Skip to content

v5.1.0

Choose a tag to compare

View all tags
@jaydrogers jaydrogers released this 04 Nov 17:05
· 2 commits to main since this release
Immutable release. Only release title and notes can be modified.
v5.1.0
32543de

🤩 What's new

PHP security releases land much faster (#739, #742)

During the last critical PHP release (#721), we waited hours for Docker Hub's php images, then PECL went down. We now compile PHP ourselves with the same Dockerfiles as the official images, so neither one can hold up a release. A new hourly check starts a build as soon as php.net lists a patch, on any day of the week.

From php.net to your image
Before php.net → wait ~4 hours for Docker Hub's php images → PECL → wait for our next release or Tuesday rebuild
After php.net → about an hour later, we compile PHP and publish

Every build also starts from current Debian and Alpine packages, so OS security fixes reach your image on the weekly rebuild (Tuesday 08:00 UTC). PHP 8.1 benefits most: its official images haven't been rebuilt since it reached end of life.

Verify that an image came from us (#742)

Every image is now signed with cosign and ships with an SBOM (every package inside it) and build provenance (how and where it was built). Check an image before you run it:

cosign verify serversideup/php:8.5-cli \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github\.com/serversideup/docker-php/\.github/workflows/service_publish-images\.yml@refs/(heads/main|tags/v.+)$'

Images published before 5.1 have provenance but no signature or SBOM. See Verifying images.

Every image is scanned for vulnerabilities (#742)

After every production build, Grype scans each published image. The results are on each run's summary page. You can see the known vulnerabilities in any image without running a scanner yourself. See Vulnerability scanning.

PHP 8.6 release candidates (#698, #739)

Test your app on PHP 8.6 before it ships. Every rebuild uses the newest release candidate on php.net, so a new RC arrives with the next weekly rebuild. These tags are for testing only.

serversideup/php:8.6-rc-fpm-nginx

New docs

The docs have been optimized from top to bottom. Every environment variable and helper command is now in a searchable reference, generated from the same data our CI checks against the code. Upgrading, Security, and Troubleshooting each have their own section. Every old URL redirects to its new page.

⬆️ Upgrading

Nothing to change. Every existing tag is still published and the images behave the same. Three things you may notice:

  • php -v now says Built by Server Side Up instead of Built by https://github.com/docker-library/php
  • install-php-extensions is upgraded from 2.12.0 to 2.12.6
  • If you run docker-php-serversideup-install-php-ext-installer without a version in your own Dockerfile, it now installs the latest release instead of 2.12.0. Pass a version to pin it.

🐛 Bug fixes

  • docker-php-serversideup-download printed every shell option to stdout before the file when you didn't give it an output file (#739)
  • FrankenPHP exited at start-up, logging no error, when CADDY_AUTO_HTTPS was disable_redirects, disable_certs, or ignore_loaded_certs and SSL_MODE was mixed or full
  • docker-php-serversideup-set-id failed the build with "UID already in use" when another user in the image already had the UID you passed, because it moved the wrong user. It now moves the other user or group to 99<id> and gives yours the ID you asked for

🏗️ For contributors

  • Every pinned version lives in scripts/conf/php-versions-base-config.yml, and Renovate replaces Dependabot to keep them current (#739)
  • scripts/dev.sh --build-php-base builds exactly what CI builds. See Build an image
  • Every GitHub Action is pinned to a commit SHA, so a moved tag can't change what runs in CI. A new zizmor lint checks the workflows on every PR, and an OpenSSF Scorecard badge tracks our supply chain practices (#742)
  • Image tests are split into one file per feature area in scripts/tests/image/, and every failure shows up in one run. New tests cover Laravel automations, startup scripts, SSL modes, trusted proxies, PHP-FPM pool variables, file permissions, and shutdown (#741)
  • Failed CI runs now actually retry once on their own (#739)
  • Building src/variations/*/Dockerfile directly now needs the dependency build args from scripts/conf/php-versions-base-config.yml, so use scripts/dev.sh

Full Changelog: v5.0.5...v5.1.0

Assets 3
Loading