+RUN chmod +x /entrypoint.sh \
+    && printf '[www]\nuser=www-data\ngroup=www-data\n' > /usr/local/etc/php-fpm.d/zz-user.conf \
+    && mkdir -p /var/www/app/var/cache /var/www/app/var/log /var/www/app/.composer \
+    && chown -R www-data:www-data /var/www/app/var /var/www/app/.composer \
+    && chown www-data:www-data /var/www/app
+# php-fpm listens on 9000 by default (unprivileged port)
+EXPOSE 9000
 
-RUN mkdir -p /var/www/app/var/cache /var/www/app/var/log && \
+USER www-data
-    chown -R 82:82 /var/www/app && \
-    chmod -R 755 /var/www/app && \
-    chown -R 82:82 /usr/local/etc/php/conf.d && \
-    chmod -R 755 /usr/local/etc/php/conf.d
 
 ENTRYPOINT ["/entrypoint.sh"]
 
-ENV PHP_FPM_USER=www-data \
+ENV COMPOSER_HOME=/var/www/app/.composer
-    PHP_FPM_GROUP=www-data \
-    COMPOSER_HOME=/var/www/app/.composer \
-    SESSION_LIFETIME=10800
 
 CMD [ "php-fpm" ]

compose.override.yaml

@@ -3,7 +3,7 @@ version: '3'
 services:
 ###> symfony/mailer ###
   mailer:
-    image: axllent/mailpit@sha256:94f6b70c1436defae6799d9ac7ff0eeff9540465b842026d5cdb018f1c0234ea
+    image: axllent/mailpit@sha256:aef2aacc11f075ec0fb6874275ee4a421e688e11a96ebb296134d1735c7761ce
     ports:
       - "1025"
       - "8025"

compose.yaml

@@ -17,7 +17,7 @@ services:
 
 ###> chill-project/chill-bundles ###
   redis:
-      image: redis@sha256:2c2dff791878316e3b083188be0d578423b24813cdda5de0e80ea4f7b3e6bfd6
+      image: redis@sha256:1f88291b4c57bdf249f02eb085a8669889b2d2954e91d4de5118a5da6b78dd53
   relatorio:
       image: registry.gitlab.com/champs-libres/public/relatorio-tornado/app:latest@sha256:2c4aa2f422c389d940adfd760b0856d237023d66cded0aa026b532b29192212e
 ###< chill-project/chill-bundles ###

docker/nginx/Dockerfile

@@ -1,4 +1,4 @@
-FROM nginx@sha256:f9ea18bfa4fad859e1ed38259d711da7ccad2c3516e875cec3351a57c859f571
+FROM nginx@sha256:165ddde8751e75a1c907d24ef10d9f6deb08b57e0fe56caf67512486aff76d82
 
 COPY ./public /var/www/app/public
 

entrypoint.sh

@@ -16,23 +16,6 @@ else
   echo "we assume the database is ready";
 fi
 
-
-if [ $(id -u) = "0" ]; then
-  { \
-    echo "[www]"; \
-    echo ""; \
-    echo "user=${PHP_FPM_USER}"; \
-    echo "group=${PHP_FPM_GROUP}"; \
-  } > /usr/local/etc/php-fpm.d/zz-user.conf
-fi
-
-{ \
-    echo ""; \
-    echo "session.save_handler = redis" ; \
-    echo "session.save_path = \"tcp://${REDIS_HOST}:${REDIS_PORT}?db=10\"" ; \
-    echo "session.gc_maxlifetime = ${SESSION_LIFETIME}" ; \
-} >> /usr/local/etc/php/conf.d/custom.ini
-
 if [ "${APP_ENV}" = "prod" ]; then
   composer dump-env "${APP_ENV}"
   chmod +r /var/www/app/.env.local.php
@@ -48,8 +31,6 @@ fi
 if [ "${CLEAR_CACHE}" != "false" ]; then
   #prepare cache
   php /var/www/app/bin/console cache:clear --no-warmup
-  chgrp ${PHP_FPM_GROUP} /var/www/app/var/cache -R && chmod g+rw /var/www/app/var/cache -R
-  chgrp ${PHP_FPM_GROUP} /var/www/app/var/log   -R && chmod g+rw /var/www/app/var/log   -R
 fi
 
 exec "${@}"

renovate.json

@@ -1,3 +1,4 @@
 {
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "reviewers": ["LenaertsJ"]
 }