[{"data":1,"prerenderedAt":498},["ShallowReactive",2],{"navigation":3,"/docs/security/how-images-are-built":249,"/docs/security/how-images-are-built-surround":493},[4],{"title":5,"path":6,"stem":7,"children":8},"Docs","/docs","docs",[9,12,48,77,132,160,185,206,219,236],{"title":10,"path":6,"stem":11},"","docs/index",{"title":13,"path":14,"stem":15,"children":16,"icon":47},"Getting Started","/docs/getting-started","docs/1.getting-started/1.index",[17,19,23,27,31,35,39,43],{"title":18,"path":14,"stem":15},"Introduction",{"title":20,"path":21,"stem":22},"Container basics","/docs/getting-started/container-basics","docs/1.getting-started/2.container-basics",{"title":24,"path":25,"stem":26},"Installation","/docs/getting-started/installation","docs/1.getting-started/3.installation",{"title":28,"path":29,"stem":30},"These images vs others","/docs/getting-started/these-images-vs-others","docs/1.getting-started/4.these-images-vs-others",{"title":32,"path":33,"stem":34},"Choosing an image","/docs/getting-started/choosing-an-image","docs/1.getting-started/5.choosing-an-image",{"title":36,"path":37,"stem":38},"Default configurations","/docs/getting-started/default-configurations","docs/1.getting-started/6.default-configurations",{"title":40,"path":41,"stem":42},"Migrating from official PHP images","/docs/getting-started/migrating-from-official-php-images","docs/1.getting-started/7.migrating-from-official-php-images",{"title":44,"path":45,"stem":46},"Contributing","/docs/getting-started/contributing","docs/1.getting-started/99.contributing",false,{"title":49,"path":50,"stem":51,"children":52,"page":47},"Image Variations","/docs/image-variations","docs/2.image-variations",[53,57,61,65,69,73],{"title":54,"path":55,"stem":56},"CLI","/docs/image-variations/cli","docs/2.image-variations/cli",{"title":58,"path":59,"stem":60},"FPM","/docs/image-variations/fpm","docs/2.image-variations/fpm",{"title":62,"path":63,"stem":64},"FPM-Apache","/docs/image-variations/fpm-apache","docs/2.image-variations/fpm-apache",{"title":66,"path":67,"stem":68},"FPM-NGINX","/docs/image-variations/fpm-nginx","docs/2.image-variations/fpm-nginx",{"title":70,"path":71,"stem":72},"FrankenPHP","/docs/image-variations/frankenphp","docs/2.image-variations/frankenphp",{"title":74,"path":75,"stem":76},"NGINX Unit (removed)","/docs/image-variations/unit","docs/2.image-variations/unit",{"title":78,"path":79,"stem":80,"children":81,"page":47},"Framework Guides","/docs/framework-guides","docs/3.framework-guides",[82,123],{"title":83,"icon":47,"defaultOpen":47,"path":84,"stem":85,"children":86,"page":47},"Laravel","/docs/framework-guides/laravel","docs/3.framework-guides/1.laravel",[87,91,95,99,103,107,111,115,119],{"title":88,"path":89,"stem":90},"Automations","/docs/framework-guides/laravel/automations","docs/3.framework-guides/1.laravel/1.automations",{"title":92,"path":93,"stem":94},"Running workers","/docs/framework-guides/laravel/workers","docs/3.framework-guides/1.laravel/2.workers",{"title":96,"path":97,"stem":98},"Health checks","/docs/framework-guides/laravel/health-checks","docs/3.framework-guides/1.laravel/3.health-checks",{"title":100,"path":101,"stem":102},"Horizon","/docs/framework-guides/laravel/horizon","docs/3.framework-guides/1.laravel/4.horizon",{"title":104,"path":105,"stem":106},"Nightwatch","/docs/framework-guides/laravel/nightwatch","docs/3.framework-guides/1.laravel/5.nightwatch",{"title":108,"path":109,"stem":110},"Octane","/docs/framework-guides/laravel/octane","docs/3.framework-guides/1.laravel/6.octane",{"title":112,"path":113,"stem":114},"Queue","/docs/framework-guides/laravel/queue","docs/3.framework-guides/1.laravel/7.queue",{"title":116,"path":117,"stem":118},"Reverb","/docs/framework-guides/laravel/reverb","docs/3.framework-guides/1.laravel/8.reverb",{"title":120,"path":121,"stem":122},"Task scheduler","/docs/framework-guides/laravel/task-scheduler","docs/3.framework-guides/1.laravel/9.task-scheduler",{"title":124,"icon":47,"defaultOpen":47,"path":125,"stem":126,"children":127,"page":47},"WordPress","/docs/framework-guides/wordpress","docs/3.framework-guides/2.wordpress",[128],{"title":129,"path":130,"stem":131},"Using WordPress with Docker","/docs/framework-guides/wordpress/using-wordpress-with-docker","docs/3.framework-guides/2.wordpress/4.using-wordpress-with-docker",{"title":133,"path":134,"stem":135,"children":136,"page":47},"Deployment And Production","/docs/deployment-and-production","docs/4.deployment-and-production",[137,141,145,148,152,156],{"title":138,"path":139,"stem":140},"Packaging your app for deployment","/docs/deployment-and-production/packaging-your-app-for-deployment","docs/4.deployment-and-production/1.packaging-your-app-for-deployment",{"title":142,"path":143,"stem":144},"Configuring SSL","/docs/deployment-and-production/configuring-ssl","docs/4.deployment-and-production/2.configuring-ssl",{"title":96,"path":146,"stem":147},"/docs/deployment-and-production/health-checks","docs/4.deployment-and-production/3.health-checks",{"title":149,"path":150,"stem":151},"Configuring trusted proxies","/docs/deployment-and-production/configuring-trusted-proxies","docs/4.deployment-and-production/4.configuring-trusted-proxies",{"title":153,"path":154,"stem":155},"Production performance tuning","/docs/deployment-and-production/production-performance-tuning","docs/4.deployment-and-production/5.production-performance-tuning",{"title":157,"path":158,"stem":159},"Choosing a host","/docs/deployment-and-production/choosing-a-host","docs/4.deployment-and-production/6.choosing-a-host",{"title":161,"icon":47,"defaultOpen":47,"path":162,"stem":163,"children":164,"page":47},"Customization","/docs/customizing-the-image","docs/5.customizing-the-image",[165,169,173,177,181],{"title":166,"path":167,"stem":168},"Changing php.ini settings","/docs/customizing-the-image/changing-common-php-settings","docs/5.customizing-the-image/1.changing-common-php-settings",{"title":170,"path":171,"stem":172},"Installing PHP extensions","/docs/customizing-the-image/installing-additional-php-extensions","docs/5.customizing-the-image/2.installing-additional-php-extensions",{"title":174,"path":175,"stem":176},"Adding start up scripts","/docs/customizing-the-image/adding-your-own-start-up-scripts","docs/5.customizing-the-image/3.adding-your-own-start-up-scripts",{"title":178,"path":179,"stem":180},"Using S6 Overlay","/docs/customizing-the-image/using-s6-overlay","docs/5.customizing-the-image/4.using-s6-overlay",{"title":182,"path":183,"stem":184},"Understanding file permissions","/docs/customizing-the-image/understanding-file-permissions","docs/5.customizing-the-image/5.understanding-file-permissions",{"title":186,"icon":47,"defaultOpen":47,"path":187,"stem":188,"children":189,"page":47},"Upgrading","/docs/upgrading","docs/6.upgrading",[190,194,198,202],{"title":191,"path":192,"stem":193},"Upgrade guide","/docs/upgrading/upgrade-guide","docs/6.upgrading/1.upgrade-guide",{"title":195,"path":196,"stem":197},"Upgrade to v5","/docs/upgrading/upgrade-to-v5","docs/6.upgrading/2.upgrade-to-v5",{"title":199,"path":200,"stem":201},"Upgrade to v4","/docs/upgrading/upgrade-to-v4","docs/6.upgrading/3.upgrade-to-v4",{"title":203,"path":204,"stem":205},"Upgrade to v3","/docs/upgrading/upgrade-to-v3","docs/6.upgrading/4.upgrade-to-v3",{"title":207,"path":208,"stem":209,"children":210,"page":47},"Troubleshooting","/docs/troubleshooting","docs/7.troubleshooting",[211,215],{"title":212,"path":213,"stem":214},"Common issues","/docs/troubleshooting/common-issues","docs/7.troubleshooting/1.common-issues",{"title":216,"path":217,"stem":218},"Getting help","/docs/troubleshooting/getting-help","docs/7.troubleshooting/2.getting-help",{"title":220,"path":221,"stem":222,"children":223,"page":47},"Security","/docs/security","docs/8.security",[224,228,232],{"title":225,"path":226,"stem":227},"How images are built","/docs/security/how-images-are-built","docs/8.security/1.how-images-are-built",{"title":229,"path":230,"stem":231},"Verifying images","/docs/security/verifying-images","docs/8.security/2.verifying-images",{"title":233,"path":234,"stem":235},"Vulnerability scanning","/docs/security/vulnerability-scanning","docs/8.security/3.vulnerability-scanning",{"title":237,"path":238,"stem":239,"children":240,"page":47},"Reference","/docs/reference","docs/9.reference",[241,245],{"title":242,"path":243,"stem":244},"Environment variable specification","/docs/reference/environment-variable-specification","docs/9.reference/1.environment-variable-specification",{"title":246,"path":247,"stem":248},"Command reference","/docs/reference/command-reference","docs/9.reference/2.command-reference",{"id":250,"title":225,"body":251,"description":484,"extension":485,"links":486,"meta":487,"navigation":490,"path":226,"redirect":486,"seo":491,"stem":227,"__hash__":492},"docs/docs/8.security/1.how-images-are-built.md",{"type":252,"value":253,"toc":474},"minimark",[254,261,266,278,290,294,303,318,322,339,396,403,407,418,421,425,434,444,448,464,468],[255,256,257],"lead-p",{},[258,259,260],"p",{},"You're about to run our images in production. You should be able to see exactly how they're made. Every image is built in public, tested before anyone can pull it, and signed so you can prove where it came from.",[262,263,265],"h2",{"id":264},"built-in-public-never-on-a-laptop","Built in public, never on a laptop",[258,267,268,269,277],{},"Every published image comes from ",[270,271,276],"a",{"href":272,"rel":273,"target":275},"https://github.com/serversideup/docker-php/actions",[274],"nofollow","_blank","GitHub Actions"," in this repository. Images are never built or pushed from a local machine. The logs of every run are public.",[258,279,280,281,289],{},"The workflows in ",[270,282,285],{"href":283,"rel":284,"target":275},"https://github.com/serversideup/docker-php/tree/main/.github/workflows",[274],[286,287,288],"code",{},".github/workflows/"," are the full recipe. This page is the short version.",[262,291,293],{"id":292},"the-same-php-as-the-official-images","The same PHP as the official images",[258,295,296,297,302],{},"We compile PHP from the php.net source with the same ",[270,298,301],{"href":299,"rel":300,"target":275},"https://github.com/docker-library/php",[274],"Dockerfiles that build the official images",". The build checks php.net's checksum and GPG signature, exactly as upstream does.",[258,304,305,306,309,310,317],{},"We make three small changes. We set the PHP patch to build, skip a PECL step so a PECL outage can't fail the build, and name Server Side Up in ",[286,307,308],{},"php -v",". ",[270,311,314],{"href":312,"rel":313,"target":275},"https://github.com/serversideup/docker-php/blob/main/scripts/prepare-php-base.sh",[274],[286,315,316],{},"scripts/prepare-php-base.sh"," shows every change.",[262,319,321],{"id":320},"security-fixes-dont-wait","Security fixes don't wait",[323,324,325,333],"ul",{},[326,327,328,332],"li",{},[329,330,331],"strong",{},"New PHP patches:"," we check php.net every hour. A new patch starts a build right away.",[326,334,335,338],{},[329,336,337],{},"Operating system fixes:"," every image rebuilds each Tuesday. PHP is recompiled from scratch, never from a cache, so a patched library such as OpenSSL lands in that week's images.",[340,341,342,355],"table",{},[343,344,345],"thead",{},[346,347,348,352],"tr",{},[349,350,351],"th",{},"Trigger",[349,353,354],{},"Tags it updates",[356,357,358,367,374,386],"tbody",{},[346,359,360,364],{},[361,362,363],"td",{},"A new PHP patch on php.net",[361,365,366],{},"Floating tags",[346,368,369,372],{},[361,370,371],{},"Every Tuesday at 08:00 UTC",[361,373,366],{},[346,375,376,379],{},[361,377,378],{},"A GitHub release",[361,380,381,382,385],{},"Floating tags, plus pinned ",[286,383,384],{},"-vX.Y.Z"," tags",[346,387,388,391],{},[361,389,390],{},"A GitHub pre-release, or every Monday at 08:25 UTC",[361,392,393,385],{},[286,394,395],{},"beta-",[258,397,398,399,402],{},"The ",[270,400,401],{"href":192},"upgrade guide"," explains floating and pinned tags.",[262,404,406],{"id":405},"nothing-ships-until-every-image-passes","Nothing ships until every image passes",[258,408,409,410,413,414,417],{},"Each image is tested on native ",[286,411,412],{},"amd64"," and ",[286,415,416],{},"arm64"," hardware before it's published. If a single image fails to build or test, nothing from that run is published.",[258,419,420],{},"The image you pull is byte for byte the image the tests ran. After publishing, the pipeline checks that the digest on Docker Hub and GitHub Packages matches the tested one.",[262,422,424],{"id":423},"signed-with-an-sbom-and-provenance","Signed, with an SBOM and provenance",[258,426,427,428,433],{},"Every image carries an SPDX SBOM and SLSA build provenance. Each one is signed with ",[270,429,432],{"href":430,"rel":431,"target":275},"https://github.com/sigstore/cosign",[274],"cosign"," keyless signing, tied to our publishing workflow. There's no private key that could leak.",[258,435,436,437,439,440,443],{},"Check them yourself before you deploy. ",[270,438,229],{"href":230}," has the commands. Published images are also ",[270,441,442],{"href":234},"scanned for vulnerabilities",".",[262,445,447],{"id":446},"every-dependency-is-pinned-and-reviewed","Every dependency is pinned and reviewed",[258,449,450,451,309,458,463],{},"Every pinned dependency version lives in one file: ",[270,452,455],{"href":453,"rel":454,"target":275},"https://github.com/serversideup/docker-php/blob/main/scripts/conf/php-versions-base-config.yml",[274],[286,456,457],{},"php-versions-base-config.yml",[270,459,462],{"href":460,"rel":461,"target":275},"https://docs.renovatebot.com/",[274],"Renovate"," proposes each update as a pull request. It waits three days after a release before it does. A maintainer reviews each one, except the weekly docker-library/php bump, which merges once every check passes. Every GitHub Action is pinned to a commit SHA.",[262,465,467],{"id":466},"every-change-is-tested-the-same-way","Every change is tested the same way",[258,469,470,471,473],{},"A pull request that changes an image builds every variation and runs the same tests. The results are public on the pull request. ",[270,472,44],{"href":45}," shows how to run the same build and tests on your own machine.",{"title":10,"searchDepth":475,"depth":475,"links":476},2,[477,478,479,480,481,482,483],{"id":264,"depth":475,"text":265},{"id":292,"depth":475,"text":293},{"id":320,"depth":475,"text":321},{"id":405,"depth":475,"text":406},{"id":423,"depth":475,"text":424},{"id":446,"depth":475,"text":447},{"id":466,"depth":475,"text":467},"Every serversideup/php image is built in public, tested before it ships, and signed so you can verify where it came from.","md",null,{"head":488,"layout":7},{"title":489},"How images are built - Docker PHP - Server Side Up",true,{"title":225,"description":484},"jCoqDaTNHOxrjrXMSRe2Pe57rn7m04nJFSG2txlz2IQ",[494,496],{"title":216,"path":217,"stem":218,"description":495,"children":-1},"Where to ask questions, report bugs, and get paid support for serversideup/php.",{"title":229,"path":230,"stem":231,"description":497,"children":-1},"Check that a serversideup/php image was built and published by our GitHub Actions workflows, and see what is inside it.",1793811941761]