Dockerfile für wbb

FROM alpine:edge
LABEL Maintainer="Spielleitung <spielleitung (a) west-nerica.de>" \
Description="Lightweight container with wbb, nginx & php-fpm based on Alpine Linux."

# wbb dependencies
RUN apk update \
&& apk upgrade \
&& apk --no-cache add nginx supervisor curl imagemagick py3-setuptools \
php83 php83-fpm php83-pdo_mysql php83-json php83-openssl php83-curl php83-opcache php83-tokenizer \
php83-zlib php83-xml php83-simplexml php83-phar php83-intl php83-dom php83-xmlreader php83-ctype php83-gmp \
php83-mbstring php83-gd php83-pecl-redis php83-pecl-memcache php83-exif php83-pecl-imagick \
--repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing/ \
&& rm -rf /var/cache/apk/*

# config files
COPY config/nginx.conf /etc/nginx/nginx.conf
COPY config/fpm-pool.conf /etc/php83/php-fpm.d/http://www.conf
COPY config/php.ini /etc/php83/php.ini
COPY config/supervisord.conf /etc/supervisor/conf.d/supervisord.conf

# dirty hack to get redis enabled
RUN echo "extension=redis.so" > /etc/php83/conf.d/redis.ini

# ensure access for processes running via nobody user
RUN chown -R nobody:nobody /run && \
chown -R nobody:nobody /var/lib/nginx && \
mkdir -p /var/tmp/nginx && \
chown -R nobody:nobody /var/tmp/nginx && \
chown -R nobody:nobody /var/log/nginx && \
touch /var/log/php.log && \
chown nobody:nobody /var/log/php.log

# setup document root
RUN mkdir -p /var/www/html

# surrender root access and switch to least privilege principle
USER nobody

# setup wbb application
WORKDIR /var/www/html
VOLUME ["/var/www/html"]

# expose
EXPOSE 8080

# have supervisord start nginx & php-fpm
CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]

# setup simple healthcheck
HEALTHCHECK --timeout=10s CMD curl --silent --fail http://127.0.0.1:8080/fpm-ping

[global]
error_log = /dev/stderr

[www]
listen = 127.0.0.1:9000
pm.status_path = /fpm-status
pm = ondemand
pm.max_children = 100
pm.process_idle_timeout = 10s;
pm.max_requests = 1000
clear_env = no
catch_workers_output = yes
ping.path = /fpm-ping

[supervisord]
nodaemon=true
logfile=/dev/null
logfile_maxbytes=0
pidfile=/run/supervisord.pid

[program:php-fpm]
command=php-fpm83 -F
stdout_logfile=/dev/stdout
stdout_logfile_maxbytes=0
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0
autorestart=false
startretries=0

[program:nginx]
command=nginx -g 'daemon off;'
stdout_logfile=/dev/stdout
stdout_logfile_maxbytes=0
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0
autorestart=false
startretries=0

worker_processes 1;
error_log stderr warn;
pid /run/nginx.pid;

events {
worker_connections 1024;
}

http {
include mime.types;
default_type application/octet-stream;

log_format main_timed '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for" '
'$request_time $upstream_response_time $pipe $upstream_cache_status';

access_log /dev/stdout main_timed;
error_log /dev/stderr notice;

keepalive_timeout 65;

server {
listen [::]:8080 default_server;
listen 8080 default_server;
server_name _;

server_tokens off;

client_max_body_size 10M;
sendfile off;

root /var/www/html;
index index.php index.html;

location / {
try_files $uri $uri/ @rewrite;
}

# wbb rewrite
location @rewrite {
rewrite ^/(forum/|cms/|wcf/|calendar/|filebase/|blog/|gallery/)?([^.]+)$ /$1index.php?$2 last;
}

# redirect server error pages to the static page /50x.html
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /var/lib/nginx/html;
}

# pass the php scripts to fastcgi daemon
location ~ \.php$ {
gzip off;
try_files $uri =404;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass 127.0.0.1:9000;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
fastcgi_index index.php;
include fastcgi_params;
}

location ~* \.(jpg|jpeg|gif|png|css|js|ico|xml)$ {
expires 5d;
}

# deny access to . files, for security reasons
location ~ /\. {
log_not_found off;
deny all;
}

# limit fpm status configs to localhost
location ~ ^/(fpm-status|fpm-ping)$ {
access_log off;
allow 127.0.0.1;
deny all;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
fastcgi_pass 127.0.0.1:9000;
}
}
}