Closed hajekj closed 1 month ago
Same issue on Digital Ocean App Platform, can confirm the suggested fix also works here. Thanks!
@zgjimgjonbalaj Try this release and let me know if you have good results: https://github.com/serversideup/docker-php/releases/tag/v3.3.0-beta1
@jaydrogers does this tag have that version serversideup/php:beta-8.2-fpm-nginx-alpine
?
Edit: Can confirm that the image above is working as expected on Digital Ocean App Platform without having to add the workaround to the Dockerfile.
Awesome. I am closing the issue, since it got resolved and the linked PR didn't close it. This can be considered resolved.
Affected Docker Images
serversideup/php:8.2-fpm-apache ...all images based on v3 using s6-overlay
Current Behavior
As mentioned in #360, when running the image on some managed cloud provider, the container fails to start with:
and when
S6_READ_ONLY_ROOT=1
is set, the container still fails to start with:This is due to the container being started with
no_new_priv
flag.Expected Behavior
I would expect the container to run perfectly on major cloud providers like v2.
Steps To Reproduce
Anything else?
There are currently two workarounds available:
root
again, which I understand that it is not recommended due to security./run
directory to be owned bywww-data
user which fixes the issueThis is currently from my Dockerfile which just modifies the published image.
I believe this mitigation is less invasive than running the container as
root
. I am up for submitting this change as a PR to fix this in all the images, since it will be much easier to use imho. What are your thoughts on this (I have no clue whether such change would negatively affect extensibility of this image, but since the same operation is performed vias6-overlay
I believe it should be okay)?