Для 7.4 такой dockerfile получился:
FROM php:7.4.33-fpm-buster
ARG USER_NAME
ARG USER_ID
ARG GROUP_ID
ARG INSTALL_XDEBUG
ARG PHP_INI_CONF_FILES
ARG PHP_FPM_CONF_FILES
ARG PHP_INI_CONF_PATH=/usr/local/etc/php
ARG PHP_FPM_CONF_PATH=/usr/local/etc/php-fpm.d
ARG PHP_PATCH_REPO=https://github.com/php/php-src.git
ARG PHP_PATCH_BRANCH=PHP-7.4-CVE-2026-109618-109619
ARG PHP_PATCH_COMMIT=712e60f9edfd03f0960fc4fc3c2c375f42b90aa2
ENV DEBIAN_FRONTEND=noninteractive
WORKDIR /usr/share/nginx/html
COPY --from=mlocati/php-extension-installer:2.12.3 /usr/bin/install-php-extensions /usr/bin/
COPY --from=composer:2.10.3 /usr/bin/composer /usr/bin/composer
COPY ./apt/sources.list /etc/apt/sources.list
COPY ./conf.d /tmp/conf.d
COPY ./php-fpm.d /tmp/php-fpm.d
RUN set -eux; \
apt-get update; \
apt-get install -y --no-install-recommends \
$PHPIZE_DEPS bison git ca-certificates \
libargon2-dev libcurl4-openssl-dev libedit-dev libonig-dev libreadline-dev \
libsodium-dev libsqlite3-dev libssl-dev libxml2-dev zlib1g-dev; \
git clone --depth 1 --branch "$PHP_PATCH_BRANCH" "$PHP_PATCH_REPO" /usr/src/php-patched; \
cd /usr/src/php-patched; \
PATCH_HEAD="$(git rev-parse HEAD)"; \
echo "Patched PHP: branch $PHP_PATCH_BRANCH at commit $PATCH_HEAD"; \
if [ -n "$PHP_PATCH_COMMIT" ] && [ "$PHP_PATCH_COMMIT" != "$PATCH_HEAD" ]; then \
echo "Commit mismatch: expected $PHP_PATCH_COMMIT, got $PATCH_HEAD" >&2; \
exit 1; \
fi; \
./buildconf --force; \
tar --exclude=.git -cJf /usr/src/php.tar.xz -C /usr/src php-patched; \
CONFIGURE_CMD="$(php -i | sed -n 's/^Configure Command => //p')"; \
test -n "$CONFIGURE_CMD"; \
echo "Reusing configure command: $CONFIGURE_CMD"; \
export CFLAGS="$PHP_CFLAGS" CPPFLAGS="$PHP_CPPFLAGS" LDFLAGS="$PHP_LDFLAGS"; \
eval "$CONFIGURE_CMD"; \
make -j"$(nproc)"; \
make install-modules install-binaries install-build install-headers install-programs; \
make clean; \
… Читать полностью →
🤔1