feat: add php extensions #29
Conversation
WalkthroughThe Dockerfile extends build dependencies by adding ca-certificates and installs the Microsoft ODBC driver for SQL Server with architecture detection and GPG verification. PHP extensions installation is expanded to include 15 additional extensions: pspell, pcntl, mongodb, ldap, imap, grpc, gmp, gettext, excimer, ev, calendar, xsl, sqlsrv, pdo_sqlsrv, and pdo_pgsql. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In `@php/Dockerfile`:
- Around line 37-40: The Dockerfile uses curl with the -k flag for the
msodbcsql18 and mssql-tools18 APKs (the download commands that fetch
msodbcsql18_18.6.1.1-1_${ARCH}.apk/.sig and
mssql-tools18_18.6.1.1-1_${ARCH}.apk/.sig); remove the -k option to re-enable
TLS certificate validation and replace with safer flags like --fail --show-error
--remote-name to fail on HTTP errors and surface issues, keeping the existing
GPG signature verification and ensuring ca-certificates is installed before
these curl commands.
- Around line 32-44: The Dockerfile currently installs msodbcsql18 and
mssql-tools only in the builder stage (the lines that download
msodbcsql18_18.6.1.1-1_${ARCH}.apk and mssql-tools18_18.6.1.1-1_${ARCH}.apk and
run apk add --allow-untrusted), so the final runtime image lacks the ODBC driver
and odbcinst.ini; update the Dockerfile to either move the entire driver install
block into the final stage or copy the installed artifacts
(msodbcsql18_18.6.1.1-1_${ARCH}.apk contents, mssql-tools files, and
odbcinst.ini) plus install the unixODBC runtime dependency into the final image
so sqlsrv / pdo_sqlsrv can find the driver at runtime.
| # Install the Microsoft ODBC driver for SQL Server (Linux) | ||
| RUN apk add --no-cache ca-certificates curl gnupg && \ | ||
| ARCH=$(uname -m) && \ | ||
| case $ARCH in x86_64) ARCH="amd64";; aarch64|arm64) ARCH="arm64";; *) echo "Unsupported architecture: $ARCH" && exit 1;; esac && \ | ||
| curl -sSL https://packages.microsoft.com/keys/microsoft.asc | gpg --import - && \ | ||
| curl -O -k "https://download.microsoft.com/download/9dcab408-e0d4-4571-a81a-5a0951e3445f/msodbcsql18_18.6.1.1-1_${ARCH}.apk" && \ | ||
| curl -O -k "https://download.microsoft.com/download/9dcab408-e0d4-4571-a81a-5a0951e3445f/msodbcsql18_18.6.1.1-1_${ARCH}.sig" && \ | ||
| curl -O -k "https://download.microsoft.com/download/b60bb8b6-d398-4819-9950-2e30cf725fb0/mssql-tools18_18.6.1.1-1_${ARCH}.apk" && \ | ||
| curl -O -k "https://download.microsoft.com/download/b60bb8b6-d398-4819-9950-2e30cf725fb0/mssql-tools18_18.6.1.1-1_${ARCH}.sig" && \ | ||
| gpg --verify msodbcsql18_18.6.1.1-1_${ARCH}.sig msodbcsql18_18.6.1.1-1_${ARCH}.apk && \ | ||
| gpg --verify mssql-tools18_18.6.1.1-1_${ARCH}.sig mssql-tools18_18.6.1.1-1_${ARCH}.apk && \ | ||
| apk add --allow-untrusted msodbcsql18_18.6.1.1-1_${ARCH}.apk mssql-tools18_18.6.1.1-1_${ARCH}.apk && \ | ||
| rm -f msodbcsql18_18.6.1.1-1_${ARCH}.apk msodbcsql18_18.6.1.1-1_${ARCH}.sig mssql-tools18_18.6.1.1-1_${ARCH}.apk mssql-tools18_18.6.1.1-1_${ARCH}.sig |
There was a problem hiding this comment.
Install the Microsoft ODBC driver in the runtime image.
This block installs the driver only in the builder stage; the final image doesn’t include the ODBC driver artifacts (nor odbcinst.ini), so sqlsrv / pdo_sqlsrv will fail at runtime. Move the driver install to the final stage or copy the artifacts + runtime deps into the final image. Line 32-44.
🔧 Example fix (copy artifacts + add unixODBC runtime dep)
@@
-RUN apk add --no-cache \
- bash sed ghostscript mysql-client imagemagick shadow msmtp unzip linux-headers \
- freetype icu openssl imagemagick libjpeg-turbo libwebp libpng libzip libssh2 git libgomp \
- libssh2-dev lz4 libavif libxpm lz4-libs && \
+RUN apk add --no-cache \
+ bash sed ghostscript mysql-client imagemagick shadow msmtp unzip linux-headers \
+ freetype icu openssl imagemagick libjpeg-turbo libwebp libpng libzip libssh2 git libgomp \
+ libssh2-dev lz4 libavif libxpm lz4-libs unixodbc && \
rm -rf /var/cache/apk/*
@@
COPY --from=builder /usr/local/lib/php/extensions /usr/local/lib/php/extensions
COPY --from=builder /usr/local/bin /usr/local/bin
COPY --from=builder /home/www-data/.wp-cli /home/www-data/.wp-cli
+COPY --from=builder /opt/microsoft /opt/microsoft
+COPY --from=builder /etc/odbcinst.ini /etc/odbcinst.ini🧰 Tools
🪛 Checkov (3.2.334)
[medium] 33-44: Ensure that packages with untrusted or missing signatures are not used by apk via the '--allow-untrusted' option
(CKV2_DOCKER_7)
[high] 33-44: Ensure that certificate validation isn't disabled with curl
(CKV2_DOCKER_2)
🤖 Prompt for AI Agents
In `@php/Dockerfile` around lines 32 - 44, The Dockerfile currently installs
msodbcsql18 and mssql-tools only in the builder stage (the lines that download
msodbcsql18_18.6.1.1-1_${ARCH}.apk and mssql-tools18_18.6.1.1-1_${ARCH}.apk and
run apk add --allow-untrusted), so the final runtime image lacks the ODBC driver
and odbcinst.ini; update the Dockerfile to either move the entire driver install
block into the final stage or copy the installed artifacts
(msodbcsql18_18.6.1.1-1_${ARCH}.apk contents, mssql-tools files, and
odbcinst.ini) plus install the unixODBC runtime dependency into the final image
so sqlsrv / pdo_sqlsrv can find the driver at runtime.
There was a problem hiding this comment.
@ma-04, understood! I've noted this for follow-up. Feel free to mention me if you have any questions while addressing it.
🧠 Learnings used
Learnt from: ma-04
Repo: flywp/dockerfiles PR: 29
File: php/Dockerfile:37-40
Timestamp: 2026-01-22T13:24:19.919Z
Learning: In the flywp/dockerfiles repository, when installing Microsoft ODBC driver packages from download.microsoft.com in Alpine Linux containers, curl experiences SSL certificate validation issues even with ca-certificates installed, so the `-k` flag is used with GPG signature verification as a compensating security control.
1 participant
Resolves #25
Notes
Installing
sqlsrvandpdo_sqlsrvrequires Microsoft ODBC driver. Microsoft download repository also has issues with curl in regards to ca-certificates.Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.