Force php-fpm container to install a particular version of Composer 2

[rmchale258]

Hello,

I have noticed that the COMPOSER_VERSION env variable does not exactly operate as one may expect, and is really more of a switch that allows a user to specify 1 or 2, but it does not appear to translate to the actual version of Composer which is installed. For instance, when I change this variable value to 2.7 the version that ultimately ends up being installed is 1.10.27 (seemingly because some underlying logic breaks when this variable is assigned to a version which includes a decimal.

Does anybody know if I'm mistaken about this and there is another explanation for that behavior?

My reason for wanting to specify a particular version is that a project I am employed on uses Veracode to scan for security vulernabilities, and there is one detected that affects all versions prior to 2.7.0:

I know that I can update to whatever version of Composer I want from within the shell using composer selfupdate but this change is ephemeral and whenever my local environment is restarted I would have to remember to run this again once the php-fpm container reinitializes. Especially given the fact that there are many engineers working on this project I would like a way to ensure this version change applies automatically or persists for all engineers.

If this environment variable is not intended to be used like this, does anybody know of another way to accomplish that result? For example, I know that I can update to the version I want with composer selfupdate from inside the shell, perhaps there is some kind of hook I can use to force this command to run whenever the php-fpm container inits?

[navarr]

There are three available options for composer version: 1, 2, and 2.2 (LTS) - due to how the self update command works

2.7 is not currently available due to issues building the PHP images.

As a temporary workaround you could start from the warden php image, run an instruction to update composer, and build that image. You can even set that as the docker file for the php service but it does require some docker knowledge