Dockerfile-composerbuilder

# This Dockerfile builds the *composer-builder" image, which is the base for the `sitebuilder-base`

ARG PHP_VERSION

FROM php:${PHP_VERSION}

# *_VERSION are passed by Gitlab as an argument through the softwareVersions file
ARG COMPOSER_VERSION
ARG NGINX_VERSION

LABEL maintainer="Drupal Admins <drupal-admins@cern.ch>" \
      composer_version="$COMPOSER_VERSION"

# TODO: check if we need this, this might be unnecessary
RUN source /etc/os-release && \
    ALPINE_VERSION=$(echo "$VERSION_ID" | cut -d. -f1-2) && \
    echo "http://dl-cdn.alpinelinux.org/alpine/v${ALPINE_VERSION}/main" >>  /etc/apk/repositories

# from https://www.drupal.org/docs/8/system-requirements/drupal-8-php-requirements
# from https://github.com/docker-library/docs/blob/master/php/README.md#supported-tags-and-respective-dockerfile-links
# install some utils
RUN apk --update add \
    # Some composer packages need git
    git \
    patch \
    curl \
    gettext \
    zip \
    unzip \
    mysql-client \
    jq \
    tzdata \
    rsync \
    icu-dev \
    libcurl \
    imagemagick-dev \
    imagemagick \
    php7-pecl-imagick \
    bzip2-dev \
    ldb-dev \
    libldap \
    openldap-dev \
    libxml2-dev \
    libxml2 \
    libxslt-dev \
    libxslt \
    net-snmp \
    net-snmp-dev \
    php7-mbstring

# Fix for iconv library
# This must be present in the sitebuilder image,
# so that it can be used in runtime.
# ffi: https://gitlab.cern.ch/webservices/webframeworks-planning/-/issues/690
RUN apk add --update gnu-libiconv
ENV LD_PRELOAD /usr/lib/preloadable_libiconv.so

# Configured timezone.
ENV TZ=Europe/Zurich
RUN touch /usr/share/zoneinfo/$TZ \
	&& cp /usr/share/zoneinfo/$TZ /etc/localtime \
	&& echo $TZ > /etc/timezone && \
	apk del tzdata \
	&& rm -rf /var/cache/apk/*

# PHP FPM
RUN set -eux; \
	\
	apk add --no-cache --virtual .build-deps autoconf g++ make \
		coreutils \
		freetype-dev \
		libjpeg-turbo-dev \
		libpng-dev \
		libzip-dev \
		mysql-client \
	; \
    \
    # install redis
	pecl install -o -f redis \
	; \
    rm -rf /tmp/pear \
	; \
	docker-php-ext-enable redis \
    ; \
    \
    # install imagick
	pecl install -o -f imagick \
	; \
	\
	docker-php-ext-enable imagick \
    ; \
	\
    # install igbinary
	pecl install -o -f igbinary\
	; \
	\
	docker-php-ext-enable igbinary\
    ; \
	\
    # install msgpack
	pecl install -o -f msgpack\
	; \
	\
	docker-php-ext-enable msgpack \
    ; \
	\
	docker-php-ext-configure gd \
     --with-freetype=/usr/include \
     --with-jpeg=/usr/include \
	; \
	\
	docker-php-ext-install -j "$(nproc)" \
		gd \
		opcache \
		pdo_mysql \
		zip \
        calendar \
        bz2 \
        dba \
        exif \
        intl \
        ldap \
        # Exists on the old infra, to deprecate?
        #memcached \
        mysqli \
        # Exists on the old infra, to deprecate?
        #odbc \
        #pdo_odbc \
        # recode \ Does no longer exist ?
        shmop \
        snmp \
        soap \
        sockets \
        sysvmsg \
        sysvsem \
        sysvshm \
        xml \
        #wddx \ Does not exist for Drupal9/PHP7.4
        xmlrpc \
        xsl \
	; \
	\
	runDeps="$( \
		scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
			| tr ',' '\n' \
			| sort -u \
			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
	)"; \
	apk add --virtual .drupal-phpexts-rundeps $runDeps; \
	apk del .build-deps

RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/bin --filename=composer --version=${COMPOSER_VERSION}


# Install nginx on php-fpm. At this point in the Dockerfile PHP/composer is installed. Now we're also adding nginx.
# We add nginx in the same image to eliminate the need to copy the sitebuilder to an empty dir on pod startup.
#
# Copy from upstream
# ~~Ref: https://github.com/bkuhl/fpm-nginx/blob/master/Dockerfile~~ (this is inspiration for the "mix")
# Ref: https://github.com/nginxinc/docker-nginx/blob/master/stable/alpine/Dockerfile

ARG NJS_VERSION
ENV PKG_RELEASE   1

RUN set -x \
# create nginx user/group first, to be consistent throughout docker variants
    && addgroup -g 101 -S nginx \
    && adduser -S -D -H -u 101 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx \
    && apkArch="$(cat /etc/apk/arch)" \
    && nginxPackages=" \
        nginx=${NGINX_VERSION}-r${PKG_RELEASE} \
        nginx-module-xslt=${NGINX_VERSION}-r${PKG_RELEASE} \
        nginx-module-geoip=${NGINX_VERSION}-r${PKG_RELEASE} \
        nginx-module-image-filter=${NGINX_VERSION}-r${PKG_RELEASE} \
        nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${PKG_RELEASE} \
    " \
    && case "$apkArch" in \
        x86_64|aarch64) \
# arches officially built by upstream
            set -x \
            && KEY_SHA512="e7fa8303923d9b95db37a77ad46c68fd4755ff935d0a534d26eba83de193c76166c68bfe7f65471bf8881004ef4aa6df3e34689c305662750c0172fca5d8552a *stdin" \
            && apk add --no-cache --virtual .cert-deps \
                openssl \
            && wget -O /tmp/nginx_signing.rsa.pub https://nginx.org/keys/nginx_signing.rsa.pub \
            && if [ "$(openssl rsa -pubin -in /tmp/nginx_signing.rsa.pub -text -noout | openssl sha512 -r)" = "$KEY_SHA512" ]; then \
                echo "key verification succeeded!"; \
                mv /tmp/nginx_signing.rsa.pub /etc/apk/keys/; \
            else \
                echo "key verification failed!"; \
                exit 1; \
            fi \
            && apk del .cert-deps \
            && apk add -X "https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \
            ;; \
        *) \
# we're on an architecture upstream doesn't officially build for
# let's build binaries from the published packaging sources
            set -x \
            && tempDir="$(mktemp -d)" \
            && chown nobody:nobody $tempDir \
            && apk add --no-cache --virtual .build-deps \
                gcc \
                libc-dev \
                make \
                openssl-dev \
                pcre-dev \
                zlib-dev \
                linux-headers \
                libxslt-dev \
                gd-dev \
                geoip-dev \
                perl-dev \
                libedit-dev \
                mercurial \
                bash \
                alpine-sdk \
                findutils \
            && su nobody -s /bin/sh -c " \
                export HOME=${tempDir} \
                && cd ${tempDir} \
                && hg clone https://hg.nginx.org/pkg-oss \
                && cd pkg-oss \
                && hg up ${NGINX_VERSION}-${PKG_RELEASE} \
                && cd alpine \
                && make all \
                && apk index -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \
                && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \
                " \
            && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \
            && apk del .build-deps \
            && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \
            ;; \
    esac \
# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
    && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
    && if [ -n "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
    && if [ -n "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
# Bring in gettext so we can get `envsubst`, then throw
# the rest away. To do this, we need to install `gettext`
# then move `envsubst` out of the way so `gettext` can
# be deleted completely, then move `envsubst` back.
    && apk add --no-cache --virtual .gettext gettext \
    && mv /usr/bin/envsubst /tmp/ \
    \
    && runDeps="$( \
        scanelf --needed --nobanner /tmp/envsubst \
            | awk '{ gsub(/,/, "\nso:", $2); print "so:" $2 }' \
            | sort -u \
            | xargs -r apk info --installed \
            | sort -u \
    )" \
    && apk add --no-cache $runDeps \
    && apk del .gettext \
    && mv /tmp/envsubst /usr/local/bin/ \
# Bring in tzdata so users could set the timezones through the environment
# variables
    && apk add --no-cache tzdata \
# Bring in curl and ca-certificates to make registering on DNS SD easier
    && apk add --no-cache curl ca-certificates \
# forward request and error logs to docker log collector
    && ln -sf /dev/stdout /var/log/nginx/access.log \
    && ln -sf /dev/stderr /var/log/nginx/error.log

RUN echo "daemon off;" >> /etc/nginx/nginx.conf

# Make the environment friendly for interactive use during development
WORKDIR /project
CMD ["/bin/sh"]