sslbrain-appliance (0.1.0)
Published 2026-05-28 21:39:39 +00:00 by soledk
Installation
docker pull code.sslbrain.com/sslbrain-public/sslbrain-appliance:0.1.0sha256:5ee47d57a49c3f5bcaeb146caaf9fb6c8e6e530fb37ab18db1cb91853c2814d5
Images
| Digest | OS / Arch | Size |
|---|---|---|
| 1e2347b31b | linux/amd64 | 652 MiB |
Image Layers ( linux/amd64)
| # debian.sh --arch 'amd64' out/ 'trixie' '@1773619200' |
| RUN /bin/sh -c set -eux; { echo 'Package: php*'; echo 'Pin: release *'; echo 'Pin-Priority: -1'; } > /etc/apt/preferences.d/no-debian-php # buildkit |
| ENV PHPIZE_DEPS=autoconf dpkg-dev file g++ gcc libc-dev make pkg-config re2c |
| RUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends $PHPIZE_DEPS ca-certificates curl xz-utils ; apt-get dist-clean # buildkit |
| ENV PHP_INI_DIR=/usr/local/etc/php |
| RUN /bin/sh -c set -eux; mkdir -p "$PHP_INI_DIR/conf.d"; [ ! -d /var/www/html ]; mkdir -p /var/www/html; chown www-data:www-data /var/www/html; chmod 1777 /var/www/html # buildkit |
| ENV PHP_CFLAGS=-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 |
| ENV PHP_CPPFLAGS=-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 |
| ENV PHP_LDFLAGS=-Wl,-O1 -pie |
| ENV GPG_KEYS=AFD8691FDAEDF03BDF6E460563F15A9B715376CA 9D7F99A0CB8F05C8A6958D6256A97AF7600A39A6 0616E93D95AF471243E26761770426E17EBBB3DD |
| ENV PHP_VERSION=8.4.19 |
| ENV PHP_URL=https://www.php.net/distributions/php-8.4.19.tar.xz PHP_ASC_URL=https://www.php.net/distributions/php-8.4.19.tar.xz.asc |
| ENV PHP_SHA256=11f7164ab26d356c31f94d3d69cc0e0707d5d2d6494a221aaeae307c08eaaa1c |
| RUN /bin/sh -c set -eux; savedAptMark="$(apt-mark showmanual)"; apt-get update; apt-get install -y --no-install-recommends gnupg; apt-get dist-clean; mkdir -p /usr/src; cd /usr/src; curl -fsSL -o php.tar.xz "$PHP_URL"; if [ -n "$PHP_SHA256" ]; then echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; fi; curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; export GNUPGHOME="$(mktemp -d)"; for key in $GPG_KEYS; do gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; done; gpg --batch --verify php.tar.xz.asc php.tar.xz; gpgconf --kill all; rm -rf "$GNUPGHOME"; apt-mark auto '.*' > /dev/null; apt-mark manual $savedAptMark > /dev/null; apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false # buildkit |
| COPY docker-php-source /usr/local/bin/ # buildkit |
| RUN /bin/sh -c set -eux; savedAptMark="$(apt-mark showmanual)"; apt-get update; apt-get install -y --no-install-recommends libargon2-dev libcurl4-openssl-dev libonig-dev libreadline-dev libsodium-dev libsqlite3-dev libssl-dev libxml2-dev zlib1g-dev ; export CFLAGS="$PHP_CFLAGS" CPPFLAGS="$PHP_CPPFLAGS" LDFLAGS="$PHP_LDFLAGS" PHP_BUILD_PROVIDER='https://github.com/docker-library/php' PHP_UNAME='Linux - Docker' ; docker-php-source extract; cd /usr/src/php; gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; if [ ! -d /usr/include/curl ]; then ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; fi; test "$PHP_INI_DIR" != "${PHP_INI_DIR%/php}"; ./configure --build="$gnuArch" --sysconfdir="${PHP_INI_DIR%/php}" --with-config-file-path="$PHP_INI_DIR" --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" --enable-option-checking=fatal --with-mhash --with-pic --enable-mbstring --enable-mysqlnd --with-password-argon2 --with-sodium=shared --with-pdo-sqlite=/usr --with-sqlite3=/usr --with-curl --with-iconv --with-openssl --with-readline --with-zlib --enable-phpdbg --enable-phpdbg-readline --with-pear --with-libdir="lib/$debMultiarch" --enable-embed --enable-zts --disable-zend-signals ; make -j "$(nproc)"; find -type f -name '*.a' -delete; make install; find /usr/local -type f -perm '/0111' -exec sh -euxc ' strip --strip-all "$@" || : ' -- '{}' + ; make clean; cp -v php.ini-* "$PHP_INI_DIR/"; cd /; docker-php-source delete; apt-mark auto '.*' > /dev/null; [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; find /usr/local -type f -executable -exec ldd '{}' ';' | awk '/=>/ { so = $(NF-1); if (index(so, "/usr/local/") == 1) { next }; gsub("^/(usr/)?", "", so); printf "*%s\n", so }' | sort -u | xargs -rt dpkg-query --search | awk 'sub(":$", "", $1) { print $1 }' | sort -u | xargs -r apt-mark manual ; apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; apt-get dist-clean; pecl update-channels; rm -rf /tmp/pear ~/.pearrc; php --version # buildkit |
| COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ # buildkit |
| RUN /bin/sh -c docker-php-ext-enable opcache # buildkit |
| RUN /bin/sh -c docker-php-ext-enable sodium # buildkit |
| ENTRYPOINT ["docker-php-entrypoint"] |
| CMD ["php" "-a"] |
| WORKDIR /app |
| RUN /bin/sh -c apt-get update && apt-get -y --no-install-recommends install mailcap libcap2-bin && apt-get clean && rm -rf /var/lib/apt/lists/* # buildkit |
| RUN /bin/sh -c set -eux; mkdir -p /app/public /config/caddy /data/caddy /etc/caddy /etc/frankenphp; sed -i 's/php/frankenphp run/g' /usr/local/bin/docker-php-entrypoint; echo '<?php phpinfo();' > /app/public/index.php # buildkit |
| COPY caddy/frankenphp/Caddyfile /etc/caddy/Caddyfile # buildkit |
| RUN /bin/sh -c ln /etc/caddy/Caddyfile /etc/frankenphp/Caddyfile && curl -sSLf -o /usr/local/bin/install-php-extensions https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions && chmod +x /usr/local/bin/install-php-extensions # buildkit |
| CMD ["--config" "/etc/frankenphp/Caddyfile" "--adapter" "caddyfile"] |
| HEALTHCHECK &{["CMD-SHELL" "curl -f http://localhost:2019/metrics || exit 1"] "0s" "0s" "0s" "0s" '\x00'} |
| ENV XDG_CONFIG_HOME=/config |
| ENV XDG_DATA_HOME=/data |
| EXPOSE [80/tcp] |
| EXPOSE [443/tcp] |
| EXPOSE [443/udp] |
| EXPOSE [2019/tcp] |
| LABEL org.opencontainers.image.title=FrankenPHP |
| LABEL org.opencontainers.image.description=The modern PHP app server |
| LABEL org.opencontainers.image.url=https://frankenphp.dev |
| LABEL org.opencontainers.image.source=https://github.com/php/frankenphp |
| LABEL org.opencontainers.image.licenses=MIT |
| LABEL org.opencontainers.image.vendor=Kévin Dunglas |
| ENV GODEBUG=cgocheck=0 |
| COPY /usr/local/lib/libwatcher* /usr/local/lib/ # buildkit |
| RUN /bin/sh -c apt-get install -y --no-install-recommends libstdc++6 && apt-get clean && ldconfig # buildkit |
| COPY /usr/local/bin/frankenphp /usr/local/bin/frankenphp # buildkit |
| RUN /bin/sh -c setcap cap_net_bind_service=+ep /usr/local/bin/frankenphp && frankenphp version && frankenphp build-info # buildkit |
| LABEL maintainer=FairSSL A/S <dev@fairssl.dk> |
| LABEL org.opencontainers.image.title=SSLBrain |
| LABEL org.opencontainers.image.description=On-premises SSL/TLS certificate lifecycle management |
| LABEL org.opencontainers.image.source=https://github.com/FairSSL/sslbrain |
| ARG USER_ID=1000 |
| ARG GROUP_ID=1000 |
| ARG TZ=UTC |
| ENV DEBIAN_FRONTEND=noninteractive TERM=xterm-color OCTANE_SERVER=frankenphp TZ=UTC USER=sslbrain ROOT=/app APP_ENV=production COMPOSER_FUND=0 COMPOSER_MAX_PARALLEL_HTTP=48 |
| WORKDIR /app |
| SHELL [/bin/bash -eou pipefail -c] |
| RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c ln -snf /usr/share/zoneinfo/${TZ} /etc/localtime && echo ${TZ} > /etc/timezone # buildkit |
| RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c apt-get update; apt-get upgrade -yqq; apt-get install -yqq --no-install-recommends --show-progress apt-utils curl wget git unzip procps ca-certificates supervisor libsodium-dev python3 python3-pip python3-venv openssh-client sshpass krb5-user libkrb5-dev gss-ntlmssp jq xmlstarlet openssl bubblewrap sqlite3 bind9-dnsutils gpg lsb-release tinyproxy && apt-get -y autoremove && apt-get clean && docker-php-source delete && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /var/log/lastlog /var/log/faillog # buildkit |
| RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c arch="$(uname -m)" && curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-${arch}.zip" -o /tmp/awscliv2.zip && unzip -q /tmp/awscliv2.zip -d /tmp && /tmp/aws/install && rm -rf /tmp/awscliv2.zip /tmp/aws && aws --version # buildkit |
| RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c mkdir -p /etc/apt/keyrings && curl -fsSL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor -o /etc/apt/keyrings/microsoft.gpg && chmod 644 /etc/apt/keyrings/microsoft.gpg && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/microsoft.gpg] https://packages.microsoft.com/repos/azure-cli/ bookworm main" > /etc/apt/sources.list.d/azure-cli.list && apt-get update -qq && apt-get install -yqq --no-install-recommends azure-cli && apt-get clean && rm -rf /var/lib/apt/lists/* && az version # buildkit |
| RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg && echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" > /etc/apt/sources.list.d/google-cloud-sdk.list && apt-get update -qq && apt-get install -yqq --no-install-recommends google-cloud-cli && apt-get clean && rm -rf /var/lib/apt/lists/* && gcloud version # buildkit |
| RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c install-php-extensions pcntl mbstring sockets pdo_sqlite pdo_pgsql opcache zip redis ldap sodium # buildkit |
| RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c pip3 install --break-system-packages --no-cache-dir pypsrp paramiko cryptography requests httpx pyyaml # buildkit |
| COPY /wheels /tmp/pyjks-wheels # buildkit |
| RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c pip3 install --break-system-packages --no-cache-dir /tmp/pyjks-wheels/*.whl && rm -rf /tmp/pyjks-wheels # buildkit |
| RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c git clone --depth 1 https://github.com/drwetter/testssl.sh.git /opt/testssl && chmod +x /opt/testssl/testssl.sh && rm -rf /opt/testssl/.git && rm -f /opt/testssl/bin/openssl.Darwin.* /opt/testssl/bin/openssl.FreeBSD.* # buildkit |
| RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c arch="$(uname -m)" && case "$arch" in x86_64) _lego_arch='linux_amd64' ;; aarch64) _lego_arch='linux_arm64' ;; armv7l|armhf) _lego_arch='linux_armv7' ;; *) echo >&2 "lego: unsupported architecture $arch"; exit 1 ;; esac && curl -fsSL "https://github.com/go-acme/lego/releases/download/v4.17.4/lego_v4.17.4_${_lego_arch}.tar.gz" -o /tmp/lego.tar.gz && tar -xzf /tmp/lego.tar.gz -C /usr/local/bin lego && rm /tmp/lego.tar.gz && chmod +x /usr/local/bin/lego && /usr/local/bin/lego --version # buildkit |
| RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c arch="$(uname -m)" && case "$arch" in armhf) _cronic_fname='supercronic-linux-arm' ;; aarch64) _cronic_fname='supercronic-linux-arm64' ;; x86_64) _cronic_fname='supercronic-linux-amd64' ;; x86) _cronic_fname='supercronic-linux-386' ;; *) echo >&2 "error: unsupported architecture: $arch"; exit 1 ;; esac && wget -q "https://github.com/aptible/supercronic/releases/download/v0.2.38/${_cronic_fname}" -O /usr/bin/supercronic && chmod +x /usr/bin/supercronic && mkdir -p /etc/supercronic && echo "*/1 * * * * php ${ROOT}/artisan schedule:run --no-interaction" > /etc/supercronic/laravel # buildkit |
| RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c userdel --remove --force www-data 2>/dev/null || true && groupadd --force -g ${GROUP_ID} ${USER} && useradd -ms /bin/bash --no-log-init --no-user-group -g ${GROUP_ID} -u ${USER_ID} ${USER} && chsh -s /usr/sbin/nologin root # buildkit |
| RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c cp ${PHP_INI_DIR}/php.ini-production ${PHP_INI_DIR}/php.ini # buildkit |
| RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c echo "memory_limit = 512M" > ${PHP_INI_DIR}/conf.d/memory.ini # buildkit |
| COPY /usr/bin/composer /usr/bin/composer # buildkit |
| COPY docker/supervisord.conf /etc/supervisord.conf # buildkit |
| COPY docker/supervisord.*.conf /etc/supervisor/conf.d/ # buildkit |
| COPY docker/entrypoint.sh /usr/local/bin/start-container # buildkit |
| COPY docker/healthcheck.sh /usr/local/bin/healthcheck # buildkit |
| COPY composer.json composer.lock ./ # buildkit |
| COPY /app/vendor vendor # buildkit |
| COPY . . # buildkit |
| COPY /build/public/build public/build # buildkit |
| RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c mkdir -p storage/framework/{sessions,views,cache,testing} storage/logs bootstrap/cache && chmod +x /usr/local/bin/start-container /usr/local/bin/healthcheck && chmod +x scripts/sslbrain-ssh-run && ln -sf /app/scripts/sslbrain-ssh-run /usr/local/bin/sslbrain-ssh-run # buildkit |
| RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c composer dump-autoload --optimize --no-dev --no-scripts # buildkit |
| RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c php artisan package:discover --ansi # buildkit |
| RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c chown -R ${USER_ID}:${GROUP_ID} ${ROOT} # buildkit |
| RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c mkdir -p /data && chown ${USER_ID}:${GROUP_ID} /data # buildkit |
| RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c mkdir -p /tmp/certops && chown ${USER_ID}:${GROUP_ID} /tmp/certops # buildkit |
| USER sslbrain |
| EXPOSE [443/tcp] |
| EXPOSE [2019/tcp] |
| VOLUME [/data] |
| ENTRYPOINT ["start-container"] |
| HEALTHCHECK &{["CMD-SHELL" "healthcheck || exit 1"] "10s" "3s" "10s" "0s" '\x05'} |
Labels
| Key | Value |
|---|---|
| dev.frankenphp.base.fingerprint | cd690ff0591bd7bca5cf417cce739461da9c4a963aab1e9a704e5937803e25be |
| maintainer | FairSSL A/S <dev@fairssl.dk> |
| org.opencontainers.image.created | 2026-03-23T04:42:40Z |
| org.opencontainers.image.description | On-premises SSL/TLS certificate lifecycle management |
| org.opencontainers.image.licenses | MIT |
| org.opencontainers.image.revision | 33fcc4d5c08a5c14f3b12a3706cb2eed414bc44f |
| org.opencontainers.image.source | https://github.com/FairSSL/sslbrain |
| org.opencontainers.image.title | SSLBrain |
| org.opencontainers.image.url | https://frankenphp.dev |
| org.opencontainers.image.vendor | Kévin Dunglas |
| org.opencontainers.image.version | v1.12.1 |
Details
2026-05-28 21:39:39 +00:00
Versions (3)
View all
Container
1
OCI / Docker