11# =============================================================================
22# jdeathe/centos-ssh-apache-php-fcgi
33#
4- # CentOS-6 , Apache 2.2 , PHP 5.3 , PHP Memcached 1.0, PHP APC 3.1 .
4+ # CentOS-7 , Apache 2.4 , PHP 5.4 , PHP Memcached 2.2, Zend Opcache .
55#
66# =============================================================================
7- FROM jdeathe/centos-ssh-apache-php:1.11.0
7+ # FROM jdeathe/centos-ssh-apache-php:1.11.0
8+ FROM jdeathe/centos-ssh:2.4.0
9+
10+ # Use the form ([{fqdn}-]{package-name}|[{fqdn}-]{provider-name})
11+ ARG PACKAGE_NAME="app"
12+ ARG PACKAGE_PATH="/opt/${PACKAGE_NAME}"
13+ ARG PACKAGE_RELEASE_VERSION="0.10.0"
814
915# -----------------------------------------------------------------------------
1016# FastCGI support
1117# -----------------------------------------------------------------------------
1218RUN rpm --rebuilddb \
13- && yum -y erase \
14- php-5.3.3-49.el6 \
1519 && yum -y install \
1620 --setopt=tsflags=nodocs \
1721 --disableplugin=fastestmirror \
18- fcgi-2.4.0-12.el6 \
19- mod_fcgid-2.3.9-1.el6 \
22+ elinks-0.12-0.37.pre6.el7 \
23+ fcgi-2.4.0-25.el7 \
24+ httpd-2.4.6-80.el7.centos.1 \
25+ httpd-tools-2.4.6-80.el7.centos.1 \
26+ mod_fcgid-2.3.9-4.el7_4.1 \
27+ mod_ssl-2.4.6-80.el7.centos.1 \
28+ php-cli-5.4.16-45.el7 \
29+ php-pecl-zendopcache-7.0.5-2.el7 \
30+ php-pecl-memcached-2.2.0-1.el7 \
2031 && yum versionlock add \
32+ elinks \
2133 fcgi \
34+ httpd-* \
2235 mod_fcgid \
36+ mod_ssl \
37+ php-* \
2338 && rm -rf /var/cache/yum/* \
2439 && yum clean all
2540
41+ # -----------------------------------------------------------------------------
42+ # Global Apache configuration changes
43+ # - Disable Apache directory indexes and welcome page.
44+ # - Disable Apache language based content negotiation.
45+ # - Custom Apache configuration.
46+ # -----------------------------------------------------------------------------
47+ RUN cp -pf \
48+ /etc/httpd/conf/httpd.conf \
49+ /etc/httpd/conf/httpd.conf.default \
50+ && sed -i \
51+ -e '/^KeepAlive .*$/d' \
52+ -e '/^MaxKeepAliveRequests .*$/d' \
53+ -e '/^KeepAliveTimeout .*$/d' \
54+ -e '/^ServerSignature On$/d' \
55+ -e '/^ServerTokens OS$/d' \
56+ -e 's~^NameVirtualHost \( .*\) $~#NameVirtualHost \1 ~g' \
57+ -e 's~^User .*$~User ${APACHE_RUN_USER}~g' \
58+ -e 's~^Group .*$~Group ${APACHE_RUN_GROUP}~g' \
59+ -e 's~^DocumentRoot \( .*\) $~#DocumentRoot \1 ~g' \
60+ -e 's~^IndexOptions \( .*\) $~#IndexOptions \1 ~g' \
61+ -e 's~^IndexIgnore \( .*\) $~#IndexIgnore \1 ~g' \
62+ -e 's~^AddIconByEncoding \( .*\) $~#AddIconByEncoding \1 ~g' \
63+ -e 's~^AddIconByType \( .*\) $~#AddIconByType \1 ~g' \
64+ -e 's~^AddIcon \( .*\) $~#AddIcon \1 ~g' \
65+ -e 's~^DefaultIcon \( .*\) $~#DefaultIcon \1 ~g' \
66+ -e 's~^ReadmeName \( .*\) $~#ReadmeName \1 ~g' \
67+ -e 's~^HeaderName \( .*\) $~#HeaderName \1 ~g' \
68+ -e 's~^\( Alias /icons/ ".*"\) $~#\1 ~' \
69+ -e '/<Directory "\/ var\/ www\/ icons">/,/#<\/ Directory>/ s~^~#~' \
70+ -e 's~^LanguagePriority \( .*\) $~#LanguagePriority \1 ~g' \
71+ -e 's~^ForceLanguagePriority \( .*\) $~#ForceLanguagePriority \1 ~g' \
72+ -e 's~^AddLanguage \( .*\) $~#AddLanguage \1 ~g' \
73+ /etc/httpd/conf/httpd.conf \
74+ && truncate -s 0 \
75+ /etc/httpd/conf.d/autoindex.conf \
76+ && chmod 444 \
77+ /etc/httpd/conf.d/autoindex.conf \
78+ && truncate -s 0 \
79+ /etc/httpd/conf.d/welcome.conf \
80+ && chmod 444 \
81+ /etc/httpd/conf.d/welcome.conf \
82+ && { \
83+ echo '' ; \
84+ echo '#' ; \
85+ echo '# Custom configuration' ; \
86+ echo '#' ; \
87+ echo 'KeepAlive On' ; \
88+ echo 'MaxKeepAliveRequests 200' ; \
89+ echo 'KeepAliveTimeout 2' ; \
90+ echo 'LogFormat \' ; \
91+ echo ' "%{X-Forwarded-For}i %l %u %t \" %r\" %>s %b \" %{Referer}i\" \" %{User-Agent}i\" " \' ; \
92+ echo ' forwarded_for_combined' ; \
93+ echo 'Include /etc/services-config/httpd/conf.d/*.conf' ; \
94+ echo 'ExtendedStatus Off' ; \
95+ echo 'Listen 8443' ; \
96+ echo 'Options -Indexes' ; \
97+ echo 'ServerSignature Off' ; \
98+ echo 'ServerTokens Prod' ; \
99+ echo 'TraceEnable Off' ; \
100+ echo 'UseCanonicalName On' ; \
101+ echo 'UseCanonicalPhysicalPort On' ; \
102+ } >> /etc/httpd/conf/httpd.conf
103+
104+ # -----------------------------------------------------------------------------
105+ # Disable all Apache modules and enable the minimum
106+ # -----------------------------------------------------------------------------
107+ RUN sed -i \
108+ -e 's~^\( LoadModule .*\) $~#\1 ~g' \
109+ -e 's~^#\( LoadModule mime_module .*\) $~\1 ~' \
110+ -e 's~^#\( LoadModule log_config_module .*\) $~\1 ~' \
111+ -e 's~^#\( LoadModule setenvif_module .*\) $~\1 ~' \
112+ -e 's~^#\( LoadModule status_module .*\) $~\1 ~' \
113+ -e 's~^#\( LoadModule authz_host_module .*\) $~\1 ~' \
114+ -e 's~^#\( LoadModule dir_module .*\) $~\1 ~' \
115+ -e 's~^#\( LoadModule alias_module .*\) $~\1 ~' \
116+ -e 's~^#\( LoadModule expires_module .*\) $~\1 ~' \
117+ -e 's~^#\( LoadModule deflate_module .*\) $~\1 ~' \
118+ -e 's~^#\( LoadModule headers_module .*\) $~\1 ~' \
119+ -e 's~^#\( LoadModule alias_module .*\) $~\1 ~' \
120+ -e 's~^#\( LoadModule version_module .*\) $~\1 ~' \
121+ /etc/httpd/conf.modules.d/00-base.conf \
122+ /etc/httpd/conf.modules.d/00-dav.conf \
123+ /etc/httpd/conf.modules.d/00-lua.conf \
124+ /etc/httpd/conf.modules.d/00-proxy.conf \
125+ /etc/httpd/conf.modules.d/00-ssl.conf \
126+ /etc/httpd/conf.modules.d/00-systemd.conf
127+
128+ # -----------------------------------------------------------------------------
129+ # Disable SSL + the default SSL Virtual Host
130+ # -----------------------------------------------------------------------------
131+ RUN sed -ri \
132+ -e '/<VirtualHost _default_:443>/,/<\/ VirtualHost>/ s~^~#~' \
133+ -e 's~(SSLSessionCacheTimeout.*)$~\1\n\n SSLUseStapling on\n SSLStaplingCache shmcb:/run/httpd/sslstaplingcache(512000)\n SSLStaplingResponderTimeout 5\n SSLStaplingReturnResponderErrors off~' \
134+ /etc/httpd/conf.d/ssl.conf \
135+ && cat \
136+ /etc/httpd/conf.d/ssl.conf \
137+ > /etc/httpd/conf.d/ssl.conf.off \
138+ && > \
139+ /etc/httpd/conf.d/ssl.conf \
140+ && chmod 444 \
141+ /etc/httpd/conf.d/ssl.conf
142+
143+ # -----------------------------------------------------------------------------
144+ # Limit threads for the application user
145+ # -----------------------------------------------------------------------------
146+ RUN { \
147+ echo '' ; \
148+ echo -e '@apache\t soft\t nproc\t 85' ; \
149+ echo -e '@apache\t hard\t nproc\t 170' ; \
150+ } >> /etc/security/limits.conf
151+
152+ # -----------------------------------------------------------------------------
153+ # Global PHP configuration changes
154+ # -----------------------------------------------------------------------------
155+ RUN sed \
156+ -e 's~^; .*$~~' \
157+ -e 's~^;*$~~' \
158+ -e '/^$/d' \
159+ -e 's~^\[ ~\n\[ ~g' \
160+ /etc/php.ini \
161+ > /etc/php.d/00-php.ini.default \
162+ && sed -r \
163+ -e 's~^;(user_ini.filename =)$~\1 ~g' \
164+ -e 's~^;(cgi.fix_pathinfo=1)$~\1 ~g' \
165+ -e 's~^;(date.timezone =)$~\1 UTC~g' \
166+ -e 's~^(expose_php = )On$~\1 Off~g' \
167+ -e 's~^;(realpath_cache_size = ).*$~\1 4096k~' \
168+ -e 's~^;(realpath_cache_ttl = ).*$~\1 600~' \
169+ -e 's~^;?(session.name = ).*$~\1 "${PHP_OPTIONS_SESSION_NAME:-PHPSESSID}"~' \
170+ -e 's~^;?(session.save_handler = ).*$~\1 "${PHP_OPTIONS_SESSION_SAVE_HANDLER:-files}"~' \
171+ -e 's~^;?(session.save_path = ).*$~\1 "${PHP_OPTIONS_SESSION_SAVE_PATH:-/var/lib/php/session}"~' \
172+ /etc/php.d/00-php.ini.default \
173+ > /etc/php.d/00-php.ini \
174+ && sed \
175+ -e 's~^; .*$~~' \
176+ -e 's~^;*$~~' \
177+ -e '/^$/d' \
178+ -e 's~^\[ ~\n\[ ~g' \
179+ /etc/php.d/opcache.ini \
180+ > /etc/php.d/opcache.ini.default \
181+ && sed \
182+ -e 's~^;\( opcache.enable_cli=\) .*$~\1 1~g' \
183+ -e 's~^\( opcache.max_accelerated_files=\) .*$~\1 32531~g' \
184+ -e 's~^;\( opcache.validate_timestamps=\) .*$~\1 0~g' \
185+ /etc/php.d/opcache.ini.default \
186+ > /etc/php.d/opcache.ini
187+
188+ # -----------------------------------------------------------------------------
189+ # Add default system users
190+ # -----------------------------------------------------------------------------
191+ RUN useradd -r -M -d /var/www/app -s /sbin/nologin app \
192+ && useradd -r -M -d /var/www/app -s /sbin/nologin -G apache,app app-www \
193+ && usermod -a -G app-www app \
194+ && usermod -a -G app-www,app apache
195+
26196# -----------------------------------------------------------------------------
27197# Copy files into place
28198# -----------------------------------------------------------------------------
199+ ADD src/usr/bin \
200+ /usr/bin/
201+ ADD src/usr/sbin \
202+ /usr/sbin/
29203ADD src/opt/scmi \
30204 /opt/scmi/
205+ ADD src/etc/profile.d \
206+ /etc/profile.d/
31207ADD src/etc/systemd/system \
32208 /etc/systemd/system/
209+ ADD src/etc/services-config/httpd/httpd-bootstrap.conf \
210+ /etc/services-config/httpd/
211+ ADD src/etc/services-config/httpd/conf.d/*.conf \
212+ /etc/services-config/httpd/conf.d/
213+ ADD src/etc/services-config/httpd/conf.virtualhost.d/*.conf \
214+ /etc/services-config/httpd/conf.virtualhost.d/
215+ ADD src/etc/services-config/supervisor/supervisord.d \
216+ /etc/services-config/supervisor/supervisord.d/
217+
218+ RUN mkdir -p \
219+ /etc/services-config/{httpd/{conf,conf.d,conf.virtualhost.d},ssl/{certs,private}} \
220+ && cp \
221+ /etc/httpd/conf/httpd.conf \
222+ /etc/services-config/httpd/conf/ \
223+ && ln -sf \
224+ /etc/services-config/httpd/conf.virtualhost.d \
225+ /etc/httpd/conf.virtualhost.d \
226+ && ln -sf \
227+ /etc/services-config/httpd/httpd-bootstrap.conf \
228+ /etc/httpd-bootstrap.conf \
229+ && ln -sf \
230+ /etc/services-config/httpd/conf/httpd.conf \
231+ /etc/httpd/conf/httpd.conf \
232+ && ln -sf \
233+ /etc/services-config/ssl/certs/localhost.crt \
234+ /etc/pki/tls/certs/localhost.crt \
235+ && ln -sf \
236+ /etc/services-config/supervisor/supervisord.conf \
237+ /etc/supervisord.conf \
238+ && ln -sf \
239+ /etc/services-config/supervisor/supervisord.d/httpd-bootstrap.conf \
240+ /etc/supervisord.d/httpd-bootstrap.conf \
241+ && ln -sf \
242+ /etc/services-config/supervisor/supervisord.d/httpd-wrapper.conf \
243+ /etc/supervisord.d/httpd-wrapper.conf \
244+ && chmod 700 \
245+ /usr/{bin/healthcheck,sbin/httpd-{bootstrap,startup,wrapper}}
33246
34247# -----------------------------------------------------------------------------
35248# Package installation
36249# -----------------------------------------------------------------------------
250+ RUN mkdir -p -m 750 ${PACKAGE_PATH} \
251+ && curl -Ls \
252+ https://github.com/jdeathe/php-hello-world/archive/${PACKAGE_RELEASE_VERSION}.tar.gz \
253+ | tar -xzpf - \
254+ --strip-components=1 \
255+ --exclude="*.gitkeep" \
256+ -C ${PACKAGE_PATH} \
257+ && sed -i \
258+ -e 's~^description =.*$~description = "This CentOS / Apache / PHP-CGI (FastCGI) service is running in a container."~' \
259+ ${PACKAGE_PATH}/etc/views/index.ini \
260+ && mv \
261+ ${PACKAGE_PATH}/public \
262+ ${PACKAGE_PATH}/public_html \
263+ && $(\
264+ if [[ -f /usr/share/php-pecl-apc/apc.php ]]; then \
265+ cp \
266+ /usr/share/php-pecl-apc/apc.php \
267+ ${PACKAGE_PATH}/public_html/_apc.php; \
268+ fi \
269+ ) \
270+ && chown -R app:app-www ${PACKAGE_PATH} \
271+ && find ${PACKAGE_PATH} -type d -exec chmod 750 {} + \
272+ && find ${PACKAGE_PATH}/var -type d -exec chmod 770 {} + \
273+ && find ${PACKAGE_PATH} -type f -exec chmod 640 {} + \
274+ && find ${PACKAGE_PATH}/bin -type f -exec chmod 750 {} +
275+
276+ # Fix Version requirements for setifempty Header option.
37277RUN sed -i \
38- -e 's~^description =.*$~description = "This CentOS / Apache / PHP-CGI (FastCGI) service is running in a container."~' \
39- ${PACKAGE_PATH}/etc/views/index.ini
278+ -e 's~<IfVersion < 2.4>~<IfVersion < 2.4.7>~' \
279+ -e 's~<IfVersion >= 2.4>~<IfVersion >= 2.4.7>~' \
280+ -e 's~^\(\s *Header always setifempty.*\) $~#\1 ~' \
281+ ${PACKAGE_PATH}/etc/httpd/conf.d/50-headers.conf
282+
283+ EXPOSE 80 8443 443
40284
41285# -----------------------------------------------------------------------------
42286# Set default environment variables used to configure the service container
43287# -----------------------------------------------------------------------------
44- ENV APACHE_MPM="worker"
288+ ENV APACHE_CONTENT_ROOT="/var/www/${PACKAGE_NAME}" \
289+ BASH_ENV="/usr/sbin/httpd-startup" \
290+ ENV="/usr/sbin/httpd-startup"
291+ ENV APACHE_AUTOSTART_HTTPD_BOOTSTRAP=true \
292+ APACHE_AUTOSTART_HTTPD_WRAPPER=true \
293+ APACHE_CUSTOM_LOG_FORMAT="combined" \
294+ APACHE_CUSTOM_LOG_LOCATION="var/log/apache_access_log" \
295+ APACHE_ERROR_LOG_LOCATION="var/log/apache_error_log" \
296+ APACHE_ERROR_LOG_LEVEL="warn" \
297+ APACHE_EXTENDED_STATUS_ENABLED=false \
298+ APACHE_HEADER_X_SERVICE_UID="{{HOSTNAME}}" \
299+ APACHE_LOAD_MODULES="" \
300+ APACHE_MOD_SSL_ENABLED=false \
301+ APACHE_MPM="worker" \
302+ APACHE_OPERATING_MODE="production" \
303+ APACHE_PUBLIC_DIRECTORY="public_html" \
304+ APACHE_RUN_GROUP="app-www" \
305+ APACHE_RUN_USER="app-www" \
306+ APACHE_SERVER_ALIAS="" \
307+ APACHE_SERVER_NAME="" \
308+ APACHE_SSL_CERTIFICATE="" \
309+ APACHE_SSL_CIPHER_SUITE="ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS" \
310+ APACHE_SSL_PROTOCOL="All -SSLv2 -SSLv3" \
311+ APACHE_SYSTEM_USER="app" \
312+ PACKAGE_PATH="${PACKAGE_PATH}" \
313+ PHP_OPTIONS_DATE_TIMEZONE="UTC" \
314+ PHP_OPTIONS_SESSION_NAME="PHPSESSID" \
315+ PHP_OPTIONS_SESSION_SAVE_HANDLER="files" \
316+ PHP_OPTIONS_SESSION_SAVE_PATH="var/session" \
317+ SSH_AUTOSTART_SSHD=false \
318+ SSH_AUTOSTART_SSHD_BOOTSTRAP=false
45319
46320# -----------------------------------------------------------------------------
47321# Set image metadata
48322# -----------------------------------------------------------------------------
49- ARG RELEASE_VERSION="1.11 .0"
323+ ARG RELEASE_VERSION="2.0 .0"
50324LABEL \
51325 maintainer="James Deathe <james.deathe@gmail.com>" \
52326 install="docker run \
@@ -77,6 +351,12 @@ jdeathe/centos-ssh-apache-php-fcgi:${RELEASE_VERSION} \
77351 org.deathe.license="MIT" \
78352 org.deathe.vendor="jdeathe" \
79353 org.deathe.url="https://github.com/jdeathe/centos-ssh-apache-php-fcgi" \
80- org.deathe.description="CentOS-6 6.10 x86_64 - Apache 2.2, PHP-CGI 5.3 (FastCGI), PHP memcached 1.0, PHP APC 3.1."
354+ org.deathe.description="CentOS-7 7.5.1804 x86_64 - Apache 2.4, PHP-CGI 5.4 (FastCGI), PHP memcached 2.2, Zend Opcache 7.0."
355+
356+ HEALTHCHECK \
357+ --interval=1s \
358+ --timeout=1s \
359+ --retries=10 \
360+ CMD ["/usr/bin/healthcheck" ]
81361
82362CMD ["/usr/sbin/httpd-startup" , "/usr/bin/supervisord" , "--configuration=/etc/supervisord.conf" ]
0 commit comments