Disable backdoor

[Nutomic]

https://github.com/HaschekSolutions/PictShare-Docker/blob/master/rootfs/pictshare.sh#L16

This is a horrible idea. If you release a new version, just publish a new Docker image.

[Nutomic]

I will write a new Dockerfile for pictshare without this stuff. Hope you are going to merge and use that.

[geek-at]

I had this discussion before and I still think it's smarter to have auto-update enabled by default.

At the moment on every restart pictshare is updated to the latest version. You can opt out using an enviroment variable

I think a reboot of a docker container happens more often than someone acutally repulling the repo to get the latest version.

Also the argument of a backdoor wouldn't change if the codebase is changing with every pull of the container since both the container and the codebase are managed by me.

Thoughts?

[dessalines]

Its your project, but I'll just say this isn't how docker's are typically done. Ideally your dockerfile shouldn't pull anything but your php dependencies required to build your executable, and the building / compiling that should occur transparently in the dockerfile. Then the entrypoint is just your executable.

You then tag this image, and push it up to dockerhub at a specific version. This version will always be consistent, and will always work the same way, as its a release. Security issues with your dockerfile being a self-updating script aside, you can't even guarantee what version of the code is running, or if its consistent with previous versions. If you do a commit that breaks something, no one can use a previous docker image.

I for instance try to never use wildcard in my dependencies because I've gotten burned so many times on software breaking. This image is essentially a :latest that doesn't even have previous versions available.

[dessalines]

I can't really help because I know nothing about how php projects are typically built with docker, but it would probably be good to look at how a few other php projects do this.

[Nutomic]

I would just start with one of the official PHP images, and follow the instructions in the description to add the source code and any required extensions.

https://hub.docker.com/_/php

[geek-at]

Never thought about it this way but it does make sense. How would I automate version numbers then? Or would I only have one :latest on docker hub?

[Nutomic]

Basically you just make a seperate Docker tag for each release, so you might have hascheksolutions/pictshare:1.0.0, hascheksolutions/pictshare:1.0.1and so on. You can also have multiple tags pointing to the same image, that way you can have both:latest` and version tags.

Here is our build script that handles this

[geek-at]

Okay. Currently I have the Pictshare code and docker repositories separated and docker hub is only building if this repo (pictshare-docker) gets updated. Should I combine these two or could it still work like this?

[Nutomic]

I dont think there is any reason to have seperate repositories. Putting it all in the same repo should be easier.

[dessalines]

Ya one way we do it is to have a folder structure like

- top level
  - src
  - docker
    - dev 
      - deploy script
      - Dockerfile
      - A sample docker-compose.yml for building the dev image
    - prod
      - a prod docker-compose.yml