8.5.10

⚠️ Upgrade notes

This release is the delivery of a full audit pass: 22 pull requests, most of them defects found by
measuring the published 8.5.9 image. Several of them change observable behaviour. Read this list
before rolling it out.

Actions that may be required

• docker run --read-only without mounts now refuses to start. The image no longer declares
  VOLUME, so the four runtime paths — /opt/etc, /opt/sbin, /app/tmp, /app/var — are yours
  to provide. The entrypoint names each unusable path and prints the exact --tmpfs line to add; on
  Kubernetes/OpenShift, mount an emptyDir at each. A container started without --read-only keeps
  working unchanged.
• Apache monitoring endpoints moved off the application port. /server-status, /status and
  /real-time-status are served on 9090, as nginx already did — they answer 404 on 9000. Any
  scrape targeting :9000/server-status has to move to :9090, and that port must not be published
  by a Service or a Route.
• The nginx monitoring port serves monitoring and nothing else. It used to fall back to the
  application docroot with no PHP handler, so :9090/secret.php returned the file as source and
  :9090/.env returned its contents, neither behind MONITORING_ALLOW. Everything but the exact
  endpoints is now 404, and dotfiles are denied on the application port too — a deployment that
  legitimately served a dotfile from the docroot needs to move it.
• php-fpm now drains in-flight requests, and that takes time. Rollouts, scale-downs and
  evictions used to cut running requests (HTTP 502); the master now waits up to 15s. Kubernetes and
  OpenShift need nothing (terminationGracePeriodSeconds defaults to 30), but a plain
  docker stop wants -t 30 and compose wants stop_grace_period: 30s, otherwise a long request
  is killed at 10s with exit 137. Lower PHP_FPM_PROCESS_CONTROL_TIMEOUT to cap the wait.
• Any exit of nginx, php-fpm or apache stops the container, including exit code 0. A SIGTERM
  sent to the php-fpm master from outside supervisor used to leave the container up with no php-fpm
  behind the web server. supervisorctl stop and a normal shutdown are unaffected.
• A variable set by a late init hook no longer reaches the application. Late hooks now run as
  child processes, so a hook ending in exit 0 no longer kills the container silently and a failing
  one is reported with its name and status. To inject a variable, use an early hook — those are
  still sourced.
• The php-fpm slowlog is php-fpm-slow.log, no longer php-fpm.log.slow: the old name fell
  outside the *.log rotation glob and was never rotated. Update any collector that names it.

Changes you get for free, but should know about

• nginx worker count now follows the container's CPU quota instead of the host's core count: a
  500m limit gives 1 worker, not 8. NGINX_WORKER_PROCESSES overrides it.
• The FastCGI buffer knobs are wired. NGINX_FASTCGI_BUFFER_SIZE and friends were declared,
  documented, and read by no template — a response header above 4 KB answered 502, and raising the
  documented variable changed nothing. They now take effect.
• PHP requests are logged. nginx had access_log off in the PHP location and the apache vhost
  logged to /dev/null; both are fixed, so expect roughly one additional access-log line per PHP
  request.
• nginx front-controller routing works: /index.php/fr/blog reaches the application with
  PATH_INFO set, gzip is actually applied, and client_max_body_size no longer contradicts PHP's
  upload_max_filesize.
• The runtime directories accept an arbitrary uid:gid. -u 1000:1000 — a bare uid with a
  matching gid, as id -u/id -g produce — failed to start; the runtime paths are now sticky
  world-writable, and nothing outside them is.

---

What's Changed

• ci: build pull requests targeting a version branch by @zebby76 in #44
• test: run the image suites in CI and pin them to the build under test by @zebby76 in #47
• fix(nginx): serve only the monitoring endpoints on the monitoring port by @zebby76 in #48
• fix(apache): harden the default configuration by @zebby76 in #49
• test: adopt upstream bats-assert and cover the apache hardening by @zebby76 in #51
• fix(fpm): let php-fpm drain in-flight requests on shutdown by @zebby76 in #55
• fix(nginx): wire the fastcgi buffer settings by @zebby76 in #57
• fix(logrotate): keep directive arguments intact and validate the config at boot by @zebby76 in #58
• fix(supervisor): treat any exit of a critical program as fatal by @zebby76 in #59
• fix(logging): log PHP requests and the default apache vhost by @zebby76 in #60
• chore(supervisor): quieten the startup and tick logging by @zebby76 in #62
• chore(nginx): correct the default tuning by @zebby76 in #63
• fix(app-init): serialise the run-once hooks and document them by @zebby76 in #64
• docs: correct the drifted documentation, and narrow the rendered credentials by @zebby76 in #65
• chore(logrotate): make the default value show the separator it documents by @zebby76 in #67
• fix(php): render the PHP configuration idempotently on a reused /opt/etc by @zebby76 in #69
• fix(aws): complete the file-based configuration and make the CLI wrapper dependable by @zebby76 in #71
• fix(image): drop the VOLUME declarations and fail loudly on an unusable runtime path by @zebby76 in #73
• fix(app-init): run the late hooks as child processes by @zebby76 in #75
• fix(apache): move the monitoring endpoints off the application port by @zebby76 in #77
• fix(logrotate): rotate the php-fpm slowlog and let stanzas be added by @zebby76 in #79
• fix(image): let the runtime directories accept an arbitrary uid:gid by @zebby76 in #81

Full Changelog: 8.5.9...8.5.10