2.4.2

Release Notes

This release tightens the sample Docker stack, and none of it reaches a project through composer update. Every change arrives when a project reconciles its docker/ files, .dockerignore and env templates from the sample and deploys the rebuilt image. The nginx image and the compose file change together, and neither starts with the other's previous version. A reconciled stack can come up cleanly and still behave differently: with no proxy configured, nginx trusts none.

Breaking changes — see system/docs/upgrading/2.4.2.md for the full detail and the commands to run:

• nginx trusts no proxy by default. Behind a proxy, set NGINX_TRUSTED_PROXIES to the proxy addresses before deploying, or every client appears as the proxy in logs, login lockout and IP lists, and a TLS-terminating proxy looks like plain HTTP to the app (force_https then refuses every request).
• Every compose file a server runs needs the nginx-init service, the nginx-runtime volume and nginx's non-root user: and tmpfs settings; the new image refuses to start without the render, and the old image fails on the new compose file.
• FPM's /status and /ping no longer pass through nginx, and each server needs kernel.yama.ptrace_scope at 1 or higher to silence nginx's start-up warning.

Docker & Sample Stack

• nginx no longer trusts X-Forwarded-For from every private range: the real-IP trust is rendered at start from NGINX_TRUSTED_PROXIES (empty trusts no proxy) and NGINX_REAL_IP_HEADER (default X-Forwarded-For), so one image serves any proxy topology without a rebuild and a client inside a private range can no longer choose the IP the app logs, locks out and rate-checks; the FPM /status and /ping location is removed so a substituted client IP can never open it :: commit
• nginx honors X-Forwarded-Proto only from a peer on NGINX_TRUSTED_PROXIES, through a block rendered beside the real-IP trust, so a client that reaches nginx past the edge can no longer make is_https() return true; neither raw header reaches PHP or the WebSocket server :: commit
• Render nginx's runtime config in a one-shot nginx-init into a volume that nginx mounts read-only, and have nginx refuse to start on a missing or stale render instead of serving it; nginx also warns at start when the host kernel.yama.ptrace_scope is 0 :: commit
• Run nginx entirely as uid 101 with the APP_GROUP group from compose, so a group-readable media tree (0750 directories, 0640 files) is served instead of returning 403, and no nginx process runs as root :: commit
• Put nginx on a new frontnet network shared only with php and ws, so it can no longer open connections to Valkey or the database; php and ws join both networks, and cron, cli, Valkey and the databases stay on appnet :: commit
• Narrow the .dockerignore allowlist from all of docker/ to docker/php/ and docker/nginx/, drop private/ and exclude public/media/, so a build no longer sends instance secrets, env files and uploads to the builder or bakes uploads into the image; cron now mounts MEDIA_PATH and ws no longer mounts PRIVATE_PATH :: commit
• Move nginx's dotfile deny above the /assets/ and /media/ locations, where it never matched, so a dotfile under either path is no longer served :: commit
• Read the FPM pool and memory_limit from the environment through ${VAR:-default} placeholders instead of a build-time render, so PHP_PM_MAX_CHILDREN, PHP_PM_MODE and the new PHP_MEMORY_LIMIT and PHP_CLI_MEMORY_LIMIT apply on recreate without a rebuild, and the entrypoint refuses to start on an invalid value :: commit
• Copy the PHP conf.d/ and FPM fpm.d/ files with --chmod=644, so an image built from a checkout made under umask 077 no longer ships an unreadable 10-app.ini that PHP skips without a warning, which left upload size, memory_limit and session.use_strict_mode at PHP defaults :: commit

Code Quality & Tooling

• Widen the line-ending rule in .gitattributes from a list of extensions to every text file (* text=auto eol=lf), so files the list missed, such as Markdown, no longer produce end-of-line changes, and apply it to extras/backend/application/libraries/MY_Image_lib_README.md, which is converted from CRLF to LF :: commit

Documentation

• Document the proxy-trust, non-root, network and runtime-configuration changes across the Docker server guide (server readiness, multi-hop proxy chains and single-value CDN headers), the Docker internals and tuning guides, the Docker guide and the upgrade notes :: commit · commit · commit · commit