Update PHP to 8.5.12+ and harden the image

build/Dockerfile

@@ -1,42 +1,34 @@
-FROM ubuntu:latest
-MAINTAINER ex0nuss
+FROM php:8.5-apache
 
-## for apt to be noninteractive
-ENV DEBIAN_FRONTEND noninteractive
-ENV DEBCONF_NONINTERACTIVE_SEEN true
+RUN php -r 'if (version_compare(PHP_VERSION, "8.5.12", "<")) { fwrite(STDERR, "PHP 8.5.12 or newer is required\n"); exit(1); }'
 
-RUN apt-get -y update && \
-    apt install -y  \
-    apache2 \
-    php \
-    libapache2-mod-php \
-    libcurl4-gnutls-dev \
-    iputils-ping \
-    wakeonlan \
-    git
+ENV DEBIAN_FRONTEND=noninteractive
 
-WORKDIR /root
-RUN git clone https://github.com/sciguy14/Remote-Wake-Sleep-On-LAN-Server.git &&\
-    chown root: /var/www/html &&\
-    chmod u+s `which ping`
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        ca-certificates \
+        git \
+        iputils-ping \
+        wakeonlan && \
+    rm -rf /var/lib/apt/lists/* && \
+    chmod u+s "$(command -v ping)"
 
-COPY ports.conf /etc/apache2/
+RUN git clone --depth 1 --branch 3.5.0 https://github.com/sciguy14/Remote-Wake-Sleep-On-LAN-Server.git /tmp/rwsols && \
+    cp -a /tmp/rwsols/www/html/. /var/www/html/ && \
+    rm -rf /tmp/rwsols && \
+    rm -f /var/www/html/config_sample.php /var/www/html/index.html && \
+    sed -i '/curl_close(/d' /var/www/html/index.php
 
-RUN a2enmod headers &&\
-    service apache2 restart &&\
-    mv -f Remote-Wake-Sleep-On-LAN-Server/000-default.conf /etc/apache2/sites-available/000-default.conf &&\
-    sed -i.bak "s/expose_php = On/expose_php = Off/g" /etc/php/7.4/apache2/php.ini &&\
-    sed -i.bak "s/E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED/error_reporting = E_ERROR/g" /etc/php/7.4/apache2/php.ini &&\
-    sed -i.bak "s/ServerSignature On/ServerSignature Off/g" /etc/apache2/conf-available/security.conf &&\
-    sed -i.bak "s/ServerTokens OS/ServerTokens Prod/g" /etc/apache2/conf-available/security.conf &&\
-    service apache2 restart &&\
-    mv Remote-Wake-Sleep-On-LAN-Server/* /var/www/html &&\
-    mv Remote-Wake-Sleep-On-LAN-Server/.htaccess /var/www/html &&\
-    rm -rf Remote-Wake-Sleep-On-LAN-Server/ &&\
-    rm -f /var/www/html/index.html
+COPY 000-default.conf /etc/apache2/sites-available/000-default.conf
+COPY ports.conf /etc/apache2/ports.conf
+COPY php-security.ini /usr/local/etc/php/conf.d/zz-security.ini
+COPY config.php /usr/local/share/rwsols-config.php
+COPY entrypoint.sh /entrypoint.sh
 
-COPY config.php /var/www/html/config.php
-COPY entrypoint.sh /
+RUN chmod +x /entrypoint.sh && \
+    a2enmod headers && \
+    sed -i 's/^ServerTokens .*/ServerTokens Prod/; s/^ServerSignature .*/ServerSignature Off/' /etc/apache2/conf-available/security.conf && \
+    echo 'ServerName localhost' >> /etc/apache2/apache2.conf
 
 ENV APACHE2_PORT=80
 ENV PASSPHRASE=admin