From 6a04fac5e6b692efb517d6fa6bf915967c870dba Mon Sep 17 00:00:00 2001 From: Trystan Lea Date: Wed, 21 Oct 2026 17:54:56 +0100 Subject: [PATCH] Update base images, s6-overlay, phpredis and actions for security fixes - mariadb 11.0 -> 11.8 (LTS); 11.0 is EOL and no longer receives fixes - redis 7.0 -> 8; 7.0 is EOL and no longer receives fixes - s6-overlay 3.1.6.2 -> 3.2.3.2; register services in the new /etc/s6-overlay/user-bundles.d location and use set -e so a wrong bundle path fails the build instead of producing an image that never starts Apache - phpredis: pin to release 6.3.0 instead of building the develop branch - GitHub Actions: checkout v7, login-action v4, build-push-action v7 Rebuilding also picks up php:8.4-apache 8.4.27, which fixes GHSA-w8hw-w9fx-j79w (CVE-2026-109618). Co-Authored-By: Claude Opus 5.5 --- .github/workflows/docker-release.yml | 8 ++++---- docker-compose.yml | 4 ++-- web/Dockerfile | 16 +++++++++------- web/install_redis.sh | 2 +- 4 files changed, 16 insertions(+), 14 deletions(-) diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml index 03f0b8d..b80149b 100644 --- a/.github/workflows/docker-release.yml +++ b/.github/workflows/docker-release.yml @@ -32,7 +32,7 @@ jobs: packages: write steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Check for Docker Hub credentials id: check_dockerhub @@ -45,14 +45,14 @@ jobs: - name: Log in to Docker Hub if: steps.check_dockerhub.outputs.available == 'true' && github.event_name != 'pull_request' - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} - name: Log in to GitHub Container Registry if: steps.check_dockerhub.outputs.available != 'true' || github.event_name == 'pull_request' - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} @@ -80,7 +80,7 @@ jobs: echo "tags=$TAGS" >> "$GITHUB_OUTPUT" - name: Build and push Docker image - uses: docker/build-push-action@v5 + uses: docker/build-push-action@v7 with: context: ./web build-args: | diff --git a/docker-compose.yml b/docker-compose.yml index 4e98174..be04d4f 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -17,7 +17,7 @@ services: condition: service_healthy db: - image: mariadb:11.0 + image: mariadb:11.8 environment: - "MYSQL_HOST=localhost" - "MARIADB_AUTO_UPGRADE=1" @@ -30,7 +30,7 @@ services: max-size: "10m" redis: - image: redis:7.0 + image: redis:8 volumes: - emon-redis-data:/data healthcheck: diff --git a/web/Dockerfile b/web/Dockerfile index 790b83f..6b6640c 100644 --- a/web/Dockerfile +++ b/web/Dockerfile @@ -5,9 +5,11 @@ FROM $BUILD_FROM ARG \ TARGETPLATFORM \ - S6_OVERLAY_VERSION=3.1.6.2 \ + S6_OVERLAY_VERSION=3.2.3.2 \ + PHPREDIS_VERSION=6.3.0 \ S6_SRC=https://github.com/just-containers/s6-overlay/releases/download \ S6_DIR=/etc/s6-overlay/s6-rc.d \ + S6_BUNDLES=/etc/s6-overlay/user-bundles.d \ PRIMOS="apache2" \ SECONDOS="emoncms_mqtt service-runner feedwriter sync_upload" \ EMONCMS_SRC=https://github.com/emoncms/emoncms \ @@ -140,7 +142,7 @@ COPY emoncms_pre.sh sql_ready.sh sync_upload-run.sh $OEM_DIR/ # sql_ready must run before Apache serves traffic (otherwise / hits user_controller with no users table). # It was only registered in user2; in s6-overlay v3 the default target may not activate user2, so # schema init never ran. sql_ready lives in user with emoncms_pre -> sql_ready -> apache2. -RUN set -x;\ +RUN set -ex;\ mkdir $S6_DIR/emoncms_pre;\ mkdir $S6_DIR/emoncms_pre/dependencies.d;\ touch $S6_DIR/emoncms_pre/dependencies.d/base;\ @@ -151,23 +153,23 @@ RUN set -x;\ touch $S6_DIR/sql_ready/dependencies.d/emoncms_pre;\ echo "oneshot" > $S6_DIR/sql_ready/type;\ echo "$OEM_DIR/sql_ready.sh" > $S6_DIR/sql_ready/up;\ - touch $S6_DIR/user/contents.d/emoncms_pre;\ - touch $S6_DIR/user/contents.d/sql_ready;\ + touch $S6_BUNDLES/user/contents.d/emoncms_pre;\ + touch $S6_BUNDLES/user/contents.d/sql_ready;\ for i in $PRIMOS; do mkdir $S6_DIR/$i; done;\ for i in $PRIMOS; do mkdir $S6_DIR/$i/dependencies.d; done;\ for i in $PRIMOS; do touch $S6_DIR/$i/dependencies.d/sql_ready; done;\ - for i in $PRIMOS; do touch $S6_DIR/user/contents.d/$i; done;\ + for i in $PRIMOS; do touch $S6_BUNDLES/user/contents.d/$i; done;\ for i in $PRIMOS; do echo "longrun" > $S6_DIR/$i/type; done;\ echo "#!/command/with-contenv sh" > $S6_DIR/apache2/run;\ echo "rm -f /var/run/apache2/apache2.pid" >> $S6_DIR/apache2/run;\ echo "exec apache2-foreground" >> $S6_DIR/apache2/run # s6-overlay: user2 bundle (workers) -RUN set -x;\ +RUN set -ex;\ for i in $SECONDOS; do mkdir $S6_DIR/$i; done;\ for i in $SECONDOS; do mkdir $S6_DIR/$i/dependencies.d; done;\ for i in $SECONDOS; do touch $S6_DIR/$i/dependencies.d/sql_ready; done;\ - for i in $SECONDOS; do touch $S6_DIR/user2/contents.d/$i; done;\ + for i in $SECONDOS; do touch $S6_BUNDLES/user2/contents.d/$i; done;\ for i in $SECONDOS; do echo "longrun" > $S6_DIR/$i/type; done;\ echo "#!/command/with-contenv sh" > $S6_DIR/emoncms_mqtt/run;\ echo "exec s6-setuidgid $DAEMON php $WWW/emoncms/scripts/services/emoncms_mqtt/emoncms_mqtt.php" >> $S6_DIR/emoncms_mqtt/run;\ diff --git a/web/install_redis.sh b/web/install_redis.sh index f901c85..d6005ba 100644 --- a/web/install_redis.sh +++ b/web/install_redis.sh @@ -2,7 +2,7 @@ # Install Redis cd / -git clone https://github.com/phpredis/phpredis +git clone --depth 1 -b ${PHPREDIS_VERSION:-6.3.0} https://github.com/phpredis/phpredis cd phpredis phpize ./configure