Upgrading to LTS Version 5.6.37+230905

Update docker/build-push-action action to v5

.github/renovate.json

@@ -0,0 +1,9 @@
+{
+  "extends": [
+    "config:base"
+  ],
+  "enabledManagers": ["dockerfile", "github-actions"],
+  "dockerfile": {
+    "ignorePaths": ["4.0", "nginx-certbot"]
+  }
+}

.github/workflows/build-latest-container-images.yaml

@@ -2,7 +2,7 @@ name: Publish Latest Container Images
 on:
   push:
     tags:
-      - '5.*'
+      - '6.*'
 
 jobs:
   lint_dockerfiles:
@@ -11,15 +11,15 @@ jobs:
     strategy:
       matrix:
         dockerfile:
-          - 5.0/apache/Dockerfile
-          - 5.0/fpm-alpine/Dockerfile
-          - 5.0/fpm/Dockerfile
+          - 6.0/apache/Dockerfile
+          - 6.0/fpm-alpine/Dockerfile
+          - 6.0/fpm/Dockerfile
     steps:
-      - uses: actions/checkout@v2
-      - uses: hadolint/hadolint-action@v1.5.0
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
+      - uses: hadolint/hadolint-action@v3.1.0
         with:
           dockerfile: ${{ matrix.dockerfile }}
-          ignore: DL4006 DL3008 DL3018
+          ignore: "DL4006,DL3008,DL3018"
 
   push_images_to_registries:
     name: Push Container Images to registries
@@ -31,66 +31,80 @@ jobs:
       contents: read
     steps:
       - name: 'Check out the repo'
-        uses: actions/checkout@v2
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
+      - name: 'Set up QEMU'
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: 'arm64,arm'
       - name: 'Set up Docker Buildx'
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v3
         with:
           buildkitd-flags: --debug
       - name: 'Log in to DockerHub'
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v1
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_TOKEN }}
       - name: 'Apache variant metadata'
         id: metadata-apache
-        uses: docker/metadata-action@v3
+        uses: docker/metadata-action@v5
         with:
           images: |
             docker.io/martialblog/limesurvey
           tags: |
-            type=semver,pattern={{raw}},suffix=-apache
-            type=semver,pattern={{major}},suffix=-apache
+            type=match,pattern=(.+),group=1
+            type=match,pattern=^(\d+),group=1
           flavor: |
-            latest=false
+            latest=true
+            suffix=-apache
       - name: 'Build and push latest Apache container images'
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v5
         with:
-          context: 5.0/apache
+          context: 6.0/apache
           push: true
           tags: ${{ steps.metadata-apache.outputs.tags }}
           labels: ${{ steps.metadata-apache.outputs.labels }}
+          platforms: linux/amd64,linux/arm64
 
       - name: 'FPM variant metadata'
         id: metadata-fpm
-        uses: docker/metadata-action@v3
+        uses: docker/metadata-action@v5
         with:
           images: |
             docker.io/martialblog/limesurvey
           tags: |
-            type=semver,pattern={{version}},suffix=-fpm
-            type=semver,pattern={{major}},suffix=-fpm
+            type=match,pattern=(.+),group=1
+            type=match,pattern=^(\d+),group=1
+          flavor: |
+            latest=false
+            suffix=-fpm
       - name: 'Build and push latest fpm container images'
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v5
         with:
-          context: 5.0/fpm
+          context: 6.0/fpm
           push: true
           tags: ${{ steps.metadata-fpm.outputs.tags }}
           labels: ${{ steps.metadata-fpm.outputs.labels }}
+          platforms: linux/amd64,linux/arm64
 
       - name: 'FPM Alpine variant metadata'
         id: metadata-fpm-alpine
-        uses: docker/metadata-action@v3
+        uses: docker/metadata-action@v5
         with:
           images: |
             docker.io/martialblog/limesurvey
           tags: |
-            type=semver,pattern={{version}},suffix=-fpm-alpine
-            type=semver,pattern={{major}},suffix=-fpm-alpine
+            type=match,pattern=(.+),group=1
+            type=match,pattern=^(\d+),group=1
+          flavor: |
+            latest=false
+            suffix=-fpm-alpine
       - name: 'Build and push latest fpm-alpine container images'
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v5
         with:
-          context: 5.0/fpm-alpine
+          context: 6.0/fpm-alpine
           push: true
           tags: ${{ steps.metadata-fpm-alpine.outputs.tags }}
           labels: ${{ steps.metadata-fpm-alpine.outputs.labels }}
+          platforms: linux/amd64,linux/arm64

.github/workflows/build-lts-container-images.yaml

@@ -2,7 +2,7 @@ name: Publish LTS Container Images
 on:
   push:
     tags:
-      - '3.*'
+      - '5.*'
 
 jobs:
   lint_dockerfiles:
@@ -11,15 +11,15 @@ jobs:
     strategy:
       matrix:
         dockerfile:
-          - 3.0/apache/Dockerfile
-          - 3.0/fpm-alpine/Dockerfile
-          - 3.0/fpm/Dockerfile
+          - 5.0/apache/Dockerfile
+          - 5.0/fpm-alpine/Dockerfile
+          - 5.0/fpm/Dockerfile
     steps:
-      - uses: actions/checkout@v2
-      - uses: hadolint/hadolint-action@v1.5.0
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
+      - uses: hadolint/hadolint-action@v3.1.0
         with:
           dockerfile: ${{ matrix.dockerfile }}
-          ignore: DL4006 DL3008 DL3018
+          ignore: "DL4006,DL3008,DL3018"
 
   push_images_to_registries:
     name: 'Push container images to registries'
@@ -31,66 +31,80 @@ jobs:
       contents: read
     steps:
       - name: 'Check out the repo'
-        uses: actions/checkout@v2
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
+      - name: 'Set up QEMU'
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: 'arm64,arm'
       - name: 'Set up Docker Buildx'
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v3
         with:
           buildkitd-flags: --debug
       - name: 'Log in to DockerHub'
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v1
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_TOKEN }}
       - name: 'Apache variant metadata'
         id: metadata-apache
-        uses: docker/metadata-action@v3
+        uses: docker/metadata-action@v5
         with:
           images: |
             docker.io/martialblog/limesurvey
           tags: |
-            type=semver,pattern={{raw}},suffix=-apache
-            type=semver,pattern={{major}},suffix=-apache
+            type=match,pattern=(.+),group=1
+            type=match,pattern=^(\d+),group=1
           flavor: |
             latest=false
+            suffix=-apache
       - name: 'Build and push LTS apache container images'
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v5
         with:
-          context: 3.0/apache
+          context: 5.0/apache
           push: true
           tags: ${{ steps.metadata-apache.outputs.tags }}
           labels: ${{ steps.metadata-apache.outputs.labels }}
+          platforms: linux/amd64,linux/arm64
 
       - name: 'FPM variant metadata'
         id: metadata-fpm
-        uses: docker/metadata-action@v3
+        uses: docker/metadata-action@v5
         with:
           images: |
             docker.io/martialblog/limesurvey
           tags: |
-            type=semver,pattern={{version}},suffix=-fpm
-            type=semver,pattern={{major}},suffix=-fpm
+            type=match,pattern=(.+),group=1
+            type=match,pattern=^(\d+),group=1
+          flavor: |
+            latest=false
+            suffix=-fpm
       - name: 'Build and push LTS fpm container images'
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v5
         with:
-          context: 3.0/fpm
+          context: 5.0/fpm
           push: true
           tags: ${{ steps.metadata-fpm.outputs.tags }}
           labels: ${{ steps.metadata-apache.outputs.labels }}
+          platforms: linux/amd64,linux/arm64
 
       - name: 'FPM Alpine variant metadata'
         id: metadata-fpm-alpine
-        uses: docker/metadata-action@v3
+        uses: docker/metadata-action@v5
         with:
           images: |
             docker.io/martialblog/limesurvey
           tags: |
-            type=semver,pattern={{version}},suffix=-fpm-alpine
-            type=semver,pattern={{major}},suffix=-fpm-alpine
+            type=match,pattern=(.+),group=1
+            type=match,pattern=^(\d+),group=1
+          flavor: |
+            latest=false
+            suffix=-fpm-alpine
       - name: 'Build and push LTS fpm-alpine container images'
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v5
         with:
-          context: 3.0/fpm-alpine
+          context: 5.0/fpm-alpine
           push: true
           tags: ${{ steps.metadata-fpm-alpine.outputs.tags }}
           labels: ${{ steps.metadata-apache.outputs.labels }}
+          platforms: linux/amd64,linux/arm64

.github/workflows/lint-dockerfiles.yaml

@@ -9,16 +9,16 @@ jobs:
     strategy:
       matrix:
         dockerfile:
-          - 3.0/apache/Dockerfile
-          - 3.0/fpm-alpine/Dockerfile
-          - 3.0/fpm/Dockerfile
           - 5.0/apache/Dockerfile
           - 5.0/fpm-alpine/Dockerfile
           - 5.0/fpm/Dockerfile
+          - 6.0/apache/Dockerfile
+          - 6.0/fpm-alpine/Dockerfile
+          - 6.0/fpm/Dockerfile
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: hadolint/hadolint-action@v1.5.0
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
+      - uses: hadolint/hadolint-action@v3.1.0
         with:
           dockerfile: ${{ matrix.dockerfile }}
-          ignore: DL4006 DL3008 DL3018
+          ignore: "DL4006,DL3008,DL3018"

.github/workflows/test-arm-container-images.yaml

@@ -0,0 +1,48 @@
+name: Test ARM Container Images
+
+on:
+  push:
+    branches:
+      - 'arm/**'
+  pull_request:
+    branches:
+      - 'arm/**'
+
+jobs:
+  test_images:
+    name: Test Latest Container Images
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        context:
+          - apache
+          - fpm-alpine
+          - fpm
+        platform:
+          - linux/arm64
+    steps:
+      - name: 'Check out the repo'
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
+
+      - name: 'Set up QEMU'
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: 'arm64,arm'
+
+      - name: 'Set up Docker Buildx'
+        uses: docker/setup-buildx-action@v3
+
+      - name: 'Build Container images'
+        uses: docker/build-push-action@v5
+        with:
+          context: 6.0/${{ matrix.context }}
+          push: false
+          load: true
+          tags: docker.io/martialblog/limesurvey:6-${{ matrix.context }}
+          platforms: ${{ matrix.platform }}
+
+      - name: 'Run Structure tests'
+        uses: plexsystems/container-structure-test-action@v0.3.0
+        with:
+          image: docker.io/martialblog/limesurvey:6-${{ matrix.context }}
+          config: tests/${{ matrix.context }}-tests.yaml

.github/workflows/test-latest-container-images.yaml

@@ -4,7 +4,7 @@ on: [push, pull_request]
 
 jobs:
   test_images:
-    name: Test Latest Container Images with Trivy
+    name: Test Latest Container Images
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -14,21 +14,26 @@ jobs:
           - fpm
     steps:
       - name: 'Check out the repo'
-        uses: actions/checkout@v2
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
+
+      - name: 'Set up QEMU'
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: 'arm64,arm'
 
       - name: 'Set up Docker Buildx'
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v3
 
       - name: 'Build Container images'
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v5
         with:
-          context: 5.0/${{ matrix.context }}
+          context: 6.0/${{ matrix.context }}
           push: false
           load: true
-          tags: docker.io/martialblog/limesurvey:5-${{ matrix.context }}
+          tags: docker.io/martialblog/limesurvey:6-${{ matrix.context }}
 
       - name: 'Run Structure tests'
-        uses: plexsystems/container-structure-test-action@v0.2.0
+        uses: plexsystems/container-structure-test-action@v0.3.0
         with:
-          image: docker.io/martialblog/limesurvey:5-${{ matrix.context }}
+          image: docker.io/martialblog/limesurvey:6-${{ matrix.context }}
           config: tests/${{ matrix.context }}-tests.yaml

.github/workflows/test-lts-container-images.yaml

@@ -4,7 +4,7 @@ on: [push, pull_request]
 
 jobs:
   test_images:
-    name: Test LTS Container Images with Trivy
+    name: Test LTS Container Images
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -14,21 +14,24 @@ jobs:
           - fpm
     steps:
       - name: 'Check out the repo'
-        uses: actions/checkout@v2
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
+
+      - name: 'Set up QEMU'
+        uses: docker/setup-qemu-action@v3
 
       - name: 'Set up Docker Buildx'
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v3
 
       - name: 'Build Container images'
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v5
         with:
-          context: 3.0/${{ matrix.context }}
+          context: 5.0/${{ matrix.context }}
           push: false
           load: true
-          tags: docker.io/martialblog/limesurvey:3-${{ matrix.context }}
+          tags: docker.io/martialblog/limesurvey:5-${{ matrix.context }}
 
       - name: 'Run Structure tests'
-        uses: plexsystems/container-structure-test-action@v0.2.0
+        uses: plexsystems/container-structure-test-action@v0.3.0
         with:
-          image: docker.io/martialblog/limesurvey:3-${{ matrix.context }}
+          image: docker.io/martialblog/limesurvey:5-${{ matrix.context }}
           config: tests/${{ matrix.context }}-tests.yaml

3.0/apache/Dockerfile

@@ -1,56 +1,70 @@
-FROM php:7.4-apache
+FROM docker.io/php:8.0-apache
 LABEL maintainer="markus@martialblog.de"
-ARG version='3.27.25+211116'
-ARG sha256_checksum='91ecfecffc3a437dbb14dec19054d64f07849fe1de00a1322699bd1f50185582'
-ARG USER=root
-ARG LISTEN_PORT=80
 
 # Install OS dependencies
 RUN set -ex; \
-        apt-get update && \
-        DEBIAN_FRONTEND=noninteractive \
-        apt-get install --no-install-recommends -y \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
+                netcat \
+        ; \
         \
-        libldap2-dev \
-        libfreetype6-dev \
-        libjpeg-dev \
-        libonig-dev \
-        zlib1g-dev \
-        libc-client-dev \
-        libkrb5-dev \
-        libpng-dev \
-        libpq-dev \
-        libzip-dev \
-        libtidy-dev \
-        libsodium-dev \
-        netcat \
-        \
-        && apt-get -y autoclean; apt-get -y autoremove; \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
         rm -rf /var/lib/apt/lists/*
 
-# Link LDAP library for PHP ldap extension
-RUN set -ex; \
-        ln -fs /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/
-
 # Install PHP Plugins and Configure PHP imap plugin
+# hadolint ignore=SC2086
 RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
-        docker-php-ext-configure imap --with-kerberos --with-imap-ssl && \
-        docker-php-ext-install -j5 \
-        exif \
-        gd \
-        imap \
-        ldap \
-        mbstring \
-        pdo \
-        pdo_mysql \
-        pdo_pgsql \
-        pgsql \
-        sodium \
-        tidy \
-        zip
-
-ENV LIMESURVEY_VERSION=$version
+        \
+        savedAptMark="$(apt-mark showmanual)"; \
+        \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
+                libldap2-dev \
+                libfreetype6-dev \
+                libjpeg-dev \
+                libonig-dev \
+                zlib1g-dev \
+                libc-client-dev \
+                libkrb5-dev \
+                libpng-dev \
+                libpq-dev \
+                libzip-dev \
+                libtidy-dev \
+                libsodium-dev \
+        ; \
+        \
+        debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+        docker-php-ext-configure gd --with-freetype --with-jpeg; \
+        docker-php-ext-configure imap --with-kerberos --with-imap-ssl; \
+        docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+        docker-php-ext-install -j "$(nproc)" \
+                exif \
+                gd \
+                imap \
+                ldap \
+                mbstring \
+                pdo \
+                pdo_mysql \
+                pdo_pgsql \
+                pgsql \
+                sodium \
+                tidy \
+                zip \
+        ; \
+        \
+# Reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+        apt-mark auto '.*' > /dev/null; \
+        apt-mark manual $savedAptMark; \
+        ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+                | awk '/=>/ { print $3 }' \
+                | sort -u \
+                | xargs -r dpkg-query -S \
+                | cut -d: -f1 \
+                | sort -u \
+                | xargs -rt apt-mark manual; \
+        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*
 
 # Apache configuration
 RUN a2enmod headers rewrite remoteip; \
@@ -65,9 +79,16 @@ RUN a2enmod headers rewrite remoteip; \
 # Use the default production configuration
 RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"
 
-# Download, unzip and chmod LimeSurvey from official GitHub repository
+ARG version="3.28.59+230517"
+ARG sha256_checksum="e048eaaf5260a8d6391609c355bb4df8c8ef0e0943b2d612d2a8414956db622a"
+ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
+ARG USER=root
+ARG LISTEN_PORT=80
+ENV LIMESURVEY_VERSION=$version
+
+# Download, unzip and chmod LimeSurvey from GitHub (defaults to the official LimeSurvey/LimeSurvey repository)
 RUN set -ex; \
-        curl -sSL "https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz" --output /tmp/limesurvey.tar.gz && \
+        curl -sSL "${archive_url}" --output /tmp/limesurvey.tar.gz && \
         echo "${sha256_checksum}  /tmp/limesurvey.tar.gz" | sha256sum -c - && \
         \
         tar xzvf "/tmp/limesurvey.tar.gz" --strip-components=1 -C /var/www/html/ && \
@@ -75,8 +96,8 @@ RUN set -ex; \
         chown -R www-data:www-data /var/www/html /etc/apache2
 
 WORKDIR /var/www/html
-COPY entrypoint.sh entrypoint.sh
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
 COPY vhosts-access-log.conf /etc/apache2/conf-enabled/other-vhosts-access-log.conf
 USER $USER
-ENTRYPOINT ["/var/www/html/entrypoint.sh"]
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
 CMD ["apache2-foreground"]

3.0/fpm-alpine/Dockerfile

@@ -1,9 +1,11 @@
-FROM php:7.4-fpm-alpine
+FROM docker.io/php:8.0-fpm-alpine
 LABEL maintainer="markus@martialblog.de"
-ARG version='3.27.25+211116'
-ARG sha256_checksum='91ecfecffc3a437dbb14dec19054d64f07849fe1de00a1322699bd1f50185582'
 
 # Install OS dependencies
+RUN apk add --no-cache netcat-openbsd bash
+
+# Install PHP Plugins
+# hadolint ignore=SC2086
 RUN set -ex; \
         apk add --no-cache --virtual .build-deps \
         freetype-dev \
@@ -15,14 +17,13 @@ RUN set -ex; \
         openldap-dev \
         oniguruma-dev \
         imap-dev \
-        postgresql-dev && \
-        apk add --no-cache netcat-openbsd bash
-
-# Install PHP Plugins
-RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
-        docker-php-ext-configure imap --with-imap-ssl && \
-        docker-php-ext-install \
+        postgresql-dev \
+    ; \
+    \
+    docker-php-ext-configure gd --with-freetype --with-jpeg; \
+    docker-php-ext-configure imap --with-imap-ssl; \
+    docker-php-ext-install -j "$(nproc)" \
+        exif \
         gd \
         imap \
         ldap \
@@ -33,11 +34,26 @@ RUN set -ex; \
         pgsql \
         sodium \
         tidy \
-        zip
+        zip \
+    ; \
+    \
+    runDeps="$( \
+        scanelf --needed --nobanner --format '%n#p' --recursive /usr/local/lib/php/extensions \
+            | tr ',' '\n' \
+            | sort -u \
+            | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+    )"; \
+    apk add --no-cache --no-network --virtual .limesurvey-phpext-rundeps $runDeps; \
+    apk del --no-cache --no-network .build-deps
 
-# Download, unzip and chmod LimeSurvey from official GitHub repository
+ARG version="3.28.59+230517"
+ARG sha256_checksum="e048eaaf5260a8d6391609c355bb4df8c8ef0e0943b2d612d2a8414956db622a"
+ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
+ENV LIMESURVEY_VERSION=$version
+
+# Download, unzip and chmod LimeSurvey from GitHub (defaults to the official LimeSurvey/LimeSurvey repository)
 RUN set -ex; \
-        curl -sSL "https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz" --output /tmp/limesurvey.tar.gz && \
+        curl -sSL "${archive_url}" --output /tmp/limesurvey.tar.gz && \
         echo "${sha256_checksum}  /tmp/limesurvey.tar.gz" | sha256sum -c - && \
         \
         tar xzvf "/tmp/limesurvey.tar.gz" --strip-components=1 -C /var/www/html/ && \
@@ -52,6 +68,6 @@ RUN set -ex; \
 EXPOSE 9000
 
 WORKDIR /var/www/html
-COPY entrypoint.sh entrypoint.sh
-ENTRYPOINT ["/var/www/html/entrypoint.sh"]
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
 CMD ["php-fpm"]

3.0/fpm/Dockerfile

@@ -1,58 +1,79 @@
-FROM php:7.4-fpm
+FROM docker.io/php:8.0-fpm
 LABEL maintainer="markus@martialblog.de"
-ARG version='3.27.25+211116'
-ARG sha256_checksum='91ecfecffc3a437dbb14dec19054d64f07849fe1de00a1322699bd1f50185582'
 
 # Install OS dependencies
 RUN set -ex; \
-        apt-get update && \
-        DEBIAN_FRONTEND=noninteractive \
-        apt-get install --no-install-recommends -y \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
+                netcat \
+        ; \
         \
-        libldap2-dev \
-        libfreetype6-dev \
-        libjpeg-dev \
-        libonig-dev \
-        zlib1g-dev \
-        libc-client-dev \
-        libkrb5-dev \
-        libpng-dev \
-        libpq-dev \
-        libzip-dev \
-        libtidy-dev \
-        libsodium-dev \
-        netcat \
-        \
-        && apt-get -y autoclean; apt-get -y autoremove; \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
         rm -rf /var/lib/apt/lists/*
 
-# Link LDAP library for PHP ldap extension
-RUN set -ex; \
-        ln -fs /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/
-
 # Install PHP Plugins and Configure PHP imap plugin
+# hadolint ignore=SC2086
 RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
-        docker-php-ext-configure imap --with-kerberos --with-imap-ssl && \
-        docker-php-ext-install -j5 \
-        exif \
-        gd \
-        imap \
-        ldap \
-        mbstring \
-        pdo \
-        pdo_mysql \
-        pdo_pgsql \
-        pgsql \
-        sodium \
-        tidy \
-        zip
+        \
+        savedAptMark="$(apt-mark showmanual)"; \
+        \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
+                libldap2-dev \
+                libfreetype6-dev \
+                libjpeg-dev \
+                libonig-dev \
+                zlib1g-dev \
+                libc-client-dev \
+                libkrb5-dev \
+                libpng-dev \
+                libpq-dev \
+                libzip-dev \
+                libtidy-dev \
+                libsodium-dev \
+        ; \
+        \
+        debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+        docker-php-ext-configure gd --with-freetype --with-jpeg; \
+        docker-php-ext-configure imap --with-kerberos --with-imap-ssl; \
+        docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+        docker-php-ext-install -j "$(nproc)" \
+                exif \
+                gd \
+                imap \
+                ldap \
+                mbstring \
+                pdo \
+                pdo_mysql \
+                pdo_pgsql \
+                pgsql \
+                sodium \
+                tidy \
+                zip \
+        ; \
+        \
+# Reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+        apt-mark auto '.*' > /dev/null; \
+        apt-mark manual $savedAptMark; \
+        ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+                | awk '/=>/ { print $3 }' \
+                | sort -u \
+                | xargs -r dpkg-query -S \
+                | cut -d: -f1 \
+                | sort -u \
+                | xargs -rt apt-mark manual; \
+        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*
 
+ARG version="3.28.59+230517"
+ARG sha256_checksum="e048eaaf5260a8d6391609c355bb4df8c8ef0e0943b2d612d2a8414956db622a"
+ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
 ENV LIMESURVEY_VERSION=$version
 
-# Download, unzip and chmod LimeSurvey from official GitHub repository
+# Download, unzip and chmod LimeSurvey from GitHub (defaults to the official LimeSurvey/LimeSurvey repository)
 RUN set -ex; \
-        curl -sSL "https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz" --output /tmp/limesurvey.tar.gz && \
+        curl -sSL "${archive_url}" --output /tmp/limesurvey.tar.gz && \
         echo "${sha256_checksum}  /tmp/limesurvey.tar.gz" | sha256sum -c - && \
         \
         tar xzvf "/tmp/limesurvey.tar.gz" --strip-components=1 -C /var/www/html/ && \
@@ -62,6 +83,6 @@ RUN set -ex; \
 EXPOSE 9000
 
 WORKDIR /var/www/html
-COPY entrypoint.sh entrypoint.sh
-ENTRYPOINT ["/var/www/html/entrypoint.sh"]
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
 CMD ["php-fpm"]

4.0/apache/Dockerfile

@@ -1,82 +0,0 @@
-FROM php:7.4-apache
-LABEL maintainer="markus@martialblog.de"
-ARG version='4.6.3+210518'
-ARG sha256_checksum='3c59afc13d0cf974c465c5f851cb8837117518e94031f5e3a28ba468ad734ce2'
-ARG USER=root
-ARG LISTEN_PORT=80
-
-# Install OS dependencies
-RUN set -ex; \
-        apt-get update && \
-        DEBIAN_FRONTEND=noninteractive \
-        apt-get install --no-install-recommends -y \
-        \
-        libldap2-dev \
-        libfreetype6-dev \
-        libjpeg-dev \
-        libonig-dev \
-        zlib1g-dev \
-        libc-client-dev \
-        libkrb5-dev \
-        libpng-dev \
-        libpq-dev \
-        libzip-dev \
-        libtidy-dev \
-        libsodium-dev \
-        netcat \
-        curl \
-        \
-        && apt-get -y autoclean; apt-get -y autoremove; \
-        rm -rf /var/lib/apt/lists/*
-
-# Link LDAP library for PHP ldap extension
-RUN set -ex; \
-        ln -fs /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/
-
-# Install PHP Plugins and Configure PHP imap plugin
-RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
-        docker-php-ext-configure imap --with-kerberos --with-imap-ssl && \
-        docker-php-ext-install -j5 \
-        exif \
-        gd \
-        imap \
-        ldap \
-        mbstring \
-        pdo \
-        pdo_mysql \
-        pdo_pgsql \
-        pgsql \
-        sodium \
-        tidy \
-        zip
-
-ENV LIMESURVEY_VERSION=$version
-
-# Apache configuration
-RUN a2enmod headers rewrite remoteip; \
-        {\
-        echo RemoteIPHeader X-Real-IP ;\
-        echo RemoteIPTrustedProxy 10.0.0.0/8 ;\
-        echo RemoteIPTrustedProxy 172.16.0.0/12 ;\
-        echo RemoteIPTrustedProxy 192.168.0.0/16 ;\
-        } > /etc/apache2/conf-available/remoteip.conf;\
-        a2enconf remoteip
-
-# Use the default production configuration
-RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"
-
-# Download, unzip and chmod LimeSurvey from official GitHub repository
-RUN set -ex; \
-        curl -sSL "https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz" --output /tmp/limesurvey.tar.gz && \
-        echo "${sha256_checksum}  /tmp/limesurvey.tar.gz" | sha256sum -c - && \
-        \
-        tar xzvf "/tmp/limesurvey.tar.gz" --strip-components=1 -C /var/www/html/ && \
-        rm -f "/tmp/limesurvey.tar.gz" && \
-        chown -R www-data:www-data /var/www/html /etc/apache2
-
-WORKDIR /var/www/html
-COPY entrypoint.sh entrypoint.sh
-USER $USER
-ENTRYPOINT ["/var/www/html/entrypoint.sh"]
-CMD ["apache2-foreground"]

4.0/fpm-alpine/Dockerfile

@@ -1,58 +0,0 @@
-FROM php:7.4-fpm-alpine
-LABEL maintainer="markus@martialblog.de"
-ARG version='4.6.3+210518'
-ARG sha256_checksum='3c59afc13d0cf974c465c5f851cb8837117518e94031f5e3a28ba468ad734ce2'
-
-# Install OS dependencies
-RUN set -ex; \
-        apk add --no-cache --virtual .build-deps \
-        freetype-dev \
-        libpng-dev \
-        libzip-dev \
-        libjpeg-turbo-dev \
-        tidyhtml-dev \
-        libsodium-dev \
-        openldap-dev \
-        oniguruma-dev \
-        imap-dev \
-        postgresql-dev && \
-        apk add --no-cache netcat-openbsd bash
-
-# Install PHP Plugins
-RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
-        docker-php-ext-configure imap --with-imap-ssl && \
-        docker-php-ext-install \
-        exif \
-        gd \
-        imap \
-        ldap \
-        mbstring \
-        pdo \
-        pdo_mysql \
-        pdo_pgsql \
-        pgsql \
-        sodium \
-        tidy \
-        zip
-
-# Download, unzip and chmod LimeSurvey from official GitHub repository
-RUN set -ex; \
-        curl -sSL "https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz" --output /tmp/limesurvey.tar.gz && \
-        echo "${sha256_checksum}  /tmp/limesurvey.tar.gz" | sha256sum -c - && \
-        \
-        tar xzvf "/tmp/limesurvey.tar.gz" --strip-components=1 -C /var/www/html/ && \
-        \
-        rm -rf "/tmp/limesurvey.tar.gz" \
-        /var/www/html/docs \
-        /var/www/html/tests \
-        /var/www/html/*.md && \
-        chown -R www-data:root /var/www/ ; \
-        chmod -R g=u /var/www
-
-EXPOSE 9000
-
-WORKDIR /var/www/html
-COPY entrypoint.sh entrypoint.sh
-ENTRYPOINT ["/var/www/html/entrypoint.sh"]
-CMD ["php-fpm"]

4.0/fpm/Dockerfile

@@ -1,67 +0,0 @@
-FROM php:7.4-fpm
-LABEL maintainer="markus@martialblog.de"
-ARG version='4.6.3+210518'
-ARG sha256_checksum='3c59afc13d0cf974c465c5f851cb8837117518e94031f5e3a28ba468ad734ce2'
-
-# Install OS dependencies
-RUN set -ex; \
-        apt-get update && \
-        DEBIAN_FRONTEND=noninteractive \
-        apt-get install --no-install-recommends -y \
-        \
-        libldap2-dev \
-        libfreetype6-dev \
-        libjpeg-dev \
-        libonig-dev \
-        zlib1g-dev \
-        libc-client-dev \
-        libkrb5-dev \
-        libpng-dev \
-        libpq-dev \
-        libzip-dev \
-        libtidy-dev \
-        libsodium-dev \
-        netcat \
-        \
-        && apt-get -y autoclean; apt-get -y autoremove; \
-        rm -rf /var/lib/apt/lists/*
-
-# Link LDAP library for PHP ldap extension
-RUN set -ex; \
-        ln -fs /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/
-
-# Install PHP Plugins and Configure PHP imap plugin
-RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
-        docker-php-ext-configure imap --with-kerberos --with-imap-ssl && \
-        docker-php-ext-install -j5 \
-        exif \
-        gd \
-        imap \
-        ldap \
-        mbstring \
-        pdo \
-        pdo_mysql \
-        pdo_pgsql \
-        pgsql \
-        sodium \
-        tidy \
-        zip
-
-ENV LIMESURVEY_VERSION=$version
-
-# Download, unzip and chmod LimeSurvey from official GitHub repository
-RUN set -ex; \
-        curl -sSL "https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz" --output /tmp/limesurvey.tar.gz && \
-        echo "${sha256_checksum}  /tmp/limesurvey.tar.gz" | sha256sum -c - && \
-        \
-        tar xzvf "/tmp/limesurvey.tar.gz" --strip-components=1 -C /var/www/html/ && \
-        rm -f "/tmp/limesurvey.tar.gz" && \
-        chown -R www-data:www-data /var/www/html
-
-EXPOSE 9000
-
-WORKDIR /var/www/html
-COPY entrypoint.sh entrypoint.sh
-ENTRYPOINT ["/var/www/html/entrypoint.sh"]
-CMD ["php-fpm"]

5.0/apache/Dockerfile

@@ -1,57 +1,72 @@
-FROM php:8-apache
+FROM docker.io/php:8.0-apache
 LABEL maintainer="markus@martialblog.de"
-ARG version='5.2.2+211115'
-ARG sha256_checksum='61148c6131ea99a699d95117d1b53f1ba7971c609c93353e7b6221dd13515659'
-ARG USER=www-data
-ARG LISTEN_PORT=8080
 
 # Install OS dependencies
 RUN set -ex; \
-        apt-get update && \
-        DEBIAN_FRONTEND=noninteractive \
-        apt-get install --no-install-recommends -y \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
+                netcat-openbsd \
+                libldap-common \
+                libsasl2-modules \
+        ; \
         \
-        libldap2-dev \
-        libfreetype6-dev \
-        libjpeg-dev \
-        libonig-dev \
-        zlib1g-dev \
-        libc-client-dev \
-        libkrb5-dev \
-        libpng-dev \
-        libpq-dev \
-        libzip-dev \
-        libtidy-dev \
-        libsodium-dev \
-        netcat \
-        curl \
-        \
-        && apt-get -y autoclean; apt-get -y autoremove; \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
         rm -rf /var/lib/apt/lists/*
 
-# Link LDAP library for PHP ldap extension
-RUN set -ex; \
-        ln -fs /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/
-
 # Install PHP Plugins and Configure PHP imap plugin
+# hadolint ignore=SC2086
 RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
-        docker-php-ext-configure imap --with-kerberos --with-imap-ssl && \
-        docker-php-ext-install -j5 \
-        exif \
-        gd \
-        imap \
-        ldap \
-        mbstring \
-        pdo \
-        pdo_mysql \
-        pdo_pgsql \
-        pgsql \
-        sodium \
-        tidy \
-        zip
-
-ENV LIMESURVEY_VERSION=$version
+        \
+        savedAptMark="$(apt-mark showmanual)"; \
+        \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
+                libldap2-dev \
+                libfreetype6-dev \
+                libjpeg-dev \
+                libonig-dev \
+                zlib1g-dev \
+                libc-client-dev \
+                libkrb5-dev \
+                libpng-dev \
+                libpq-dev \
+                libzip-dev \
+                libtidy-dev \
+                libsodium-dev \
+        ; \
+        \
+        debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+        docker-php-ext-configure gd --with-freetype --with-jpeg; \
+        docker-php-ext-configure imap --with-kerberos --with-imap-ssl; \
+        docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+        docker-php-ext-install -j "$(nproc)" \
+                exif \
+                gd \
+                imap \
+                ldap \
+                mbstring \
+                pdo \
+                pdo_mysql \
+                pdo_pgsql \
+                pgsql \
+                sodium \
+                tidy \
+                zip \
+        ; \
+        \
+# Reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+        apt-mark auto '.*' > /dev/null; \
+        apt-mark manual $savedAptMark; \
+        ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+                | awk '/=>/ { print $3 }' \
+                | sort -u \
+                | xargs -r dpkg-query -S \
+                | cut -d: -f1 \
+                | sort -u \
+                | xargs -rt apt-mark manual; \
+        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*
 
 # Apache configuration
 RUN a2enmod headers rewrite remoteip; \
@@ -66,9 +81,16 @@ RUN a2enmod headers rewrite remoteip; \
 # Use the default production configuration
 RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"
 
-# Download, unzip and chmod LimeSurvey from official GitHub repository
+ARG version="5.6.37+230905"
+ARG sha256_checksum="f81bb0340036603aaea4bb211bab9df5de707f30a41974df0dc9026b2d89c863"
+ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/refs/tags/${version}.tar.gz"
+ARG USER=www-data
+ARG LISTEN_PORT=8080
+ENV LIMESURVEY_VERSION=$version
+
+# Download, unzip and chmod LimeSurvey from GitHub (defaults to the official LimeSurvey/LimeSurvey repository)
 RUN set -ex; \
-        curl -sSL "https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz" --output /tmp/limesurvey.tar.gz && \
+        curl -sSL "${archive_url}" --output /tmp/limesurvey.tar.gz && \
         echo "${sha256_checksum}  /tmp/limesurvey.tar.gz" | sha256sum -c - && \
         \
         tar xzvf "/tmp/limesurvey.tar.gz" --strip-components=1 -C /var/www/html/ && \
@@ -78,8 +100,8 @@ RUN set -ex; \
 EXPOSE $LISTEN_PORT
 
 WORKDIR /var/www/html
-COPY entrypoint.sh entrypoint.sh
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
 COPY vhosts-access-log.conf /etc/apache2/conf-enabled/other-vhosts-access-log.conf
 USER $USER
-ENTRYPOINT ["/var/www/html/entrypoint.sh"]
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
 CMD ["apache2-foreground"]

5.0/apache/entrypoint.sh

@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container
 
+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}
 
 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,19 +26,19 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'
 
-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
-ENCRYPT_NONCE=${ENCRYPT_NONCE:-}
-ENCRYPT_SECRET_BOX_KEY=${ENCRYPT_SECRET_BOX_KEY:-}
+file_env 'ENCRYPT_KEYPAIR'
+file_env 'ENCRYPT_PUBLIC_KEY'
+file_env 'ENCRYPT_SECRET_KEY'
+file_env 'ENCRYPT_NONCE'
+file_env 'ENCRYPT_SECRET_BOX_KEY'
 
 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'
 
 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
@@ -35,12 +52,12 @@ DEBUG_SQL=${DEBUG_SQL:-0}
 LISTEN_PORT=${LISTEN_PORT:-"8080"}
 
 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
     exit 1
 fi
 
 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
     exit 1
 fi
 

5.0/fpm-alpine/Dockerfile

@@ -1,10 +1,16 @@
-FROM php:8-fpm-alpine
+FROM docker.io/php:8.0-fpm-alpine
 LABEL maintainer="markus@martialblog.de"
-ARG version='5.2.2+211115'
-ARG sha256_checksum='61148c6131ea99a699d95117d1b53f1ba7971c609c93353e7b6221dd13515659'
-ARG USER=www-data
 
 # Install OS dependencies
+RUN set -ex; \
+        apk add --no-cache \
+        netcat-openbsd \
+        libsasl \
+        libldap \
+        bash
+
+# Install PHP Plugins
+# hadolint ignore=SC2086
 RUN set -ex; \
         apk add --no-cache --virtual .build-deps \
         freetype-dev \
@@ -16,14 +22,12 @@ RUN set -ex; \
         openldap-dev \
         oniguruma-dev \
         imap-dev \
-        postgresql-dev && \
-        apk add --no-cache netcat-openbsd bash
-
-# Install PHP Plugins
-RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
-        docker-php-ext-configure imap --with-imap-ssl && \
-        docker-php-ext-install \
+        postgresql-dev \
+    ; \
+    \
+    docker-php-ext-configure gd --with-freetype --with-jpeg; \
+    docker-php-ext-configure imap --with-imap-ssl; \
+    docker-php-ext-install -j "$(nproc)" \
         exif \
         gd \
         imap \
@@ -35,11 +39,27 @@ RUN set -ex; \
         pgsql \
         sodium \
         tidy \
-        zip
+        zip \
+    ; \
+    \
+    runDeps="$( \
+        scanelf --needed --nobanner --format '%n#p' --recursive /usr/local/lib/php/extensions \
+            | tr ',' '\n' \
+            | sort -u \
+            | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+    )"; \
+    apk add --no-cache --no-network --virtual .limesurvey-phpext-rundeps $runDeps; \
+    apk del --no-cache --no-network .build-deps
 
-# Download, unzip and chmod LimeSurvey from official GitHub repository
+ARG version="5.6.37+230905"
+ARG sha256_checksum="f81bb0340036603aaea4bb211bab9df5de707f30a41974df0dc9026b2d89c863"
+ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/refs/tags/${version}.tar.gz"
+ARG USER=www-data
+ENV LIMESURVEY_VERSION=$version
+
+# Download, unzip and chmod LimeSurvey from GitHub (defaults to the official LimeSurvey/LimeSurvey repository)
 RUN set -ex; \
-        curl -sSL "https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz" --output /tmp/limesurvey.tar.gz && \
+        curl -sSL "${archive_url}" --output /tmp/limesurvey.tar.gz && \
         echo "${sha256_checksum}  /tmp/limesurvey.tar.gz" | sha256sum -c - && \
         \
         tar xzvf "/tmp/limesurvey.tar.gz" --strip-components=1 -C /var/www/html/ && \
@@ -54,7 +74,7 @@ RUN set -ex; \
 EXPOSE 9000
 
 WORKDIR /var/www/html
-COPY entrypoint.sh entrypoint.sh
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
 USER $USER
-ENTRYPOINT ["/var/www/html/entrypoint.sh"]
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
 CMD ["php-fpm"]

5.0/fpm-alpine/entrypoint.sh

@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container
 
+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}
 
 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,19 +26,19 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'
 
-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
-ENCRYPT_NONCE=${ENCRYPT_NONCE:-}
-ENCRYPT_SECRET_BOX_KEY=${ENCRYPT_SECRET_BOX_KEY:-}
+file_env 'ENCRYPT_KEYPAIR'
+file_env 'ENCRYPT_PUBLIC_KEY'
+file_env 'ENCRYPT_SECRET_KEY'
+file_env 'ENCRYPT_NONCE'
+file_env 'ENCRYPT_SECRET_BOX_KEY'
 
 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'
 
 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
@@ -33,12 +50,12 @@ DEBUG=${DEBUG:-0}
 DEBUG_SQL=${DEBUG_SQL:-0}
 
 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
     exit 1
 fi
 
 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
     exit 1
 fi
 

5.0/fpm/Dockerfile

@@ -1,59 +1,82 @@
-FROM php:8-fpm
+FROM docker.io/php:8.0-fpm
 LABEL maintainer="markus@martialblog.de"
-ARG version='5.2.2+211115'
-ARG sha256_checksum='61148c6131ea99a699d95117d1b53f1ba7971c609c93353e7b6221dd13515659'
-ARG USER=www-data
 
 # Install OS dependencies
 RUN set -ex; \
-        apt-get update && \
-        DEBIAN_FRONTEND=noninteractive \
-        apt-get install --no-install-recommends -y \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
+                netcat-openbsd \
+                libldap-common \
+                libsasl2-modules \
+        ; \
         \
-        libldap2-dev \
-        libfreetype6-dev \
-        libjpeg-dev \
-        libonig-dev \
-        zlib1g-dev \
-        libc-client-dev \
-        libkrb5-dev \
-        libpng-dev \
-        libpq-dev \
-        libzip-dev \
-        libtidy-dev \
-        libsodium-dev \
-        netcat \
-        \
-        && apt-get -y autoclean; apt-get -y autoremove; \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
         rm -rf /var/lib/apt/lists/*
 
-# Link LDAP library for PHP ldap extension
-RUN set -ex; \
-        ln -fs /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/
-
 # Install PHP Plugins and Configure PHP imap plugin
+# hadolint ignore=SC2086
 RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
-        docker-php-ext-configure imap --with-kerberos --with-imap-ssl && \
-        docker-php-ext-install -j5 \
-        exif \
-        gd \
-        imap \
-        ldap \
-        mbstring \
-        pdo \
-        pdo_mysql \
-        pdo_pgsql \
-        pgsql \
-        sodium \
-        tidy \
-        zip
+        \
+        savedAptMark="$(apt-mark showmanual)"; \
+        \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
+                libldap2-dev \
+                libfreetype6-dev \
+                libjpeg-dev \
+                libonig-dev \
+                zlib1g-dev \
+                libc-client-dev \
+                libkrb5-dev \
+                libpng-dev \
+                libpq-dev \
+                libzip-dev \
+                libtidy-dev \
+                libsodium-dev \
+        ; \
+        \
+        debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+        docker-php-ext-configure gd --with-freetype --with-jpeg; \
+        docker-php-ext-configure imap --with-kerberos --with-imap-ssl; \
+        docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+        docker-php-ext-install -j "$(nproc)" \
+                exif \
+                gd \
+                imap \
+                ldap \
+                mbstring \
+                pdo \
+                pdo_mysql \
+                pdo_pgsql \
+                pgsql \
+                sodium \
+                tidy \
+                zip \
+        ; \
+        \
+# Reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+        apt-mark auto '.*' > /dev/null; \
+        apt-mark manual $savedAptMark; \
+        ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+                | awk '/=>/ { print $3 }' \
+                | sort -u \
+                | xargs -r dpkg-query -S \
+                | cut -d: -f1 \
+                | sort -u \
+                | xargs -rt apt-mark manual; \
+        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*
 
+ARG version="5.6.37+230905"
+ARG sha256_checksum="f81bb0340036603aaea4bb211bab9df5de707f30a41974df0dc9026b2d89c863"
+ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/refs/tags/${version}.tar.gz"
+ARG USER=www-data
 ENV LIMESURVEY_VERSION=$version
 
-# Download, unzip and chmod LimeSurvey from official GitHub repository
+# Download, unzip and chmod LimeSurvey from GitHub (defaults to the official LimeSurvey/LimeSurvey repository)
 RUN set -ex; \
-        curl -sSL "https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz" --output /tmp/limesurvey.tar.gz && \
+        curl -sSL "${archive_url}" --output /tmp/limesurvey.tar.gz && \
         echo "${sha256_checksum}  /tmp/limesurvey.tar.gz" | sha256sum -c - && \
         \
         tar xzvf "/tmp/limesurvey.tar.gz" --strip-components=1 -C /var/www/html/ && \
@@ -63,7 +86,7 @@ RUN set -ex; \
 EXPOSE 9000
 
 WORKDIR /var/www/html
-COPY entrypoint.sh entrypoint.sh
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
 USER $USER
-ENTRYPOINT ["/var/www/html/entrypoint.sh"]
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
 CMD ["php-fpm"]

5.0/fpm/entrypoint.sh

@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container
 
+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}
 
 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,19 +26,19 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'
 
-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
-ENCRYPT_NONCE=${ENCRYPT_NONCE:-}
-ENCRYPT_SECRET_BOX_KEY=${ENCRYPT_SECRET_BOX_KEY:-}
+file_env 'ENCRYPT_KEYPAIR'
+file_env 'ENCRYPT_PUBLIC_KEY'
+file_env 'ENCRYPT_SECRET_KEY'
+file_env 'ENCRYPT_NONCE'
+file_env 'ENCRYPT_SECRET_BOX_KEY'
 
 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'
 
 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
@@ -33,12 +50,12 @@ DEBUG=${DEBUG:-0}
 DEBUG_SQL=${DEBUG_SQL:-0}
 
 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
     exit 1
 fi
 
 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
     exit 1
 fi
 
@@ -159,7 +176,7 @@ if [ $PHP_UPDATEDB_EXIT_CODE -eq 0 ]; then
 else
     echo ''
     echo 'Running console.php install'
-    php application/commands/console.php install "$ADMIN_USER" "$ADMIN_PASSWORD" "$ADMIN_NAME $ADMIN_EMAIL"
+    php application/commands/console.php install "$ADMIN_USER" "$ADMIN_PASSWORD" "$ADMIN_NAME" "$ADMIN_EMAIL"
 fi
 
 exec "$@"

6.0/apache/Dockerfile

@@ -0,0 +1,107 @@
+FROM docker.io/php:8.0-apache
+LABEL maintainer="markus@martialblog.de"
+
+# Install OS dependencies
+RUN set -ex; \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
+                netcat-openbsd \
+                libldap-common \
+                libsasl2-modules \
+        ; \
+        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*
+
+# Install PHP Plugins and Configure PHP imap plugin
+# hadolint ignore=SC2086
+RUN set -ex; \
+        \
+        savedAptMark="$(apt-mark showmanual)"; \
+        \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
+                libldap2-dev \
+                libfreetype6-dev \
+                libjpeg-dev \
+                libonig-dev \
+                zlib1g-dev \
+                libc-client-dev \
+                libkrb5-dev \
+                libpng-dev \
+                libpq-dev \
+                libzip-dev \
+                libtidy-dev \
+                libsodium-dev \
+        ; \
+        \
+        debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+        docker-php-ext-configure gd --with-freetype --with-jpeg; \
+        docker-php-ext-configure imap --with-kerberos --with-imap-ssl; \
+        docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+        docker-php-ext-install -j "$(nproc)" \
+                exif \
+                gd \
+                imap \
+                ldap \
+                mbstring \
+                pdo \
+                pdo_mysql \
+                pdo_pgsql \
+                pgsql \
+                sodium \
+                tidy \
+                zip \
+        ; \
+        \
+# Reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+        apt-mark auto '.*' > /dev/null; \
+        apt-mark manual $savedAptMark; \
+        ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+                | awk '/=>/ { print $3 }' \
+                | sort -u \
+                | xargs -r dpkg-query -S \
+                | cut -d: -f1 \
+                | sort -u \
+                | xargs -rt apt-mark manual; \
+        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*
+
+# Apache configuration
+RUN a2enmod headers rewrite remoteip; \
+        {\
+        echo RemoteIPHeader X-Real-IP ;\
+        echo RemoteIPTrustedProxy 10.0.0.0/8 ;\
+        echo RemoteIPTrustedProxy 172.16.0.0/12 ;\
+        echo RemoteIPTrustedProxy 192.168.0.0/16 ;\
+        } > /etc/apache2/conf-available/remoteip.conf;\
+        a2enconf remoteip
+
+# Use the default production configuration
+RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"
+
+ARG version="6.2.5+230828"
+ARG sha256_checksum="ce87447506c2c25cd0cea2e1dd38263b10e843f45a91a41cb0d37a5818d49845"
+ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/refs/tags/${version}.tar.gz"
+ARG USER=www-data
+ARG LISTEN_PORT=8080
+ENV LIMESURVEY_VERSION=$version
+
+# Download, unzip and chmod LimeSurvey from GitHub (defaults to the official LimeSurvey/LimeSurvey repository)
+RUN set -ex; \
+        curl -sSL "${archive_url}" --output /tmp/limesurvey.tar.gz && \
+        echo "${sha256_checksum}  /tmp/limesurvey.tar.gz" | sha256sum -c - && \
+        \
+        tar xzvf "/tmp/limesurvey.tar.gz" --strip-components=1 -C /var/www/html/ && \
+        rm -f "/tmp/limesurvey.tar.gz" && \
+        chown -R "$USER:$USER" /var/www/html /etc/apache2
+
+EXPOSE $LISTEN_PORT
+
+WORKDIR /var/www/html
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+COPY vhosts-access-log.conf /etc/apache2/conf-enabled/other-vhosts-access-log.conf
+USER $USER
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+CMD ["apache2-foreground"]

6.0/apache/entrypoint.sh

@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container
 
+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}
 
 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,34 +26,38 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'
 
-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
+file_env 'ENCRYPT_KEYPAIR'
+file_env 'ENCRYPT_PUBLIC_KEY'
+file_env 'ENCRYPT_SECRET_KEY'
+file_env 'ENCRYPT_NONCE'
+file_env 'ENCRYPT_SECRET_BOX_KEY'
 
 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'
 
 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
 URL_FORMAT=${URL_FORMAT:-'path'}
+SHOW_SCRIPT_NAME=${SHOW_SCRIPT_NAME:-'true'}
+TABLE_SESSION=${TABLE_SESSION:-}
 
 DEBUG=${DEBUG:-0}
 DEBUG_SQL=${DEBUG_SQL:-0}
 
-LISTEN_PORT=${LISTEN_PORT:-"80"}
+LISTEN_PORT=${LISTEN_PORT:-"8080"}
 
 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
     exit 1
 fi
 
 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
     exit 1
 fi
 
@@ -92,12 +113,17 @@ return array(
       'username' => '$DB_USERNAME',
       'password' => '$DB_PASSWORD',
       'charset' => '$DB_CHARSET',
-      'tablePrefix' => '$DB_TABLE_PREFIX',
+      'tablePrefix' => '${DB_TABLE_PREFIX//[[:space:]]/}',
     ),
+    //'session' => array (
+    //   'class' => 'application.core.web.DbHttpSession',
+    //   'connectionID' => 'db',
+    //   'sessionTableName' => '{{sessions}}',
+    //),
     'urlManager' => array(
       'urlFormat' => '$URL_FORMAT',
       'rules' => array(),
-      'showScriptName' => true,
+      'showScriptName' => $SHOW_SCRIPT_NAME,
     ),
     'request' => array(
       'baseUrl' => '$BASE_URL',
@@ -115,6 +141,13 @@ EOF
 
 fi
 
+# Enable Table Sessions if required
+if [ -n "$TABLE_SESSION" ]; then
+    echo 'Info: Setting Table Session'
+    # Remove the comments in the config
+    sed -i "s/\/\///g" application/config/config.php
+fi
+
 # Check if security config already provisioned
 if [ -f application/config/security.php ]; then
     echo 'Info: security.php already provisioned'
@@ -128,6 +161,8 @@ else
 \$config['encryptionkeypair'] = '$ENCRYPT_KEYPAIR';
 \$config['encryptionpublickey'] = '$ENCRYPT_PUBLIC_KEY';
 \$config['encryptionsecretkey'] = '$ENCRYPT_SECRET_KEY';
+\$config['encryptionnonce'] = '$ENCRYPT_NONCE';
+\$config['encryptionsecretboxkey'] = '$ENCRYPT_SECRET_BOX_KEY';
 return \$config;
 EOF
     else

6.0/apache/vhosts-access-log.conf

@@ -0,0 +1,3 @@
+SetEnvIF User-Agent "(?i)(check|health|probe)" dontlog
+ErrorLog ${APACHE_LOG_DIR}/error.log
+CustomLog ${APACHE_LOG_DIR}/access.log combined env=!dontlog

6.0/fpm-alpine/Dockerfile

@@ -0,0 +1,80 @@
+FROM docker.io/php:8.0-fpm-alpine
+LABEL maintainer="markus@martialblog.de"
+
+# Install OS dependencies
+RUN set -ex; \
+        apk add --no-cache \
+        netcat-openbsd \
+        libsasl \
+        libldap \
+        bash
+
+# Install PHP Plugins
+# hadolint ignore=SC2086
+RUN set -ex; \
+        apk add --no-cache --virtual .build-deps \
+        freetype-dev \
+        libpng-dev \
+        libzip-dev \
+        libjpeg-turbo-dev \
+        tidyhtml-dev \
+        libsodium-dev \
+        openldap-dev \
+        oniguruma-dev \
+        imap-dev \
+        postgresql-dev \
+    ; \
+    \
+    docker-php-ext-configure gd --with-freetype --with-jpeg; \
+    docker-php-ext-configure imap --with-imap-ssl; \
+    docker-php-ext-install -j "$(nproc)" \
+        exif \
+        gd \
+        imap \
+        ldap \
+        mbstring \
+        pdo \
+        pdo_mysql \
+        pdo_pgsql \
+        pgsql \
+        sodium \
+        tidy \
+        zip \
+    ; \
+    \
+    runDeps="$( \
+        scanelf --needed --nobanner --format '%n#p' --recursive /usr/local/lib/php/extensions \
+            | tr ',' '\n' \
+            | sort -u \
+            | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+    )"; \
+    apk add --no-cache --no-network --virtual .limesurvey-phpext-rundeps $runDeps; \
+    apk del --no-cache --no-network .build-deps
+
+ARG version="6.2.5+230828"
+ARG sha256_checksum="ce87447506c2c25cd0cea2e1dd38263b10e843f45a91a41cb0d37a5818d49845"
+ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/refs/tags/${version}.tar.gz"
+ARG USER=www-data
+ENV LIMESURVEY_VERSION=$version
+
+# Download, unzip and chmod LimeSurvey from GitHub (defaults to the official LimeSurvey/LimeSurvey repository)
+RUN set -ex; \
+        curl -sSL "${archive_url}" --output /tmp/limesurvey.tar.gz && \
+        echo "${sha256_checksum}  /tmp/limesurvey.tar.gz" | sha256sum -c - && \
+        \
+        tar xzvf "/tmp/limesurvey.tar.gz" --strip-components=1 -C /var/www/html/ && \
+        \
+        rm -rf "/tmp/limesurvey.tar.gz" \
+        /var/www/html/docs \
+        /var/www/html/tests \
+        /var/www/html/*.md && \
+        chown -R "${USER}:root" /var/www/ ; \
+        chmod -R g=u /var/www
+
+EXPOSE 9000
+
+WORKDIR /var/www/html
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+USER $USER
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+CMD ["php-fpm"]

6.0/fpm-alpine/entrypoint.sh

@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container
 
+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}
 
 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,32 +26,36 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'
 
-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
+file_env 'ENCRYPT_KEYPAIR'
+file_env 'ENCRYPT_PUBLIC_KEY'
+file_env 'ENCRYPT_SECRET_KEY'
+file_env 'ENCRYPT_NONCE'
+file_env 'ENCRYPT_SECRET_BOX_KEY'
 
 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'
 
 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
 URL_FORMAT=${URL_FORMAT:-'path'}
+SHOW_SCRIPT_NAME=${SHOW_SCRIPT_NAME:-'true'}
+TABLE_SESSION=${TABLE_SESSION:-}
 
 DEBUG=${DEBUG:-0}
 DEBUG_SQL=${DEBUG_SQL:-0}
 
 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
     exit 1
 fi
 
 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
     exit 1
 fi
 
@@ -85,12 +106,17 @@ return array(
       'username' => '$DB_USERNAME',
       'password' => '$DB_PASSWORD',
       'charset' => '$DB_CHARSET',
-      'tablePrefix' => '$DB_TABLE_PREFIX',
+      'tablePrefix' => '${DB_TABLE_PREFIX//[[:space:]]/}',
     ),
+    //'session' => array (
+    //   'class' => 'application.core.web.DbHttpSession',
+    //   'connectionID' => 'db',
+    //   'sessionTableName' => '{{sessions}}',
+    //),
     'urlManager' => array(
       'urlFormat' => '$URL_FORMAT',
       'rules' => array(),
-      'showScriptName' => true,
+      'showScriptName' => $SHOW_SCRIPT_NAME,
     ),
     'request' => array(
       'baseUrl' => '$BASE_URL',
@@ -108,6 +134,13 @@ EOF
 
 fi
 
+# Enable Table Sessions if required
+if [ -n "$TABLE_SESSION" ]; then
+    echo 'Info: Setting Table Session'
+    # Remove the comments in the config
+    sed -i "s/\/\///g" application/config/config.php
+fi
+
 # Check if security config already provisioned
 if [ -f application/config/security.php ]; then
     echo 'Info: security.php already provisioned'
@@ -121,6 +154,8 @@ else
 \$config['encryptionkeypair'] = '$ENCRYPT_KEYPAIR';
 \$config['encryptionpublickey'] = '$ENCRYPT_PUBLIC_KEY';
 \$config['encryptionsecretkey'] = '$ENCRYPT_SECRET_KEY';
+\$config['encryptionnonce'] = '$ENCRYPT_NONCE';
+\$config['encryptionsecretboxkey'] = '$ENCRYPT_SECRET_BOX_KEY';
 return \$config;
 EOF
     else

6.0/fpm/Dockerfile

@@ -0,0 +1,92 @@
+FROM docker.io/php:8.0-fpm
+LABEL maintainer="markus@martialblog.de"
+
+# Install OS dependencies
+RUN set -ex; \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
+                netcat-openbsd \
+                libldap-common \
+                libsasl2-modules \
+        ; \
+        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*
+
+# Install PHP Plugins and Configure PHP imap plugin
+# hadolint ignore=SC2086
+RUN set -ex; \
+        \
+        savedAptMark="$(apt-mark showmanual)"; \
+        \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
+                libldap2-dev \
+                libfreetype6-dev \
+                libjpeg-dev \
+                libonig-dev \
+                zlib1g-dev \
+                libc-client-dev \
+                libkrb5-dev \
+                libpng-dev \
+                libpq-dev \
+                libzip-dev \
+                libtidy-dev \
+                libsodium-dev \
+        ; \
+        \
+        debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+        docker-php-ext-configure gd --with-freetype --with-jpeg; \
+        docker-php-ext-configure imap --with-kerberos --with-imap-ssl; \
+        docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+        docker-php-ext-install -j "$(nproc)" \
+                exif \
+                gd \
+                imap \
+                ldap \
+                mbstring \
+                pdo \
+                pdo_mysql \
+                pdo_pgsql \
+                pgsql \
+                sodium \
+                tidy \
+                zip \
+        ; \
+        \
+# Reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+        apt-mark auto '.*' > /dev/null; \
+        apt-mark manual $savedAptMark; \
+        ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+                | awk '/=>/ { print $3 }' \
+                | sort -u \
+                | xargs -r dpkg-query -S \
+                | cut -d: -f1 \
+                | sort -u \
+                | xargs -rt apt-mark manual; \
+        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*
+
+ARG version="6.2.5+230828"
+ARG sha256_checksum="ce87447506c2c25cd0cea2e1dd38263b10e843f45a91a41cb0d37a5818d49845"
+ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/refs/tags/${version}.tar.gz"
+ARG USER=www-data
+ENV LIMESURVEY_VERSION=$version
+
+# Download, unzip and chmod LimeSurvey from GitHub (defaults to the official LimeSurvey/LimeSurvey repository)
+RUN set -ex; \
+        curl -sSL "${archive_url}" --output /tmp/limesurvey.tar.gz && \
+        echo "${sha256_checksum}  /tmp/limesurvey.tar.gz" | sha256sum -c - && \
+        \
+        tar xzvf "/tmp/limesurvey.tar.gz" --strip-components=1 -C /var/www/html/ && \
+        rm -f "/tmp/limesurvey.tar.gz" && \
+        chown -R "$USER:$USER" /var/www/html
+
+EXPOSE 9000
+
+WORKDIR /var/www/html
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+USER $USER
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+CMD ["php-fpm"]

6.0/fpm/entrypoint.sh

@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container
 
+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}
 
 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,32 +26,36 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'
 
-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
+file_env 'ENCRYPT_KEYPAIR'
+file_env 'ENCRYPT_PUBLIC_KEY'
+file_env 'ENCRYPT_SECRET_KEY'
+file_env 'ENCRYPT_NONCE'
+file_env 'ENCRYPT_SECRET_BOX_KEY'
 
 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'
 
 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
 URL_FORMAT=${URL_FORMAT:-'path'}
+SHOW_SCRIPT_NAME=${SHOW_SCRIPT_NAME:-'true'}
+TABLE_SESSION=${TABLE_SESSION:-}
 
 DEBUG=${DEBUG:-0}
 DEBUG_SQL=${DEBUG_SQL:-0}
 
 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
     exit 1
 fi
 
 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
     exit 1
 fi
 
@@ -85,12 +106,17 @@ return array(
       'username' => '$DB_USERNAME',
       'password' => '$DB_PASSWORD',
       'charset' => '$DB_CHARSET',
-      'tablePrefix' => '$DB_TABLE_PREFIX',
+      'tablePrefix' => '${DB_TABLE_PREFIX//[[:space:]]/}',
     ),
+    //'session' => array (
+    //   'class' => 'application.core.web.DbHttpSession',
+    //   'connectionID' => 'db',
+    //   'sessionTableName' => '{{sessions}}',
+    //),
     'urlManager' => array(
       'urlFormat' => '$URL_FORMAT',
       'rules' => array(),
-      'showScriptName' => true,
+      'showScriptName' => $SHOW_SCRIPT_NAME,
     ),
     'request' => array(
       'baseUrl' => '$BASE_URL',
@@ -108,6 +134,13 @@ EOF
 
 fi
 
+# Enable Table Sessions if required
+if [ -n "$TABLE_SESSION" ]; then
+    echo 'Info: Setting Table Session'
+    # Remove the comments in the config
+    sed -i "s/\/\///g" application/config/config.php
+fi
+
 # Check if security config already provisioned
 if [ -f application/config/security.php ]; then
     echo 'Info: security.php already provisioned'
@@ -121,6 +154,8 @@ else
 \$config['encryptionkeypair'] = '$ENCRYPT_KEYPAIR';
 \$config['encryptionpublickey'] = '$ENCRYPT_PUBLIC_KEY';
 \$config['encryptionsecretkey'] = '$ENCRYPT_SECRET_KEY';
+\$config['encryptionnonce'] = '$ENCRYPT_NONCE';
+\$config['encryptionsecretboxkey'] = '$ENCRYPT_SECRET_BOX_KEY';
 return \$config;
 EOF
     else

CONTRIBUTING.md

@@ -2,6 +2,15 @@
 
 Every Pull Request is welcome.
 
+## Branches
+Choosing a proper name for a branch helps us identify its purpose and possibly find an associated bug or feature. Generally a branch name should include a topic such as `fix` or `feature` followed by a description. Branches should have only changes relevant to a specific issue.
+
+```
+git checkout -b fix/bug-in-connection
+git checkout -b feature/improved-config-handling
+git checkout -b doc/fix-typo
+```
+
 ## Upgrading the Version
 
 The versions in this repository should correspond to the [GitHub LimeSurvey Releases](https://github.com/LimeSurvey/LimeSurvey/releases)
@@ -12,19 +21,19 @@ To update the version, simply update ARG variables for version and corresponding
 # Version from GitHub Tags
 # sha256 of tar.gz from GitHub Releases
 
-$ grep ARG 4.0/apache/Dockerfile
-ARG version='4.3.13+200824'
+$ grep ARG 5.0/apache/Dockerfile
+ARG version='5.3.13+200824'
 ARG sha256_checksum='4e9c6f20e'
 ```
 
 It is best to use the upgrade shell script:
 
 ```bash
-./upgrade.sh 4.3.13+200824
+./upgrade.sh 5.3.13+200824
 # Check if sha256 is correct
 
-git add 4.0/ && git commit -m 'Upgrading to Version 4.3.13+200824'
-git tag 4.3.13-200824
+git add 5.0/ && git commit -m 'Upgrading to Version 5.3.13+200824'
+git tag 5.3.13-200824
 ```
 
 ## Testing
@@ -50,3 +59,9 @@ make fpm-alpine-latest
 
 container-structure-test test --image  docker.io/martialblog/limesurvey:5-fpm --config tests/fpm-tests.yaml
 ```
+
+### ARM Platform
+
+Changes related to the ARM platform should use branches starting with the `arm/` prefix, this ensures the GitHub Actions are triggered.
+
+Background: ARM builds take a long time to finish on the GitHub Runners.

Makefile

@@ -1,14 +1,14 @@
-# .PHONY: apache fpm fpm-alpine
+RUNTIME?=podman
 
 apache-lts:
-	docker build --pull -t docker.io/martialblog/limesurvey:3-apache 3.0/apache
+	$(RUNTIME) build --pull -t docker.io/martialblog/limesurvey:5-apache 5.0/apache
 apache-latest:
-	docker build --pull -t docker.io/martialblog/limesurvey:5-apache 5.0/apache
+	$(RUNTIME) build --pull -t docker.io/martialblog/limesurvey:6-apache 6.0/apache
 fpm-alpine-lts:
-	docker build --pull -t docker.io/martialblog/limesurvey:3-fpm-alpine 3.0/fpm-alpine
+	$(RUNTIME) build --pull -t docker.io/martialblog/limesurvey:5-fpm-alpine 5.0/fpm-alpine
 fpm-alpine-latest:
-	docker build --pull -t docker.io/martialblog/limesurvey:5-fpm-alpine 5.0/fpm-alpine
+	$(RUNTIME) build --pull -t docker.io/martialblog/limesurvey:6-fpm-alpine 6.0/fpm-alpine
 fpm-lts:
-	docker build --pull -t docker.io/martialblog/limesurvey:3-fpm 3.0/fpm
+	$(RUNTIME) build --pull -t docker.io/martialblog/limesurvey:5-fpm 5.0/fpm
 fpm-latest:
-	docker build --pull -t docker.io/martialblog/limesurvey:5-fpm 5.0/fpm
+	$(RUNTIME) build --pull -t docker.io/martialblog/limesurvey:6-fpm 6.0/fpm

README.md

@@ -14,12 +14,12 @@ Dockerfile to build a [LimeSurvey](https://limesurvey.org) Image for the Docker
 
 ## Supported tags and respective Dockerfile links
 
+- [`6-apache`, `6.<BUILD-NUMBER>-apache`, `latest` ](https://github.com/martialblog/docker-limesurvey/blob/master/6.0/apache/Dockerfile)
+- [`6-fpm`, `6.<BUILD-NUMBER>-fpm`](https://github.com/martialblog/docker-limesurvey/blob/master/6.0/fpm/Dockerfile)
+- [`6-fpm-alpine`, `6.<BUILD-NUMBER>-fpm-alpine`](https://github.com/martialblog/docker-limesurvey/blob/master/6.0/fpm-alpine/Dockerfile)
 - [`5-apache`, `5.<BUILD-NUMBER>-apache`, `latest` ](https://github.com/martialblog/docker-limesurvey/blob/master/5.0/apache/Dockerfile)
 - [`5-fpm`, `5.<BUILD-NUMBER>-fpm`](https://github.com/martialblog/docker-limesurvey/blob/master/5.0/fpm/Dockerfile)
 - [`5-fpm-alpine`, `5.<BUILD-NUMBER>-fpm-alpine`](https://github.com/martialblog/docker-limesurvey/blob/master/5.0/fpm-alpine/Dockerfile)
-- [`3-apache`, `3.<BUILD-NUMBER>-apache`](https://github.com/martialblog/docker-limesurvey/blob/master/3.0/apache/Dockerfile)
-- [`3-fpm`, `3.<BUILD-NUMBER>-fpm`](https://github.com/martialblog/docker-limesurvey/blob/master/3.0/fpm/Dockerfile)
-- [`3-fpm-alpine`, `3.<BUILD-NUMBER>-fpm-alpine`](https://github.com/martialblog/docker-limesurvey/blob/master/3.0/fpm-alpine/Dockerfile)
 
 # Using the Apache Image
 
@@ -85,8 +85,16 @@ For further details on the settings see: https://manual.limesurvey.org/Data_encr
 
 # Reverse Proxy configuration
 
+If you are running LimeSurvey behind a Reverse Proxy you might need some additional configuration in the Proxy. For example:
+
+* Apache: `ProxyPreserveHost On`
+* Nginx: `fastcgi_param HTTP_HOST my-survey.example.local;`
+* Traefik: Set the Host Header explicitly via a customRequestHeaders
+
 ## Traefik example
 
+**Hint**: if you want to deploy LimeSurvey on a sub-path (e.g. https://example.com/limesurvey) you have to set the BASE_URL and adjust the Containers Webservers. See the docker-compose Traefik example in the repository.
+
 ```
 # BASE_URL = /limesurvey
 "traefik.http.routers.limesurvey.rule=PathPrefix(`/limesurvey`)",
@@ -107,24 +115,36 @@ For further details on the settings see: https://manual.limesurvey.org/Data_encr
 | DB_MYSQL_ENGINE | MySQL engine used for survey tables (values: MyISAM, InnoDB, default: MyISAM)       |
 | DB_USERNAME     | Database user                             |
 | DB_PASSWORD     | Database user's password                  |
-| ADMIN_USER      | Initial LimeSurvey Admin User             |
-| ADMIN_NAME      | Initial LimeSurvey Admin Username         |
+| ADMIN_USER      | Initial LimeSurvey Admin Username (for signing into admin panel)             |
+| ADMIN_NAME      | Initial LimeSurvey Admin Name             |
 | ADMIN_EMAIL     | Initial LimeSurvey Admin Email            |
-| ADMIN_PASSWORD  | Initial LimeSurvey Admin Password         |
+| ADMIN_PASSWORD  | Initial LimeSurvey Admin Password (for signing into admin panel)         |
 | PUBLIC_URL      | Public URL for public scripts             |
 | BASE_URL        | Application Base URL                      |
 | URL_FORMAT      | URL Format. path or get                   |
 | TABLE_SESSION   | Enable table sessions (true)              |
-| SHOW_SCRIPT_NAME | Script name in URL (true|false). Default: true |
+| SHOW_SCRIPT_NAME | Script name in URL (true\|false). Default: true |
 | DEBUG           | Debug level (0, 1, 2). Default: 0         |
 | DEBUG_SQL       | SQL Debug level (0, 1, 2). Default 0      |
 | ENCRYPT_KEYPAIR  | Data encryption keypair                  |
 | ENCRYPT_PUBLIC_KEY | Data encryption public key             |
 | ENCRYPT_SECRET_KEY | Data encryption secret key             |
-| ENCRYPT_NONCE      | Data encryption nonce (used in 5.0)    |
-| ENCRYPT_SECRET_BOX_KEY | Data encryption secret box key (used in 5.0)             |
+| ENCRYPT_NONCE      | Data encryption nonce (used in 5.0 and higher) |
+| ENCRYPT_SECRET_BOX_KEY | Data encryption secret box key (used in 5.0 and higher) |
 | LISTEN_PORT     | Apache: Listen port. Default: 8080        |
 
+Sensitive information can also be passed `_FILE` to the following environment variables to load the values from the given file path. Example `DB_PASSWORD_FILE=/run/secrets/db_password`.
+
+```
+DB_PASSWORD_FILE
+ADMIN_PASSWORD_FILE
+ENCRYPT_KEYPAIR_FILE
+ENCRYPT_PUBLIC_KEY_FILE
+ENCRYPT_SECRET_KEY_FILE
+ENCRYPT_NONCE_FILE
+ENCRYPT_SECRET_BOX_KEY_FILE
+```
+
 For further details on the settings see: https://manual.limesurvey.org/Optional_settings#Advanced_Path_Settings
 
 # Running LimeSurvey with docker-compose
@@ -141,6 +161,8 @@ http://localhost:8080/
 http://localhost:8080/index.php/admin
 ```
 
+Please note / warning: To sign into the admin panel in the examples, the credentials are username: *admin* password: *foobar*, however, if you are planning for any use beyond testing, it is highly recommended that you use environment variables to define a secure username and password.
+
 # Running LimeSurvey with Helm
 
 A Helm Chart for this Image can be used for deployments. Please refer to the Helm Repository for further details:
@@ -163,6 +185,12 @@ local     docker-limesurvey_lime
 $ docker volume rm docker-limesurvey_lime
 ```
 
+## Upgrading to 6.0 from 5.x
+
+The LimeSurvey 6 Images will use PHP 8.1 as Base Images.
+
+LimeSurvey 5 will become the new LTS. LimeSurvey 3 is deprecated and will no longer be supported.
+
 ## Upgrading to 5.0 from 4.x
 
 The default user in the Container will now be *www-data* (uid 33 in Debian, uid 82 in Alpine), any volumes mounted need the corresponding permissions:
@@ -183,6 +211,17 @@ drwxr-xr-x 3 82 82 4096 Jun  3 13:51 surveys
 
 If you are using the Apache2 Images, the default port will now be **8080**. Depending on your setup the port configurations might need adjustment.
 
+# Known Issues
+
+## LimeSurvey behind a reverse proxy with a subdirectory
+
+When running LimeSurvey behind a reverse proxy with a subdirectory (i.e. example.com/limesurvey), the admin area might not be displayed correctly due to a routing issue. The application will forward you to the BASE URL regardless.
+
+This might be fixed by setting the HTTP Host Header in the reverse proxy explicitly.
+
+See:
+- https://github.com/martialblog/docker-limesurvey/issues/127
+
 # References
 
 - https://www.limesurvey.org/

docker-compose.apache.yml

@@ -0,0 +1,29 @@
+version: "3.0"
+services:
+  limesurvey:
+    image: docker.io/martialblog/limesurvey:latest
+    links:
+      - lime-db
+    depends_on:
+      - lime-db
+    environment:
+      - "DB_HOST=lime-db"
+      - "DB_PASSWORD=secret"
+      - "ADMIN_PASSWORD=foobar"
+      - "PUBLIC_URL=http://my.survey.localhost:8080"  # Example, Change this
+      - "BASE_URL=http://my.survey.localhost:8080"  # Example, Change this
+  proxy:
+    image: docker.io/httpd:bullseye
+    volumes:
+      - "./examples/apache-httpd.conf:/usr/local/apache2/conf/httpd.conf:ro"
+      - "./examples/apache-reverse-proxy.conf:/usr/local/apache2/conf/reverse-proxy.conf:ro"
+    ports:
+      - "8080:8080"
+  lime-db:
+    image: docker.io/mysql:5.7
+    environment:
+      - "MYSQL_USER=limesurvey"
+      - "MYSQL_DATABASE=limesurvey"
+      - "MYSQL_PASSWORD=secret"
+      - "MYSQL_ROOT_PASSWORD=secret"
+

docker-compose.example.yml

@@ -1,7 +1,7 @@
 version: '3'
 services:
   limesurvey:
-    image: martialblog/limesurvey:latest
+    image: docker.io/martialblog/limesurvey:latest
     restart: always
     environment:
       - DB_TYPE=pgsql
@@ -22,7 +22,7 @@ services:
     depends_on:
       - db
   db:
-    image: postgres:10-alpine
+    image: docker.io/postgres:10-alpine
     restart: always
     volumes:
       - db-data:/var/lib/postgresql

docker-compose.fpm-certbot.yml

@@ -2,7 +2,7 @@ version: "3.0"
 services:
   limesurvey:
     build:
-      context: 5.0/fpm/
+      context: 6.0/fpm/
       dockerfile: Dockerfile
     volumes:
       # Hint: This is just an example, change /tmp to something persistent
@@ -33,14 +33,14 @@ services:
     environment:
       - "HOSTNAMES=www.example.com example.com"
   certbot:
-    image: certbot/certbot
+    image: docker.io/certbot/certbot
     restart: unless-stopped
     volumes:
       - ./certbot/conf:/etc/letsencrypt
       - ./certbot/www:/var/www/certbot
     entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
   lime-db:
-    image: mysql:5.7
+    image: docker.io/mysql:5.7
     environment:
       - "MYSQL_USER=limesurvey"
       - "MYSQL_DATABASE=limesurvey"

docker-compose.fpm.alpine.yml

@@ -2,7 +2,7 @@ version: "3.0"
 services:
   limesurvey:
     build:
-      context: 5.0/fpm-alpine/
+      context: 6.0/fpm-alpine/
       dockerfile: Dockerfile
     volumes:
       # Hint: This is just an example, change /tmp to something persistent
@@ -17,16 +17,18 @@ services:
       - "DB_PASSWORD=secret"
       - "ADMIN_PASSWORD=foobar"
   lime-web:
-    image: nginx:alpine
+    image: docker.io/nginx:alpine
     links:
       - limesurvey
+    depends_on:
+      - limesurvey
     ports:
       - "8080:80"
     volumes:
       - ./examples/nginx.conf:/etc/nginx/nginx.conf:ro
       - lime:/var/www/html
   lime-db:
-    image: mysql:5.7
+    image: docker.io/mysql:5.7
     environment:
       - "MYSQL_USER=limesurvey"
       - "MYSQL_DATABASE=limesurvey"

docker-compose.fpm.yml

@@ -2,7 +2,7 @@ version: "3.0"
 services:
   limesurvey:
     build:
-      context: 5.0/fpm/
+      context: 6.0/fpm/
       dockerfile: Dockerfile
     volumes:
       # Hint: This is just an example, change /tmp to something persistent
@@ -17,7 +17,7 @@ services:
       - "DB_PASSWORD=secret"
       - "ADMIN_PASSWORD=foobar"
   lime-web:
-    image: nginx
+    image: docker.io/nginx
     links:
       - limesurvey
     ports:
@@ -26,7 +26,7 @@ services:
       - ./examples/nginx.conf:/etc/nginx/nginx.conf:ro
       - lime:/var/www/html
   lime-db:
-    image: mysql:5.7
+    image: docker.io/mysql:5.7
     environment:
       - "MYSQL_USER=limesurvey"
       - "MYSQL_DATABASE=limesurvey"

docker-compose.pgsql.yml

@@ -3,7 +3,7 @@ services:
   limesurvey:
     build:
       # Hint: Change it to 3.0/apache/ if you want to use LimeSurvey 3.*
-      context: 5.0/apache/
+      context: 6.0/apache/
       dockerfile: Dockerfile
     volumes:
       # Hint: This is just an example, change /tmp to something persistent
@@ -22,9 +22,9 @@ services:
       - "DB_PASSWORD=secret"
       - "ADMIN_PASSWORD=foobar"
   lime-db:
-    image: postgres:10
+    image: docker.io/postgres:10
     volumes:
-      - db-data:/var/lib/postgresql
+      - db-data:/var/lib/postgresql/data
     environment:
       - "POSTGRES_USER=limesurvey"
       - "POSTGRES_DB=limesurvey"

docker-compose.traefik.domain.yml

@@ -0,0 +1,42 @@
+version: "3.0"
+services:
+  limesurvey:
+    build:
+      context: 6.0/apache/
+      dockerfile: Dockerfile
+    labels:
+      traefik.enable: 'true'
+      traefik.http.routers.limesurvey-http-router.entrypoints: "http"
+      traefik.http.routers.limesurvey-http-router.rule: "Host(`my.survey.localhost`)"
+      traefik.http.services.limesurvey-service.loadbalancer.server.port: "8080"
+    links:
+      - lime-db
+    depends_on:
+      - lime-db
+    environment:
+      - "DB_HOST=lime-db"
+      - "DB_PASSWORD=secret"
+      - "ADMIN_PASSWORD=foobar"
+      - "PUBLIC_URL=http://my.survey.localhost:8888"
+      - "BASE_URL=http://my.survey.localhost:8888"
+  traefik:
+    image: docker.io/traefik:v2.9
+    container_name: "traefik"
+    command:
+      - "--api.insecure=true"
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--entrypoints.http.address=:8888"
+    ports:
+      - "8888:8888"
+      - "8080:8080"
+    volumes:
+      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+  lime-db:
+    image: docker.io/mysql:5.7
+    environment:
+      - "MYSQL_USER=limesurvey"
+      - "MYSQL_DATABASE=limesurvey"
+      - "MYSQL_PASSWORD=secret"
+      - "MYSQL_ROOT_PASSWORD=secret"
+

docker-compose.traefik.yml

@@ -0,0 +1,46 @@
+version: "3.0"
+services:
+  limesurvey:
+    build:
+      context: 6.0/apache/
+      dockerfile: Dockerfile
+    labels:
+      traefik.enable: 'true'
+      traefik.http.routers.limesurvey-http-router.entrypoints: "http"
+      traefik.http.routers.limesurvey-http-router.rule: "PathPrefix(`/limesurvey`)"
+      traefik.http.services.limesurvey-service.loadbalancer.server.port: "8080"
+    links:
+      - lime-db
+    depends_on:
+      - lime-db
+    volumes:
+      # Unfortunately the StripPrefix Function in Traefik won't work;
+      # Meaning, we will have to set 'Alias /limesurvey "/var/www/html"' in the Apache Config
+      - "./examples/apache-example.conf:/etc/apache2/sites-available/000-default.conf:ro"
+    environment:
+      - "DB_HOST=lime-db"
+      - "DB_PASSWORD=secret"
+      - "ADMIN_PASSWORD=foobar"
+      - "PUBLIC_URL=http://localhost:8888/limesurvey"
+      - "BASE_URL=http://localhost:8888/limesurvey"
+  traefik:
+    image: docker.io/traefik:v2.9
+    container_name: "traefik"
+    command:
+      - "--api.insecure=true"
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--entrypoints.http.address=:8888"
+    ports:
+      - "8888:8888"
+      - "8080:8080"
+    volumes:
+      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+  lime-db:
+    image: docker.io/mysql:5.7
+    environment:
+      - "MYSQL_USER=limesurvey"
+      - "MYSQL_DATABASE=limesurvey"
+      - "MYSQL_PASSWORD=secret"
+      - "MYSQL_ROOT_PASSWORD=secret"
+

docker-compose.yml

@@ -2,7 +2,7 @@ version: "3.0"
 services:
   limesurvey:
     build:
-      context: 5.0/apache/
+      context: 6.0/apache/
       dockerfile: Dockerfile
     volumes:
       # Hint: This is just an example, change /tmp to something persistent
@@ -20,7 +20,7 @@ services:
       # If you require an empty table prefix, use a space as the DB_TABLE_PREFIX
       # - "DB_TABLE_PREFIX= "
   lime-db:
-    image: mysql:5.7
+    image: docker.io/mysql:5.7
     environment:
       - "MYSQL_USER=limesurvey"
       - "MYSQL_DATABASE=limesurvey"

examples/apache-example.conf

@@ -1,7 +1,7 @@
 <VirtualHost *:8080>
 	ServerAdmin foo@bar.com
 	DocumentRoot /var/www/html
-        Alias /lime "/var/www/html"
+        Alias /limesurvey "/var/www/html"
 
         <Directory />
                 Options FollowSymLinks

examples/apache-httpd.conf

@@ -0,0 +1,131 @@
+ServerRoot "/usr/local/apache2"
+Listen 8080
+
+LoadModule mpm_event_module modules/mod_mpm_event.so
+LoadModule authn_file_module modules/mod_authn_file.so
+LoadModule authn_core_module modules/mod_authn_core.so
+LoadModule authz_host_module modules/mod_authz_host.so
+LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
+LoadModule authz_user_module modules/mod_authz_user.so
+LoadModule authz_core_module modules/mod_authz_core.so
+LoadModule access_compat_module modules/mod_access_compat.so
+LoadModule auth_basic_module modules/mod_auth_basic.so
+LoadModule watchdog_module modules/mod_watchdog.so
+LoadModule reqtimeout_module modules/mod_reqtimeout.so
+LoadModule filter_module modules/mod_filter.so
+LoadModule mime_module modules/mod_mime.so
+LoadModule log_config_module modules/mod_log_config.so
+LoadModule env_module modules/mod_env.so
+LoadModule headers_module modules/mod_headers.so
+LoadModule setenvif_module modules/mod_setenvif.so
+LoadModule version_module modules/mod_version.so
+LoadModule proxy_module modules/mod_proxy.so
+LoadModule proxy_connect_module modules/mod_proxy_connect.so
+LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
+LoadModule proxy_http_module modules/mod_proxy_http.so
+LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so
+LoadModule proxy_scgi_module modules/mod_proxy_scgi.so
+LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so
+LoadModule proxy_fdpass_module modules/mod_proxy_fdpass.so
+LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
+LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
+LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
+LoadModule proxy_express_module modules/mod_proxy_express.so
+LoadModule proxy_hcheck_module modules/mod_proxy_hcheck.so
+LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
+LoadModule ssl_module modules/mod_ssl.so
+LoadModule lbmethod_byrequests_module modules/mod_lbmethod_byrequests.so
+LoadModule lbmethod_bytraffic_module modules/mod_lbmethod_bytraffic.so
+LoadModule lbmethod_bybusyness_module modules/mod_lbmethod_bybusyness.so
+LoadModule lbmethod_heartbeat_module modules/mod_lbmethod_heartbeat.so
+LoadModule unixd_module modules/mod_unixd.so
+LoadModule status_module modules/mod_status.so
+LoadModule autoindex_module modules/mod_autoindex.so
+#LoadModule suexec_module modules/mod_suexec.so
+<IfModule !mpm_prefork_module>
+</IfModule>
+<IfModule mpm_prefork_module>
+</IfModule>
+LoadModule dir_module modules/mod_dir.so
+LoadModule alias_module modules/mod_alias.so
+<IfModule unixd_module>
+
+User daemon
+Group daemon
+
+</IfModule>
+
+ServerAdmin you@example.com
+#
+<Directory />
+    AllowOverride none
+    Require all denied
+</Directory>
+
+DocumentRoot "/usr/local/apache2/htdocs"
+<Directory "/usr/local/apache2/htdocs">
+    Options Indexes FollowSymLinks
+    AllowOverride None
+    Require all granted
+</Directory>
+
+<IfModule dir_module>
+    DirectoryIndex index.html
+</IfModule>
+
+<Files ".ht*">
+    Require all denied
+</Files>
+
+ErrorLog /proc/self/fd/2
+
+LogLevel warn
+
+<IfModule log_config_module>
+    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
+    LogFormat "%h %l %u %t \"%r\" %>s %b" common
+
+    <IfModule logio_module>
+      # You need to enable mod_logio.c to use %I and %O
+      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
+    </IfModule>
+
+    CustomLog /proc/self/fd/1 common
+</IfModule>
+
+<IfModule alias_module>
+    ScriptAlias /cgi-bin/ "/usr/local/apache2/cgi-bin/"
+
+</IfModule>
+
+<IfModule cgid_module>
+</IfModule>
+
+<Directory "/usr/local/apache2/cgi-bin">
+    AllowOverride None
+    Options None
+    Require all granted
+</Directory>
+
+<IfModule headers_module>
+    RequestHeader unset Proxy early
+</IfModule>
+
+<IfModule mime_module>
+    TypesConfig conf/mime.types
+
+    AddType application/x-compress .Z
+    AddType application/x-gzip .gz .tgz
+</IfModule>
+
+# Configure mod_proxy_html to understand HTML4/XHTML1
+<IfModule proxy_html_module>
+Include conf/extra/proxy-html.conf
+</IfModule>
+
+<IfModule ssl_module>
+SSLRandomSeed startup builtin
+SSLRandomSeed connect builtin
+</IfModule>
+
+IncludeOptional conf/reverse-proxy.conf

examples/apache-reverse-proxy.conf

@@ -0,0 +1,8 @@
+<VirtualHost *:8080>
+    ServerAdmin admin@localhost.local
+    ServerName my.survey.localhost
+
+    ProxyPass / http://limesurvey:80/
+    ProxyPassReverse / http://limesurvey:80/
+    ProxyPreserveHost On
+</VirtualHost>

examples/nginx.conf

@@ -19,7 +19,7 @@ http {
         location / {
             try_files $uri /index.php?$args;
         }
-        location ~ ^/(protected|framework|themes/\w+/views) {
+        location ~ ^/(protected|application|framework|themes/\w+/views) {
             deny  all;
         }
         location ~ \.(js|css|png|jpg|gif|swf|ico|pdf|mov|fla|zip|rar)$ {
@@ -33,6 +33,8 @@ http {
             fastcgi_pass  limesurvey:9000;
             fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
             fastcgi_param  SCRIPT_NAME      $fastcgi_script_name;
+            # For Subdomains like https://survey.example.com
+            # fastcgi_param  HTTP_HOST      survey.example.com;
         }
     }
 }

tests/apache-tests.yaml

@@ -9,7 +9,7 @@ fileContentTests:
     path: '/var/www/html/admin/index.php'
     expectedContents: ['LimeSurvey']
   - name: 'Entrypoint file content'
-    path: '/var/www/html/entrypoint.sh'
+    path: '/usr/local/bin/entrypoint.sh'
     expectedContents: ['console.php', 'ADMIN_USER']
 
 fileExistenceTests:
@@ -21,9 +21,6 @@ fileExistenceTests:
     path: '/var/www/html/admin/index.php'
     shouldExist: true
     permissions: '-rw-rw-r--'
-  - name: 'Ldap syslink'
-    path: '/usr/lib/x86_64-linux-gnu/libldap.so'
-    shouldExist: true
   - name:  "Dependencies - PHP - gd"
     path: '/usr/local/etc/php/conf.d/docker-php-ext-gd.ini'
     shouldExist: true
@@ -54,30 +51,6 @@ commandTests:
     command: "dpkg"
     args: ["-l", "netcat"]
     exitCode: 0
-  - name:  "Dependencies - libldap2-dev"
-    command: "dpkg"
-    args: ["-l", "libldap2-dev"]
-    exitCode: 0
-  - name:  "Dependencies - zlib1g-dev"
-    command: "dpkg"
-    args: ["-l", "zlib1g-dev"]
-    exitCode: 0
-  - name:  "Dependencies - libc-client-dev"
-    command: "dpkg"
-    args: ["-l", "libc-client-dev"]
-    exitCode: 0
-  - name:  "Dependencies - libkrb5-dev"
-    command: "dpkg"
-    args: ["-l", "libkrb5-dev"]
-    exitCode: 0
-  - name:  "Dependencies - libpng-dev"
-    command: "dpkg"
-    args: ["-l", "libpng-dev"]
-    exitCode: 0
-  - name:  "Dependencies - libpq-dev"
-    command: "dpkg"
-    args: ["-l", "libpq-dev"]
-    exitCode: 0
   - name:  "Dependencies - PHP Modules"
     command: "php"
     args: ["-m"]

tests/fpm-alpine-tests.yaml

@@ -9,7 +9,7 @@ fileContentTests:
     path: '/var/www/html/admin/index.php'
     expectedContents: ['LimeSurvey']
   - name: 'Entrypoint file content'
-    path: '/var/www/html/entrypoint.sh'
+    path: '/usr/local/bin/entrypoint.sh'
     expectedContents: ['console.php', 'ADMIN_USER']
 
 fileExistenceTests:

upgrade.sh

@@ -34,5 +34,5 @@ sed -r -i -e "s/[0-9]+(\.[0-9]+)+\+[0-9]+/$NEW_VERSION/" "$MAJOR_VERSION/apache/
 sed -r -i -e "s/[A-Fa-f0-9]{64}/$SHA256_CHECKSUM/" "$MAJOR_VERSION/apache/Dockerfile" "$MAJOR_VERSION/fpm/Dockerfile" "$MAJOR_VERSION/fpm-alpine/Dockerfile"
 
 # After that, check and commit
-echo "git add 3.0 ; git commit -m 'Upgrading to LTS Version ${NEW_VERSION}' && git tag ${NEW_TAG}"
-echo "git add 5.0 ; git commit -m 'Upgrading to Version ${NEW_VERSION}' && git tag ${NEW_TAG}"
+echo "git add 5.0 ; git commit -m 'Upgrading to LTS Version ${NEW_VERSION}' && git tag ${NEW_TAG}"
+echo "git add 6.0 ; git commit -m 'Upgrading to Version ${NEW_VERSION}' && git tag ${NEW_TAG}"