add version comparison to plugins workflow

This reverts commit 14e3db80b5.

.github/workflows/bump_DotclearWatch.yml

@@ -0,0 +1,82 @@
+name: Check plugin DotclearWatch
+
+on:
+  schedule:
+  - cron: '15 23 * * *'
+  workflow_dispatch:
+
+env:
+  PLUGIN_NAME: DotclearWatch
+  PLUGIN_REPO: jcdenis/DotclearWatch
+  PLUGIN_ENV: DC_DOCKER_PLUGIN_DOTCLEARWATCH
+
+jobs:
+  version:
+    name: Check versions
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      distant: ${{ steps.distant.outputs.version }}
+      local: ${{ steps.local.outputs.version }}
+      newer: ${{ steps.compare.outputs.newer }}
+    steps:
+      - name: Read distant version
+        id: repository
+        uses: oprypin/find-latest-tag@v1.1.2
+        with:
+          repository: ${{ env.PLUGIN_REPO }}
+          prefix: 'v'
+      - name: Parse distant version
+        id: distant
+        run: |
+          version=${{ steps.repository.outputs.tag }}
+          echo "version=${version:1}" >> $GITHUB_OUTPUT
+      - name: Check out local repository
+        uses: actions/checkout@v4
+      - name: Parse local version
+        id: local
+        run: |
+          version=$(sed -n "s/\s*${{ env.PLUGIN_ENV }}=\(.*\)\s\(.*\)/\1/p" ./Dockerfile)
+          echo "version=${version}" >> $GITHUB_OUTPUT
+      - name: Compare version
+        id: compare
+        run: |
+          echo '* Distant: ${{ steps.distant.outputs.version }}' >> $GITHUB_STEP_SUMMARY
+          echo '* Local: ${{ steps.local.outputs.version }}' >> $GITHUB_STEP_SUMMARY
+          function version { echo "$@" | awk -F. '{ printf("%d%04d%03d\n", $1,$2,$3); }'; }
+          if [ $(version '${{ steps.distant.outputs.version }}') -gt $(version '${{ steps.local.outputs.version }}') ]; then
+          echo '* Plugin ${{ env.PLUGIN_NAME }} has newer version ${{ steps.message.outputs.message }}' >> $GITHUB_STEP_SUMMARY
+          echo "newer=true" >> $GITHUB_OUTPUT
+          else
+          echo '* Plugin ${{ env.PLUGIN_NAME }} is up to date' >> $GITHUB_STEP_SUMMARY
+          echo "newer=false" >> $GITHUB_OUTPUT
+          fi
+
+  update:
+    needs: version
+    name: Update dockerfile
+    if: (needs.version.outputs.newer == 'true')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Set message
+        id: message
+        run: |
+          message=$'Bump ${{ env.PLUGIN_NAME }} from ${{ needs.version.outputs.local }} to ${{ needs.version.outputs.distant }}'
+          echo "message=${message}" >> $GITHUB_OUTPUT
+      - name: Check out the repo
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Edit file
+        run: |
+          sed -i "s/${{ env.PLUGIN_ENV }}=${{ needs.version.outputs.local }}/${{ env.PLUGIN_ENV }}=${{ needs.version.outputs.distant }}/g" ./Dockerfile
+      - name: Commit change
+        uses: EndBug/add-and-commit@v9.1.4
+        with:
+          default_author: github_actions
+          message: ${{ steps.message.outputs.message }}
+      - name: summary
+        run: echo '* ${{ steps.message.outputs.message }}' >> $GITHUB_STEP_SUMMARY

.github/workflows/bump_dcLog.yml

@@ -0,0 +1,82 @@
+name: Check plugin dcLog
+
+on:
+  schedule:
+  - cron: '25 23 * * *'
+  workflow_dispatch:
+
+env:
+  PLUGIN_NAME: dclog
+  PLUGIN_REPO: jcdenis/dcLog
+  PLUGIN_ENV: DC_DOCKER_PLUGIN_DCLOG
+
+jobs:
+  version:
+    name: Check versions
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      distant: ${{ steps.distant.outputs.version }}
+      local: ${{ steps.local.outputs.version }}
+      newer: ${{ steps.compare.outputs.newer }}
+    steps:
+      - name: Read distant version
+        id: repository
+        uses: oprypin/find-latest-tag@v1.1.2
+        with:
+          repository: ${{ env.PLUGIN_REPO }}
+          prefix: 'v'
+      - name: Parse distant version
+        id: distant
+        run: |
+          version=${{ steps.repository.outputs.tag }}
+          echo "version=${version:1}" >> $GITHUB_OUTPUT
+      - name: Check out local repository
+        uses: actions/checkout@v4
+      - name: Parse local version
+        id: local
+        run: |
+          version=$(sed -n "s/\s*${{ env.PLUGIN_ENV }}=\(.*\)\s\(.*\)/\1/p" ./Dockerfile)
+          echo "version=${version}" >> $GITHUB_OUTPUT
+      - name: Compare version
+        id: compare
+        run: |
+          echo '* Distant: ${{ steps.distant.outputs.version }}' >> $GITHUB_STEP_SUMMARY
+          echo '* Local: ${{ steps.local.outputs.version }}' >> $GITHUB_STEP_SUMMARY
+          function version { echo "$@" | awk -F. '{ printf("%d%04d%03d\n", $1,$2,$3); }'; }
+          if [ $(version '${{ steps.distant.outputs.version }}') -gt $(version '${{ steps.local.outputs.version }}') ]; then
+          echo '* Plugin ${{ env.PLUGIN_NAME }} has newer version ${{ steps.message.outputs.message }}' >> $GITHUB_STEP_SUMMARY
+          echo "newer=true" >> $GITHUB_OUTPUT
+          else
+          echo '* Plugin ${{ env.PLUGIN_NAME }} is up to date' >> $GITHUB_STEP_SUMMARY
+          echo "newer=false" >> $GITHUB_OUTPUT
+          fi
+
+  update:
+    needs: version
+    name: Update dockerfile
+    if: (needs.version.outputs.newer == 'true')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Set message
+        id: message
+        run: |
+          message=$'Bump ${{ env.PLUGIN_NAME }} from ${{ needs.version.outputs.local }} to ${{ needs.version.outputs.distant }}'
+          echo "message=${message}" >> $GITHUB_OUTPUT
+      - name: Check out the repo
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Edit file
+        run: |
+          sed -i "s/${{ env.PLUGIN_ENV }}=${{ needs.version.outputs.local }}/${{ env.PLUGIN_ENV }}=${{ needs.version.outputs.distant }}/g" ./Dockerfile
+      - name: Commit change
+        uses: EndBug/add-and-commit@v9.1.4
+        with:
+          default_author: github_actions
+          message: ${{ steps.message.outputs.message }}
+      - name: summary
+        run: echo '* ${{ steps.message.outputs.message }}' >> $GITHUB_STEP_SUMMARY

.github/workflows/bump_sysInfo.yml

@@ -0,0 +1,81 @@
+name: Check plugin sysInfo
+
+on:
+  schedule:
+  - cron: '35 23 * * *'
+  workflow_dispatch:
+
+env:
+  PLUGIN_NAME: sysInfo
+  PLUGIN_REPO: franck-paul/sysInfo
+  PLUGIN_ENV: DC_DOCKER_PLUGIN_SYSINFO
+
+jobs:
+  version:
+    name: Check versions
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      distant: ${{ steps.distant.outputs.version }}
+      local: ${{ steps.local.outputs.version }}
+      newer: ${{ steps.compare.outputs.newer }}
+    steps:
+      - name: Read distant version
+        id: repository
+        uses: oprypin/find-latest-tag@v1.1.2
+        with:
+          repository: ${{ env.PLUGIN_REPO }}
+      - name: Parse distant version
+        id: distant
+        run: |
+          version=${{ steps.repository.outputs.tag }}
+          echo "version=${version}" >> $GITHUB_OUTPUT
+      - name: Check out local repository
+        uses: actions/checkout@v4
+      - name: Parse local version
+        id: local
+        run: |
+          version=$(sed -n "s/\s*${{ env.PLUGIN_ENV }}=\(.*\)\s\(.*\)/\1/p" ./Dockerfile)
+          echo "version=${version}" >> $GITHUB_OUTPUT
+      - name: Compare version
+        id: compare
+        run: |
+          echo '* Distant: ${{ steps.distant.outputs.version }}' >> $GITHUB_STEP_SUMMARY
+          echo '* Local: ${{ steps.local.outputs.version }}' >> $GITHUB_STEP_SUMMARY
+          function version { echo "$@" | awk -F. '{ printf("%d%04d%03d\n", $1,$2,$3); }'; }
+          if [ $(version '${{ steps.distant.outputs.version }}') -gt $(version '${{ steps.local.outputs.version }}') ]; then
+          echo '* Plugin ${{ env.PLUGIN_NAME }} has newer version ${{ steps.message.outputs.message }}' >> $GITHUB_STEP_SUMMARY
+          echo "newer=true" >> $GITHUB_OUTPUT
+          else
+          echo '* Plugin ${{ env.PLUGIN_NAME }} is up to date' >> $GITHUB_STEP_SUMMARY
+          echo "newer=false" >> $GITHUB_OUTPUT
+          fi
+
+  update:
+    needs: version
+    name: Update dockerfile
+    if: (needs.version.outputs.newer == 'true')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Set message
+        id: message
+        run: |
+          message=$'Bump ${{ env.PLUGIN_NAME }} from ${{ needs.version.outputs.local }} to ${{ needs.version.outputs.distant }}'
+          echo "message=${message}" >> $GITHUB_OUTPUT
+      - name: Check out the repo
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Edit file
+        run: |
+          sed -i "s/${{ env.PLUGIN_ENV }}=${{ needs.version.outputs.local }}/${{ env.PLUGIN_ENV }}=${{ needs.version.outputs.distant }}/g" ./Dockerfile
+      - name: Commit change
+        uses: EndBug/add-and-commit@v9.1.4
+        with:
+          default_author: github_actions
+          message: ${{ steps.message.outputs.message }}
+      - name: summary
+        run: echo '* ${{ steps.message.outputs.message }}' >> $GITHUB_STEP_SUMMARY

.github/workflows/release_branch.yml

@@ -55,10 +55,21 @@ jobs:
             ${{ env.DOCKER_NAMESPACE }}/${{ env.DOTCLEAR_IMAGE }}:${{ github.ref_name }}
             ghcr.io/${{ env.GITHUB_REPOSITORY }}:${{ github.ref_name }}
           build-args: CANAL=stable
-          platforms: linux/386,linux/amd64,linux/arm64,linux/arm/V7
+          platforms: linux/386,linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/ppc64le,linux/s390x
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+      - name: Docker Scout
+        id: docker-scout
+        uses: docker/scout-action@v1.16.1
+        with:
+          command: environment,quickview,cves,recommendations
+          image: ${{ env.DOCKER_NAMESPACE }}/${{ env.DOTCLEAR_IMAGE }}:${{ github.ref_name }}
+          environment: stable
+          organization: ${{ env.DOCKER_NAMESPACE }}
+          write-comment: true
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Send Telegram Message Ok
         uses: appleboy/telegram-action@master
         env:

.github/workflows/release_stable.yml

@@ -59,6 +59,12 @@ jobs:
           SUMMARY=$'Image ${{ env.DOCKER_NAMESPACE }}/${{ env.DOTCLEAR_IMAGE }}:${{ steps.dotclear.outputs.tag }} found.'
           echo "$SUMMARY" >> $GITHUB_STEP_SUMMARY
 
+      - name: rebuild
+        if: ((steps.registry.outputs.image_exists == 'true') && (github.event.inputs.force_rebuild == 'true'))
+        run: |
+          SUMMARY=$'Rebuilding image ${{ env.DOCKER_NAMESPACE }}/${{ env.DOTCLEAR_IMAGE }}:${{ steps.dotclear.outputs.tag }} is forced.'
+          echo "$SUMMARY" >> $GITHUB_STEP_SUMMARY
+
       - name: Check repository branch
         id: branch
         uses: GuillaumeFalourd/branch-exists@v1.1
@@ -140,10 +146,32 @@ jobs:
             ghcr.io/${{ env.GITHUB_REPOSITORY }}:${{ needs.check_image.outputs.version }}
             ghcr.io/${{ env.GITHUB_REPOSITORY }}:latest
           build-args: CANAL=${{ env.DOTCLEAR_CANAL }}
-          platforms: linux/386,linux/amd64,linux/arm64,linux/arm/V7
+          platforms: linux/386,linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/ppc64le,linux/s390x
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+      - name: Docker Scout stable
+        id: docker-scout
+        uses: docker/scout-action@v1.16.1
+        with:
+          command: environment,quickview,cves,recommendations
+          image: ${{ env.DOCKER_NAMESPACE }}/${{ env.DOTCLEAR_IMAGE }}:${{ needs.check_image.outputs.version }}
+          environment: stable
+          organization: ${{ env.DOCKER_NAMESPACE }}
+          write-comment: true
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Docker Scout latest
+        id: docker-scout2
+        uses: docker/scout-action@v1.16.1
+        with:
+          command: environment,quickview,cves,recommendations
+          image: ${{ env.DOCKER_NAMESPACE }}/${{ env.DOTCLEAR_IMAGE }}:latest
+          environment: latest
+          organization: ${{ env.DOCKER_NAMESPACE }}
+          write-comment: true
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Send Telegram Message Ok
         uses: appleboy/telegram-action@master
         env:

.github/workflows/release_testing.yml

@@ -2,7 +2,7 @@ name: Build and push testing image
 
 on:
   schedule:
-  - cron: '0 1 * * *'
+  - cron: '15 4 * * *'
   workflow_dispatch:
 
 env:
@@ -88,10 +88,21 @@ jobs:
             ${{ env.DOCKER_NAMESPACE }}/${{ env.DOTCLEAR_IMAGE }}:${{ env.DOTCLEAR_CANAL }}
             ghcr.io/${{ env.GITHUB_REPOSITORY }}:${{ env.DOTCLEAR_CANAL }}
           build-args: CANAL=${{ env.DOTCLEAR_CANAL }}
-          platforms: linux/386,linux/amd64,linux/arm64,linux/arm/V7
+          platforms: linux/386,linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/ppc64le,linux/s390x
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+      - name: Docker Scout
+        id: docker-scout
+        uses: docker/scout-action@v1.16.1
+        with:
+          command: environment,quickview,cves,recommendations
+          image: ${{ env.DOCKER_NAMESPACE }}/${{ env.DOTCLEAR_IMAGE }}:${{ env.DOTCLEAR_CANAL }}
+          environment: testing
+          organization: ${{ env.DOCKER_NAMESPACE }}
+          write-comment: true
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Send Telegram Message Ok
         uses: appleboy/telegram-action@master
         env:

.github/workflows/release_unstable.yml

@@ -2,7 +2,7 @@ name: Build and push dev image
 
 on:
   schedule:
-  - cron: '0 1 * * *'
+  - cron: '15 4 * * *'
   workflow_dispatch:
 
 env:
@@ -55,10 +55,21 @@ jobs:
             ${{ env.DOCKER_NAMESPACE }}/${{ env.DOTCLEAR_IMAGE }}:dev
             ghcr.io/${{ env.GITHUB_REPOSITORY }}:dev
           build-args: CANAL=${{ env.DOTCLEAR_CANAL }}
-          platforms: linux/386,linux/amd64,linux/arm64,linux/arm/V7
+          platforms: linux/386,linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/ppc64le,linux/s390x
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+      - name: Docker Scout
+        id: docker-scout
+        uses: docker/scout-action@v1.16.1
+        with:
+          command: environment,quickview,cves,recommendations
+          image: ${{ env.DOCKER_NAMESPACE }}/${{ env.DOTCLEAR_IMAGE }}:dev
+          environment: unstable
+          organization: ${{ env.DOCKER_NAMESPACE }}
+          write-comment: true
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Send Telegram Message Ok
         uses: appleboy/telegram-action@master
         env:

Dockerfile

@@ -5,39 +5,51 @@
 # Alpine
 ##
 
-# Use latest Alpine docker release
-FROM alpine:latest
+# Use fix Alpine docker release
+FROM alpine:3.21.0
+
+# Select Dotclear release canal (stable | unstable)
+ARG CANAL stable
+
+# Set environment variables
+ENV DC_DOCKER_CANAL=$CANAL \
+    DC_DOCKER_PHP=php84 \
+    DC_DOCKER_PLUGIN_DOTCLEARWATCH=0.9.3 \
+    DC_DOCKER_PLUGIN_DCLOG=1.7.3 \
+    DC_DOCKER_PLUGIN_SYSINFO=10.4 \
+    DC_RC_PATH=/var/www/dotclear/config.php \
+    DC_PLUGINS_ROOT=/var/www/dotclear/plugins \
+    DC_TPL_CACHE=/var/www/dotclear/cache \
+    DC_VAR=/var/www/dotclear/var
+
+# Image label
+LABEL "org.opencontainers.image.authors"="Jean-Christian Paul Denis" \
+    "org.opencontainers.image.source"="https://github.com/JcDenis/docker-dotclear" \
+    "org.opencontainers.image.description"="Dotclear docker image $DC_DOCKER_CANAL" \
+    "org.opencontainers.image.licenses"="AGPL-3.0"
 
 # Set system timezone
 RUN echo "UTC" > /etc/timezone
 
-# Select Dotclear release canal (stable | unstable)
-ARG CANAL stable
-ENV CNL_DOTCLEAR=$CANAL
+# Create user
+RUN adduser -D -g 'www' www
 
-# Image label
-LABEL org.opencontainers.image.source=https://github.com/JcDenis/docker-dotclear
-LABEL org.opencontainers.image.description="Dotclear docker image $CNL_DOTCLEAR"
-LABEL org.opencontainers.image.licenses=AGPL-3.0
 
 ##
 # Nginx
 ##
 
-# Create user
-RUN adduser -D -g 'www' www
-
 # Install required package
 RUN apk add --no-cache --update \
     nginx \
     curl \
     tar \
     unzip \
-    xq
+    libxml2-utils
 
 # Create directories structure
-RUN mkdir -p /var/www/dotclear
-RUN chown -R www:www /var/lib/nginx /var/www
+RUN mkdir -p /var/www/dotclear \
+    && chown -R www:www /var/lib/nginx /var/www
 
 # Copy nginx configuration
 COPY etc/nginx.conf /etc/nginx/nginx.conf
@@ -45,46 +57,47 @@ COPY etc/snippets_subfolder.conf /etc/nginx/snippets/snippets_subfolder.conf
 COPY etc/snippets_subdomain.conf /etc/nginx/snippets/snippets_subdomain.conf
 COPY etc/snippets_common.conf /etc/nginx/snippets/snippets_common.conf
 
+# Fix vuln alpine 3.21.0 : curl 8.11.0-r2 => 8.11-r0
+RUN apk upgrade curl
+
+
 ##
 # PHP
 ##
 
 # Try to bypass Alpine Linux iconv bug
-#RUN apk add --no-cache --repository http://dl-cdn.alpinelinux.org/alpine/edge/community/ gnu-libiconv
 RUN apk add --no-cache --repository http://dl-cdn.alpinelinux.org/alpine/v3.12/community/ gnu-libiconv=1.15-r2
 ENV LD_PRELOAD=/usr/lib/preloadable_libiconv.so
 
-# Use PHP 8.3 release
-ENV VER_PHP=php83
-
 # Install PHP required packages
 RUN apk add --no-cache --update \
-    ${VER_PHP}-common \
-    ${VER_PHP}-cli \
-    ${VER_PHP}-fpm \
-    ${VER_PHP}-session \
-    ${VER_PHP}-curl \
-    ${VER_PHP}-gd \
-    ${VER_PHP}-gmp \
-    ${VER_PHP}-exif \
-    ${VER_PHP}-tidy \
-    ${VER_PHP}-intl \
-    ${VER_PHP}-json \
-    ${VER_PHP}-mbstring \
-    ${VER_PHP}-iconv \
-    ${VER_PHP}-gettext \
-    ${VER_PHP}-mysqli \
-    ${VER_PHP}-pgsql \
-    ${VER_PHP}-opcache \
-    ${VER_PHP}-dom \
-    ${VER_PHP}-xml \
-    ${VER_PHP}-simplexml \
-    ${VER_PHP}-zip \
-    ${VER_PHP}-pdo_sqlite
+    ${DC_DOCKER_PHP}-common \
+    ${DC_DOCKER_PHP}-cli \
+    ${DC_DOCKER_PHP}-fpm \
+    ${DC_DOCKER_PHP}-session \
+    ${DC_DOCKER_PHP}-curl \
+    ${DC_DOCKER_PHP}-gd \
+    ${DC_DOCKER_PHP}-gmp \
+    ${DC_DOCKER_PHP}-exif \
+    ${DC_DOCKER_PHP}-tidy \
+    ${DC_DOCKER_PHP}-intl \
+    ${DC_DOCKER_PHP}-json \
+    ${DC_DOCKER_PHP}-mbstring \
+    ${DC_DOCKER_PHP}-iconv \
+    ${DC_DOCKER_PHP}-gettext \
+    ${DC_DOCKER_PHP}-mysqli \
+    ${DC_DOCKER_PHP}-pgsql \
+    ${DC_DOCKER_PHP}-opcache \
+    ${DC_DOCKER_PHP}-dom \
+    ${DC_DOCKER_PHP}-xml \
+    ${DC_DOCKER_PHP}-simplexml \
+    ${DC_DOCKER_PHP}-zip \
+    ${DC_DOCKER_PHP}-pdo_sqlite
 
 # Copy PHP configuration
-COPY etc/${CNL_DOTCLEAR}-php.ini /etc/${VER_PHP}/php.ini
-COPY etc/php-fpm.conf /etc/${VER_PHP}/php-fpm.d/www.conf
+COPY etc/${DC_DOCKER_CANAL}-php.ini /etc/${DC_DOCKER_PHP}/php.ini
+COPY etc/php-fpm.conf /etc/${DC_DOCKER_PHP}/php-fpm.d/www.conf
+
 
 ##
 # Dotclear
@@ -92,62 +105,45 @@ COPY etc/php-fpm.conf /etc/${VER_PHP}/php-fpm.d/www.conf
 
 # Download latest Dotclear version
 RUN curl -fsSL -o versions.xml "http://download.dotclear.org/versions.xml" \
-    && curl -fsSL -o dotclear.zip $(cat versions.xml | xq -x "//release[@name='$CNL_DOTCLEAR']/@href") \
-    && echo "$(cat versions.xml | xq -x "//release[@name='$CNL_DOTCLEAR']/@checksum") dotclear.zip" | md5sum -c - \
+    && curl -fsSL -o dotclear.zip $(xmllint --xpath "//release[@name='$DC_DOCKER_CANAL']/@href" versions.xml | awk -F'[="]' '!/>/{print $(NF-1)}') \
+    && echo "$(xmllint --xpath "//release[@name='$DC_DOCKER_CANAL']/@checksum" versions.xml | awk -F'[="]' '!/>/{print $(NF-1)}') dotclear.zip" | md5sum -c - \
     && mkdir -p /usr/src/dotclear \
     && unzip -d /usr/src dotclear.zip \
-    && rm dotclear.zip \
-    && chown -R www:www /usr/src/dotclear \
-    && chmod -R 755 /usr/src/dotclear/public /usr/src/dotclear/cache \
-    && rm -f /var/www/dotclear/app/*
+    && rm dotclear.zip
 
-# Create www structure
+# Create predefined www structure
 COPY www /var/lib/dotclear
-RUN chown -R www:www /var/lib/dotclear
 
-# These variables are only used for first install, see inc/config.php, from dotclear 2.32
-# Custom path for dotclear config file
-ENV DC_RC_PATH=/var/www/dotclear/config.php
-# Directory of third party plugins
-ENV DC_PLUGINS_ROOT=/var/www/dotclear/plugins
-# Directory for template cache files
-ENV DC_TPL_CACHE=/var/www/dotclear/cache
-# Directory for dotclear var
-ENV DC_VAR=/var/www/dotclear/var
 
 ##
 # Plugins
 ##
 
 # DotclearWatch
-ENV VER_DW=0.9.3
-RUN curl -fsSL -o plugin.zip "https://github.com/JcDenis/DotclearWatch/releases/download/v$VER_DW/plugin-DotclearWatch.zip" \
+RUN curl -fsSL -o plugin.zip "https://github.com/JcDenis/DotclearWatch/releases/download/v$DC_DOCKER_PLUGIN_DOTCLEARWATCH/plugin-DotclearWatch.zip" \
     && mkdir -p /var/lib/dotclear/plugins/DotclearWatch \
     && unzip -d /var/lib/dotclear/plugins plugin.zip \
-    && chown -R www:www /var/lib/dotclear/plugins \
     && rm plugin.zip
 
 # dcLog
-ENV VER_DL=1.7.3
-RUN curl -fsSL -o plugin.zip "https://github.com/JcDenis/dcLog/releases/download/v$VER_DL/plugin-dcLog.zip" \
+RUN curl -fsSL -o plugin.zip "https://github.com/JcDenis/dcLog/releases/download/v$DC_DOCKER_PLUGIN_DCLOG/plugin-dcLog.zip" \
     && mkdir -p /var/lib/dotclear/plugins/dcLog \
     && unzip -d /var/lib/dotclear/plugins plugin.zip \
-    && chown -R www:www /var/lib/dotclear/plugins \
     && rm plugin.zip
 
 # sysInfo
-ENV VER_SI=9.8
-RUN curl -fsSL -o plugin.zip "https://github.com/franck-paul/sysInfo/releases/download/$VER_SI/plugin-sysInfo-$VER_SI.zip" \
+RUN curl -fsSL -o plugin.zip "https://github.com/franck-paul/sysInfo/releases/download/$DC_DOCKER_PLUGIN_SYSINFO/plugin-sysInfo-$DC_DOCKER_PLUGIN_SYSINFO.zip" \
     && mkdir -p /var/lib/dotclear/plugins/sysInfo \
     && unzip -d /var/lib/dotclear/plugins plugin.zip \
-    && chown -R www:www /var/lib/dotclear/plugins \
     && rm plugin.zip
 
-
 ##
 # END
 ##
 
+# Fix ownership
+RUN chown -R www:www /var/lib/dotclear /usr/src/dotclear
+
 # Docker container uses port 80
 EXPOSE 80
 

README.md

@@ -11,11 +11,16 @@
 
 ## 1. THE SHORT WAY
 
-In your futur server, with Docker compose installed, execute:
+In your futur server, with Docker installed, execute:
+
+    docker run -d --name dotclear -p 80:80 -v dotclear:/var/www/dotclear
+
+or with Docker compose installed, execute:
 
     curl -fsSL -o docker-compose.yaml https://raw.githubusercontent.com/JcDenis/docker-dotclear/refs/heads/master/docker-compose.yaml && docker-compose up -d
 
 
+
 ## 2. WHAT IS DOTCLEAR
 
 Dotclear is an open-source web publishing software.
@@ -32,8 +37,9 @@ tool allowing anyone to publish on the web, regardless of their technical skills
 This repository contains all features to build or run Dotclear on a Docker environment.
 It is hightly based on work from [darknao](https://github.com/darknao/docker-dotclear).
 
-* Dotclear docker images are avaialable at [Docker hub](https://hub.docker.com/r/jcpd/docker-dotclear) or [Github registry](https://github.com/JcDenis/docker-dotclear/pkgs/container/docker-dotclear)
-* Dotclear docker sources are avaialable at [Github repository](https://github.com/JcDenis/docker-dotclear)
+* Dotclear docker images are available at [Docker hub](https://hub.docker.com/r/jcpd/docker-dotclear) or [Github registry](https://github.com/JcDenis/docker-dotclear/pkgs/container/docker-dotclear)
+* Dotclear docker sources are available at [Github repository](https://github.com/JcDenis/docker-dotclear)
+* Dotclear docker helps (french) are available at [Doclear Watch Blog](https://docker.dotclear.watch)
 
 
 ### 3.1 TAGS
@@ -68,13 +74,12 @@ Or to build image from unstable canal, from the Dokerfile path, execute:
 Builds should support:
 
 * postgresql and mysql and sqlite database
-* linux/386,linux/amd64,linux/arm64,linux/arm/V7 plateforms
+* linux/386,linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/ppc64le,linux/s390x (and more) plateforms
 * docker container healthcheck
 
 
 ### 3.3 DOCKER
 
-
 #### 3.3.1 Exemple of a docker compose file with a mariadb database
 
 Create and edit a **docker-compose.yaml** file and put into it this contents :
@@ -284,25 +289,59 @@ To upgrade Dotclear to next version it is recommanded to pull latest image and r
 or use Dotclear buitin update system but themes wiil not be updated.
 
 
-### 4. TODO
+## 4. TODO
 
 * Add better cache management. From another container or from Dotclear container.
 * Add mail support.
 
 
-### 5. CONTRIBUTING
+## 5. SECURITY
+
+* Nginx master process runs as root and set uid/gid to user www
+* PHP-FPM master process runs as root and set uid/gid to user www
+* Docker image entrypoint runs as root and set runuser to www at its end
+* Dotclear application files are chown to user www
+
+For security report see [SECURITY file](/SECURITY.md) or open a ticket on github repository.
+
+
+## 6. CONTRIBUTING
 
 This image is an open source project. If you'd like to contribute, please read the [CONTRIBUTING file](/CONTRIBUTING.md).
 You can submit a pull request, or feel free to use any other way you'd prefer.
 
 
-### 6. LICENSE
+## 7. LICENSES
 
-Copyright Jean-Christian Paul Denis
-AGPL-v3 <https://www.gnu.org/licenses/agpl-3.0.html>
+Many licenses are involved in there, from files in repository to those from softwares used in final Docker image.
 
-This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
-This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more details.
-You should have received a copy of the GNU Affero General Public License along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
-Dotclear software is licensed under AGPL-3, Copyright Olivier Meunier & Association Dotclear
+### 7.1 DOCKER-DOTCLEAR REPOSITORY FILES
+
+All files in docker-dotclear repository are licensed under AGPL-3, Copyright (c) Jean-Christian Paul Denis.
+
+    Copyright (c) Jean-Christian Paul Denis
+    AGPL-v3 <https://www.gnu.org/licenses/agpl-3.0.html>
+    This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
+    This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more details.
+    You should have received a copy of the GNU Affero General Public License along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+
+### 7.2 LINUX ALPINE
+
+Linux Alpine operating system in these final Docker images is licensed under MIT License, Copyright (c) 2019 Natanael Copa.
+
+
+### 7.3 NGINX
+
+NGINX web server in these final Docker images is licensed under 2-clause BSD-like license, Copyright (c) 2002-2021 Igor Sysoev, 2011-2024 Nginx, Inc.
+
+
+### 7.4 PHP
+
+PHP hypertext preprocessor in these final Docker images is licensed under the PHP License v3.01, copyright (c) the PHP Group.
+
+
+### 7.5 DOTCLEAR
+
+Dotclear software present in these final Docker images is licensed under AGPL-v3, Copyright (c) Olivier Meunier & Association Dotclear.

docker-compose.yaml

@@ -1,4 +1,5 @@
-# jcpd/docker-dotclear:latest
+# Docker compose file exemple for latest Dotclear release. 
+# Using docker volumes and 2 containers, one for blog web server and one for the database
 volumes:
   dc_app:
   dc_db:
@@ -32,8 +33,8 @@ services:
     ports:
       - 80:80
     depends_on:
-      dc_db: # MYSQL database service
-        condition: service_healthy # Waiting for database ready
+      dc_db:
+        condition: service_healthy
     environment:
       DC_DBDRIVER: mysqlimb4
       DC_DBHOST: dc_db

docker-entrypoint.sh

@@ -6,7 +6,7 @@
 set -e
 
 # Read image version
-if [ "$CNL_DOTCLEAR" == "stable" ]; then
+if [ "$DC_DOCKER_CANAL" == "stable" ]; then
 	# stable = x.xx.x => x.xx.x
 	export COMPARE_HAYSTACK="s/^\s*\"release_version\":\s*\"\(.*\)\",/\1/p"
 else
@@ -65,12 +65,13 @@ echo >&2 "Updating Dotclear common themes..."
 cp -rf /var/www/dotclear/app/themes/* /var/www/dotclear/themes
 
 # DEBUG mode for non stable releases
-if [ "$CNL_DOTCLEAR" == "stable" ]; then
+if [ "$DC_DOCKER_CANAL" == "stable" ]; then
 	echo >&2 "Disabling Dotclear DEBUG mode"
 	sed -i -e "s/ \/\/\*== DC_DEBUG ==/ \/\*== DC_DEBUG ==/g" /var/www/dotclear/app/src/Config.php
 else
-	echo >&2 "Enabling Dotclear DEBUG mode"
+	echo >&2 "Enabling Dotclear DEBUG mode and DEV mode"
 	sed -i -e "s/ \/\*== DC_DEBUG ==/ \/\/\*== DC_DEBUG ==/g" /var/www/dotclear/app/src/Config.php
+	sed -i -e "s/'DC_DEV', false/'DC_DEV', true/g" /var/www/dotclear/app/src/Config.php
 fi
 
 # Various cleanup. Sorry not sorry.
@@ -82,17 +83,22 @@ rm -f /var/www/dotclear/servers/default.conf
 # Fix www permissions
 echo >&2 "Setting up permissions..."
 chown -R www:www /var/www/dotclear
+[ -e /var/www/dotclear/config.php ] && chmod 600 /var/www/dotclear/config.php
+chmod 600 -R /var/www/dotclear/servers
 
 # Print summary to docker logs
 VERSION_INSTALLED=$(sed -n "s/^\s*\"release_version\":\s*\"\(.*\)\",/\1/p" release.json)
-echo >&2 "| Summary: "
-echo >&2 "| Alpine $(cat /etc/alpine-release)"
-echo >&2 "| Nginx $(nginx -v 2>&1 | sed 's/nginx version: nginx\///')"
-echo >&2 "| PHP $(php -r "echo PHP_VERSION;")"
-echo >&2 "| Dotclear ${VERSION_INSTALLED}"
+echo >&2 '┌──'
+echo >&2 "│ Summary: "
+echo >&2 "│ ◦ Alpine $(cat /etc/alpine-release)"
+echo >&2 "│ ◦ Nginx $(nginx -v 2>&1 | sed 's/nginx version: nginx\///')"
+echo >&2 "│ ◦ PHP $(php84 -r "echo PHP_VERSION;")"
+echo >&2 "│ ◦ Dotclear ${VERSION_INSTALLED}"
+echo >&2 '└──'
 
 # Start web server
-php-fpm83 -D # FPM must start first in daemon mode
+php-fpm84 -D # FPM must start first in daemon mode
 nginx # Then nginx in no daemon mode
 
-exec "$@"
+# Switch from user root to wwww
+exec runuser -u www "$@"

etc/testing-php.ini

@@ -104,9 +104,9 @@ session.referer_check =
 session.cache_limiter = nocache
 session.cache_expire = 180
 session.use_trans_sid = 0
-session.sid_length = 26
+#session.sid_length = 26
 session.trans_sid_tags = "a=href,area=href,frame=src,form="
-session.sid_bits_per_character = 5
+#session.sid_bits_per_character = 5
 
 [opcache]
 opcache.enable=1

etc/unstable-php.ini

@@ -104,9 +104,9 @@ session.referer_check =
 session.cache_limiter = nocache
 session.cache_expire = 180
 session.use_trans_sid = 0
-session.sid_length = 26
+#session.sid_length = 26
 session.trans_sid_tags = "a=href,area=href,frame=src,form="
-session.sid_bits_per_character = 5
+#session.sid_bits_per_character = 5
 
 [opcache]
 opcache.enable=1

exemple/compose/volume/mysql/docker-compose.yml

@@ -6,7 +6,7 @@ services:
     restart: unless-stopped
     command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
     volumes:
-      - dcstable/db:/var/lib/mysql
+      - dcstable_db:/var/lib/mysql
     environment:
       MYSQL_ROOT_PASSWORD: dotclear_root
       MYSQL_DATABASE: dotclear_db
@@ -24,7 +24,7 @@ services:
     container_name: dcstableapp
     restart: unless-stopped
     volumes:
-      - dcstable/app:/var/www/dotclear
+      - dcstable_app:/var/www/dotclear
     ports:
       - 80:80
     depends_on:
@@ -40,4 +40,5 @@ services:
       DC_ADMINMAILFROM: contact@exemple.com
 
 volumes:
-  dcstable:
+  dcstable_db:
+  dcstable_app:

exemple/compose/volume/pgsql/docker-compose.yml

@@ -10,7 +10,7 @@ services:
       POSTGRES_DB: dcstable_db
       PGDATA: /var/lib/postgresql/data/pgdata
     volumes:
-      - dcstable:/var/lib/postgresql/data
+      - dcstable_db:/var/lib/postgresql/data
     healthcheck:
       test: [ "CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}" ]
       interval: 1s
@@ -24,7 +24,7 @@ services:
     ports:
       - 80:80
     volumes:
-      - dcstable/app:/var/www/dotclear
+      - dcstable_app:/var/www/dotclear
     depends_on:
       dcstabledb:
         condition: service_healthy
@@ -38,4 +38,5 @@ services:
       DC_ADMINMAILFROM: contact@exemple.com
 
 volumes:
-  dcstable:
+  dcstable_db:
+  dcstable_app: