sclorg / s2i-php-container Goto Github PK

What if the index.php is nested, eg: /opt/openshift/src/public/index.php then the Apache can't serve it cause its expecting the index.php in the /opt/openshift/src dir due to the https://github.com/openshift/sti-php/blob/master/5.5/contrib/httpdconf.sed#L4

We need to come with a way how to specify the DocumentRoot, something like a context-dir ...

Hello

It would be good if we can set the xdebug.max_nesting_level value as an environment variable.

From sclorg/s2i-perl-container#73 (comment)

Instead of sending stderr to a file, send it do stderr like we do in other images.

Code: 5.5/contrib/etc/httpdconf.sed#L7

See the patch applied to Perl, it was very good, including tests.

I need php 7.0 for deploying an Application. How can i do that?
If there is a documentation to create a docker PHP i will be happy to create a PR here.

Njjjj

I think this problem existed in v2 as well. The environment variables has to be listed in the appropriate config in Apache, otherwise PHP won't be able to see them.

One guy reported this today at the roadshow in Prague. I haven't tried to reproduce it, but it seems like the composer is not working properly when the timezone in container is not set.

I'd like to discuss installing composer in the Dockerfiles instead of in the assemble scripts.

The reasons:

1. Less time spent during builds.
2. Builds do not rely on getcomposer.org being available (or maybe still do if downloading any depedencies...).
3. Have a fixed "version" of composer that will/can be tested together with the image, as opposed to getting a potentially different version with every build using the builder image.

The Zend Opcache memory consumption default of 16MB is too low in a PHP7 environment with interned string buffer set to 8MB (currently non-configurable in 10-opcache.ini).

This issue is described in https://bugs.php.net/bug.php?id=72720

Why was 16MB chosen as the default for this container? The default set in PHP documentation for Opcache is 64MB and the scl-php70 package sets this at 128MB. Should the s2i-php container use this same default or another value? Small applications will happily run in 32MB allocated whereas Wordpress and Drupal will prefer 64 or 128.

Prior to #151, OpCache was allocated 128MB due to the run script not setting the container template correctly. Perhaps this value should be used as the default for the container to ensure BC.

When starting a container made with 7.1 container as base startup fails on errors on MPM-config

Reading script following script fails because files under /opt/app-root/etc/conf.d are owned by root and others have only read permissions
s2i-php-container/7.1/root/usr/share/container-scripts/php/pre-start/20-copy-config.sh

It seems that s2i-php-container/7.1/root/usr/share/container-scripts/php/post-assemble/20-copy-config.sh is run as root and pre-start version as non-root user and after post-assemble files have not been processed correctly.

Error message on startup:

-> Cgroups memory limit is set, using HTTPD_MAX_REQUEST_WORKERS=68
=> sourcing 20-copy-config.sh ...
---> 09:20:11     Processing additional arbitrary httpd configuration provided by s2i ...
=> sourcing 00-documentroot.conf ...
/usr/share/container-scripts/php//common.sh: line 97: /opt/app-root/etc/conf.d/00-documentroot.conf: Permission denied
=> sourcing 50-mpm-tuning.conf ...
/usr/share/container-scripts/php//common.sh: line 97: /opt/app-root/etc/conf.d/50-mpm-tuning.conf: Permission denied
=> sourcing 40-ssl-certs.sh ...
AH00526: Syntax error on line 3 of /opt/app-root/etc/conf.d/50-mpm-tuning.conf:
StartServers takes one argument, Number of child processes launched at server startup

Listing of /opt/app-root/etc/conf.d from extended php-post-assemble script

ls -lah /opt/app-root/etc/conf.d
total 8.0K
drwxrwxrwx. 2 default root  60 Mar 15 11:31 .
drwxrwxrwx. 4 default root  75 Jan 22 12:55 ..
-rw-r--r--. 1 default root  33 Mar 15 11:31 00-documentroot.conf
-rw-r--r--. 1 default root 478 Mar 15 11:31 50-mpm-tuning.conf

I was wondering if the parameter

--no-scripts

in the assemble script can be removed? Since symfony 2 projects run scripts during composer install eg.

• clearing Cache
• build Bootstrap
• install assets of all bundles to the public web directory
• create app/config/parameters.yml

...
"scripts": {
        "post-install-cmd": [
            "Incenteev\\ParameterHandler\\ScriptHandler::buildParameters",
            "Sensio\\Bundle\\DistributionBundle\\Composer\\ScriptHandler::buildBootstrap",
            "Sensio\\Bundle\\DistributionBundle\\Composer\\ScriptHandler::clearCache",
            "Sensio\\Bundle\\DistributionBundle\\Composer\\ScriptHandler::installAssets",
            "Sensio\\Bundle\\DistributionBundle\\Composer\\ScriptHandler::installRequirementsFile",
            "Sensio\\Bundle\\DistributionBundle\\Composer\\ScriptHandler::prepareDeploymentTarget"
        ],
        "post-update-cmd": [
            "Incenteev\\ParameterHandler\\ScriptHandler::buildParameters",
            "Sensio\\Bundle\\DistributionBundle\\Composer\\ScriptHandler::buildBootstrap",
            "Sensio\\Bundle\\DistributionBundle\\Composer\\ScriptHandler::clearCache",
            "Sensio\\Bundle\\DistributionBundle\\Composer\\ScriptHandler::installAssets",
            "Sensio\\Bundle\\DistributionBundle\\Composer\\ScriptHandler::installRequirementsFile",
            "Sensio\\Bundle\\DistributionBundle\\Composer\\ScriptHandler::prepareDeploymentTarget"
        ]
    },
...

As an alternative solution I would suggest to make an sti-php-symfony image, which is based on either php-55-centos7 or php-56-centos7

It would be desirable if we could have the DocumentRoot configurable as an environment variable, ie. our repository is configured to have composer.json in the root directory, but a different directory stores the public content (ie. /web or /public)

Hi, when lunch my application return this error:

"Class 'MongoClient' not found in /opt/app-root/src"

So i changed to 'MongoDB\Driver\Manager' but the result is the same:

"Class 'MongoDB\Driver\Manager' not found"

There are modules:
sh-4.2$ cd /opt/rh/rh-php70/root/usr/lib64/php/modules
sh-4.2$ ls
bcmath.so gd.so mysqlnd.so shmop.so wddx.so
bz2.so gettext.so opcache.so simplexml.so xml.so
calendar.so gmp.so pdo.so soap.so xmlreader.so
ctype.so iconv.so pdo_mysql.so sockets.so xmlwriter.so
curl.so intl.so pdo_pgsql.so sqlite3.so xsl.so
dom.so json.so pdo_sqlite.so sysvmsg.so zip.so
exif.so ldap.so pgsql.so sysvsem.so
fileinfo.so mbstring.so phar.so sysvshm.so
ftp.so mysqli.so posix.so tokenizer.so

why mongodb.so is not installed on server? what is the correct way?

Thanks

With CakePHP 3.2.x out there, maybe one day we can revisit and update this example to use that, and a compose.json file, etc.

Are there plans to implement the save-artifacts into the other containers so we can speed up build times?

Hello

This repo description says:

intended for OpenShift and general usage

However the readme only gives examples of using directly with s2i and docker, which are standalone applications from OpenShift.

Also, the link to the OpenShift on the readme (https://docs.openshift.org/latest/using_images/s2i_images/php.html) also does not give instructions on how to use these with OpenShift, but instead with docker.

I\m interested in how I can use a template in OpenShift, which accepts a git url (containing php and/or composer.json) and create a php application image - from within OpenShift.

Any guidance on this is appreciated.

It seems strange to be including xdebug for prod containers, it'd be ideal if we could add an option to disable this by ENV variable (or not include it at all?)

Hello, i realized that images builded by sti has a considerable size, looking for a answer i've found the source pulled from a git repository is located twice on the output image, once at /opt/app-root/src and /tmp/src.

Am i missing something or we can add rm -rf /tmp/src at the bottom of assemble script?

With OpenShift v2, there was an easy way to install PEAR dependency in PHP cartridge, by editing .openshift/pear.txt.

Is there something similar with this s2i container? I see that PEAR is mentioned in include path (/opt/rh/rh-php70/root/usr/share/pear), but I am not sure how to install a dependency there.

I pulled the latest centos/php-71-centos7 and found my apps start showing permission denied errors on /tmp/session/:

Warning: session_start(): open(/tmp/sessions/sess_eb242dea5a72c0892fa8758d86836ec0, O_RDWR) failed: Permission denied (13)

I looked that code and found that seems caused by a recent change which introduced the /usr/libexec/container-setup script. In this script /tmp/sessions owner is set to 1000:0. It used to be 1001:0.

Sorry that I am not familiar with steps to contribute code change. Could anyone help fixing the issue?

💠 Adding a test case to the existing app didn't seen like the most fun and useful thing to do right now, so I'm opening this issue as a remainder to myself later or kind request for help if someone else wants to contribute sample unit tests.

This patch adds a build hook to run tests as part of the build flow in OpenShift:

diff --git a/openshift/templates/cakephp-mysql.json b/openshift/templates/cakephp-mysql.json
index 52143da..c1140b0 100644
--- a/openshift/templates/cakephp-mysql.json
+++ b/openshift/templates/cakephp-mysql.json
@@ -106,7 +106,10 @@
               "secret": "${GITHUB_WEBHOOK_SECRET}"
             }
           }
-        ]
+        ],
+        "postCommit": {
+          "script": "./Console/cake test"
+        }
       }
     },
     {
diff --git a/openshift/templates/cakephp.json b/openshift/templates/cakephp.json
index b77dc0c..dae89ff 100644
--- a/openshift/templates/cakephp.json
+++ b/openshift/templates/cakephp.json
@@ -31,7 +31,7 @@
           }
         ],
         "selector": {
-          "name": "cakephp-example" 
+          "name": "cakephp-example"
         }
       }
     },
@@ -106,7 +106,10 @@
               "secret": "${GITHUB_WEBHOOK_SECRET}"
             }
           }
-        ]
+        ],
+        "postCommit": {
+          "script": "./Console/cake test"
+        }
       }
     },
     {

Note: ./Console/cake test might need extra arguments. See http://book.cakephp.org/2.0/en/development/testing.html (since apparently we're using 2.x as of now).

hi, i have this structure in my git repository

• example (folder)
• public (folder)
• composer.json (file)

it's possible to set public folder as public web root?

There are some inconsistencies between versions involving these two packages:

memcache (not in PHP 7.0)
xdebug (not in PHP 5.5 or 7.0)

Memcache is one of two memcached clients available in PHP. The more common package is "memcached" rather than "memcache" because the memcached library has more functionality as it was written to replace "memcache".

Xdebug is mostly used for development purposes or profiling in non-production use. It is not a good practice to have it enabled by default, especially for a server that can be used as both.

Xdebug should probably just be removed for now due to the nature of it (also with it only being in PHP 5.6) and memcached should be made available in PHP 7. Long term, it would be nice to see enabling/disabling modules on an as-needed basis since the root account is stripped and you cannot install them with this image without modifying it directly.

Hello,

at https://github.com/sclorg/s2i-php-container/blob/master/7.1/README.md is explained, how to extend the image with a Script that get started before httpd starts.

I add a skript in the httpd-pre-init subfolder directly at the git source root folder.
And there I placed a example.sh script.

I expected, that this script get started with the resulting container. But it wont be started.
The script exists inside the container:

bash# oc rsh containername
sh-4.2$ pwd
/opt/app-root/src
sh-4.2$ ls -al ./httpd-pre-init
total 12
drwxrwxr-x.  2 default root   46 May 24 10:26 .
drwxrwxr-x. 16 default root 4096 May 24 11:15 ..
-rw-rw-r--.  1 default root  509 May 24 10:26 example.sh
sh-4.2$

It seams, that the "run-httpd" script from the sclorg apache 2.4 container will not used/not exist:

sh-4.2$ find / -name "run-httpd" 2>/dev/null
sh-4.2$ find / -name "pre-init" 2>/dev/null
/usr/share/container-scripts/php/pre-init
sh-4.2$ ls -al /usr/share/container-scripts/php/pre-init
total 0
drwxr-xr-x. 2 root root  6 May  9 12:08 .
drwxr-xr-x. 6 root root 94 May  9 12:08 ..
sh-4.2$

Maybe some for pre-start or is missing here to use function process_extending_files() from common.sh
https://github.com/sclorg/s2i-php-container/tree/master/7.0/root/usr/share/container-scripts/php

What is necessary, that this script get started once inside the container?

Many Thanks advance

The installation of the mcrypt module per default or a documentation for it would be welcome.

In the file /opt/rh/httpd24/root/etc/httpd/conf.d/php55-php.conf the default session path will be set.
This directory is not writable when running a container on ose3 environment in non priviledged mode.

For a fix see pull request #49 #50

i got this error, when build image:
Found 'composer.json', installing dependencies using composer.phar... Downloading https://getcomposer.org/installer, attempt 1/6 % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- 0:00:04 --:--:-- 0curl: (6) Could not resolve host: getcomposer.org; Unknown error

There is a slight problem with s2i-php when using it behind a proxy with no direct access to the internet.

Namely: https://github.com/openshift/s2i-php/blob/master/5.6/s2i/bin/assemble#L12

This part specfically (as I understand it) does not honor proxy settings such as http_proxy or HTTP_proxy or its equivalents for different protocols.

I would ask to simply change it to curl instead to fetch that file since that will follow proxy settings properly.

(The whole discussion about fetching files blindly from the internet is another discussion).

Using LoadModule ssl_module modules/mod_ssl.so causes AH02951: mod_ssl does not seem to be enabled despite mod_ssl supposedly being installed in https://github.com/sclorg/s2i-php-container/blob/master/7.0/Dockerfile.rhel7#L52

Some applications rely on composer plugins to properly install their dependencies. For example, some applications delegates to composer the installations of npm and bower packages. Composer uses the plugin fxpio/composer-asset-plugin for this kind of 3rd party deps management. The issue is fxpio/composer-asset-plugin only can be installed/enable globally. So the image should install install using the command:

composer global require "fxp/composer-asset-plugin:~1.3"

[PHP 5.6]
When a php script tries to call mail() function it gets "/usr/sbin/sendmail: File not found" error.
Is it possible to install sendmail ? How ?

Hello, i couldn't find zip extension on image nor in scl testing repo, is there any way to add it?

We have been receiving increased reports for performance issues with the 5.6 image.

5.6 has issues with slow response times which often leads to gateway timeouts etc.

Downgrading/upgrading to 5.5/7.0 resolve the problem.

Docker image for CentOS7 and php5.6 produce the following erorr to the /tmp/error_log:

Failed loading /opt/rh/php54/root/usr/lib64/php/modules/opcache.so:  /opt/rh/php54/root/usr/lib64/php/modules/opcache.so: cannot open shared object file: No such file or directory

And indeed:

$ docker exec 895ce6156408 ls -l /opt/rh/php54/root/usr/lib64/php/modules/opcache.so
ls: cannot access /opt/rh/php54/root/usr/lib64/php/modules/opcache.so: No such file or directory

Because it's in another directory:

$ docker exec 895ce6156408 ls -l /opt/rh/rh-php56/root/usr/lib64/php/modules/opcache.so
-rwxr-xr-x. 1 root root 154456 Jun 29 08:26 /opt/rh/rh-php56/root/usr/lib64/php/modules/opcache.so

I believe that it should be fixed in the following files:

$ git grep php54
5.6/contrib/etc/php.d/10-opcache.ini.template:zend_extension=/opt/rh/php54/root/usr/lib64/php/modules/opcache.so
5.6/contrib/etc/php.d/10-opcache.ini.template:opcache.blacklist_filename=/opt/rh/php54/root/etc/php.d/opcache*.blacklist

Steps to reproduce:

1. $ make build VERSION=5.6 TARGET=centos7
2. s2i build https://github.com/openshift/sti-php.git --context-dir=5.6/test/test-app openshift/php-56-centos7 php-test-app
3. docker run -d -p 8080:8080 php-test-app
4. docker exec $(docker ps | grep php-test-app | awk '{print $1}') cat /tmp/error_log

(Found during my work on BZ#1231862)

When trying to include custom directory within a source which include the custom .ini file, users have to set the PHP_INI_SCAN_DIR=/opt/app-root/src/php:/etc/opt/rh/rh-php56/php.d

This is supported by PHP and works, problem is this line in the run script: https://github.com/openshift/s2i-php/blob/master/5.6/s2i/bin/run#L22

this will explode and opcache will not be saved... however the httpd will run ;-)

I have a patch that add's newrelic agent and ability to config via env vars, would it be acceptable ?

If I run

 s2i --incremental=true build https://github.com/simbo1905/hello-composer.git centos/php-71-centos7 hello-composer

multiple times in a row I see:

ERROR: Error reading next tar header: archive/tar: invalid tar header
ERROR: Error extracting tar stream
WARNING: Clean build will be performed because of error saving previous build artifacts

Whereas we would expect the .s2i/save-artifacts to have backed up the vendor folder.

I am using:

Docker version 17.12.0-ce, build c97c6d6
s2i v1.1.8

Hello,

the readme.md is updated well and I tried to place some testscripts in my source code under ./php-pre-init or ./php-post-assemble.

Unfortunately will this scripts will ignored. After Build and after deplyoment I do not see a result inside the running pod:

bash:$ oc -n infra rsh phpmyadmin-26-ae442
sh-4.2$ pwd
/opt/app-root/src
sh-4.2$ cat php-pre-start/modifyindex.sh
echo 'This content was replaced by pre-init script.' > ${HTTPD_APP_ROOT}/src/index.html
sh-4.2$  find / -name "index.html" 2>/dev/null
/opt/rh/httpd24/root/usr/share/httpd/noindex/index.html
(expected file not found - this means, the script was never run)
sh-4.2$ ls php-post-assemble/
test.sh
sh-4.2$ cat  php-post-assemble/test.sh
echo 'This content was replaced by php-post-assamble script.' > ${HTTPD_APP_ROOT}/src/index2.html
echo 'This content was replaced by php-post-assamble script2' > /tmp/index2.html
sh-4.2$  find / -name "index2.html" 2>/dev/null
(nothing found - this means, the script was never run)
sh-4.2$ 

I do not found a Script, that copies the Skripts from php-pre-init or php-post-assemble.
Maybe it is some missing in s2i-php-container like:
s2i-php-container/7.1/root/usr/share/container-scripts/php/pre-start/20-copy-config.sh
for example:
s2i-php-container/7.1/root/usr/share/container-scripts/php/pre-start/60-copy-init-scripts.sh

with content like

# additional arbitrary httpd pre init scripts provided by user using s2i

log_info 'Processing additional arbitrary httpd pre init scripts provided by s2i ...'

process_extending_config_files ${APP_DATA}/php-pre-init/ ??????

(I do not know, how the pre-init scirpts get started inside the builted image.)

How can I inject a .sh script from my source code repository into the resulting image, that runs once during a pod starts and the pod get ready?

Many Thanks in Advance!

When reading the docs, it states that you can create a httpd-pre-init folder which can contain bash scripts. Does this mean that these scripts will get executed before the httpd process is started in openshift or is this only meant for the s2i build process? If the latter is true, how do I execute some commands before starting this docker image?

I use a Laravel based php app and I need to execute "php artisan migrate" before starting httpd. How would I implement this?

Hi everyone,

Not sure this is the best place to ask the question but the version of PHP 5.5 used seems rather old :

sh-4.2$ php --version                                                           
PHP 5.5.21 (cli) (built: Oct  5 2015 21:26:44)                                  
Copyright (c) 1997-2014 The PHP Group                                           
Zend Engine v2.5.0, Copyright (c) 1998-2014 Zend Technologies                   
    with Zend OPcache v7.0.4-dev, Copyright (c) 1999-2014, by Zend Technologies

There have been several releases that fix security problems : http://php.net/ChangeLog-5.php
Can someone may share the update policy ?

Thanks

While investigating #149 I found that the S2I run script writes our the 10-opcache.ini file to /etc/opt/rh/rh-php70/ directory instead of the scanned /etc/opt/rh/rh-php70/php.d directory

envsubst < /opt/app-root/etc/php.d/10-opcache.ini.template > /etc/opt/rh/rh-php70/10-opcache.ini

php -i shows that we don't load the file from the rh-php70 directory

Loaded Configuration File => /etc/opt/rh/rh-php70/php.ini
Scan this dir for additional .ini files => /etc/opt/rh/rh-php70/php.d
Additional .ini files parsed => /etc/opt/rh/rh-php70/php.d/10-opcache.ini,

Hi,

I would like to add a feature to use the composer from epel instead of using it from assemble. Is that a better way of doing so? I am I allowed to send in a proposal/merge?

The dockerhub image centos/php-56-centos7:latest doesn't seem to have the correct permissions set:

ls cannot open directory /opt/rh/httpd24/root/var/run/httpd/: Permission denied

openshift/php-55-centos7 does not have this issue

I am using OpenShift 1.5.1.alpha. I have a Drupal site installed in the server, integrates on a git repo. Everytime it creates a build on the server, site is redirected to its installation process.

I have noticed two things.

1. When I create dummy files and commit it to the repo, the files are permanently created on the server after the reinstallation.

2. When I create changes, install package from the server inside the Drupal root directory, everything is gone after it rebuilds/reinstall the site.

Also, the site installed is broken. I can only access the user and homepage with a no-theme-page. Looking on the browser console, I see that during the installation, site is not generating the CSS folder and needed files on it. All other pages or links is unaccessible. I check the permission of sites/ folder and changes everything to 777, I get no difference.

Thanks in advance!

-John Rey

Until/If openshift/origin#9728 lands, it would be great to set e.g. Strict-Transport-Security header.

I propose that for every env variables named like SET_HEADER_<HEADER_NAME> a SetEnv directive is inserted into a conf snippet in /opt/app-root/etc/conf.d.

I would further propose handling CORS headers explicitly. Maybe with a configmap. If you are interested, I will prototype it and ask for comments.

The assemble script executes the following Composer command :

./composer.phar install --no-interaction --no-ansi --optimize-autoloader

By default, Composer installs the dev packages (defined in require-dev in composer.json) which is not always needed for production deployments (it increases the build time, generates bigger images, generates a bigger classes autoloaded which decreases performance, install extra packages with potential security issues, ...)

It would be nice to have a build option to execute Composer with the --no-dev option.

I'll try to create a pull request soon.

I tried to add extensions by using PHP_INI_SCAN_DIR like https://github.com/nak3/openshiftv3-php with customizing *.ini:

extension = /opt/app-root/src/lib/modules/tidy.so

However, it overwrites default extensiton /opt/rh/php55/root/usr/lib64/php/modules. What is the best way to install PHP extensions?

OpenShift v2 has pear.txt and it might be good idea if we could use them on v3.
(I know it is possible by customizing sti-image, but some users don't like use customized image.)

S2I run script sets a default value of "16M" instead of "16" for the opcache memory consumption via:

export OPCACHE_MEMORY_CONSUMPTION=${OPCACHE_MEMORY_CONSUMPTION:-16M}

however the PHP documentation marks this as an integer field

opcache.memory_consumption integer
The size of the shared memory storage used by OPcache, in megabytes.

I implemented JSON logging in our forked php container.
This has the advantage that the fields of the log are nicely presented in kibana.
Would this be of general interest? If yes, I can prepare a pull request.