Upgrading to Version 6.1.8+230717

Add support for secrets in files

.github/renovate.json

@@ -0,0 +1,9 @@
+{
+  "extends": [
+    "config:base"
+  ],
+  "enabledManagers": ["dockerfile", "github-actions"],
+  "dockerfile": {
+    "ignorePaths": ["4.0", "nginx-certbot"]
+  }
+}

.github/workflows/build-latest-container-images.yaml

@@ -16,10 +16,10 @@ jobs:
           - 6.0/fpm/Dockerfile
     steps:
       - uses: actions/checkout@v3
-      - uses: hadolint/hadolint-action@v1.5.0
+      - uses: hadolint/hadolint-action@v3.1.0
         with:
           dockerfile: ${{ matrix.dockerfile }}
-          ignore: DL4006 DL3008 DL3018
+          ignore: "DL4006,DL3008,DL3018"
 
   push_images_to_registries:
     name: Push Container Images to registries
@@ -59,7 +59,7 @@ jobs:
             latest=true
             suffix=-apache
       - name: 'Build and push latest Apache container images'
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v4
         with:
           context: 6.0/apache
           push: true
@@ -80,7 +80,7 @@ jobs:
             latest=false
             suffix=-fpm
       - name: 'Build and push latest fpm container images'
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v4
         with:
           context: 6.0/fpm
           push: true
@@ -101,7 +101,7 @@ jobs:
             latest=false
             suffix=-fpm-alpine
       - name: 'Build and push latest fpm-alpine container images'
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v4
         with:
           context: 6.0/fpm-alpine
           push: true

.github/workflows/build-lts-container-images.yaml

@@ -16,10 +16,10 @@ jobs:
           - 5.0/fpm/Dockerfile
     steps:
       - uses: actions/checkout@v3
-      - uses: hadolint/hadolint-action@v1.5.0
+      - uses: hadolint/hadolint-action@v3.1.0
         with:
           dockerfile: ${{ matrix.dockerfile }}
-          ignore: DL4006 DL3008 DL3018
+          ignore: "DL4006,DL3008,DL3018"
 
   push_images_to_registries:
     name: 'Push container images to registries'
@@ -29,11 +29,6 @@ jobs:
     permissions:
       packages: write
       contents: read
-    strategy:
-      matrix:
-        platform:
-          - linux/amd64
-          - linux/arm64
     steps:
       - name: 'Check out the repo'
         uses: actions/checkout@v3
@@ -64,13 +59,13 @@ jobs:
             latest=false
             suffix=-apache
       - name: 'Build and push LTS apache container images'
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v4
         with:
           context: 5.0/apache
           push: true
           tags: ${{ steps.metadata-apache.outputs.tags }}
           labels: ${{ steps.metadata-apache.outputs.labels }}
-          platforms: ${{ matrix.platform }}
+          platforms: linux/amd64,linux/arm64
 
       - name: 'FPM variant metadata'
         id: metadata-fpm
@@ -85,13 +80,13 @@ jobs:
             latest=false
             suffix=-fpm
       - name: 'Build and push LTS fpm container images'
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v4
         with:
           context: 5.0/fpm
           push: true
           tags: ${{ steps.metadata-fpm.outputs.tags }}
           labels: ${{ steps.metadata-apache.outputs.labels }}
-          platforms: ${{ matrix.platform }}
+          platforms: linux/amd64,linux/arm64
 
       - name: 'FPM Alpine variant metadata'
         id: metadata-fpm-alpine
@@ -106,10 +101,10 @@ jobs:
             latest=false
             suffix=-fpm-alpine
       - name: 'Build and push LTS fpm-alpine container images'
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v4
         with:
           context: 5.0/fpm-alpine
           push: true
           tags: ${{ steps.metadata-fpm-alpine.outputs.tags }}
           labels: ${{ steps.metadata-apache.outputs.labels }}
-          platforms: ${{ matrix.platform }}
+          platforms: linux/amd64,linux/arm64

.github/workflows/lint-dockerfiles.yaml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: hadolint/hadolint-action@v1.5.0
+      - uses: hadolint/hadolint-action@v3.1.0
         with:
           dockerfile: ${{ matrix.dockerfile }}
-          ignore: DL4006 DL3008 DL3018
+          ignore: "DL4006,DL3008,DL3018"

.github/workflows/test-arm-container-images.yaml

@@ -33,7 +33,7 @@ jobs:
         uses: docker/setup-buildx-action@v2
 
       - name: 'Build Container images'
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v4
         with:
           context: 6.0/${{ matrix.context }}
           push: false
@@ -42,7 +42,7 @@ jobs:
           platforms: ${{ matrix.platform }}
 
       - name: 'Run Structure tests'
-        uses: plexsystems/container-structure-test-action@v0.2.0
+        uses: plexsystems/container-structure-test-action@v0.3.0
         with:
           image: docker.io/martialblog/limesurvey:6-${{ matrix.context }}
           config: tests/${{ matrix.context }}-tests.yaml

.github/workflows/test-latest-container-images.yaml

@@ -25,7 +25,7 @@ jobs:
         uses: docker/setup-buildx-action@v2
 
       - name: 'Build Container images'
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v4
         with:
           context: 6.0/${{ matrix.context }}
           push: false
@@ -33,7 +33,7 @@ jobs:
           tags: docker.io/martialblog/limesurvey:6-${{ matrix.context }}
 
       - name: 'Run Structure tests'
-        uses: plexsystems/container-structure-test-action@v0.2.0
+        uses: plexsystems/container-structure-test-action@v0.3.0
         with:
           image: docker.io/martialblog/limesurvey:6-${{ matrix.context }}
           config: tests/${{ matrix.context }}-tests.yaml

.github/workflows/test-lts-container-images.yaml

@@ -23,7 +23,7 @@ jobs:
         uses: docker/setup-buildx-action@v2
 
       - name: 'Build Container images'
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v4
         with:
           context: 5.0/${{ matrix.context }}
           push: false
@@ -31,7 +31,7 @@ jobs:
           tags: docker.io/martialblog/limesurvey:5-${{ matrix.context }}
 
       - name: 'Run Structure tests'
-        uses: plexsystems/container-structure-test-action@v0.2.0
+        uses: plexsystems/container-structure-test-action@v0.3.0
         with:
           image: docker.io/martialblog/limesurvey:5-${{ matrix.context }}
           config: tests/${{ matrix.context }}-tests.yaml

3.0/apache/Dockerfile

@@ -3,48 +3,68 @@ LABEL maintainer="markus@martialblog.de"
 
 # Install OS dependencies
 RUN set -ex; \
-        apt-get update && \
+        apt-get update; \
-        DEBIAN_FRONTEND=noninteractive \
+        apt-get install -y --no-install-recommends \
-        apt-get install --no-install-recommends -y \
+                netcat \
+        ; \
         \
-        libldap2-dev \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
-        libfreetype6-dev \
-        libjpeg-dev \
-        libonig-dev \
-        zlib1g-dev \
-        libc-client-dev \
-        libkrb5-dev \
-        libpng-dev \
-        libpq-dev \
-        libzip-dev \
-        libtidy-dev \
-        libsodium-dev \
-        netcat \
-        \
-        && apt-get -y autoclean; apt-get -y autoremove; \
         rm -rf /var/lib/apt/lists/*
 
-# Link LDAP library for PHP ldap extension
-RUN set -ex; \
-        ln -fs /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/
-
 # Install PHP Plugins and Configure PHP imap plugin
+# hadolint ignore=SC2086
 RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
+        \
-        docker-php-ext-configure imap --with-kerberos --with-imap-ssl && \
+        savedAptMark="$(apt-mark showmanual)"; \
-        docker-php-ext-install -j5 \
+        \
-        exif \
+        apt-get update; \
-        gd \
+        apt-get install -y --no-install-recommends \
-        imap \
+                libldap2-dev \
-        ldap \
+                libfreetype6-dev \
-        mbstring \
+                libjpeg-dev \
-        pdo \
+                libonig-dev \
-        pdo_mysql \
+                zlib1g-dev \
-        pdo_pgsql \
+                libc-client-dev \
-        pgsql \
+                libkrb5-dev \
-        sodium \
+                libpng-dev \
-        tidy \
+                libpq-dev \
-        zip
+                libzip-dev \
+                libtidy-dev \
+                libsodium-dev \
+        ; \
+        \
+        debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+        docker-php-ext-configure gd --with-freetype --with-jpeg; \
+        docker-php-ext-configure imap --with-kerberos --with-imap-ssl; \
+        docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+        docker-php-ext-install -j "$(nproc)" \
+                exif \
+                gd \
+                imap \
+                ldap \
+                mbstring \
+                pdo \
+                pdo_mysql \
+                pdo_pgsql \
+                pgsql \
+                sodium \
+                tidy \
+                zip \
+        ; \
+        \
+# Reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+        apt-mark auto '.*' > /dev/null; \
+        apt-mark manual $savedAptMark; \
+        ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+                | awk '/=>/ { print $3 }' \
+                | sort -u \
+                | xargs -r dpkg-query -S \
+                | cut -d: -f1 \
+                | sort -u \
+                | xargs -rt apt-mark manual; \
+        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*
 
 # Apache configuration
 RUN a2enmod headers rewrite remoteip; \
@@ -59,14 +79,14 @@ RUN a2enmod headers rewrite remoteip; \
 # Use the default production configuration
 RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"
 
-ARG version="3.28.55+230328"
+ARG version="3.28.59+230517"
-ARG sha256_checksum="7f820259aa68fcd2fff7a23e9261ad65af0b28085ef93a69bf14cc068ee829c5"
+ARG sha256_checksum="e048eaaf5260a8d6391609c355bb4df8c8ef0e0943b2d612d2a8414956db622a"
 ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
 ARG USER=root
 ARG LISTEN_PORT=80
 ENV LIMESURVEY_VERSION=$version
 
-# Download, unzip and chmod LimeSurvey from GitHub (defaults to the official LimeSurvey/LimeSurvey repository) 
+# Download, unzip and chmod LimeSurvey from GitHub (defaults to the official LimeSurvey/LimeSurvey repository)
 RUN set -ex; \
         curl -sSL "${archive_url}" --output /tmp/limesurvey.tar.gz && \
         echo "${sha256_checksum}  /tmp/limesurvey.tar.gz" | sha256sum -c - && \

3.0/fpm-alpine/Dockerfile

@@ -2,6 +2,10 @@ FROM docker.io/php:8.0-fpm-alpine
 LABEL maintainer="markus@martialblog.de"
 
 # Install OS dependencies
+RUN apk add --no-cache netcat-openbsd bash
+
+# Install PHP Plugins
+# hadolint ignore=SC2086
 RUN set -ex; \
         apk add --no-cache --virtual .build-deps \
         freetype-dev \
@@ -13,14 +17,13 @@ RUN set -ex; \
         openldap-dev \
         oniguruma-dev \
         imap-dev \
-        postgresql-dev && \
+        postgresql-dev \
-        apk add --no-cache netcat-openbsd bash
+    ; \
-
+    \
-# Install PHP Plugins
+    docker-php-ext-configure gd --with-freetype --with-jpeg; \
-RUN set -ex; \
+    docker-php-ext-configure imap --with-imap-ssl; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
+    docker-php-ext-install -j "$(nproc)" \
-        docker-php-ext-configure imap --with-imap-ssl && \
+        exif \
-        docker-php-ext-install \
         gd \
         imap \
         ldap \
@@ -31,14 +34,24 @@ RUN set -ex; \
         pgsql \
         sodium \
         tidy \
-        zip
+        zip \
+    ; \
+    \
+    runDeps="$( \
+        scanelf --needed --nobanner --format '%n#p' --recursive /usr/local/lib/php/extensions \
+            | tr ',' '\n' \
+            | sort -u \
+            | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+    )"; \
+    apk add --no-cache --no-network --virtual .limesurvey-phpext-rundeps $runDeps; \
+    apk del --no-cache --no-network .build-deps
 
-ARG version="3.28.55+230328"
+ARG version="3.28.59+230517"
-ARG sha256_checksum="7f820259aa68fcd2fff7a23e9261ad65af0b28085ef93a69bf14cc068ee829c5"
+ARG sha256_checksum="e048eaaf5260a8d6391609c355bb4df8c8ef0e0943b2d612d2a8414956db622a"
 ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
 ENV LIMESURVEY_VERSION=$version
 
-# Download, unzip and chmod LimeSurvey from GitHub (defaults to the official LimeSurvey/LimeSurvey repository) 
+# Download, unzip and chmod LimeSurvey from GitHub (defaults to the official LimeSurvey/LimeSurvey repository)
 RUN set -ex; \
         curl -sSL "${archive_url}" --output /tmp/limesurvey.tar.gz && \
         echo "${sha256_checksum}  /tmp/limesurvey.tar.gz" | sha256sum -c - && \

3.0/fpm/Dockerfile

@@ -3,55 +3,75 @@ LABEL maintainer="markus@martialblog.de"
 
 # Install OS dependencies
 RUN set -ex; \
-        apt-get update && \
+        apt-get update; \
-        DEBIAN_FRONTEND=noninteractive \
+        apt-get install -y --no-install-recommends \
-        apt-get install --no-install-recommends -y \
+                netcat \
+        ; \
         \
-        libldap2-dev \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
-        libfreetype6-dev \
-        libjpeg-dev \
-        libonig-dev \
-        zlib1g-dev \
-        libc-client-dev \
-        libkrb5-dev \
-        libpng-dev \
-        libpq-dev \
-        libzip-dev \
-        libtidy-dev \
-        libsodium-dev \
-        netcat \
-        \
-        && apt-get -y autoclean; apt-get -y autoremove; \
         rm -rf /var/lib/apt/lists/*
 
-# Link LDAP library for PHP ldap extension
-RUN set -ex; \
-        ln -fs /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/
-
 # Install PHP Plugins and Configure PHP imap plugin
+# hadolint ignore=SC2086
 RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
+        \
-        docker-php-ext-configure imap --with-kerberos --with-imap-ssl && \
+        savedAptMark="$(apt-mark showmanual)"; \
-        docker-php-ext-install -j5 \
+        \
-        exif \
+        apt-get update; \
-        gd \
+        apt-get install -y --no-install-recommends \
-        imap \
+                libldap2-dev \
-        ldap \
+                libfreetype6-dev \
-        mbstring \
+                libjpeg-dev \
-        pdo \
+                libonig-dev \
-        pdo_mysql \
+                zlib1g-dev \
-        pdo_pgsql \
+                libc-client-dev \
-        pgsql \
+                libkrb5-dev \
-        sodium \
+                libpng-dev \
-        tidy \
+                libpq-dev \
-        zip
+                libzip-dev \
+                libtidy-dev \
+                libsodium-dev \
+        ; \
+        \
+        debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+        docker-php-ext-configure gd --with-freetype --with-jpeg; \
+        docker-php-ext-configure imap --with-kerberos --with-imap-ssl; \
+        docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+        docker-php-ext-install -j "$(nproc)" \
+                exif \
+                gd \
+                imap \
+                ldap \
+                mbstring \
+                pdo \
+                pdo_mysql \
+                pdo_pgsql \
+                pgsql \
+                sodium \
+                tidy \
+                zip \
+        ; \
+        \
+# Reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+        apt-mark auto '.*' > /dev/null; \
+        apt-mark manual $savedAptMark; \
+        ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+                | awk '/=>/ { print $3 }' \
+                | sort -u \
+                | xargs -r dpkg-query -S \
+                | cut -d: -f1 \
+                | sort -u \
+                | xargs -rt apt-mark manual; \
+        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*
 
-ARG version="3.28.55+230328"
+ARG version="3.28.59+230517"
-ARG sha256_checksum="7f820259aa68fcd2fff7a23e9261ad65af0b28085ef93a69bf14cc068ee829c5"
+ARG sha256_checksum="e048eaaf5260a8d6391609c355bb4df8c8ef0e0943b2d612d2a8414956db622a"
 ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
 ENV LIMESURVEY_VERSION=$version
 
-# Download, unzip and chmod LimeSurvey from GitHub (defaults to the official LimeSurvey/LimeSurvey repository) 
+# Download, unzip and chmod LimeSurvey from GitHub (defaults to the official LimeSurvey/LimeSurvey repository)
 RUN set -ex; \
         curl -sSL "${archive_url}" --output /tmp/limesurvey.tar.gz && \
         echo "${sha256_checksum}  /tmp/limesurvey.tar.gz" | sha256sum -c - && \

5.0/apache/Dockerfile

@@ -3,49 +3,70 @@ LABEL maintainer="markus@martialblog.de"
 
 # Install OS dependencies
 RUN set -ex; \
-        apt-get update && \
+        apt-get update; \
-        DEBIAN_FRONTEND=noninteractive \
+        apt-get install -y --no-install-recommends \
-        apt-get install --no-install-recommends -y \
+                netcat-openbsd \
+                libldap-common \
+                libsasl2-modules \
+        ; \
         \
-        libldap2-dev \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
-        libfreetype6-dev \
-        libjpeg-dev \
-        libonig-dev \
-        zlib1g-dev \
-        libc-client-dev \
-        libkrb5-dev \
-        libpng-dev \
-        libpq-dev \
-        libzip-dev \
-        libtidy-dev \
-        libsodium-dev \
-        netcat \
-        curl \
-        \
-        && apt-get -y autoclean; apt-get -y autoremove; \
         rm -rf /var/lib/apt/lists/*
 
-# Link LDAP library for PHP ldap extension
-RUN set -ex; \
-        ln -fs /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/
-
 # Install PHP Plugins and Configure PHP imap plugin
+# hadolint ignore=SC2086
 RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
+        \
-        docker-php-ext-configure imap --with-kerberos --with-imap-ssl && \
+        savedAptMark="$(apt-mark showmanual)"; \
-        docker-php-ext-install -j5 \
+        \
-        exif \
+        apt-get update; \
-        gd \
+        apt-get install -y --no-install-recommends \
-        imap \
+                libldap2-dev \
-        ldap \
+                libfreetype6-dev \
-        mbstring \
+                libjpeg-dev \
-        pdo \
+                libonig-dev \
-        pdo_mysql \
+                zlib1g-dev \
-        pdo_pgsql \
+                libc-client-dev \
-        pgsql \
+                libkrb5-dev \
-        sodium \
+                libpng-dev \
-        tidy \
+                libpq-dev \
-        zip
+                libzip-dev \
+                libtidy-dev \
+                libsodium-dev \
+        ; \
+        \
+        debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+        docker-php-ext-configure gd --with-freetype --with-jpeg; \
+        docker-php-ext-configure imap --with-kerberos --with-imap-ssl; \
+        docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+        docker-php-ext-install -j "$(nproc)" \
+                exif \
+                gd \
+                imap \
+                ldap \
+                mbstring \
+                pdo \
+                pdo_mysql \
+                pdo_pgsql \
+                pgsql \
+                sodium \
+                tidy \
+                zip \
+        ; \
+        \
+# Reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+        apt-mark auto '.*' > /dev/null; \
+        apt-mark manual $savedAptMark; \
+        ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+                | awk '/=>/ { print $3 }' \
+                | sort -u \
+                | xargs -r dpkg-query -S \
+                | cut -d: -f1 \
+                | sort -u \
+                | xargs -rt apt-mark manual; \
+        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*
 
 # Apache configuration
 RUN a2enmod headers rewrite remoteip; \
@@ -60,14 +81,14 @@ RUN a2enmod headers rewrite remoteip; \
 # Use the default production configuration
 RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"
 
-ARG version="5.6.14+230403"
+ARG version="5.6.31+230718"
-ARG sha256_checksum="671689d54db6c018c5dd764c852fccd5e582c4cf743bd7fe50329d2fbab5f8a7"
+ARG sha256_checksum="56e95727d591d63b265c010be972647bcaf3b8adfbf19847b8aba55dfe593376"
 ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
 ARG USER=www-data
 ARG LISTEN_PORT=8080
 ENV LIMESURVEY_VERSION=$version
 
-# Download, unzip and chmod LimeSurvey from GitHub (defaults to the official LimeSurvey/LimeSurvey repository) 
+# Download, unzip and chmod LimeSurvey from GitHub (defaults to the official LimeSurvey/LimeSurvey repository)
 RUN set -ex; \
         curl -sSL "${archive_url}" --output /tmp/limesurvey.tar.gz && \
         echo "${sha256_checksum}  /tmp/limesurvey.tar.gz" | sha256sum -c - && \

5.0/apache/entrypoint.sh

@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container
 
+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}
 
 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,19 +26,19 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'
 
-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
+file_env 'ENCRYPT_KEYPAIR'
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
+file_env 'ENCRYPT_PUBLIC_KEY'
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
+file_env 'ENCRYPT_SECRET_KEY'
-ENCRYPT_NONCE=${ENCRYPT_NONCE:-}
+file_env 'ENCRYPT_NONCE'
-ENCRYPT_SECRET_BOX_KEY=${ENCRYPT_SECRET_BOX_KEY:-}
+file_env 'ENCRYPT_SECRET_BOX_KEY'
 
 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'
 
 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
@@ -35,12 +52,12 @@ DEBUG_SQL=${DEBUG_SQL:-0}
 LISTEN_PORT=${LISTEN_PORT:-"8080"}
 
 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
     exit 1
 fi
 
 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
     exit 1
 fi
 

5.0/fpm-alpine/Dockerfile

@@ -2,6 +2,15 @@ FROM docker.io/php:8.0-fpm-alpine
 LABEL maintainer="markus@martialblog.de"
 
 # Install OS dependencies
+RUN set -ex; \
+        apk add --no-cache \
+        netcat-openbsd \
+        libsasl \
+        libldap \
+        bash
+
+# Install PHP Plugins
+# hadolint ignore=SC2086
 RUN set -ex; \
         apk add --no-cache --virtual .build-deps \
         freetype-dev \
@@ -13,14 +22,12 @@ RUN set -ex; \
         openldap-dev \
         oniguruma-dev \
         imap-dev \
-        postgresql-dev && \
+        postgresql-dev \
-        apk add --no-cache netcat-openbsd bash
+    ; \
-
+    \
-# Install PHP Plugins
+    docker-php-ext-configure gd --with-freetype --with-jpeg; \
-RUN set -ex; \
+    docker-php-ext-configure imap --with-imap-ssl; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
+    docker-php-ext-install -j "$(nproc)" \
-        docker-php-ext-configure imap --with-imap-ssl && \
-        docker-php-ext-install \
         exif \
         gd \
         imap \
@@ -32,15 +39,25 @@ RUN set -ex; \
         pgsql \
         sodium \
         tidy \
-        zip
+        zip \
+    ; \
+    \
+    runDeps="$( \
+        scanelf --needed --nobanner --format '%n#p' --recursive /usr/local/lib/php/extensions \
+            | tr ',' '\n' \
+            | sort -u \
+            | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+    )"; \
+    apk add --no-cache --no-network --virtual .limesurvey-phpext-rundeps $runDeps; \
+    apk del --no-cache --no-network .build-deps
 
-ARG version="5.6.14+230403"
+ARG version="5.6.31+230718"
-ARG sha256_checksum="671689d54db6c018c5dd764c852fccd5e582c4cf743bd7fe50329d2fbab5f8a7"
+ARG sha256_checksum="56e95727d591d63b265c010be972647bcaf3b8adfbf19847b8aba55dfe593376"
 ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
 ARG USER=www-data
 ENV LIMESURVEY_VERSION=$version
 
-# Download, unzip and chmod LimeSurvey from GitHub (defaults to the official LimeSurvey/LimeSurvey repository) 
+# Download, unzip and chmod LimeSurvey from GitHub (defaults to the official LimeSurvey/LimeSurvey repository)
 RUN set -ex; \
         curl -sSL "${archive_url}" --output /tmp/limesurvey.tar.gz && \
         echo "${sha256_checksum}  /tmp/limesurvey.tar.gz" | sha256sum -c - && \

5.0/fpm-alpine/entrypoint.sh

@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container
 
+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}
 
 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,19 +26,19 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'
 
-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
+file_env 'ENCRYPT_KEYPAIR'
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
+file_env 'ENCRYPT_PUBLIC_KEY'
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
+file_env 'ENCRYPT_SECRET_KEY'
-ENCRYPT_NONCE=${ENCRYPT_NONCE:-}
+file_env 'ENCRYPT_NONCE'
-ENCRYPT_SECRET_BOX_KEY=${ENCRYPT_SECRET_BOX_KEY:-}
+file_env 'ENCRYPT_SECRET_BOX_KEY'
 
 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'
 
 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
@@ -33,12 +50,12 @@ DEBUG=${DEBUG:-0}
 DEBUG_SQL=${DEBUG_SQL:-0}
 
 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
     exit 1
 fi
 
 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
     exit 1
 fi
 

5.0/fpm/Dockerfile

@@ -3,56 +3,78 @@ LABEL maintainer="markus@martialblog.de"
 
 # Install OS dependencies
 RUN set -ex; \
-        apt-get update && \
+        apt-get update; \
-        DEBIAN_FRONTEND=noninteractive \
+        apt-get install -y --no-install-recommends \
-        apt-get install --no-install-recommends -y \
+                netcat-openbsd \
+                libldap-common \
+                libsasl2-modules \
+        ; \
         \
-        libldap2-dev \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
-        libfreetype6-dev \
-        libjpeg-dev \
-        libonig-dev \
-        zlib1g-dev \
-        libc-client-dev \
-        libkrb5-dev \
-        libpng-dev \
-        libpq-dev \
-        libzip-dev \
-        libtidy-dev \
-        libsodium-dev \
-        netcat \
-        \
-        && apt-get -y autoclean; apt-get -y autoremove; \
         rm -rf /var/lib/apt/lists/*
 
-# Link LDAP library for PHP ldap extension
-RUN set -ex; \
-        ln -fs /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/
-
 # Install PHP Plugins and Configure PHP imap plugin
+# hadolint ignore=SC2086
 RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
+        \
-        docker-php-ext-configure imap --with-kerberos --with-imap-ssl && \
+        savedAptMark="$(apt-mark showmanual)"; \
-        docker-php-ext-install -j5 \
+        \
-        exif \
+        apt-get update; \
-        gd \
+        apt-get install -y --no-install-recommends \
-        imap \
+                libldap2-dev \
-        ldap \
+                libfreetype6-dev \
-        mbstring \
+                libjpeg-dev \
-        pdo \
+                libonig-dev \
-        pdo_mysql \
+                zlib1g-dev \
-        pdo_pgsql \
+                libc-client-dev \
-        pgsql \
+                libkrb5-dev \
-        sodium \
+                libpng-dev \
-        tidy \
+                libpq-dev \
-        zip
+                libzip-dev \
+                libtidy-dev \
+                libsodium-dev \
+        ; \
+        \
+        debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+        docker-php-ext-configure gd --with-freetype --with-jpeg; \
+        docker-php-ext-configure imap --with-kerberos --with-imap-ssl; \
+        docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+        docker-php-ext-install -j "$(nproc)" \
+                exif \
+                gd \
+                imap \
+                ldap \
+                mbstring \
+                pdo \
+                pdo_mysql \
+                pdo_pgsql \
+                pgsql \
+                sodium \
+                tidy \
+                zip \
+        ; \
+        \
+# Reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+        apt-mark auto '.*' > /dev/null; \
+        apt-mark manual $savedAptMark; \
+        ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+                | awk '/=>/ { print $3 }' \
+                | sort -u \
+                | xargs -r dpkg-query -S \
+                | cut -d: -f1 \
+                | sort -u \
+                | xargs -rt apt-mark manual; \
+        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*
 
-ARG version="5.6.14+230403"
+ARG version="5.6.31+230718"
-ARG sha256_checksum="671689d54db6c018c5dd764c852fccd5e582c4cf743bd7fe50329d2fbab5f8a7"
+ARG sha256_checksum="56e95727d591d63b265c010be972647bcaf3b8adfbf19847b8aba55dfe593376"
 ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
 ARG USER=www-data
 ENV LIMESURVEY_VERSION=$version
 
-# Download, unzip and chmod LimeSurvey from GitHub (defaults to the official LimeSurvey/LimeSurvey repository) 
+# Download, unzip and chmod LimeSurvey from GitHub (defaults to the official LimeSurvey/LimeSurvey repository)
 RUN set -ex; \
         curl -sSL "${archive_url}" --output /tmp/limesurvey.tar.gz && \
         echo "${sha256_checksum}  /tmp/limesurvey.tar.gz" | sha256sum -c - && \

5.0/fpm/entrypoint.sh

@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container
 
+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}
 
 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,19 +26,19 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'
 
-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
+file_env 'ENCRYPT_KEYPAIR'
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
+file_env 'ENCRYPT_PUBLIC_KEY'
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
+file_env 'ENCRYPT_SECRET_KEY'
-ENCRYPT_NONCE=${ENCRYPT_NONCE:-}
+file_env 'ENCRYPT_NONCE'
-ENCRYPT_SECRET_BOX_KEY=${ENCRYPT_SECRET_BOX_KEY:-}
+file_env 'ENCRYPT_SECRET_BOX_KEY'
 
 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'
 
 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
@@ -33,12 +50,12 @@ DEBUG=${DEBUG:-0}
 DEBUG_SQL=${DEBUG_SQL:-0}
 
 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
     exit 1
 fi
 
 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
     exit 1
 fi
 

6.0/apache/Dockerfile

@@ -1,51 +1,72 @@
-FROM docker.io/php:8.1-apache
+FROM docker.io/php:8.0-apache
 LABEL maintainer="markus@martialblog.de"
 
 # Install OS dependencies
 RUN set -ex; \
-        apt-get update && \
+        apt-get update; \
-        DEBIAN_FRONTEND=noninteractive \
+        apt-get install -y --no-install-recommends \
-        apt-get install --no-install-recommends -y \
+                netcat-openbsd \
+                libldap-common \
+                libsasl2-modules \
+        ; \
         \
-        libldap2-dev \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
-        libfreetype6-dev \
-        libjpeg-dev \
-        libonig-dev \
-        zlib1g-dev \
-        libc-client-dev \
-        libkrb5-dev \
-        libpng-dev \
-        libpq-dev \
-        libzip-dev \
-        libtidy-dev \
-        libsodium-dev \
-        netcat \
-        curl \
-        \
-        && apt-get -y autoclean; apt-get -y autoremove; \
         rm -rf /var/lib/apt/lists/*
 
-# Link LDAP library for PHP ldap extension
-RUN set -ex; \
-        ln -fs /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/
-
 # Install PHP Plugins and Configure PHP imap plugin
+# hadolint ignore=SC2086
 RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
+        \
-        docker-php-ext-configure imap --with-kerberos --with-imap-ssl && \
+        savedAptMark="$(apt-mark showmanual)"; \
-        docker-php-ext-install -j5 \
+        \
-        exif \
+        apt-get update; \
-        gd \
+        apt-get install -y --no-install-recommends \
-        imap \
+                libldap2-dev \
-        ldap \
+                libfreetype6-dev \
-        mbstring \
+                libjpeg-dev \
-        pdo \
+                libonig-dev \
-        pdo_mysql \
+                zlib1g-dev \
-        pdo_pgsql \
+                libc-client-dev \
-        pgsql \
+                libkrb5-dev \
-        sodium \
+                libpng-dev \
-        tidy \
+                libpq-dev \
-        zip
+                libzip-dev \
+                libtidy-dev \
+                libsodium-dev \
+        ; \
+        \
+        debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+        docker-php-ext-configure gd --with-freetype --with-jpeg; \
+        docker-php-ext-configure imap --with-kerberos --with-imap-ssl; \
+        docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+        docker-php-ext-install -j "$(nproc)" \
+                exif \
+                gd \
+                imap \
+                ldap \
+                mbstring \
+                pdo \
+                pdo_mysql \
+                pdo_pgsql \
+                pgsql \
+                sodium \
+                tidy \
+                zip \
+        ; \
+        \
+# Reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+        apt-mark auto '.*' > /dev/null; \
+        apt-mark manual $savedAptMark; \
+        ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+                | awk '/=>/ { print $3 }' \
+                | sort -u \
+                | xargs -r dpkg-query -S \
+                | cut -d: -f1 \
+                | sort -u \
+                | xargs -rt apt-mark manual; \
+        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*
 
 # Apache configuration
 RUN a2enmod headers rewrite remoteip; \
@@ -60,8 +81,8 @@ RUN a2enmod headers rewrite remoteip; \
 # Use the default production configuration
 RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"
 
-ARG version="6.0.0+230405"
+ARG version="6.1.8+230717"
-ARG sha256_checksum="ee636330911150b5f109323b6226c48d9fd7634856b251bbf66a75a29d4b4756"
+ARG sha256_checksum="c89caf3768859e43eafe6de5b578f30f5d4506aa3b5681f78e58a1cdccb95599"
 ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
 ARG USER=www-data
 ARG LISTEN_PORT=8080

6.0/apache/entrypoint.sh

@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container
 
+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}
 
 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,19 +26,19 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'
 
-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
+file_env 'ENCRYPT_KEYPAIR'
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
+file_env 'ENCRYPT_PUBLIC_KEY'
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
+file_env 'ENCRYPT_SECRET_KEY'
-ENCRYPT_NONCE=${ENCRYPT_NONCE:-}
+file_env 'ENCRYPT_NONCE'
-ENCRYPT_SECRET_BOX_KEY=${ENCRYPT_SECRET_BOX_KEY:-}
+file_env 'ENCRYPT_SECRET_BOX_KEY'
 
 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'
 
 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
@@ -35,12 +52,12 @@ DEBUG_SQL=${DEBUG_SQL:-0}
 LISTEN_PORT=${LISTEN_PORT:-"8080"}
 
 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
     exit 1
 fi
 
 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
     exit 1
 fi
 

6.0/fpm-alpine/Dockerfile

@@ -1,7 +1,16 @@
-FROM docker.io/php:8.1-fpm-alpine
+FROM docker.io/php:8.0-fpm-alpine
 LABEL maintainer="markus@martialblog.de"
 
 # Install OS dependencies
+RUN set -ex; \
+        apk add --no-cache \
+        netcat-openbsd \
+        libsasl \
+        libldap \
+        bash
+
+# Install PHP Plugins
+# hadolint ignore=SC2086
 RUN set -ex; \
         apk add --no-cache --virtual .build-deps \
         freetype-dev \
@@ -13,14 +22,12 @@ RUN set -ex; \
         openldap-dev \
         oniguruma-dev \
         imap-dev \
-        postgresql-dev && \
+        postgresql-dev \
-        apk add --no-cache netcat-openbsd bash
+    ; \
-
+    \
-# Install PHP Plugins
+    docker-php-ext-configure gd --with-freetype --with-jpeg; \
-RUN set -ex; \
+    docker-php-ext-configure imap --with-imap-ssl; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
+    docker-php-ext-install -j "$(nproc)" \
-        docker-php-ext-configure imap --with-imap-ssl && \
-        docker-php-ext-install \
         exif \
         gd \
         imap \
@@ -32,10 +39,20 @@ RUN set -ex; \
         pgsql \
         sodium \
         tidy \
-        zip
+        zip \
+    ; \
+    \
+    runDeps="$( \
+        scanelf --needed --nobanner --format '%n#p' --recursive /usr/local/lib/php/extensions \
+            | tr ',' '\n' \
+            | sort -u \
+            | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+    )"; \
+    apk add --no-cache --no-network --virtual .limesurvey-phpext-rundeps $runDeps; \
+    apk del --no-cache --no-network .build-deps
 
-ARG version="6.0.0+230405"
+ARG version="6.1.8+230717"
-ARG sha256_checksum="ee636330911150b5f109323b6226c48d9fd7634856b251bbf66a75a29d4b4756"
+ARG sha256_checksum="c89caf3768859e43eafe6de5b578f30f5d4506aa3b5681f78e58a1cdccb95599"
 ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
 ARG USER=www-data
 ENV LIMESURVEY_VERSION=$version

6.0/fpm-alpine/entrypoint.sh

@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container
 
+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}
 
 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,19 +26,19 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'
 
-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
+file_env 'ENCRYPT_KEYPAIR'
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
+file_env 'ENCRYPT_PUBLIC_KEY'
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
+file_env 'ENCRYPT_SECRET_KEY'
-ENCRYPT_NONCE=${ENCRYPT_NONCE:-}
+file_env 'ENCRYPT_NONCE'
-ENCRYPT_SECRET_BOX_KEY=${ENCRYPT_SECRET_BOX_KEY:-}
+file_env 'ENCRYPT_SECRET_BOX_KEY'
 
 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'
 
 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
@@ -33,12 +50,12 @@ DEBUG=${DEBUG:-0}
 DEBUG_SQL=${DEBUG_SQL:-0}
 
 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
     exit 1
 fi
 
 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
     exit 1
 fi
 

6.0/fpm/Dockerfile

@@ -1,53 +1,75 @@
-FROM docker.io/php:8.1-fpm
+FROM docker.io/php:8.0-fpm
 LABEL maintainer="markus@martialblog.de"
 
 # Install OS dependencies
 RUN set -ex; \
-        apt-get update && \
+        apt-get update; \
-        DEBIAN_FRONTEND=noninteractive \
+        apt-get install -y --no-install-recommends \
-        apt-get install --no-install-recommends -y \
+                netcat-openbsd \
+                libldap-common \
+                libsasl2-modules \
+        ; \
         \
-        libldap2-dev \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
-        libfreetype6-dev \
-        libjpeg-dev \
-        libonig-dev \
-        zlib1g-dev \
-        libc-client-dev \
-        libkrb5-dev \
-        libpng-dev \
-        libpq-dev \
-        libzip-dev \
-        libtidy-dev \
-        libsodium-dev \
-        netcat \
-        \
-        && apt-get -y autoclean; apt-get -y autoremove; \
         rm -rf /var/lib/apt/lists/*
 
-# Link LDAP library for PHP ldap extension
-RUN set -ex; \
-        ln -fs /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/
-
 # Install PHP Plugins and Configure PHP imap plugin
+# hadolint ignore=SC2086
 RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
+        \
-        docker-php-ext-configure imap --with-kerberos --with-imap-ssl && \
+        savedAptMark="$(apt-mark showmanual)"; \
-        docker-php-ext-install -j5 \
+        \
-        exif \
+        apt-get update; \
-        gd \
+        apt-get install -y --no-install-recommends \
-        imap \
+                libldap2-dev \
-        ldap \
+                libfreetype6-dev \
-        mbstring \
+                libjpeg-dev \
-        pdo \
+                libonig-dev \
-        pdo_mysql \
+                zlib1g-dev \
-        pdo_pgsql \
+                libc-client-dev \
-        pgsql \
+                libkrb5-dev \
-        sodium \
+                libpng-dev \
-        tidy \
+                libpq-dev \
-        zip
+                libzip-dev \
+                libtidy-dev \
+                libsodium-dev \
+        ; \
+        \
+        debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+        docker-php-ext-configure gd --with-freetype --with-jpeg; \
+        docker-php-ext-configure imap --with-kerberos --with-imap-ssl; \
+        docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+        docker-php-ext-install -j "$(nproc)" \
+                exif \
+                gd \
+                imap \
+                ldap \
+                mbstring \
+                pdo \
+                pdo_mysql \
+                pdo_pgsql \
+                pgsql \
+                sodium \
+                tidy \
+                zip \
+        ; \
+        \
+# Reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+        apt-mark auto '.*' > /dev/null; \
+        apt-mark manual $savedAptMark; \
+        ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+                | awk '/=>/ { print $3 }' \
+                | sort -u \
+                | xargs -r dpkg-query -S \
+                | cut -d: -f1 \
+                | sort -u \
+                | xargs -rt apt-mark manual; \
+        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*
 
-ARG version="6.0.0+230405"
+ARG version="6.1.8+230717"
-ARG sha256_checksum="ee636330911150b5f109323b6226c48d9fd7634856b251bbf66a75a29d4b4756"
+ARG sha256_checksum="c89caf3768859e43eafe6de5b578f30f5d4506aa3b5681f78e58a1cdccb95599"
 ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
 ARG USER=www-data
 ENV LIMESURVEY_VERSION=$version

6.0/fpm/entrypoint.sh

@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container
 
+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}
 
 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,19 +26,19 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'
 
-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
+file_env 'ENCRYPT_KEYPAIR'
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
+file_env 'ENCRYPT_PUBLIC_KEY'
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
+file_env 'ENCRYPT_SECRET_KEY'
-ENCRYPT_NONCE=${ENCRYPT_NONCE:-}
+file_env 'ENCRYPT_NONCE'
-ENCRYPT_SECRET_BOX_KEY=${ENCRYPT_SECRET_BOX_KEY:-}
+file_env 'ENCRYPT_SECRET_BOX_KEY'
 
 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'
 
 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
@@ -33,12 +50,12 @@ DEBUG=${DEBUG:-0}
 DEBUG_SQL=${DEBUG_SQL:-0}
 
 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
     exit 1
 fi
 
 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
     exit 1
 fi
 

README.md

@@ -133,6 +133,18 @@ If you are running LimeSurvey behind a Reverse Proxy you might need some additio
 | ENCRYPT_SECRET_BOX_KEY | Data encryption secret box key (used in 5.0 and higher) |
 | LISTEN_PORT     | Apache: Listen port. Default: 8080        |
 
+Sensitive information can also be passed `_FILE` to the following environment variables to load the values from the given file path. Example `DB_PASSWORD_FILE=/run/secrets/db_password`.
+
+```
+DB_PASSWORD_FILE
+ADMIN_PASSWORD_FILE
+ENCRYPT_KEYPAIR_FILE
+ENCRYPT_PUBLIC_KEY_FILE
+ENCRYPT_SECRET_KEY_FILE
+ENCRYPT_NONCE_FILE
+ENCRYPT_SECRET_BOX_KEY_FILE
+```
+
 For further details on the settings see: https://manual.limesurvey.org/Optional_settings#Advanced_Path_Settings
 
 # Running LimeSurvey with docker-compose

tests/apache-tests.yaml

@@ -51,30 +51,6 @@ commandTests:
     command: "dpkg"
     args: ["-l", "netcat"]
     exitCode: 0
-  - name:  "Dependencies - libldap2-dev"
-    command: "dpkg"
-    args: ["-l", "libldap2-dev"]
-    exitCode: 0
-  - name:  "Dependencies - zlib1g-dev"
-    command: "dpkg"
-    args: ["-l", "zlib1g-dev"]
-    exitCode: 0
-  - name:  "Dependencies - libc-client-dev"
-    command: "dpkg"
-    args: ["-l", "libc-client-dev"]
-    exitCode: 0
-  - name:  "Dependencies - libkrb5-dev"
-    command: "dpkg"
-    args: ["-l", "libkrb5-dev"]
-    exitCode: 0
-  - name:  "Dependencies - libpng-dev"
-    command: "dpkg"
-    args: ["-l", "libpng-dev"]
-    exitCode: 0
-  - name:  "Dependencies - libpq-dev"
-    command: "dpkg"
-    args: ["-l", "libpq-dev"]
-    exitCode: 0
   - name:  "Dependencies - PHP Modules"
     command: "php"
     args: ["-m"]