[{"data":1,"prerenderedAt":384},["ShallowReactive",2],{"navigation":3,"/docs/security/vulnerability-scanning":249,"/docs/security/vulnerability-scanning-surround":379},[4],{"title":5,"path":6,"stem":7,"children":8},"Docs","/docs","docs",[9,12,48,77,132,160,185,206,219,236],{"title":10,"path":6,"stem":11},"","docs/index",{"title":13,"path":14,"stem":15,"children":16,"icon":47},"Getting Started","/docs/getting-started","docs/1.getting-started/1.index",[17,19,23,27,31,35,39,43],{"title":18,"path":14,"stem":15},"Introduction",{"title":20,"path":21,"stem":22},"Container basics","/docs/getting-started/container-basics","docs/1.getting-started/2.container-basics",{"title":24,"path":25,"stem":26},"Installation","/docs/getting-started/installation","docs/1.getting-started/3.installation",{"title":28,"path":29,"stem":30},"These images vs others","/docs/getting-started/these-images-vs-others","docs/1.getting-started/4.these-images-vs-others",{"title":32,"path":33,"stem":34},"Choosing an image","/docs/getting-started/choosing-an-image","docs/1.getting-started/5.choosing-an-image",{"title":36,"path":37,"stem":38},"Default configurations","/docs/getting-started/default-configurations","docs/1.getting-started/6.default-configurations",{"title":40,"path":41,"stem":42},"Migrating from official PHP images","/docs/getting-started/migrating-from-official-php-images","docs/1.getting-started/7.migrating-from-official-php-images",{"title":44,"path":45,"stem":46},"Contributing","/docs/getting-started/contributing","docs/1.getting-started/99.contributing",false,{"title":49,"path":50,"stem":51,"children":52,"page":47},"Image Variations","/docs/image-variations","docs/2.image-variations",[53,57,61,65,69,73],{"title":54,"path":55,"stem":56},"CLI","/docs/image-variations/cli","docs/2.image-variations/cli",{"title":58,"path":59,"stem":60},"FPM","/docs/image-variations/fpm","docs/2.image-variations/fpm",{"title":62,"path":63,"stem":64},"FPM-Apache","/docs/image-variations/fpm-apache","docs/2.image-variations/fpm-apache",{"title":66,"path":67,"stem":68},"FPM-NGINX","/docs/image-variations/fpm-nginx","docs/2.image-variations/fpm-nginx",{"title":70,"path":71,"stem":72},"FrankenPHP","/docs/image-variations/frankenphp","docs/2.image-variations/frankenphp",{"title":74,"path":75,"stem":76},"NGINX Unit (removed)","/docs/image-variations/unit","docs/2.image-variations/unit",{"title":78,"path":79,"stem":80,"children":81,"page":47},"Framework Guides","/docs/framework-guides","docs/3.framework-guides",[82,123],{"title":83,"icon":47,"defaultOpen":47,"path":84,"stem":85,"children":86,"page":47},"Laravel","/docs/framework-guides/laravel","docs/3.framework-guides/1.laravel",[87,91,95,99,103,107,111,115,119],{"title":88,"path":89,"stem":90},"Automations","/docs/framework-guides/laravel/automations","docs/3.framework-guides/1.laravel/1.automations",{"title":92,"path":93,"stem":94},"Running workers","/docs/framework-guides/laravel/workers","docs/3.framework-guides/1.laravel/2.workers",{"title":96,"path":97,"stem":98},"Health checks","/docs/framework-guides/laravel/health-checks","docs/3.framework-guides/1.laravel/3.health-checks",{"title":100,"path":101,"stem":102},"Horizon","/docs/framework-guides/laravel/horizon","docs/3.framework-guides/1.laravel/4.horizon",{"title":104,"path":105,"stem":106},"Nightwatch","/docs/framework-guides/laravel/nightwatch","docs/3.framework-guides/1.laravel/5.nightwatch",{"title":108,"path":109,"stem":110},"Octane","/docs/framework-guides/laravel/octane","docs/3.framework-guides/1.laravel/6.octane",{"title":112,"path":113,"stem":114},"Queue","/docs/framework-guides/laravel/queue","docs/3.framework-guides/1.laravel/7.queue",{"title":116,"path":117,"stem":118},"Reverb","/docs/framework-guides/laravel/reverb","docs/3.framework-guides/1.laravel/8.reverb",{"title":120,"path":121,"stem":122},"Task scheduler","/docs/framework-guides/laravel/task-scheduler","docs/3.framework-guides/1.laravel/9.task-scheduler",{"title":124,"icon":47,"defaultOpen":47,"path":125,"stem":126,"children":127,"page":47},"WordPress","/docs/framework-guides/wordpress","docs/3.framework-guides/2.wordpress",[128],{"title":129,"path":130,"stem":131},"Using WordPress with Docker","/docs/framework-guides/wordpress/using-wordpress-with-docker","docs/3.framework-guides/2.wordpress/4.using-wordpress-with-docker",{"title":133,"path":134,"stem":135,"children":136,"page":47},"Deployment And Production","/docs/deployment-and-production","docs/4.deployment-and-production",[137,141,145,148,152,156],{"title":138,"path":139,"stem":140},"Packaging your app for deployment","/docs/deployment-and-production/packaging-your-app-for-deployment","docs/4.deployment-and-production/1.packaging-your-app-for-deployment",{"title":142,"path":143,"stem":144},"Configuring SSL","/docs/deployment-and-production/configuring-ssl","docs/4.deployment-and-production/2.configuring-ssl",{"title":96,"path":146,"stem":147},"/docs/deployment-and-production/health-checks","docs/4.deployment-and-production/3.health-checks",{"title":149,"path":150,"stem":151},"Configuring trusted proxies","/docs/deployment-and-production/configuring-trusted-proxies","docs/4.deployment-and-production/4.configuring-trusted-proxies",{"title":153,"path":154,"stem":155},"Production performance tuning","/docs/deployment-and-production/production-performance-tuning","docs/4.deployment-and-production/5.production-performance-tuning",{"title":157,"path":158,"stem":159},"Choosing a host","/docs/deployment-and-production/choosing-a-host","docs/4.deployment-and-production/6.choosing-a-host",{"title":161,"icon":47,"defaultOpen":47,"path":162,"stem":163,"children":164,"page":47},"Customization","/docs/customizing-the-image","docs/5.customizing-the-image",[165,169,173,177,181],{"title":166,"path":167,"stem":168},"Changing php.ini settings","/docs/customizing-the-image/changing-common-php-settings","docs/5.customizing-the-image/1.changing-common-php-settings",{"title":170,"path":171,"stem":172},"Installing PHP extensions","/docs/customizing-the-image/installing-additional-php-extensions","docs/5.customizing-the-image/2.installing-additional-php-extensions",{"title":174,"path":175,"stem":176},"Adding start up scripts","/docs/customizing-the-image/adding-your-own-start-up-scripts","docs/5.customizing-the-image/3.adding-your-own-start-up-scripts",{"title":178,"path":179,"stem":180},"Using S6 Overlay","/docs/customizing-the-image/using-s6-overlay","docs/5.customizing-the-image/4.using-s6-overlay",{"title":182,"path":183,"stem":184},"Understanding file permissions","/docs/customizing-the-image/understanding-file-permissions","docs/5.customizing-the-image/5.understanding-file-permissions",{"title":186,"icon":47,"defaultOpen":47,"path":187,"stem":188,"children":189,"page":47},"Upgrading","/docs/upgrading","docs/6.upgrading",[190,194,198,202],{"title":191,"path":192,"stem":193},"Upgrade guide","/docs/upgrading/upgrade-guide","docs/6.upgrading/1.upgrade-guide",{"title":195,"path":196,"stem":197},"Upgrade to v5","/docs/upgrading/upgrade-to-v5","docs/6.upgrading/2.upgrade-to-v5",{"title":199,"path":200,"stem":201},"Upgrade to v4","/docs/upgrading/upgrade-to-v4","docs/6.upgrading/3.upgrade-to-v4",{"title":203,"path":204,"stem":205},"Upgrade to v3","/docs/upgrading/upgrade-to-v3","docs/6.upgrading/4.upgrade-to-v3",{"title":207,"path":208,"stem":209,"children":210,"page":47},"Troubleshooting","/docs/troubleshooting","docs/7.troubleshooting",[211,215],{"title":212,"path":213,"stem":214},"Common issues","/docs/troubleshooting/common-issues","docs/7.troubleshooting/1.common-issues",{"title":216,"path":217,"stem":218},"Getting help","/docs/troubleshooting/getting-help","docs/7.troubleshooting/2.getting-help",{"title":220,"path":221,"stem":222,"children":223,"page":47},"Security","/docs/security","docs/8.security",[224,228,232],{"title":225,"path":226,"stem":227},"How images are built","/docs/security/how-images-are-built","docs/8.security/1.how-images-are-built",{"title":229,"path":230,"stem":231},"Verifying images","/docs/security/verifying-images","docs/8.security/2.verifying-images",{"title":233,"path":234,"stem":235},"Vulnerability scanning","/docs/security/vulnerability-scanning","docs/8.security/3.vulnerability-scanning",{"title":237,"path":238,"stem":239,"children":240,"page":47},"Reference","/docs/reference","docs/9.reference",[241,245],{"title":242,"path":243,"stem":244},"Environment variable specification","/docs/reference/environment-variable-specification","docs/9.reference/1.environment-variable-specification",{"title":246,"path":247,"stem":248},"Command reference","/docs/reference/command-reference","docs/9.reference/2.command-reference",{"id":250,"title":233,"body":251,"description":370,"extension":371,"links":372,"meta":373,"navigation":376,"path":234,"redirect":372,"seo":377,"stem":235,"__hash__":378},"docs/docs/8.security/3.vulnerability-scanning.md",{"type":252,"value":253,"toc":363},"minimark",[254,261,266,283,286,290,299,302,306,309,317,321,324,350,359],[255,256,257],"lead-p",{},[258,259,260],"p",{},"Every image we publish is scanned for known vulnerabilities after each production build. The results are public. The numbers to watch are the fixable ones.",[262,263,265],"h2",{"id":264},"when-and-how-images-are-scanned","When and how images are scanned",[258,267,268,269,277,278,282],{},"A scan runs after every production publish. That includes releases, the weekly rebuild on Tuesdays at 08:00 UTC, and new PHP patches. ",[270,271,276],"a",{"href":272,"rel":273,"target":275},"https://github.com/anchore/grype",[274],"nofollow","_blank","Grype"," scans the ",[279,280,281],"code",{},"linux/amd64"," platform of every published image, pulled from GitHub Packages. Tags that point at the same image share one scan.",[258,284,285],{},"The scan job has no access token and no registry credentials. Grype runs in its own container. A compromised scanner would have nothing to steal and nothing it could publish.",[262,287,289],{"id":288},"see-the-latest-results","See the latest results",[258,291,292,293,298],{},"Open the ",[270,294,297],{"href":295,"rel":296,"target":275},"https://github.com/serversideup/docker-php/actions/workflows/action_publish-images-production.yml?query=is%3Asuccess",[274],"latest successful production run",". Its summary page has a table for each variation with every image's critical, high, and medium counts, and how many findings have a fix.",[258,300,301],{},"Findings that have a fix also become code scanning alerts for the maintainers. Each one closes once a scan no longer finds it.",[262,303,305],{"id":304},"most-findings-have-no-fix-yet","Most findings have no fix yet",[258,307,308],{},"A scanner matches every package in the image against public CVE databases. Many of the CVEs it reports are ones the distribution has marked \"not fixed\" or \"won't fix\". There is no newer package to install for those.",[258,310,311,312],{},"No rebuild can change an unfixed finding. The fixable count is the meaningful number. The docker-library project explains this in more depth in ",[270,313,316],{"href":314,"rel":315,"target":275},"https://github.com/docker-library/faq#why-does-my-security-scanner-show-that-an-image-has-cves",[274],"Why does my security scanner show that an image has CVEs?",[262,318,320],{"id":319},"scan-it-yourself","Scan it yourself",[258,322,323],{},"You don't have to rely on our scan. The images are public and work with any scanner:",[325,326,331],"pre",{"className":327,"code":328,"filename":329,"language":330,"meta":10,"style":10},"language-bash shiki shiki-themes github-dark","grype serversideup/php:8.5-cli --only-fixed\n","Terminal","bash",[279,332,333],{"__ignoreMap":10},[334,335,338,342,346],"span",{"class":336,"line":337},"line",1,[334,339,341],{"class":340},"svObZ","grype",[334,343,345],{"class":344},"sU2Wk"," serversideup/php:8.5-cli",[334,347,349],{"class":348},"sDLfK"," --only-fixed\n",[258,351,352,353,358],{},"To report a problem in our own scripts, configs, or workflows, use ",[270,354,357],{"href":355,"rel":356,"target":275},"https://github.com/serversideup/docker-php/security/policy",[274],"private vulnerability reporting"," instead.",[360,361,362],"style",{},"html pre.shiki code .svObZ, html code.shiki .svObZ{--shiki-default:#B392F0}html pre.shiki code .sU2Wk, html code.shiki .sU2Wk{--shiki-default:#9ECBFF}html pre.shiki code .sDLfK, html code.shiki .sDLfK{--shiki-default:#79B8FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":10,"searchDepth":364,"depth":364,"links":365},2,[366,367,368,369],{"id":264,"depth":364,"text":265},{"id":288,"depth":364,"text":289},{"id":304,"depth":364,"text":305},{"id":319,"depth":364,"text":320},"How every published serversideup/php image is scanned for known vulnerabilities, and where to see the results.","md",null,{"head":374,"layout":7},{"title":375},"Vulnerability scanning - Docker PHP - Server Side Up",true,{"title":233,"description":370},"MZUO3DNTAeulQPqQhAlSIo6rt1i73DzIhC7837pJGfE",[380,382],{"title":229,"path":230,"stem":231,"description":381,"children":-1},"Check that a serversideup/php image was built and published by our GitHub Actions workflows, and see what is inside it.",{"title":242,"path":243,"stem":244,"description":383,"children":-1},"Every environment variable the serversideup/php images read, with its default and the variations that use it.",1793811943565]