julielenaerts
0e6ec94ae4
- Remove root-only FPM user configuration from entrypoint.sh (moved to Dockerfile build time) - Remove Redis session configuration from entrypoint.sh (handled by Symfony services) - Remove cache directory permission adjustments (unnecessary with proper ownership) - Set file ownership to www-data:www-data at build time using COPY --chown - Create required directories and set ownership in single RUN layer - Switch to www-data USER before CMD - Remove PHP_FPM_USER, PHP_FPM_GROUP, SESSION_LIFETIME environment variables - Add docker/ directory to .dockerignore
38 lines
1.6 KiB
Docker
38 lines
1.6 KiB
Docker
FROM chill/base-image:8.4-edge
|
|
|
|
# copy directories with ownership for the unprivileged runtime user
|
|
COPY --chown=www-data:www-data ./bin /var/www/app/bin/.
|
|
COPY --chown=www-data:www-data ./composer.* /var/www/app/
|
|
COPY --chown=www-data:www-data ./config /var/www/app/config/.
|
|
COPY --chown=www-data:www-data ./migrations /var/www/app/migrations/.
|
|
COPY --chown=www-data:www-data ./public /var/www/app/public/.
|
|
COPY --chown=www-data:www-data ./src /var/www/app/src/.
|
|
COPY --chown=www-data:www-data ./templates /var/www/app/templates/.
|
|
COPY --chown=www-data:www-data ./translations /var/www/app/translations/.
|
|
COPY --chown=www-data:www-data ./vendor /var/www/app/vendor/.
|
|
|
|
COPY --chown=www-data:www-data ./.env /var/www/app/.env
|
|
|
|
# import the manifest.json file
|
|
COPY --chown=www-data:www-data ./public/build/manifest.json /var/www/app/public/build/manifest.json
|
|
|
|
COPY ./entrypoint.sh /entrypoint.sh
|
|
|
|
# - mark entrypoint executable
|
|
# - declare the FPM pool user/group at build time (was previously written by entrypoint.sh as root)
|
|
# - prepare writable Symfony var/ and COMPOSER_HOME directories for the unprivileged runtime user
|
|
RUN chmod +x /entrypoint.sh \
|
|
&& printf '[www]\nuser=www-data\ngroup=www-data\n' > /usr/local/etc/php-fpm.d/zz-user.conf \
|
|
&& mkdir -p /var/www/app/var/cache /var/www/app/var/log /var/www/app/.composer \
|
|
&& chown -R www-data:www-data /var/www/app/var /var/www/app/.composer \
|
|
&& chown www-data:www-data /var/www/app
|
|
# php-fpm listens on 9000 by default (unprivileged port)
|
|
EXPOSE 9000
|
|
|
|
USER www-data
|
|
|
|
ENTRYPOINT ["/entrypoint.sh"]
|
|
|
|
ENV COMPOSER_HOME=/var/www/app/.composer
|
|
|
|
CMD [ "php-fpm" ] |