Implementing rootless php-lol images

.github/actions/docker/action.yml

@@ -31,11 +31,19 @@ runs:
         version=$(grep -E '^\s*(ENV\s+)?VERSION=' '${{ inputs.dockerfile }}' | tail -1 | sed -E 's/^.*VERSION=([^ \\]+).*/\1/')
         vcs_ref=$(git rev-parse --short HEAD)
         image_name=$(cd $(dirname ${{ inputs.dockerfile }}) && echo "${PWD##*/}")
+        rootless=false
+        rootless_tags=
         tags=bdossantos/${image_name}:latest,bdossantos/${image_name}:${version},bdossantos/${image_name}:${version}-${vcs_ref},bdossantos/${image_name}:${version%.*}
+        if [[ -f "$(dirname ${{ inputs.dockerfile }})/.rootless" ]]; then
+          rootless=true
+          rootless_tags=bdossantos/${image_name}:latest-rootless,bdossantos/${image_name}:${version}-rootless,bdossantos/${image_name}:${version}-${vcs_ref}-rootless,bdossantos/${image_name}:${version%.*}-rootless
+        fi
         cache_image=bdossantos/${image_name}:buildcache
         echo "build_date=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
         echo "cache_image=${cache_image}" >> $GITHUB_OUTPUT
         echo "path=$(dirname ${{ inputs.dockerfile }})" >> $GITHUB_OUTPUT
+        echo "rootless=${rootless}" >> $GITHUB_OUTPUT
+        echo "rootless_tags=${rootless_tags}" >> $GITHUB_OUTPUT
         echo "tags=${tags}" >> $GITHUB_OUTPUT
         echo "vcs_ref=${vcs_ref}" >> $GITHUB_OUTPUT
 
@@ -52,3 +60,19 @@ runs:
         push: ${{ github.event_name != 'pull_request' }}
         sbom: true
         tags: ${{ steps.context.outputs.tags }}
+
+    - name: Build and push rootless docker image
+      if: steps.context.outputs.rootless == 'true'
+      uses: docker/build-push-action@v6
+      with:
+        build-args: |
+          BUILD_DATE=${{ steps.context.outputs.build_date }}
+          VCS_REF=${{ steps.context.outputs.vcs_ref }}
+        cache-from: type=registry,ref=${{ steps.context.outputs.cache_image }}
+        cache-to: type=registry,ref=${{ steps.context.outputs.cache_image }},mode=max
+        context: ${{ steps.context.outputs.path }}
+        file: ${{ inputs.dockerfile }}
+        push: ${{ github.event_name != 'pull_request' }}
+        sbom: true
+        tags: ${{ steps.context.outputs.rootless_tags }}
+        target: run-rootless

Makefile

@@ -52,7 +52,30 @@ container-structure-test: ## Run container-structure-test
 	$(info --> Run container-structure-test)
 	@$(CWD)/bin/container-structure-test test --image bdossantos/dnscrypt-proxy --config tests/dnscrypt-proxy.yaml
 	@$(CWD)/bin/container-structure-test test --image bdossantos/paperless-ngx --config tests/paperless-ngx.yaml
-	@$(CWD)/bin/container-structure-test test --image bdossantos/php-lol --config tests/php-lol.yaml
+	@$(CWD)/bin/container-structure-test test --image bdossantos/php-lol83 --config tests/php-lol.yaml
+	@$(CWD)/bin/container-structure-test test --image bdossantos/php-lol84 --config tests/php-lol.yaml
+	@$(CWD)/bin/container-structure-test test --image bdossantos/php-lol85 --config tests/php-lol.yaml
+	@$(CWD)/bin/container-structure-test test --image bdossantos/php-lol83-rootless --config tests/php-lol-rootless.yaml
+	@$(CWD)/bin/container-structure-test test --image bdossantos/php-lol84-rootless --config tests/php-lol-rootless.yaml
+	@$(CWD)/bin/container-structure-test test --image bdossantos/php-lol85-rootless --config tests/php-lol-rootless.yaml
+	@for image in bdossantos/php-lol83-rootless bdossantos/php-lol84-rootless bdossantos/php-lol85-rootless; do \
+		docker run --rm --read-only --tmpfs /dev/shm --entrypoint sh $$image -ceu '\
+			/usr/bin/supervisord -c /etc/supervisor/supervisord.conf & \
+			pid=$$!; \
+			trap "kill $$pid" EXIT; \
+			rm -f /dev/shm/supervisor-status; \
+			started=; \
+			for _ in 1 2 3 4 5; do \
+				if /usr/bin/supervisorctl status >/dev/shm/supervisor-status; then \
+					started=1; \
+					break; \
+				fi; \
+				sleep 1; \
+			done; \
+			test -n "$$started"; \
+			grep -E "^php-fpm\\s+RUNNING" /dev/shm/supervisor-status; \
+			grep -E "^nginx\\s+RUNNING" /dev/shm/supervisor-status'; \
+	done
 	@$(CWD)/bin/container-structure-test test --image bdossantos/pint --config tests/pint.yaml
 	@$(CWD)/bin/container-structure-test test --image bdossantos/python-github-backup --config tests/python-github-backup.yaml
 	@$(CWD)/bin/container-structure-test test --image bdossantos/radicale --config tests/radicale.yaml

README.md

@@ -14,7 +14,7 @@ multi-stage builds, pinned dependencies, and non-root users.
 | [dnscrypt-proxy](dockerfiles/dnscrypt-proxy) | [DNSCrypt](https://dnscrypt.info/) proxy with encrypted DNS support |
 | [memcached](dockerfiles/memcached) | [Memcached](https://memcached.org/) with built-in proxy support and embedded [routelib](https://github.com/memcached/memcached-proxylibs) |
 | [paperless-ngx](dockerfiles/paperless-ngx) | [Paperless-ngx](https://docs.paperless-ngx.com/) document management system |
-| [php-lol](dockerfiles/php-lol) | PHP-FPM with Nginx and common extensions (8.3, 8.4, 8.5) |
+| [php-lol](dockerfiles/php-lol) | PHP-FPM with Nginx and common extensions (8.3, 8.4, 8.5, plus versioned `-rootless` tags) |
 | [pingdom-exporter](dockerfiles/pingdom-exporter) | Prometheus exporter for Pingdom metrics |
 | [pint](dockerfiles/pint) | [Pint](https://cloudflare.github.io/pint/) – Prometheus rule linter by Cloudflare |
 | [python-github-backup](dockerfiles/python-github-backup) | [python-github-backup](https://github.com/josegonzalez/python-github-backup) – GitHub repository backup tool |

docker-compose.ci.yml

@@ -21,22 +21,46 @@ services:
     build:
       context: dockerfiles/php-lol
       dockerfile: Dockerfile.8.3
-    image: bdossantos/php-lol
+    image: bdossantos/php-lol83
     container_name: php-lol83
   php-lol84:
     <<: *default
     build:
       context: dockerfiles/php-lol
       dockerfile: Dockerfile.8.4
-    image: bdossantos/php-lol
+    image: bdossantos/php-lol84
     container_name: php-lol84
   php-lol85:
     <<: *default
     build:
       context: dockerfiles/php-lol
       dockerfile: Dockerfile.8.5
-    image: bdossantos/php-lol
+    image: bdossantos/php-lol85
     container_name: php-lol85
+  php-lol83-rootless:
+    <<: *default
+    build:
+      context: dockerfiles/php-lol
+      dockerfile: Dockerfile.8.3
+      target: run-rootless
+    image: bdossantos/php-lol83-rootless
+    container_name: php-lol83-rootless
+  php-lol84-rootless:
+    <<: *default
+    build:
+      context: dockerfiles/php-lol
+      dockerfile: Dockerfile.8.4
+      target: run-rootless
+    image: bdossantos/php-lol84-rootless
+    container_name: php-lol84-rootless
+  php-lol85-rootless:
+    <<: *default
+    build:
+      context: dockerfiles/php-lol
+      dockerfile: Dockerfile.8.5
+      target: run-rootless
+    image: bdossantos/php-lol85-rootless
+    container_name: php-lol85-rootless
   pingdom-exporter:
     <<: *default
     build:

dockerfiles/php-lol/Dockerfile.8.3

@@ -254,3 +254,50 @@ EXPOSE 80/tcp 443/tcp
 
 ENTRYPOINT ["/entrypoint.sh"]
 CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/supervisord.conf"]
+
+FROM foundation AS run-rootless
+
+ARG BUILD_DATE
+ARG VCS_REF
+ARG VERSION=8.3.33
+
+LABEL org.label-schema.build-date="$BUILD_DATE" \
+  org.label-schema.name="php-lol" \
+  org.label-schema.schema-version="1.0" \
+  org.label-schema.url="https://github.com/bdossantos/dockerfiles" \
+  org.label-schema.usage="https://github.com/bdossantos/dockerfiles" \
+  org.label-schema.vcs-ref="$VCS_REF" \
+  org.label-schema.vcs-url="https://github.com/bdossantos/dockerfiles" \
+  org.label-schema.vendor="PHP" \
+  org.label-schema.version="$VERSION" \
+  org.opencontainers.image.created="$BUILD_DATE" \
+  org.opencontainers.image.documentation="https://github.com/bdossantos/dockerfiles" \
+  org.opencontainers.image.revision="$VCS_REF" \
+  org.opencontainers.image.source="https://github.com/bdossantos/dockerfiles" \
+  org.opencontainers.image.title="php-lol" \
+  org.opencontainers.image.url="https://github.com/bdossantos/dockerfiles" \
+  org.opencontainers.image.vendor="PHP" \
+  org.opencontainers.image.version="$VERSION"
+
+COPY app.rootless.conf /etc/supervisor/conf.d/app.conf
+COPY nginx.rootless.conf /etc/nginx/nginx.conf
+COPY supervisord.rootless.conf /etc/supervisor/supervisord.conf
+COPY zzz-php-fpm-tuning.rootless.conf /usr/local/etc/php-fpm.d/zzz-php-fpm-tuning.conf
+
+RUN chown -R 65534:65534 \
+  /var/cache/nginx \
+  /var/lib/php/session \
+  && chmod 0444 \
+    /etc/nginx/nginx.conf \
+    /etc/supervisor/conf.d/app.conf \
+    /etc/supervisor/supervisord.conf \
+    /usr/local/etc/php-fpm.d/zzz-php-fpm-tuning.conf
+
+WORKDIR /usr/src/app
+
+EXPOSE 8080/tcp
+
+USER 65534:65534
+
+ENTRYPOINT ["/entrypoint.sh"]
+CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/supervisord.conf"]

dockerfiles/php-lol/Dockerfile.8.4

@@ -252,3 +252,50 @@ EXPOSE 80/tcp 443/tcp
 
 ENTRYPOINT ["/entrypoint.sh"]
 CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/supervisord.conf"]
+
+FROM foundation AS run-rootless
+
+ARG BUILD_DATE
+ARG VCS_REF
+ARG VERSION=8.4.25
+
+LABEL org.label-schema.build-date="$BUILD_DATE" \
+  org.label-schema.name="php-lol" \
+  org.label-schema.schema-version="1.0" \
+  org.label-schema.url="https://github.com/bdossantos/dockerfiles" \
+  org.label-schema.usage="https://github.com/bdossantos/dockerfiles" \
+  org.label-schema.vcs-ref="$VCS_REF" \
+  org.label-schema.vcs-url="https://github.com/bdossantos/dockerfiles" \
+  org.label-schema.vendor="PHP" \
+  org.label-schema.version="$VERSION" \
+  org.opencontainers.image.created="$BUILD_DATE" \
+  org.opencontainers.image.documentation="https://github.com/bdossantos/dockerfiles" \
+  org.opencontainers.image.revision="$VCS_REF" \
+  org.opencontainers.image.source="https://github.com/bdossantos/dockerfiles" \
+  org.opencontainers.image.title="php-lol" \
+  org.opencontainers.image.url="https://github.com/bdossantos/dockerfiles" \
+  org.opencontainers.image.vendor="PHP" \
+  org.opencontainers.image.version="$VERSION"
+
+COPY app.rootless.conf /etc/supervisor/conf.d/app.conf
+COPY nginx.rootless.conf /etc/nginx/nginx.conf
+COPY supervisord.rootless.conf /etc/supervisor/supervisord.conf
+COPY zzz-php-fpm-tuning.rootless.conf /usr/local/etc/php-fpm.d/zzz-php-fpm-tuning.conf
+
+RUN chown -R 65534:65534 \
+  /var/cache/nginx \
+  /var/lib/php/session \
+  && chmod 0444 \
+    /etc/nginx/nginx.conf \
+    /etc/supervisor/conf.d/app.conf \
+    /etc/supervisor/supervisord.conf \
+    /usr/local/etc/php-fpm.d/zzz-php-fpm-tuning.conf
+
+WORKDIR /usr/src/app
+
+EXPOSE 8080/tcp
+
+USER 65534:65534
+
+ENTRYPOINT ["/entrypoint.sh"]
+CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/supervisord.conf"]

dockerfiles/php-lol/Dockerfile.8.5

@@ -318,3 +318,50 @@ EXPOSE 80/tcp 443/tcp
 
 ENTRYPOINT ["/entrypoint.sh"]
 CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/supervisord.conf"]
+
+FROM foundation AS run-rootless
+
+ARG BUILD_DATE
+ARG VCS_REF
+ARG VERSION=8.5.10
+
+LABEL org.label-schema.build-date="$BUILD_DATE" \
+  org.label-schema.name="php-lol" \
+  org.label-schema.schema-version="1.0" \
+  org.label-schema.url="https://github.com/bdossantos/dockerfiles" \
+  org.label-schema.usage="https://github.com/bdossantos/dockerfiles" \
+  org.label-schema.vcs-ref="$VCS_REF" \
+  org.label-schema.vcs-url="https://github.com/bdossantos/dockerfiles" \
+  org.label-schema.vendor="PHP" \
+  org.label-schema.version="$VERSION" \
+  org.opencontainers.image.created="$BUILD_DATE" \
+  org.opencontainers.image.documentation="https://github.com/bdossantos/dockerfiles" \
+  org.opencontainers.image.revision="$VCS_REF" \
+  org.opencontainers.image.source="https://github.com/bdossantos/dockerfiles" \
+  org.opencontainers.image.title="php-lol" \
+  org.opencontainers.image.url="https://github.com/bdossantos/dockerfiles" \
+  org.opencontainers.image.vendor="PHP" \
+  org.opencontainers.image.version="$VERSION"
+
+COPY app.rootless.conf /etc/supervisor/conf.d/app.conf
+COPY nginx.rootless.conf /etc/nginx/nginx.conf
+COPY supervisord.rootless.conf /etc/supervisor/supervisord.conf
+COPY zzz-php-fpm-tuning.rootless.conf /usr/local/etc/php-fpm.d/zzz-php-fpm-tuning.conf
+
+RUN chown -R 65534:65534 \
+  /var/cache/nginx \
+  /var/lib/php/session \
+  && chmod 0444 \
+    /etc/nginx/nginx.conf \
+    /etc/supervisor/conf.d/app.conf \
+    /etc/supervisor/supervisord.conf \
+    /usr/local/etc/php-fpm.d/zzz-php-fpm-tuning.conf
+
+WORKDIR /usr/src/app
+
+EXPOSE 8080/tcp
+
+USER 65534:65534
+
+ENTRYPOINT ["/entrypoint.sh"]
+CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/supervisord.conf"]

dockerfiles/php-lol/app.rootless.conf

@@ -0,0 +1,17 @@
+[program:php-fpm]
+command = /usr/local/sbin/php-fpm -F -y /usr/local/etc/php-fpm.conf
+stdout_logfile = /dev/stdout
+stdout_logfile_maxbytes = 0
+redirect_stderr = true
+autostart = true
+autorestart = true
+priority = 5
+
+[program:nginx]
+command = /usr/sbin/nginx -g "daemon off;"
+stdout_logfile = /dev/stdout
+stdout_logfile_maxbytes = 0
+redirect_stderr = true
+autostart = true
+autorestart = true
+priority = 10