[{"data":1,"prerenderedAt":619},["ShallowReactive",2],{"navigation":3,"/docs/security/verifying-images":249,"/docs/security/verifying-images-surround":614},[4],{"title":5,"path":6,"stem":7,"children":8},"Docs","/docs","docs",[9,12,48,77,132,160,185,206,219,236],{"title":10,"path":6,"stem":11},"","docs/index",{"title":13,"path":14,"stem":15,"children":16,"icon":47},"Getting Started","/docs/getting-started","docs/1.getting-started/1.index",[17,19,23,27,31,35,39,43],{"title":18,"path":14,"stem":15},"Introduction",{"title":20,"path":21,"stem":22},"Container basics","/docs/getting-started/container-basics","docs/1.getting-started/2.container-basics",{"title":24,"path":25,"stem":26},"Installation","/docs/getting-started/installation","docs/1.getting-started/3.installation",{"title":28,"path":29,"stem":30},"These images vs others","/docs/getting-started/these-images-vs-others","docs/1.getting-started/4.these-images-vs-others",{"title":32,"path":33,"stem":34},"Choosing an image","/docs/getting-started/choosing-an-image","docs/1.getting-started/5.choosing-an-image",{"title":36,"path":37,"stem":38},"Default configurations","/docs/getting-started/default-configurations","docs/1.getting-started/6.default-configurations",{"title":40,"path":41,"stem":42},"Migrating from official PHP images","/docs/getting-started/migrating-from-official-php-images","docs/1.getting-started/7.migrating-from-official-php-images",{"title":44,"path":45,"stem":46},"Contributing","/docs/getting-started/contributing","docs/1.getting-started/99.contributing",false,{"title":49,"path":50,"stem":51,"children":52,"page":47},"Image Variations","/docs/image-variations","docs/2.image-variations",[53,57,61,65,69,73],{"title":54,"path":55,"stem":56},"CLI","/docs/image-variations/cli","docs/2.image-variations/cli",{"title":58,"path":59,"stem":60},"FPM","/docs/image-variations/fpm","docs/2.image-variations/fpm",{"title":62,"path":63,"stem":64},"FPM-Apache","/docs/image-variations/fpm-apache","docs/2.image-variations/fpm-apache",{"title":66,"path":67,"stem":68},"FPM-NGINX","/docs/image-variations/fpm-nginx","docs/2.image-variations/fpm-nginx",{"title":70,"path":71,"stem":72},"FrankenPHP","/docs/image-variations/frankenphp","docs/2.image-variations/frankenphp",{"title":74,"path":75,"stem":76},"NGINX Unit (removed)","/docs/image-variations/unit","docs/2.image-variations/unit",{"title":78,"path":79,"stem":80,"children":81,"page":47},"Framework Guides","/docs/framework-guides","docs/3.framework-guides",[82,123],{"title":83,"icon":47,"defaultOpen":47,"path":84,"stem":85,"children":86,"page":47},"Laravel","/docs/framework-guides/laravel","docs/3.framework-guides/1.laravel",[87,91,95,99,103,107,111,115,119],{"title":88,"path":89,"stem":90},"Automations","/docs/framework-guides/laravel/automations","docs/3.framework-guides/1.laravel/1.automations",{"title":92,"path":93,"stem":94},"Running workers","/docs/framework-guides/laravel/workers","docs/3.framework-guides/1.laravel/2.workers",{"title":96,"path":97,"stem":98},"Health checks","/docs/framework-guides/laravel/health-checks","docs/3.framework-guides/1.laravel/3.health-checks",{"title":100,"path":101,"stem":102},"Horizon","/docs/framework-guides/laravel/horizon","docs/3.framework-guides/1.laravel/4.horizon",{"title":104,"path":105,"stem":106},"Nightwatch","/docs/framework-guides/laravel/nightwatch","docs/3.framework-guides/1.laravel/5.nightwatch",{"title":108,"path":109,"stem":110},"Octane","/docs/framework-guides/laravel/octane","docs/3.framework-guides/1.laravel/6.octane",{"title":112,"path":113,"stem":114},"Queue","/docs/framework-guides/laravel/queue","docs/3.framework-guides/1.laravel/7.queue",{"title":116,"path":117,"stem":118},"Reverb","/docs/framework-guides/laravel/reverb","docs/3.framework-guides/1.laravel/8.reverb",{"title":120,"path":121,"stem":122},"Task scheduler","/docs/framework-guides/laravel/task-scheduler","docs/3.framework-guides/1.laravel/9.task-scheduler",{"title":124,"icon":47,"defaultOpen":47,"path":125,"stem":126,"children":127,"page":47},"WordPress","/docs/framework-guides/wordpress","docs/3.framework-guides/2.wordpress",[128],{"title":129,"path":130,"stem":131},"Using WordPress with Docker","/docs/framework-guides/wordpress/using-wordpress-with-docker","docs/3.framework-guides/2.wordpress/4.using-wordpress-with-docker",{"title":133,"path":134,"stem":135,"children":136,"page":47},"Deployment And Production","/docs/deployment-and-production","docs/4.deployment-and-production",[137,141,145,148,152,156],{"title":138,"path":139,"stem":140},"Packaging your app for deployment","/docs/deployment-and-production/packaging-your-app-for-deployment","docs/4.deployment-and-production/1.packaging-your-app-for-deployment",{"title":142,"path":143,"stem":144},"Configuring SSL","/docs/deployment-and-production/configuring-ssl","docs/4.deployment-and-production/2.configuring-ssl",{"title":96,"path":146,"stem":147},"/docs/deployment-and-production/health-checks","docs/4.deployment-and-production/3.health-checks",{"title":149,"path":150,"stem":151},"Configuring trusted proxies","/docs/deployment-and-production/configuring-trusted-proxies","docs/4.deployment-and-production/4.configuring-trusted-proxies",{"title":153,"path":154,"stem":155},"Production performance tuning","/docs/deployment-and-production/production-performance-tuning","docs/4.deployment-and-production/5.production-performance-tuning",{"title":157,"path":158,"stem":159},"Choosing a host","/docs/deployment-and-production/choosing-a-host","docs/4.deployment-and-production/6.choosing-a-host",{"title":161,"icon":47,"defaultOpen":47,"path":162,"stem":163,"children":164,"page":47},"Customization","/docs/customizing-the-image","docs/5.customizing-the-image",[165,169,173,177,181],{"title":166,"path":167,"stem":168},"Changing php.ini settings","/docs/customizing-the-image/changing-common-php-settings","docs/5.customizing-the-image/1.changing-common-php-settings",{"title":170,"path":171,"stem":172},"Installing PHP extensions","/docs/customizing-the-image/installing-additional-php-extensions","docs/5.customizing-the-image/2.installing-additional-php-extensions",{"title":174,"path":175,"stem":176},"Adding start up scripts","/docs/customizing-the-image/adding-your-own-start-up-scripts","docs/5.customizing-the-image/3.adding-your-own-start-up-scripts",{"title":178,"path":179,"stem":180},"Using S6 Overlay","/docs/customizing-the-image/using-s6-overlay","docs/5.customizing-the-image/4.using-s6-overlay",{"title":182,"path":183,"stem":184},"Understanding file permissions","/docs/customizing-the-image/understanding-file-permissions","docs/5.customizing-the-image/5.understanding-file-permissions",{"title":186,"icon":47,"defaultOpen":47,"path":187,"stem":188,"children":189,"page":47},"Upgrading","/docs/upgrading","docs/6.upgrading",[190,194,198,202],{"title":191,"path":192,"stem":193},"Upgrade guide","/docs/upgrading/upgrade-guide","docs/6.upgrading/1.upgrade-guide",{"title":195,"path":196,"stem":197},"Upgrade to v5","/docs/upgrading/upgrade-to-v5","docs/6.upgrading/2.upgrade-to-v5",{"title":199,"path":200,"stem":201},"Upgrade to v4","/docs/upgrading/upgrade-to-v4","docs/6.upgrading/3.upgrade-to-v4",{"title":203,"path":204,"stem":205},"Upgrade to v3","/docs/upgrading/upgrade-to-v3","docs/6.upgrading/4.upgrade-to-v3",{"title":207,"path":208,"stem":209,"children":210,"page":47},"Troubleshooting","/docs/troubleshooting","docs/7.troubleshooting",[211,215],{"title":212,"path":213,"stem":214},"Common issues","/docs/troubleshooting/common-issues","docs/7.troubleshooting/1.common-issues",{"title":216,"path":217,"stem":218},"Getting help","/docs/troubleshooting/getting-help","docs/7.troubleshooting/2.getting-help",{"title":220,"path":221,"stem":222,"children":223,"page":47},"Security","/docs/security","docs/8.security",[224,228,232],{"title":225,"path":226,"stem":227},"How images are built","/docs/security/how-images-are-built","docs/8.security/1.how-images-are-built",{"title":229,"path":230,"stem":231},"Verifying images","/docs/security/verifying-images","docs/8.security/2.verifying-images",{"title":233,"path":234,"stem":235},"Vulnerability scanning","/docs/security/vulnerability-scanning","docs/8.security/3.vulnerability-scanning",{"title":237,"path":238,"stem":239,"children":240,"page":47},"Reference","/docs/reference","docs/9.reference",[241,245],{"title":242,"path":243,"stem":244},"Environment variable specification","/docs/reference/environment-variable-specification","docs/9.reference/1.environment-variable-specification",{"title":246,"path":247,"stem":248},"Command reference","/docs/reference/command-reference","docs/9.reference/2.command-reference",{"id":250,"title":229,"body":251,"description":605,"extension":606,"links":607,"meta":608,"navigation":611,"path":230,"redirect":607,"seo":612,"stem":231,"__hash__":613},"docs/docs/8.security/2.verifying-images.md",{"type":252,"value":253,"toc":598},"minimark",[254,261,266,282,291,295,307,356,373,376,383,387,396,427,438,442,455,481,488,514,584,588,594],[255,256,257],"lead-p",{},[258,259,260],"p",{},"Every image we publish is signed and carries a software bill of materials (SBOM) and build provenance. Use them to confirm that the image you pulled came from our GitHub Actions workflows and to see exactly what went into it.",[262,263,265],"h2",{"id":264},"why-verify-an-image","Why verify an image",[258,267,268,269,273,274,277,278,281],{},"A tag is only a pointer. Whoever controls it can point ",[270,271,272],"code",{},"8.5-cli"," at a different image. A signature check proves the image was published by the ",[270,275,276],{},"serversideup/docker-php"," repository's own publish workflow, from ",[270,279,280],{},"main"," or a release tag. The SBOM and provenance tell you what is in the image and how it was built, which is what most supply-chain policies and audits ask for.",[283,284,285],"note",{},[258,286,287,288,290],{},"Images published before signing started have provenance but no SBOM or signature. Version-pinned tags from v5.0.5 and earlier are never rebuilt, so they always fail the check, while floating tags such as ",[270,289,272],{}," are signed from their next rebuild.",[262,292,294],{"id":293},"verify-the-signature","Verify the signature",[258,296,297,298,306],{},"Install cosign by following the ",[299,300,305],"a",{"href":301,"rel":302,"target":304},"https://docs.sigstore.dev/cosign/system_config/installation/",[303],"nofollow","_blank","Sigstore installation guide",", then run:",[308,309,314],"pre",{"className":310,"code":311,"filename":312,"language":313,"meta":10,"style":10},"language-bash shiki shiki-themes github-dark","cosign verify serversideup/php:8.5-cli \\\n  --certificate-oidc-issuer https://token.actions.githubusercontent.com \\\n  --certificate-identity-regexp '^https://github\\.com/serversideup/docker-php/\\.github/workflows/service_publish-images\\.yml@refs/(heads/main|tags/v.+)$'\n","Terminal","bash",[270,315,316,336,347],{"__ignoreMap":10},[317,318,321,325,329,332],"span",{"class":319,"line":320},"line",1,[317,322,324],{"class":323},"svObZ","cosign",[317,326,328],{"class":327},"sU2Wk"," verify",[317,330,331],{"class":327}," serversideup/php:8.5-cli",[317,333,335],{"class":334},"sDLfK"," \\\n",[317,337,339,342,345],{"class":319,"line":338},2,[317,340,341],{"class":334},"  --certificate-oidc-issuer",[317,343,344],{"class":327}," https://token.actions.githubusercontent.com",[317,346,335],{"class":334},[317,348,350,353],{"class":319,"line":349},3,[317,351,352],{"class":334},"  --certificate-identity-regexp",[317,354,355],{"class":327}," '^https://github\\.com/serversideup/docker-php/\\.github/workflows/service_publish-images\\.yml@refs/(heads/main|tags/v.+)$'\n",[258,357,358,359,361,362,365,366,369,370,372],{},"The two flags say who you trust. The issuer is GitHub Actions. The identity is our publish workflow running from ",[270,360,280],{}," or a ",[270,363,364],{},"v"," release tag. Beta images are signed from a pre-release tag, such as ",[270,367,368],{},"v5.0.0-beta5",", or from ",[270,371,280],{}," on the weekly beta rebuild, so they pass this check too. Verifying proves an image came from us, not that it is a stable release. cosign exits with an error if the image has no signature from that identity.",[258,374,375],{},"Signing is keyless: there is no public key to download. Each signature is tied to the workflow run that made it through GitHub's OIDC token and recorded in Sigstore's public transparency log.",[258,377,378,379,382],{},"Docker Hub and GitHub Packages each hold their own signature. The same command works for ",[270,380,381],{},"ghcr.io/serversideup/php:8.5-cli",". The signature covers the image index, which references the image for every platform along with its SBOM and provenance. One check covers all of them.",[262,384,386],{"id":385},"read-the-sbom","Read the SBOM",[258,388,389,390,395],{},"The SBOM is an ",[299,391,394],{"href":392,"rel":393,"target":304},"https://spdx.dev/",[303],"SPDX"," document that lists the packages in the image. Read it for one platform with Docker Buildx:",[308,397,399],{"className":310,"code":398,"filename":312,"language":313,"meta":10,"style":10},"docker buildx imagetools inspect serversideup/php:8.5-cli \\\n  --format '{{ json (index .SBOM \"linux/amd64\").SPDX }}'\n",[270,400,401,419],{"__ignoreMap":10},[317,402,403,406,409,412,415,417],{"class":319,"line":320},[317,404,405],{"class":323},"docker",[317,407,408],{"class":327}," buildx",[317,410,411],{"class":327}," imagetools",[317,413,414],{"class":327}," inspect",[317,416,331],{"class":327},[317,418,335],{"class":334},[317,420,421,424],{"class":319,"line":338},[317,422,423],{"class":334},"  --format",[317,425,426],{"class":327}," '{{ json (index .SBOM \"linux/amd64\").SPDX }}'\n",[258,428,429,430,433,434,437],{},"Use ",[270,431,432],{},"linux/arm64"," for the arm64 image. On an image published before SBOMs were added, the command prints ",[270,435,436],{},"null",".",[262,439,441],{"id":440},"read-the-build-provenance","Read the build provenance",[258,443,444,445,450,451,454],{},"The provenance is a ",[299,446,449],{"href":447,"rel":448,"target":304},"https://slsa.dev/",[303],"SLSA"," record of how the image was built: the source commit, the Dockerfile, the build arguments, and the base images. We publish it in full (",[270,452,453],{},"mode=max","):",[308,456,458],{"className":310,"code":457,"filename":312,"language":313,"meta":10,"style":10},"docker buildx imagetools inspect serversideup/php:8.5-cli \\\n  --format '{{ json (index .Provenance \"linux/amd64\").SLSA }}'\n",[270,459,460,474],{"__ignoreMap":10},[317,461,462,464,466,468,470,472],{"class":319,"line":320},[317,463,405],{"class":323},[317,465,408],{"class":327},[317,467,411],{"class":327},[317,469,414],{"class":327},[317,471,331],{"class":327},[317,473,335],{"class":334},[317,475,476,478],{"class":319,"line":338},[317,477,423],{"class":334},[317,479,480],{"class":327}," '{{ json (index .Provenance \"linux/amd64\").SLSA }}'\n",[258,482,483,484,487],{},"To see only the commit and Dockerfile an image was built from, read ",[270,485,486],{},"invocation.configSource",":",[308,489,491],{"className":310,"code":490,"filename":312,"language":313,"meta":10,"style":10},"docker buildx imagetools inspect serversideup/php:8.5-cli \\\n  --format '{{ json (index .Provenance \"linux/amd64\").SLSA.invocation.configSource }}'\n",[270,492,493,507],{"__ignoreMap":10},[317,494,495,497,499,501,503,505],{"class":319,"line":320},[317,496,405],{"class":323},[317,498,408],{"class":327},[317,500,411],{"class":327},[317,502,414],{"class":327},[317,504,331],{"class":327},[317,506,335],{"class":334},[317,508,509,511],{"class":319,"line":338},[317,510,423],{"class":334},[317,512,513],{"class":327}," '{{ json (index .Provenance \"linux/amd64\").SLSA.invocation.configSource }}'\n",[308,515,520],{"className":516,"code":517,"filename":518,"language":519,"meta":10,"style":10},"language-json shiki shiki-themes github-dark","{\n  \"digest\": {\n    \"sha1\": \"af1462e3abf8c67ff3fb78141255adc33de5bf2c\"\n  },\n  \"entryPoint\": \"src/variations/cli/Dockerfile\",\n  \"uri\": \"https://github.com/serversideup/docker-php.git#af1462e3abf8c67ff3fb78141255adc33de5bf2c\"\n}\n","Output","json",[270,521,522,528,536,547,553,567,578],{"__ignoreMap":10},[317,523,524],{"class":319,"line":320},[317,525,527],{"class":526},"s95oV","{\n",[317,529,530,533],{"class":319,"line":338},[317,531,532],{"class":334},"  \"digest\"",[317,534,535],{"class":526},": {\n",[317,537,538,541,544],{"class":319,"line":349},[317,539,540],{"class":334},"    \"sha1\"",[317,542,543],{"class":526},": ",[317,545,546],{"class":327},"\"af1462e3abf8c67ff3fb78141255adc33de5bf2c\"\n",[317,548,550],{"class":319,"line":549},4,[317,551,552],{"class":526},"  },\n",[317,554,556,559,561,564],{"class":319,"line":555},5,[317,557,558],{"class":334},"  \"entryPoint\"",[317,560,543],{"class":526},[317,562,563],{"class":327},"\"src/variations/cli/Dockerfile\"",[317,565,566],{"class":526},",\n",[317,568,570,573,575],{"class":319,"line":569},6,[317,571,572],{"class":334},"  \"uri\"",[317,574,543],{"class":526},[317,576,577],{"class":327},"\"https://github.com/serversideup/docker-php.git#af1462e3abf8c67ff3fb78141255adc33de5bf2c\"\n",[317,579,581],{"class":319,"line":580},7,[317,582,583],{"class":526},"}\n",[262,585,587],{"id":586},"scan-it-yourself","Scan it yourself",[258,589,590,591,593],{},"The images are public, so you can run any scanner against them. ",[299,592,233],{"href":234}," shows a Grype command and explains why most findings have no fix.",[595,596,597],"style",{},"html pre.shiki code .svObZ, html code.shiki .svObZ{--shiki-default:#B392F0}html pre.shiki code .sU2Wk, html code.shiki .sU2Wk{--shiki-default:#9ECBFF}html pre.shiki code .sDLfK, html code.shiki .sDLfK{--shiki-default:#79B8FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .s95oV, html code.shiki .s95oV{--shiki-default:#E1E4E8}",{"title":10,"searchDepth":338,"depth":338,"links":599},[600,601,602,603,604],{"id":264,"depth":338,"text":265},{"id":293,"depth":338,"text":294},{"id":385,"depth":338,"text":386},{"id":440,"depth":338,"text":441},{"id":586,"depth":338,"text":587},"Check that a serversideup/php image was built and published by our GitHub Actions workflows, and see what is inside it.","md",null,{"head":609,"layout":7},{"title":610},"Verifying images - Docker PHP - Server Side Up",true,{"title":229,"description":605},"HIDzJt--1isahJ0sc5PbDO5R6D8FJIQ5MAayaSu64t8",[615,617],{"title":225,"path":226,"stem":227,"description":616,"children":-1},"Every serversideup/php image is built in public, tested before it ships, and signed so you can verify where it came from.",{"title":233,"path":234,"stem":235,"description":618,"children":-1},"How every published serversideup/php image is scanned for known vulnerabilities, and where to see the results.",1793811942602]