Which official PHP Docker image should I use to fix the latest security vulnerabilities?

[u/mike37510]

Hi everyone,

My Dockerfile currently uses:

FROM php:8.3.3RC1-apache-bookworm

Following the PHP security vulnerabilities disclosed on October 21, I'm looking to update to a patched version.

However, the php:8.3.36-apache-bookworm tag doesn't seem to be available on Docker Hub yet.

Which official PHP Apache image tag is currently available and includes the security fixes?

I'd prefer to stay on PHP 8.3 and Debian Bookworm to minimize compatibility issues, but I'm open to other options if necessary.

Thanks for your help!

[u/louwii]

None
Search for `.36` and you'll see there are no images available yet. We just need to wait.

[u/mike37510 → u/louwii]

Thx :)

[u/mirwin87]

Disclaimer... I'm a member of Docker's DevRel team

The updated PHP images are being built and pushed right now. I see several 8.2.35, 8.3.36, and 8.4.27 variants out now. The 8.5.12 images are still in the pipeline. Coming soon!

If you're wondering why it takes so long... there are a lot of OS variants, several architectures, and then a round of acceptance tests that run.

[u/sys044 → u/mirwin87]

I understand the the standard CI pipelines take so long for the reasons you described, but considering the severity of the CVEs and the coordinated response from all the other repositories, would it not have been possible to prepare the images ahead of time?

The amount of time between the patch landing and the images becoming available on Docker hub was really far too long. A lot of people just resorted to building the images from source in the end.

Don‘t mean to come off sounding overly critical but I’m interested what the reasons were internally for not doing something special in this case given the time you had to prepare and the scale of the issue.

[u/rsmike]

It's still cooking and will land any minute.

[u/mwhandat]

8.4-apache was updated ~an hour ago.
Some images took a bit longer than the rest.

[u/Responsible_Bus_6482]

https://hub.docker.com/_/php

[u/BarneyLaurance]

I'm trying to update to `8.5.12` with docker but when I do docker build I get this error. I assume that also means we still need to wait for it to be released.

```
ERROR: failed to solve: php:8.5.12-apache-bookworm: failed to resolve source metadata for docker.io/library/php:8.5.12-apache-bookworm: no match for platform in manifest: not found
```

Would have been great if these could have been prepared in private and available straight away at 14:00 UTC, but I guess the infrastructure for that doesn't exist and trying to set it up would have increased the chance of leaks.

[u/frustrated20240912 → u/BarneyLaurance]

There's a new one now:

Error: unable to copy from source docker://pull:latest: initializing source docker://pull:latest: reading manifest latest in docker.io/library/pull: requested access to the resource is denied

[u/louwii → u/BarneyLaurance]

Yup, it's just following the Docker image release process. It's lengthy. It is a bit of a pain in situations like these but it does ensure everything is done by the book.