Upgrading to LTS Version 5.6.40+231005

Upgrading to Version 6.2.9+230925
Upgrading to LTS Version 5.6.39+230926
2025-12-06 16:39:11 +01:00 · 2023-10-16 18:04:13 +02:00 · 2023-10-05 08:38:44 +02:00 · 2023-10-05 08:37:58 +02:00 · 2023-10-01 11:15:26 +02:00 · 2023-09-26 07:51:17 +02:00
23 changed files with 665 additions and 400 deletions
--- a/.github/workflows/build-latest-container-images.yaml
+++ b/.github/workflows/build-latest-container-images.yaml
@@ -15,7 +15,7 @@ jobs:
          - 6.0/fpm-alpine/Dockerfile
          - 6.0/fpm/Dockerfile
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
      - uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: ${{ matrix.dockerfile }}
@@ -31,24 +31,24 @@ jobs:
      contents: read
    steps:
      - name: 'Check out the repo'
-        uses: actions/checkout@v3
+        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
      - name: 'Set up QEMU'
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
        with:
          platforms: 'arm64,arm'
      - name: 'Set up Docker Buildx'
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
        with:
          buildkitd-flags: --debug
      - name: 'Log in to DockerHub'
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_TOKEN }}
      - name: 'Apache variant metadata'
        id: metadata-apache
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
        with:
          images: |
            docker.io/martialblog/limesurvey
@@ -59,7 +59,7 @@ jobs:
            latest=true
            suffix=-apache
      - name: 'Build and push latest Apache container images'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
        with:
          context: 6.0/apache
          push: true
@@ -69,7 +69,7 @@ jobs:

      - name: 'FPM variant metadata'
        id: metadata-fpm
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
        with:
          images: |
            docker.io/martialblog/limesurvey
@@ -80,7 +80,7 @@ jobs:
            latest=false
            suffix=-fpm
      - name: 'Build and push latest fpm container images'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
        with:
          context: 6.0/fpm
          push: true
@@ -90,7 +90,7 @@ jobs:

      - name: 'FPM Alpine variant metadata'
        id: metadata-fpm-alpine
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
        with:
          images: |
            docker.io/martialblog/limesurvey
@@ -101,7 +101,7 @@ jobs:
            latest=false
            suffix=-fpm-alpine
      - name: 'Build and push latest fpm-alpine container images'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
        with:
          context: 6.0/fpm-alpine
          push: true
--- a/.github/workflows/build-lts-container-images.yaml
+++ b/.github/workflows/build-lts-container-images.yaml
@@ -15,7 +15,7 @@ jobs:
          - 5.0/fpm-alpine/Dockerfile
          - 5.0/fpm/Dockerfile
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
      - uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: ${{ matrix.dockerfile }}
@@ -31,24 +31,24 @@ jobs:
      contents: read
    steps:
      - name: 'Check out the repo'
-        uses: actions/checkout@v3
+        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
      - name: 'Set up QEMU'
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
        with:
          platforms: 'arm64,arm'
      - name: 'Set up Docker Buildx'
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
        with:
          buildkitd-flags: --debug
      - name: 'Log in to DockerHub'
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_TOKEN }}
      - name: 'Apache variant metadata'
        id: metadata-apache
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
        with:
          images: |
            docker.io/martialblog/limesurvey
@@ -59,7 +59,7 @@ jobs:
            latest=false
            suffix=-apache
      - name: 'Build and push LTS apache container images'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
        with:
          context: 5.0/apache
          push: true
@@ -69,7 +69,7 @@ jobs:

      - name: 'FPM variant metadata'
        id: metadata-fpm
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
        with:
          images: |
            docker.io/martialblog/limesurvey
@@ -80,7 +80,7 @@ jobs:
            latest=false
            suffix=-fpm
      - name: 'Build and push LTS fpm container images'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
        with:
          context: 5.0/fpm
          push: true
@@ -90,7 +90,7 @@ jobs:

      - name: 'FPM Alpine variant metadata'
        id: metadata-fpm-alpine
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
        with:
          images: |
            docker.io/martialblog/limesurvey
@@ -101,7 +101,7 @@ jobs:
            latest=false
            suffix=-fpm-alpine
      - name: 'Build and push LTS fpm-alpine container images'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
        with:
          context: 5.0/fpm-alpine
          push: true
--- a/.github/workflows/lint-dockerfiles.yaml
+++ b/.github/workflows/lint-dockerfiles.yaml
@@ -17,7 +17,7 @@ jobs:
          - 6.0/fpm/Dockerfile
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
      - uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: ${{ matrix.dockerfile }}
--- a/.github/workflows/test-arm-container-images.yaml
+++ b/.github/workflows/test-arm-container-images.yaml
@@ -22,18 +22,18 @@ jobs:
          - linux/arm64
    steps:
      - name: 'Check out the repo'
-        uses: actions/checkout@v3
+        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4

      - name: 'Set up QEMU'
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
        with:
          platforms: 'arm64,arm'

      - name: 'Set up Docker Buildx'
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3

      - name: 'Build Container images'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
        with:
          context: 6.0/${{ matrix.context }}
          push: false
--- a/.github/workflows/test-latest-container-images.yaml
+++ b/.github/workflows/test-latest-container-images.yaml
@@ -14,18 +14,18 @@ jobs:
          - fpm
    steps:
      - name: 'Check out the repo'
-        uses: actions/checkout@v3
+        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4

      - name: 'Set up QEMU'
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
        with:
          platforms: 'arm64,arm'

      - name: 'Set up Docker Buildx'
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3

      - name: 'Build Container images'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
        with:
          context: 6.0/${{ matrix.context }}
          push: false
--- a/.github/workflows/test-lts-container-images.yaml
+++ b/.github/workflows/test-lts-container-images.yaml
@@ -14,16 +14,16 @@ jobs:
          - fpm
    steps:
      - name: 'Check out the repo'
-        uses: actions/checkout@v3
+        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4

      - name: 'Set up QEMU'
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3

      - name: 'Set up Docker Buildx'
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3

      - name: 'Build Container images'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
        with:
          context: 5.0/${{ matrix.context }}
          push: false
--- a/3.0/apache/Dockerfile
+++ b/3.0/apache/Dockerfile
@@ -3,10 +3,22 @@ LABEL maintainer="markus@martialblog.de"

 # Install OS dependencies
 RUN set -ex; \
-        apt-get update && \
-        DEBIAN_FRONTEND=noninteractive \
-        apt-get install --no-install-recommends -y \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
+                netcat \
+        ; \
        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*
+
+# Install PHP Plugins and Configure PHP imap plugin
+# hadolint ignore=SC2086
+RUN set -ex; \
+        \
+        savedAptMark="$(apt-mark showmanual)"; \
+        \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
                libldap2-dev \
                libfreetype6-dev \
                libjpeg-dev \
@@ -19,20 +31,13 @@ RUN set -ex; \
                libzip-dev \
                libtidy-dev \
                libsodium-dev \
-        netcat \
+        ; \
        \
-        && apt-get -y autoclean; apt-get -y autoremove; \
-        rm -rf /var/lib/apt/lists/*
-
-# Link LDAP library for PHP ldap extension
-RUN set -ex; \
-        ln -fs /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/
-
-# Install PHP Plugins and Configure PHP imap plugin
-RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
-        docker-php-ext-configure imap --with-kerberos --with-imap-ssl && \
-        docker-php-ext-install -j5 \
+        debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+        docker-php-ext-configure gd --with-freetype --with-jpeg; \
+        docker-php-ext-configure imap --with-kerberos --with-imap-ssl; \
+        docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+        docker-php-ext-install -j "$(nproc)" \
                exif \
                gd \
                imap \
@@ -44,7 +49,22 @@ RUN set -ex; \
                pgsql \
                sodium \
                tidy \
-        zip
+                zip \
+        ; \
+        \
+# Reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+        apt-mark auto '.*' > /dev/null; \
+        apt-mark manual $savedAptMark; \
+        ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+                | awk '/=>/ { print $3 }' \
+                | sort -u \
+                | xargs -r dpkg-query -S \
+                | cut -d: -f1 \
+                | sort -u \
+                | xargs -rt apt-mark manual; \
+        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*

 # Apache configuration
 RUN a2enmod headers rewrite remoteip; \
@@ -59,8 +79,8 @@ RUN a2enmod headers rewrite remoteip; \
 # Use the default production configuration
 RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"

-ARG version="3.28.56+230404"
-ARG sha256_checksum="abfdc800d97feabbd448df4a2cfa72a954d2f6b013475132b0691ac2563e7228"
+ARG version="3.28.59+230517"
+ARG sha256_checksum="e048eaaf5260a8d6391609c355bb4df8c8ef0e0943b2d612d2a8414956db622a"
 ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
 ARG USER=root
 ARG LISTEN_PORT=80
--- a/3.0/fpm-alpine/Dockerfile
+++ b/3.0/fpm-alpine/Dockerfile
@@ -2,6 +2,10 @@ FROM docker.io/php:8.0-fpm-alpine
 LABEL maintainer="markus@martialblog.de"

 # Install OS dependencies
+RUN apk add --no-cache netcat-openbsd bash
+
+# Install PHP Plugins
+# hadolint ignore=SC2086
 RUN set -ex; \
        apk add --no-cache --virtual .build-deps \
        freetype-dev \
@@ -13,14 +17,13 @@ RUN set -ex; \
        openldap-dev \
        oniguruma-dev \
        imap-dev \
-        postgresql-dev && \
-        apk add --no-cache netcat-openbsd bash
-
-# Install PHP Plugins
-RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
-        docker-php-ext-configure imap --with-imap-ssl && \
-        docker-php-ext-install \
+        postgresql-dev \
+    ; \
+    \
+    docker-php-ext-configure gd --with-freetype --with-jpeg; \
+    docker-php-ext-configure imap --with-imap-ssl; \
+    docker-php-ext-install -j "$(nproc)" \
+        exif \
        gd \
        imap \
        ldap \
@@ -31,10 +34,20 @@ RUN set -ex; \
        pgsql \
        sodium \
        tidy \
-        zip
+        zip \
+    ; \
+    \
+    runDeps="$( \
+        scanelf --needed --nobanner --format '%n#p' --recursive /usr/local/lib/php/extensions \
+            | tr ',' '\n' \
+            | sort -u \
+            | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+    )"; \
+    apk add --no-cache --no-network --virtual .limesurvey-phpext-rundeps $runDeps; \
+    apk del --no-cache --no-network .build-deps

-ARG version="3.28.56+230404"
-ARG sha256_checksum="abfdc800d97feabbd448df4a2cfa72a954d2f6b013475132b0691ac2563e7228"
+ARG version="3.28.59+230517"
+ARG sha256_checksum="e048eaaf5260a8d6391609c355bb4df8c8ef0e0943b2d612d2a8414956db622a"
 ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
 ENV LIMESURVEY_VERSION=$version

--- a/3.0/fpm/Dockerfile
+++ b/3.0/fpm/Dockerfile
@@ -3,10 +3,22 @@ LABEL maintainer="markus@martialblog.de"

 # Install OS dependencies
 RUN set -ex; \
-        apt-get update && \
-        DEBIAN_FRONTEND=noninteractive \
-        apt-get install --no-install-recommends -y \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
+                netcat \
+        ; \
        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*
+
+# Install PHP Plugins and Configure PHP imap plugin
+# hadolint ignore=SC2086
+RUN set -ex; \
+        \
+        savedAptMark="$(apt-mark showmanual)"; \
+        \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
                libldap2-dev \
                libfreetype6-dev \
                libjpeg-dev \
@@ -19,20 +31,13 @@ RUN set -ex; \
                libzip-dev \
                libtidy-dev \
                libsodium-dev \
-        netcat \
+        ; \
        \
-        && apt-get -y autoclean; apt-get -y autoremove; \
-        rm -rf /var/lib/apt/lists/*
-
-# Link LDAP library for PHP ldap extension
-RUN set -ex; \
-        ln -fs /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/
-
-# Install PHP Plugins and Configure PHP imap plugin
-RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
-        docker-php-ext-configure imap --with-kerberos --with-imap-ssl && \
-        docker-php-ext-install -j5 \
+        debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+        docker-php-ext-configure gd --with-freetype --with-jpeg; \
+        docker-php-ext-configure imap --with-kerberos --with-imap-ssl; \
+        docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+        docker-php-ext-install -j "$(nproc)" \
                exif \
                gd \
                imap \
@@ -44,10 +49,25 @@ RUN set -ex; \
                pgsql \
                sodium \
                tidy \
-        zip
+                zip \
+        ; \
+        \
+# Reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+        apt-mark auto '.*' > /dev/null; \
+        apt-mark manual $savedAptMark; \
+        ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+                | awk '/=>/ { print $3 }' \
+                | sort -u \
+                | xargs -r dpkg-query -S \
+                | cut -d: -f1 \
+                | sort -u \
+                | xargs -rt apt-mark manual; \
+        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*

-ARG version="3.28.56+230404"
-ARG sha256_checksum="abfdc800d97feabbd448df4a2cfa72a954d2f6b013475132b0691ac2563e7228"
+ARG version="3.28.59+230517"
+ARG sha256_checksum="e048eaaf5260a8d6391609c355bb4df8c8ef0e0943b2d612d2a8414956db622a"
 ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
 ENV LIMESURVEY_VERSION=$version

--- a/5.0/apache/Dockerfile
+++ b/5.0/apache/Dockerfile
@@ -3,10 +3,24 @@ LABEL maintainer="markus@martialblog.de"

 # Install OS dependencies
 RUN set -ex; \
-        apt-get update && \
-        DEBIAN_FRONTEND=noninteractive \
-        apt-get install --no-install-recommends -y \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
+                netcat-openbsd \
+                libldap-common \
+                libsasl2-modules \
+        ; \
        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*
+
+# Install PHP Plugins and Configure PHP imap plugin
+# hadolint ignore=SC2086
+RUN set -ex; \
+        \
+        savedAptMark="$(apt-mark showmanual)"; \
+        \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
                libldap2-dev \
                libfreetype6-dev \
                libjpeg-dev \
@@ -19,21 +33,13 @@ RUN set -ex; \
                libzip-dev \
                libtidy-dev \
                libsodium-dev \
-        netcat \
-        curl \
+        ; \
        \
-        && apt-get -y autoclean; apt-get -y autoremove; \
-        rm -rf /var/lib/apt/lists/*
-
-# Link LDAP library for PHP ldap extension
-RUN set -ex; \
-        ln -fs /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/
-
-# Install PHP Plugins and Configure PHP imap plugin
-RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
-        docker-php-ext-configure imap --with-kerberos --with-imap-ssl && \
-        docker-php-ext-install -j5 \
+        debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+        docker-php-ext-configure gd --with-freetype --with-jpeg; \
+        docker-php-ext-configure imap --with-kerberos --with-imap-ssl; \
+        docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+        docker-php-ext-install -j "$(nproc)" \
                exif \
                gd \
                imap \
@@ -45,7 +51,22 @@ RUN set -ex; \
                pgsql \
                sodium \
                tidy \
-        zip
+                zip \
+        ; \
+        \
+# Reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+        apt-mark auto '.*' > /dev/null; \
+        apt-mark manual $savedAptMark; \
+        ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+                | awk '/=>/ { print $3 }' \
+                | sort -u \
+                | xargs -r dpkg-query -S \
+                | cut -d: -f1 \
+                | sort -u \
+                | xargs -rt apt-mark manual; \
+        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*

 # Apache configuration
 RUN a2enmod headers rewrite remoteip; \
@@ -60,9 +81,9 @@ RUN a2enmod headers rewrite remoteip; \
 # Use the default production configuration
 RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"

-ARG version="5.6.17+230426"
-ARG sha256_checksum="dd1773d8c4bf03f66bc6e2d137b1c570bf8db02bfd6e85e5d6ce9927df6f277d"
-ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
+ARG version="5.6.40+231005"
+ARG sha256_checksum="b5bbf49d054320efae39adfe396049907047b8fd3daf614b0599d238321ec95d"
+ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/refs/tags/${version}.tar.gz"
 ARG USER=www-data
 ARG LISTEN_PORT=8080
 ENV LIMESURVEY_VERSION=$version
--- a/5.0/apache/entrypoint.sh
+++ b/5.0/apache/entrypoint.sh
@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container

+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}

 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,19 +26,19 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'

-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
-ENCRYPT_NONCE=${ENCRYPT_NONCE:-}
-ENCRYPT_SECRET_BOX_KEY=${ENCRYPT_SECRET_BOX_KEY:-}
+file_env 'ENCRYPT_KEYPAIR'
+file_env 'ENCRYPT_PUBLIC_KEY'
+file_env 'ENCRYPT_SECRET_KEY'
+file_env 'ENCRYPT_NONCE'
+file_env 'ENCRYPT_SECRET_BOX_KEY'

 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'

 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
@@ -35,12 +52,12 @@ DEBUG_SQL=${DEBUG_SQL:-0}
 LISTEN_PORT=${LISTEN_PORT:-"8080"}

 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
    exit 1
 fi

 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
    exit 1
 fi

--- a/5.0/fpm-alpine/Dockerfile
+++ b/5.0/fpm-alpine/Dockerfile
@@ -2,6 +2,15 @@ FROM docker.io/php:8.0-fpm-alpine
 LABEL maintainer="markus@martialblog.de"

 # Install OS dependencies
+RUN set -ex; \
+        apk add --no-cache \
+        netcat-openbsd \
+        libsasl \
+        libldap \
+        bash
+
+# Install PHP Plugins
+# hadolint ignore=SC2086
 RUN set -ex; \
        apk add --no-cache --virtual .build-deps \
        freetype-dev \
@@ -13,14 +22,12 @@ RUN set -ex; \
        openldap-dev \
        oniguruma-dev \
        imap-dev \
-        postgresql-dev && \
-        apk add --no-cache netcat-openbsd bash
-
-# Install PHP Plugins
-RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
-        docker-php-ext-configure imap --with-imap-ssl && \
-        docker-php-ext-install \
+        postgresql-dev \
+    ; \
+    \
+    docker-php-ext-configure gd --with-freetype --with-jpeg; \
+    docker-php-ext-configure imap --with-imap-ssl; \
+    docker-php-ext-install -j "$(nproc)" \
        exif \
        gd \
        imap \
@@ -32,11 +39,21 @@ RUN set -ex; \
        pgsql \
        sodium \
        tidy \
-        zip
+        zip \
+    ; \
+    \
+    runDeps="$( \
+        scanelf --needed --nobanner --format '%n#p' --recursive /usr/local/lib/php/extensions \
+            | tr ',' '\n' \
+            | sort -u \
+            | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+    )"; \
+    apk add --no-cache --no-network --virtual .limesurvey-phpext-rundeps $runDeps; \
+    apk del --no-cache --no-network .build-deps

-ARG version="5.6.17+230426"
-ARG sha256_checksum="dd1773d8c4bf03f66bc6e2d137b1c570bf8db02bfd6e85e5d6ce9927df6f277d"
-ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
+ARG version="5.6.40+231005"
+ARG sha256_checksum="b5bbf49d054320efae39adfe396049907047b8fd3daf614b0599d238321ec95d"
+ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/refs/tags/${version}.tar.gz"
 ARG USER=www-data
 ENV LIMESURVEY_VERSION=$version

--- a/5.0/fpm-alpine/entrypoint.sh
+++ b/5.0/fpm-alpine/entrypoint.sh
@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container

+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}

 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,19 +26,19 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'

-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
-ENCRYPT_NONCE=${ENCRYPT_NONCE:-}
-ENCRYPT_SECRET_BOX_KEY=${ENCRYPT_SECRET_BOX_KEY:-}
+file_env 'ENCRYPT_KEYPAIR'
+file_env 'ENCRYPT_PUBLIC_KEY'
+file_env 'ENCRYPT_SECRET_KEY'
+file_env 'ENCRYPT_NONCE'
+file_env 'ENCRYPT_SECRET_BOX_KEY'

 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'

 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
@@ -33,12 +50,12 @@ DEBUG=${DEBUG:-0}
 DEBUG_SQL=${DEBUG_SQL:-0}

 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
    exit 1
 fi

 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
    exit 1
 fi

--- a/5.0/fpm/Dockerfile
+++ b/5.0/fpm/Dockerfile
@@ -3,10 +3,24 @@ LABEL maintainer="markus@martialblog.de"

 # Install OS dependencies
 RUN set -ex; \
-        apt-get update && \
-        DEBIAN_FRONTEND=noninteractive \
-        apt-get install --no-install-recommends -y \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
+                netcat-openbsd \
+                libldap-common \
+                libsasl2-modules \
+        ; \
        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*
+
+# Install PHP Plugins and Configure PHP imap plugin
+# hadolint ignore=SC2086
+RUN set -ex; \
+        \
+        savedAptMark="$(apt-mark showmanual)"; \
+        \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
                libldap2-dev \
                libfreetype6-dev \
                libjpeg-dev \
@@ -19,20 +33,13 @@ RUN set -ex; \
                libzip-dev \
                libtidy-dev \
                libsodium-dev \
-        netcat \
+        ; \
        \
-        && apt-get -y autoclean; apt-get -y autoremove; \
-        rm -rf /var/lib/apt/lists/*
-
-# Link LDAP library for PHP ldap extension
-RUN set -ex; \
-        ln -fs /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/
-
-# Install PHP Plugins and Configure PHP imap plugin
-RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
-        docker-php-ext-configure imap --with-kerberos --with-imap-ssl && \
-        docker-php-ext-install -j5 \
+        debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+        docker-php-ext-configure gd --with-freetype --with-jpeg; \
+        docker-php-ext-configure imap --with-kerberos --with-imap-ssl; \
+        docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+        docker-php-ext-install -j "$(nproc)" \
                exif \
                gd \
                imap \
@@ -44,11 +51,26 @@ RUN set -ex; \
                pgsql \
                sodium \
                tidy \
-        zip
+                zip \
+        ; \
+        \
+# Reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+        apt-mark auto '.*' > /dev/null; \
+        apt-mark manual $savedAptMark; \
+        ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+                | awk '/=>/ { print $3 }' \
+                | sort -u \
+                | xargs -r dpkg-query -S \
+                | cut -d: -f1 \
+                | sort -u \
+                | xargs -rt apt-mark manual; \
+        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*

-ARG version="5.6.17+230426"
-ARG sha256_checksum="dd1773d8c4bf03f66bc6e2d137b1c570bf8db02bfd6e85e5d6ce9927df6f277d"
-ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
+ARG version="5.6.40+231005"
+ARG sha256_checksum="b5bbf49d054320efae39adfe396049907047b8fd3daf614b0599d238321ec95d"
+ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/refs/tags/${version}.tar.gz"
 ARG USER=www-data
 ENV LIMESURVEY_VERSION=$version

--- a/5.0/fpm/entrypoint.sh
+++ b/5.0/fpm/entrypoint.sh
@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container

+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}

 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,19 +26,19 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'

-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
-ENCRYPT_NONCE=${ENCRYPT_NONCE:-}
-ENCRYPT_SECRET_BOX_KEY=${ENCRYPT_SECRET_BOX_KEY:-}
+file_env 'ENCRYPT_KEYPAIR'
+file_env 'ENCRYPT_PUBLIC_KEY'
+file_env 'ENCRYPT_SECRET_KEY'
+file_env 'ENCRYPT_NONCE'
+file_env 'ENCRYPT_SECRET_BOX_KEY'

 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'

 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
@@ -33,12 +50,12 @@ DEBUG=${DEBUG:-0}
 DEBUG_SQL=${DEBUG_SQL:-0}

 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
    exit 1
 fi

 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
    exit 1
 fi

--- a/6.0/apache/Dockerfile
+++ b/6.0/apache/Dockerfile
@@ -1,12 +1,26 @@
-FROM docker.io/php:8.1-apache
+FROM docker.io/php:8.0-apache
 LABEL maintainer="markus@martialblog.de"

 # Install OS dependencies
 RUN set -ex; \
-        apt-get update && \
-        DEBIAN_FRONTEND=noninteractive \
-        apt-get install --no-install-recommends -y \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
+                netcat-openbsd \
+                libldap-common \
+                libsasl2-modules \
+        ; \
        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*
+
+# Install PHP Plugins and Configure PHP imap plugin
+# hadolint ignore=SC2086
+RUN set -ex; \
+        \
+        savedAptMark="$(apt-mark showmanual)"; \
+        \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
                libldap2-dev \
                libfreetype6-dev \
                libjpeg-dev \
@@ -19,21 +33,13 @@ RUN set -ex; \
                libzip-dev \
                libtidy-dev \
                libsodium-dev \
-        netcat \
-        curl \
+        ; \
        \
-        && apt-get -y autoclean; apt-get -y autoremove; \
-        rm -rf /var/lib/apt/lists/*
-
-# Link LDAP library for PHP ldap extension
-RUN set -ex; \
-        ln -fs /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/
-
-# Install PHP Plugins and Configure PHP imap plugin
-RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
-        docker-php-ext-configure imap --with-kerberos --with-imap-ssl && \
-        docker-php-ext-install -j5 \
+        debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+        docker-php-ext-configure gd --with-freetype --with-jpeg; \
+        docker-php-ext-configure imap --with-kerberos --with-imap-ssl; \
+        docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+        docker-php-ext-install -j "$(nproc)" \
                exif \
                gd \
                imap \
@@ -45,7 +51,22 @@ RUN set -ex; \
                pgsql \
                sodium \
                tidy \
-        zip
+                zip \
+        ; \
+        \
+# Reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+        apt-mark auto '.*' > /dev/null; \
+        apt-mark manual $savedAptMark; \
+        ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+                | awk '/=>/ { print $3 }' \
+                | sort -u \
+                | xargs -r dpkg-query -S \
+                | cut -d: -f1 \
+                | sort -u \
+                | xargs -rt apt-mark manual; \
+        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*

 # Apache configuration
 RUN a2enmod headers rewrite remoteip; \
@@ -60,9 +81,9 @@ RUN a2enmod headers rewrite remoteip; \
 # Use the default production configuration
 RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"

-ARG version="6.0.4+230427"
-ARG sha256_checksum="05f95ba3d0591402263cc9bf5b9fdb8603f6dba3ece2dbf1be795ad7ba7fa8c2"
-ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
+ARG version="6.2.9+230925"
+ARG sha256_checksum="91e334e0e3076b812ca8cb642577f5bfcb69e4abf1fd3de666b2ab0d90b118e9"
+ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/refs/tags/${version}.tar.gz"
 ARG USER=www-data
 ARG LISTEN_PORT=8080
 ENV LIMESURVEY_VERSION=$version
--- a/6.0/apache/entrypoint.sh
+++ b/6.0/apache/entrypoint.sh
@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container

+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}

 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,19 +26,19 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'

-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
-ENCRYPT_NONCE=${ENCRYPT_NONCE:-}
-ENCRYPT_SECRET_BOX_KEY=${ENCRYPT_SECRET_BOX_KEY:-}
+file_env 'ENCRYPT_KEYPAIR'
+file_env 'ENCRYPT_PUBLIC_KEY'
+file_env 'ENCRYPT_SECRET_KEY'
+file_env 'ENCRYPT_NONCE'
+file_env 'ENCRYPT_SECRET_BOX_KEY'

 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'

 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
@@ -35,12 +52,12 @@ DEBUG_SQL=${DEBUG_SQL:-0}
 LISTEN_PORT=${LISTEN_PORT:-"8080"}

 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
    exit 1
 fi

 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
    exit 1
 fi

--- a/6.0/fpm-alpine/Dockerfile
+++ b/6.0/fpm-alpine/Dockerfile
@@ -1,7 +1,16 @@
-FROM docker.io/php:8.1-fpm-alpine
+FROM docker.io/php:8.0-fpm-alpine
 LABEL maintainer="markus@martialblog.de"

 # Install OS dependencies
+RUN set -ex; \
+        apk add --no-cache \
+        netcat-openbsd \
+        libsasl \
+        libldap \
+        bash
+
+# Install PHP Plugins
+# hadolint ignore=SC2086
 RUN set -ex; \
        apk add --no-cache --virtual .build-deps \
        freetype-dev \
@@ -13,14 +22,12 @@ RUN set -ex; \
        openldap-dev \
        oniguruma-dev \
        imap-dev \
-        postgresql-dev && \
-        apk add --no-cache netcat-openbsd bash
-
-# Install PHP Plugins
-RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
-        docker-php-ext-configure imap --with-imap-ssl && \
-        docker-php-ext-install \
+        postgresql-dev \
+    ; \
+    \
+    docker-php-ext-configure gd --with-freetype --with-jpeg; \
+    docker-php-ext-configure imap --with-imap-ssl; \
+    docker-php-ext-install -j "$(nproc)" \
        exif \
        gd \
        imap \
@@ -32,11 +39,21 @@ RUN set -ex; \
        pgsql \
        sodium \
        tidy \
-        zip
+        zip \
+    ; \
+    \
+    runDeps="$( \
+        scanelf --needed --nobanner --format '%n#p' --recursive /usr/local/lib/php/extensions \
+            | tr ',' '\n' \
+            | sort -u \
+            | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+    )"; \
+    apk add --no-cache --no-network --virtual .limesurvey-phpext-rundeps $runDeps; \
+    apk del --no-cache --no-network .build-deps

-ARG version="6.0.4+230427"
-ARG sha256_checksum="05f95ba3d0591402263cc9bf5b9fdb8603f6dba3ece2dbf1be795ad7ba7fa8c2"
-ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
+ARG version="6.2.9+230925"
+ARG sha256_checksum="91e334e0e3076b812ca8cb642577f5bfcb69e4abf1fd3de666b2ab0d90b118e9"
+ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/refs/tags/${version}.tar.gz"
 ARG USER=www-data
 ENV LIMESURVEY_VERSION=$version

--- a/6.0/fpm-alpine/entrypoint.sh
+++ b/6.0/fpm-alpine/entrypoint.sh
@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container

+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}

 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,19 +26,19 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'

-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
-ENCRYPT_NONCE=${ENCRYPT_NONCE:-}
-ENCRYPT_SECRET_BOX_KEY=${ENCRYPT_SECRET_BOX_KEY:-}
+file_env 'ENCRYPT_KEYPAIR'
+file_env 'ENCRYPT_PUBLIC_KEY'
+file_env 'ENCRYPT_SECRET_KEY'
+file_env 'ENCRYPT_NONCE'
+file_env 'ENCRYPT_SECRET_BOX_KEY'

 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'

 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
@@ -33,12 +50,12 @@ DEBUG=${DEBUG:-0}
 DEBUG_SQL=${DEBUG_SQL:-0}

 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
    exit 1
 fi

 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
    exit 1
 fi

--- a/6.0/fpm/Dockerfile
+++ b/6.0/fpm/Dockerfile
@@ -1,12 +1,26 @@
-FROM docker.io/php:8.1-fpm
+FROM docker.io/php:8.0-fpm
 LABEL maintainer="markus@martialblog.de"

 # Install OS dependencies
 RUN set -ex; \
-        apt-get update && \
-        DEBIAN_FRONTEND=noninteractive \
-        apt-get install --no-install-recommends -y \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
+                netcat-openbsd \
+                libldap-common \
+                libsasl2-modules \
+        ; \
        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*
+
+# Install PHP Plugins and Configure PHP imap plugin
+# hadolint ignore=SC2086
+RUN set -ex; \
+        \
+        savedAptMark="$(apt-mark showmanual)"; \
+        \
+        apt-get update; \
+        apt-get install -y --no-install-recommends \
                libldap2-dev \
                libfreetype6-dev \
                libjpeg-dev \
@@ -19,20 +33,13 @@ RUN set -ex; \
                libzip-dev \
                libtidy-dev \
                libsodium-dev \
-        netcat \
+        ; \
        \
-        && apt-get -y autoclean; apt-get -y autoremove; \
-        rm -rf /var/lib/apt/lists/*
-
-# Link LDAP library for PHP ldap extension
-RUN set -ex; \
-        ln -fs /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/
-
-# Install PHP Plugins and Configure PHP imap plugin
-RUN set -ex; \
-        docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr && \
-        docker-php-ext-configure imap --with-kerberos --with-imap-ssl && \
-        docker-php-ext-install -j5 \
+        debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+        docker-php-ext-configure gd --with-freetype --with-jpeg; \
+        docker-php-ext-configure imap --with-kerberos --with-imap-ssl; \
+        docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+        docker-php-ext-install -j "$(nproc)" \
                exif \
                gd \
                imap \
@@ -44,11 +51,26 @@ RUN set -ex; \
                pgsql \
                sodium \
                tidy \
-        zip
+                zip \
+        ; \
+        \
+# Reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+        apt-mark auto '.*' > /dev/null; \
+        apt-mark manual $savedAptMark; \
+        ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+                | awk '/=>/ { print $3 }' \
+                | sort -u \
+                | xargs -r dpkg-query -S \
+                | cut -d: -f1 \
+                | sort -u \
+                | xargs -rt apt-mark manual; \
+        \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*

-ARG version="6.0.4+230427"
-ARG sha256_checksum="05f95ba3d0591402263cc9bf5b9fdb8603f6dba3ece2dbf1be795ad7ba7fa8c2"
-ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/${version}.tar.gz"
+ARG version="6.2.9+230925"
+ARG sha256_checksum="91e334e0e3076b812ca8cb642577f5bfcb69e4abf1fd3de666b2ab0d90b118e9"
+ARG archive_url="https://github.com/LimeSurvey/LimeSurvey/archive/refs/tags/${version}.tar.gz"
 ARG USER=www-data
 ENV LIMESURVEY_VERSION=$version

--- a/6.0/fpm/entrypoint.sh
+++ b/6.0/fpm/entrypoint.sh
@@ -1,6 +1,23 @@
 #!/bin/bash
 # Entrypoint for Docker Container

+file_env() {
+        local v="$1"
+        local fv="${v}_FILE"
+        local default="${2:-}"
+        if [ "${!v:-}" ] && [ "${!fv:-}" ]; then
+            echo >&2 "$v and $fv are exclusive"
+            exit 1
+        fi
+        local val="$default"
+        if [ "${!v:-}" ]; then
+                val="${!v}"
+        elif [ "${!fv:-}" ]; then
+                val="$(< "${!fv}")"
+        fi
+        export "$v"="$val"
+        unset "$fv"
+}

 DB_TYPE=${DB_TYPE:-'mysql'}
 DB_HOST=${DB_HOST:-'mysql'}
@@ -9,19 +26,19 @@ DB_SOCK=${DB_SOCK:-}
 DB_NAME=${DB_NAME:-'limesurvey'}
 DB_TABLE_PREFIX=${DB_TABLE_PREFIX:-'lime_'}
 DB_USERNAME=${DB_USERNAME:-'limesurvey'}
-DB_PASSWORD=${DB_PASSWORD:-}
 DB_MYSQL_ENGINE=${DB_MYSQL_ENGINE:-'MyISAM'}
+file_env 'DB_PASSWORD'

-ENCRYPT_KEYPAIR=${ENCRYPT_KEYPAIR:-}
-ENCRYPT_PUBLIC_KEY=${ENCRYPT_PUBLIC_KEY:-}
-ENCRYPT_SECRET_KEY=${ENCRYPT_SECRET_KEY:-}
-ENCRYPT_NONCE=${ENCRYPT_NONCE:-}
-ENCRYPT_SECRET_BOX_KEY=${ENCRYPT_SECRET_BOX_KEY:-}
+file_env 'ENCRYPT_KEYPAIR'
+file_env 'ENCRYPT_PUBLIC_KEY'
+file_env 'ENCRYPT_SECRET_KEY'
+file_env 'ENCRYPT_NONCE'
+file_env 'ENCRYPT_SECRET_BOX_KEY'

 ADMIN_USER=${ADMIN_USER:-'admin'}
 ADMIN_NAME=${ADMIN_NAME:-'admin'}
 ADMIN_EMAIL=${ADMIN_EMAIL:-'foobar@example.com'}
-ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+file_env 'ADMIN_PASSWORD'

 BASE_URL=${BASE_URL:-}
 PUBLIC_URL=${PUBLIC_URL:-}
@@ -33,12 +50,12 @@ DEBUG=${DEBUG:-0}
 DEBUG_SQL=${DEBUG_SQL:-0}

 if [ -z "$DB_PASSWORD" ]; then
-    echo >&2 'Error: Missing DB_PASSWORD'
+    echo >&2 'Error: Missing DB_PASSWORD or DB_PASSWORD_FILE'
    exit 1
 fi

 if [ -z "$ADMIN_PASSWORD" ]; then
-    echo >&2 'Error: Missing ADMIN_PASSWORD'
+    echo >&2 'Error: Missing ADMIN_PASSWORD or ADMIN_PASSWORD_FILE'
    exit 1
 fi

--- a/README.md
+++ b/README.md
@@ -115,10 +115,10 @@ If you are running LimeSurvey behind a Reverse Proxy you might need some additio
 | DB_MYSQL_ENGINE | MySQL engine used for survey tables (values: MyISAM, InnoDB, default: MyISAM)       |
 | DB_USERNAME     | Database user                             |
 | DB_PASSWORD     | Database user's password                  |
-| ADMIN_USER      | Initial LimeSurvey Admin User             |
-| ADMIN_NAME      | Initial LimeSurvey Admin Username         |
+| ADMIN_USER      | Initial LimeSurvey Admin Username (for signing into admin panel)             |
+| ADMIN_NAME      | Initial LimeSurvey Admin Name             |
 | ADMIN_EMAIL     | Initial LimeSurvey Admin Email            |
-| ADMIN_PASSWORD  | Initial LimeSurvey Admin Password         |
+| ADMIN_PASSWORD  | Initial LimeSurvey Admin Password (for signing into admin panel)         |
 | PUBLIC_URL      | Public URL for public scripts             |
 | BASE_URL        | Application Base URL                      |
 | URL_FORMAT      | URL Format. path or get                   |
@@ -133,6 +133,18 @@ If you are running LimeSurvey behind a Reverse Proxy you might need some additio
 | ENCRYPT_SECRET_BOX_KEY | Data encryption secret box key (used in 5.0 and higher) |
 | LISTEN_PORT     | Apache: Listen port. Default: 8080        |

+Sensitive information can also be passed `_FILE` to the following environment variables to load the values from the given file path. Example `DB_PASSWORD_FILE=/run/secrets/db_password`.
+
+```
+DB_PASSWORD_FILE
+ADMIN_PASSWORD_FILE
+ENCRYPT_KEYPAIR_FILE
+ENCRYPT_PUBLIC_KEY_FILE
+ENCRYPT_SECRET_KEY_FILE
+ENCRYPT_NONCE_FILE
+ENCRYPT_SECRET_BOX_KEY_FILE
+```
+
 For further details on the settings see: https://manual.limesurvey.org/Optional_settings#Advanced_Path_Settings

 # Running LimeSurvey with docker-compose
@@ -149,6 +161,8 @@ http://localhost:8080/
 http://localhost:8080/index.php/admin
 ```

+Please note / warning: To sign into the admin panel in the examples, the credentials are username: *admin* password: *foobar*, however, if you are planning for any use beyond testing, it is highly recommended that you use environment variables to define a secure username and password.
+
 # Running LimeSurvey with Helm

 A Helm Chart for this Image can be used for deployments. Please refer to the Helm Repository for further details:
--- a/tests/apache-tests.yaml
+++ b/tests/apache-tests.yaml
@@ -51,30 +51,6 @@ commandTests:
    command: "dpkg"
    args: ["-l", "netcat"]
    exitCode: 0
-  - name:  "Dependencies - libldap2-dev"
-    command: "dpkg"
-    args: ["-l", "libldap2-dev"]
-    exitCode: 0
-  - name:  "Dependencies - zlib1g-dev"
-    command: "dpkg"
-    args: ["-l", "zlib1g-dev"]
-    exitCode: 0
-  - name:  "Dependencies - libc-client-dev"
-    command: "dpkg"
-    args: ["-l", "libc-client-dev"]
-    exitCode: 0
-  - name:  "Dependencies - libkrb5-dev"
-    command: "dpkg"
-    args: ["-l", "libkrb5-dev"]
-    exitCode: 0
-  - name:  "Dependencies - libpng-dev"
-    command: "dpkg"
-    args: ["-l", "libpng-dev"]
-    exitCode: 0
-  - name:  "Dependencies - libpq-dev"
-    command: "dpkg"
-    args: ["-l", "libpq-dev"]
-    exitCode: 0
  - name:  "Dependencies - PHP Modules"
    command: "php"
    args: ["-m"]
Author	SHA1	Message	Date
Markus Opolka	98aa523b48	Upgrading to LTS Version 5.6.40+231005	2023-10-16 18:04:13 +02:00
Markus Opolka	5b13fa3dd0	Upgrading to Version 6.2.9+230925	2023-10-05 08:38:44 +02:00
Markus Opolka	554a86cf2c	Upgrading to LTS Version 5.6.39+230926	2023-10-05 08:37:58 +02:00
Markus Opolka	97aa52b49e	Merge pull request #169 from martialblog/renovate/actions-checkout-digest Update actions/checkout digest to 8ade135	2023-10-01 11:15:26 +02:00
Markus Opolka	ee74cfbd89	Upgrading to Version 6.2.8+230921	2023-09-26 07:51:17 +02:00
Markus Opolka	38ea5d09ff	Upgrading to LTS Version 5.6.38+230919	2023-09-26 07:50:57 +02:00
Markus Opolka	2ef585ab53	Upgrading to Version 6.2.7+230918	2023-09-23 09:32:02 +02:00
renovate[bot]	195e017967	Update actions/checkout digest to 8ade135	2023-09-22 19:05:09 +00:00
Markus Opolka	d53b6ed63d	Upgrading to Version 6.2.6+230904	2023-09-18 17:43:32 +02:00
Markus Opolka	c40d1b648d	Upgrading to LTS Version 5.6.37+230905	2023-09-18 17:06:51 +02:00
Markus Opolka	bd14d877e5	Merge pull request #164 from martialblog/renovate/docker-build-push-action-5.x Update docker/build-push-action action to v5	2023-09-12 19:52:00 +02:00
Markus Opolka	5c95e13179	Merge pull request #168 from martialblog/renovate/docker-setup-qemu-action-3.x Update docker/setup-qemu-action action to v3	2023-09-12 19:51:39 +02:00
Markus Opolka	0e35341b7c	Merge pull request #166 from martialblog/renovate/docker-metadata-action-5.x Update docker/metadata-action action to v5	2023-09-12 16:59:23 +02:00
renovate[bot]	469ca15cb5	Update docker/setup-qemu-action action to v3	2023-09-12 14:59:17 +00:00
Markus Opolka	4f8ea7c4f1	Merge pull request #167 from martialblog/renovate/docker-setup-buildx-action-3.x Update docker/setup-buildx-action action to v3	2023-09-12 16:58:51 +02:00
renovate[bot]	9c19d78e26	Update docker/setup-buildx-action action to v3	2023-09-12 13:50:46 +00:00
renovate[bot]	30cd0c51cc	Update docker/metadata-action action to v5	2023-09-12 13:50:40 +00:00
Markus Opolka	538f9837df	Merge pull request #165 from martialblog/renovate/docker-login-action-3.x Update docker/login-action action to v3	2023-09-12 15:50:14 +02:00
renovate[bot]	8de96875af	Update docker/login-action action to v3	2023-09-12 11:28:46 +00:00
renovate[bot]	adbecadb0e	Update docker/build-push-action action to v5	2023-09-12 11:28:42 +00:00
Markus Opolka	d6270a9cad	Merge pull request #163 from MarkErik/patch-2 doc/credentials	2023-09-06 16:26:06 +02:00
Mark	265b375fc1	Update README.md Added paragraph listing the credentials used in example docker-compose files, with warning to change if use for anything beyond testing. Edited Description for ADMIN_USER and ADMIN_NAME to clarify which parameters are used for signing into the admin panel. (Previously ADMIN_NAME's description included the word username, which is confusing as it is not the username used to sign into the admin panel)	2023-09-06 09:57:44 -04:00
Mark	9135f556f5	Update README.md Fixing previous commit due to forgetting how to format and use Markdown!	2023-09-05 13:28:06 -04:00
Mark	8ec394c7af	Update README.md Save some time for people who want to test out LimeSurvey using the sample docker-compose files so that they don't need to go poking around the different files to find the example credentials used.	2023-09-05 13:15:06 -04:00
Markus Opolka	acfd7b529d	Merge pull request #160 from martialblog/renovate/actions-checkout-4.x Update actions/checkout action to v4	2023-09-05 09:36:55 +02:00
Markus Opolka	537c1e5313	Merge pull request #162 from martialblog/fix/urls Update Download URLs	2023-09-05 09:36:44 +02:00
Markus Opolka	1c108c70df	Fix URLs for Latest version	2023-09-05 09:23:38 +02:00
Markus Opolka	42e521a759	Fix URLs for LTS version	2023-09-05 09:11:46 +02:00
renovate[bot]	432b17d255	Update actions/checkout action to v4	2023-09-04 12:29:50 +00:00
Markus Opolka	215d95e43c	Upgrading to Version 6.2.5+230828	2023-09-04 14:18:36 +02:00
Markus Opolka	03804c3b28	Upgrading to LTS Version 5.6.36+230830	2023-09-04 14:09:07 +02:00
Markus Opolka	0639806b11	Upgrading to Version 6.2.4+230825	2023-08-29 10:08:47 +02:00
Markus Opolka	5ad9f7debc	Upgrading to LTS Version 5.6.35+230822	2023-08-29 10:08:22 +02:00
Markus Opolka	fb42a5ab24	Upgrading to Version 6.2.3+230821	2023-08-25 07:59:37 +02:00
Markus Opolka	7f0ad78dff	Upgrading to Version 6.2.2+230814	2023-08-22 08:36:30 +02:00
Markus Opolka	46ce93f6a1	Upgrading to LTS Version 5.6.34+230816	2023-08-22 08:35:38 +02:00
Markus Opolka	888b04c584	Upgrading to Version 6.2.1+230807	2023-08-15 09:01:10 +02:00
Markus Opolka	340d96e0cd	Upgrading to LTS Version 5.6.33+230808	2023-08-15 09:00:38 +02:00
Markus Opolka	7289e1b639	Upgrading to Version 6.2.0+230732	2023-08-08 10:26:03 +02:00
Markus Opolka	352fe09010	Upgrading to LTS Version 5.6.32+230731	2023-08-08 10:25:33 +02:00
Markus Opolka	1bcf07c1c3	Upgrading to Version 6.1.8+230717	2023-08-01 09:21:35 +02:00
Markus Opolka	8b7d3f1beb	Upgrading to LTS Version 5.6.31+230718	2023-08-01 09:21:09 +02:00
Markus Opolka	dfa75801ca	Upgrading to Version 6.1.7+230710	2023-07-21 05:43:37 +02:00
Markus Opolka	29f016d75d	Upgrading to LTS Version 5.6.30+230711	2023-07-21 05:43:12 +02:00
Markus Opolka	b476026121	Upgrading to Version 6.1.6+230703	2023-07-11 08:33:47 +02:00
Markus Opolka	200585ed62	Upgrading to LTS Version 5.6.29+230704	2023-07-11 08:31:17 +02:00
Markus Opolka	b281762fd1	Merge pull request #156 from martialblog/feature/file-env Add support for secrets in files	2023-07-11 08:29:36 +02:00
Markus Opolka	ecb0c6b188	Merge pull request #158 from martialblog/feature/ldapslibs Add OS libraries for ldaps	2023-07-11 08:29:11 +02:00
Markus Opolka	6b109ed5bb	Add OS libraries for ldaps	2023-07-09 12:09:45 +02:00
Markus Opolka	eca133264d	Upgrading to Version 6.1.5+230626	2023-07-04 08:56:03 +02:00
Markus Opolka	98f042dea9	Upgrading to LTS Version 5.6.28+230627	2023-07-04 08:55:36 +02:00
Markus Opolka	749137e69c	Add support for secrets in files	2023-06-28 17:11:56 +02:00
Markus Opolka	56238f9aa7	Upgrading to Version 6.1.4+230620	2023-06-28 16:41:31 +02:00
Markus Opolka	0cda131e2c	Upgrading to LTS Version 5.6.27+230621	2023-06-28 16:41:00 +02:00
Markus Opolka	9ad9054c3a	Merge pull request #155 from martialblog/fix/nc-pkg-name Fix netcat package name	2023-06-28 16:40:04 +02:00
Markus Opolka	b0eabe4f28	Downgrade to PHP 8.0 - There were issues with PHP extensions not being installed	2023-06-28 16:38:45 +02:00
Markus Opolka	dfefb689e8	Fix netcat package name	2023-06-28 16:38:43 +02:00
Markus Opolka	1ab5496e40	Upgrading to LTS Version 5.6.26+230613	2023-06-22 08:28:45 +02:00
Markus Opolka	ab67bbc8c6	Upgrading to Version 6.1.2+230606	2023-06-13 12:23:46 +02:00
Markus Opolka	9ea27fd9fe	Upgrading to LTS Version 5.6.25+230605	2023-06-13 12:23:18 +02:00
Markus Opolka	4be9f37601	Upgrading to Version 6.1.1+230530	2023-06-09 13:35:14 +02:00
Markus Opolka	45f5178e3b	Upgrading to LTS Version 5.6.24+230531	2023-06-09 13:34:41 +02:00
Markus Opolka	f772b7a05f	Upgrading to Version 3.28.59+230517	2023-06-09 13:34:16 +02:00
Markus Opolka	5c8cd4570a	Update structure tests	2023-06-09 13:27:50 +02:00
Markus Opolka	66f433e1d0	Fix linting issues	2023-06-09 13:18:56 +02:00
J0WI	52ee67675a	Drop build dependencies from Debian variant (#153 )	2023-06-09 13:14:20 +02:00
Markus Opolka	6d3bc51ebc	Fix linting issues in alpine Dockerfiles	2023-06-09 12:19:04 +02:00
J0WI	0c28e5bbf9	Drop build dependencies from Alpine variant (#152 )	2023-06-09 12:03:35 +02:00
Markus Opolka	23e6fa6f88	Upgrading to Version 6.0.7+230515	2023-05-24 08:45:36 +02:00
Markus Opolka	4e30695b0b	Upgrading to LTS Version 5.6.21+230518	2023-05-24 08:44:50 +02:00
Markus Opolka	f290fc7f1c	Upgrading to Version 6.0.6+230508	2023-05-19 09:03:27 +02:00
Markus Opolka	20c1fafdf6	Upgrading to LTS Version 5.6.20+230516	2023-05-19 09:03:02 +02:00
Markus Opolka	281cc199aa	Upgrading to Version 6.0.5+230502	2023-05-09 08:36:05 +02:00
Markus Opolka	d15b0a2693	Upgrading to LTS Version 5.6.18+230503	2023-05-09 08:35:37 +02:00