Repository navigation
Investigating rootless variant for php-lol images - #378
bdossantos with Copilot wants to merge 3 commits into
Conversation
Co-authored-by: bdossantos <[email protected]>
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The default target breaks publishing for non-PHP images, and the rootless variants have unresolved build behavior and validation gaps.
Review effort: Balanced
Findings: 1
Open (4)
What changed in this PR
This PR adds rootless variants of the PHP-FPM/Nginx images while keeping the existing images available.
Changes:
- Adds UID 65534, port 8080 targets for PHP 8.3, 8.4, and 8.5.
- Adds rootless publishing and build-target selection.
- Documents the new tags and preserves regular targets in CI Compose.
| File | Description |
|---|---|
| README.md | Documents rootless tags and port 8080. |
| dockerfiles/php-lol/Dockerfile.8.5 | Adds the PHP 8.5 rootless target. |
| dockerfiles/php-lol/Dockerfile.8.4 | Adds the PHP 8.4 rootless target. |
| dockerfiles/php-lol/Dockerfile.8.3 | Adds the PHP 8.3 rootless target. |
| docker-compose.ci.yml | Selects regular PHP build targets. |
| .github/workflows/cd.yml | Adds rootless build and publishing jobs. |
| .github/actions/docker/action.yml | Adds target and tag-suffix inputs. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| with: | ||
| dockerfile: ${{ matrix.dockerfile }} | ||
| registry_password: ${{ secrets.DOCKERHUB_TOKEN }} | ||
| target: rootless |
There was a problem hiding this comment.
Added a CI step that builds each rootless variant (8.3/8.4/8.5), checks the user is 65534:65534, runs it read-only and waits for nginx on 8080 (e5bcb70). I couldn't run Docker here, so this step hasn't run yet.
| dockerfile: ${{ matrix.dockerfile }} | ||
| registry_password: ${{ secrets.DOCKERHUB_TOKEN }} | ||
| target: rootless | ||
| tag_suffix: -rootless |
There was a problem hiding this comment.
latest-rootless is now published only from PHP 8.5, via a new tag_latest action input. Version-specific rootless tags are still published for all versions (e5bcb70).
| # Same as "run", but the whole process tree (supervisord, php-fpm, nginx) runs | ||
| # as 65534:65534 and nginx listens on unprivileged port 8080. | ||
| # | ||
| FROM run AS rootless |
There was a problem hiding this comment.
In all three Dockerfiles, both variants now branch from a shared runtime stage. rootless exposes only 8080, and run is the final stage and exposes 80/443, so plain docker build gives the port-80 image again (e5bcb70). I couldn't run Docker here, so the Dockerfiles haven't been built.
Co-authored-by: bdossantos <[email protected]>
…test-rootless Co-authored-by: bdossantos <[email protected]>
Pull request created by AI Agent