SSLBrain (public distribution)

Public anonymous-pull registry for sslbrain customer artefacts. Only the signed appliance image lives here. URL is intentionally not advertised; signing model (sslbrain-sigverify against pinned trust anchors) provides the actual trust.

sslbrain-appliance (0.1.0)

Published 2026-05-28 21:39:39 +00:00 by soledk

Installation

docker pull code.sslbrain.com/sslbrain-public/sslbrain-appliance:0.1.0
sha256:5ee47d57a49c3f5bcaeb146caaf9fb6c8e6e530fb37ab18db1cb91853c2814d5

Images

Digest OS / Arch Size
1e2347b31b linux/amd64 652 MiB

Image Layers ( linux/amd64)

# debian.sh --arch 'amd64' out/ 'trixie' '@1773619200'
RUN /bin/sh -c set -eux; { echo 'Package: php*'; echo 'Pin: release *'; echo 'Pin-Priority: -1'; } > /etc/apt/preferences.d/no-debian-php # buildkit
ENV PHPIZE_DEPS=autoconf dpkg-dev file g++ gcc libc-dev make pkg-config re2c
RUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends $PHPIZE_DEPS ca-certificates curl xz-utils ; apt-get dist-clean # buildkit
ENV PHP_INI_DIR=/usr/local/etc/php
RUN /bin/sh -c set -eux; mkdir -p "$PHP_INI_DIR/conf.d"; [ ! -d /var/www/html ]; mkdir -p /var/www/html; chown www-data:www-data /var/www/html; chmod 1777 /var/www/html # buildkit
ENV PHP_CFLAGS=-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
ENV PHP_CPPFLAGS=-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
ENV PHP_LDFLAGS=-Wl,-O1 -pie
ENV GPG_KEYS=AFD8691FDAEDF03BDF6E460563F15A9B715376CA 9D7F99A0CB8F05C8A6958D6256A97AF7600A39A6 0616E93D95AF471243E26761770426E17EBBB3DD
ENV PHP_VERSION=8.4.19
ENV PHP_URL=https://www.php.net/distributions/php-8.4.19.tar.xz PHP_ASC_URL=https://www.php.net/distributions/php-8.4.19.tar.xz.asc
ENV PHP_SHA256=11f7164ab26d356c31f94d3d69cc0e0707d5d2d6494a221aaeae307c08eaaa1c
RUN /bin/sh -c set -eux; savedAptMark="$(apt-mark showmanual)"; apt-get update; apt-get install -y --no-install-recommends gnupg; apt-get dist-clean; mkdir -p /usr/src; cd /usr/src; curl -fsSL -o php.tar.xz "$PHP_URL"; if [ -n "$PHP_SHA256" ]; then echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; fi; curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; export GNUPGHOME="$(mktemp -d)"; for key in $GPG_KEYS; do gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; done; gpg --batch --verify php.tar.xz.asc php.tar.xz; gpgconf --kill all; rm -rf "$GNUPGHOME"; apt-mark auto '.*' > /dev/null; apt-mark manual $savedAptMark > /dev/null; apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false # buildkit
COPY docker-php-source /usr/local/bin/ # buildkit
RUN /bin/sh -c set -eux; savedAptMark="$(apt-mark showmanual)"; apt-get update; apt-get install -y --no-install-recommends libargon2-dev libcurl4-openssl-dev libonig-dev libreadline-dev libsodium-dev libsqlite3-dev libssl-dev libxml2-dev zlib1g-dev ; export CFLAGS="$PHP_CFLAGS" CPPFLAGS="$PHP_CPPFLAGS" LDFLAGS="$PHP_LDFLAGS" PHP_BUILD_PROVIDER='https://github.com/docker-library/php' PHP_UNAME='Linux - Docker' ; docker-php-source extract; cd /usr/src/php; gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; if [ ! -d /usr/include/curl ]; then ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; fi; test "$PHP_INI_DIR" != "${PHP_INI_DIR%/php}"; ./configure --build="$gnuArch" --sysconfdir="${PHP_INI_DIR%/php}" --with-config-file-path="$PHP_INI_DIR" --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" --enable-option-checking=fatal --with-mhash --with-pic --enable-mbstring --enable-mysqlnd --with-password-argon2 --with-sodium=shared --with-pdo-sqlite=/usr --with-sqlite3=/usr --with-curl --with-iconv --with-openssl --with-readline --with-zlib --enable-phpdbg --enable-phpdbg-readline --with-pear --with-libdir="lib/$debMultiarch" --enable-embed --enable-zts --disable-zend-signals ; make -j "$(nproc)"; find -type f -name '*.a' -delete; make install; find /usr/local -type f -perm '/0111' -exec sh -euxc ' strip --strip-all "$@" || : ' -- '{}' + ; make clean; cp -v php.ini-* "$PHP_INI_DIR/"; cd /; docker-php-source delete; apt-mark auto '.*' > /dev/null; [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; find /usr/local -type f -executable -exec ldd '{}' ';' | awk '/=>/ { so = $(NF-1); if (index(so, "/usr/local/") == 1) { next }; gsub("^/(usr/)?", "", so); printf "*%s\n", so }' | sort -u | xargs -rt dpkg-query --search | awk 'sub(":$", "", $1) { print $1 }' | sort -u | xargs -r apt-mark manual ; apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; apt-get dist-clean; pecl update-channels; rm -rf /tmp/pear ~/.pearrc; php --version # buildkit
COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ # buildkit
RUN /bin/sh -c docker-php-ext-enable opcache # buildkit
RUN /bin/sh -c docker-php-ext-enable sodium # buildkit
ENTRYPOINT ["docker-php-entrypoint"]
CMD ["php" "-a"]
WORKDIR /app
RUN /bin/sh -c apt-get update && apt-get -y --no-install-recommends install mailcap libcap2-bin && apt-get clean && rm -rf /var/lib/apt/lists/* # buildkit
RUN /bin/sh -c set -eux; mkdir -p /app/public /config/caddy /data/caddy /etc/caddy /etc/frankenphp; sed -i 's/php/frankenphp run/g' /usr/local/bin/docker-php-entrypoint; echo '<?php phpinfo();' > /app/public/index.php # buildkit
COPY caddy/frankenphp/Caddyfile /etc/caddy/Caddyfile # buildkit
RUN /bin/sh -c ln /etc/caddy/Caddyfile /etc/frankenphp/Caddyfile && curl -sSLf -o /usr/local/bin/install-php-extensions https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions && chmod +x /usr/local/bin/install-php-extensions # buildkit
CMD ["--config" "/etc/frankenphp/Caddyfile" "--adapter" "caddyfile"]
HEALTHCHECK &{["CMD-SHELL" "curl -f http://localhost:2019/metrics || exit 1"] "0s" "0s" "0s" "0s" '\x00'}
ENV XDG_CONFIG_HOME=/config
ENV XDG_DATA_HOME=/data
EXPOSE [80/tcp]
EXPOSE [443/tcp]
EXPOSE [443/udp]
EXPOSE [2019/tcp]
LABEL org.opencontainers.image.title=FrankenPHP
LABEL org.opencontainers.image.description=The modern PHP app server
LABEL org.opencontainers.image.url=https://frankenphp.dev
LABEL org.opencontainers.image.source=https://github.com/php/frankenphp
LABEL org.opencontainers.image.licenses=MIT
LABEL org.opencontainers.image.vendor=Kévin Dunglas
ENV GODEBUG=cgocheck=0
COPY /usr/local/lib/libwatcher* /usr/local/lib/ # buildkit
RUN /bin/sh -c apt-get install -y --no-install-recommends libstdc++6 && apt-get clean && ldconfig # buildkit
COPY /usr/local/bin/frankenphp /usr/local/bin/frankenphp # buildkit
RUN /bin/sh -c setcap cap_net_bind_service=+ep /usr/local/bin/frankenphp && frankenphp version && frankenphp build-info # buildkit
LABEL maintainer=FairSSL A/S <dev@fairssl.dk>
LABEL org.opencontainers.image.title=SSLBrain
LABEL org.opencontainers.image.description=On-premises SSL/TLS certificate lifecycle management
LABEL org.opencontainers.image.source=https://github.com/FairSSL/sslbrain
ARG USER_ID=1000
ARG GROUP_ID=1000
ARG TZ=UTC
ENV DEBIAN_FRONTEND=noninteractive TERM=xterm-color OCTANE_SERVER=frankenphp TZ=UTC USER=sslbrain ROOT=/app APP_ENV=production COMPOSER_FUND=0 COMPOSER_MAX_PARALLEL_HTTP=48
WORKDIR /app
SHELL [/bin/bash -eou pipefail -c]
RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c ln -snf /usr/share/zoneinfo/${TZ} /etc/localtime && echo ${TZ} > /etc/timezone # buildkit
RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c apt-get update; apt-get upgrade -yqq; apt-get install -yqq --no-install-recommends --show-progress apt-utils curl wget git unzip procps ca-certificates supervisor libsodium-dev python3 python3-pip python3-venv openssh-client sshpass krb5-user libkrb5-dev gss-ntlmssp jq xmlstarlet openssl bubblewrap sqlite3 bind9-dnsutils gpg lsb-release tinyproxy && apt-get -y autoremove && apt-get clean && docker-php-source delete && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /var/log/lastlog /var/log/faillog # buildkit
RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c arch="$(uname -m)" && curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-${arch}.zip" -o /tmp/awscliv2.zip && unzip -q /tmp/awscliv2.zip -d /tmp && /tmp/aws/install && rm -rf /tmp/awscliv2.zip /tmp/aws && aws --version # buildkit
RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c mkdir -p /etc/apt/keyrings && curl -fsSL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor -o /etc/apt/keyrings/microsoft.gpg && chmod 644 /etc/apt/keyrings/microsoft.gpg && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/microsoft.gpg] https://packages.microsoft.com/repos/azure-cli/ bookworm main" > /etc/apt/sources.list.d/azure-cli.list && apt-get update -qq && apt-get install -yqq --no-install-recommends azure-cli && apt-get clean && rm -rf /var/lib/apt/lists/* && az version # buildkit
RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg && echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" > /etc/apt/sources.list.d/google-cloud-sdk.list && apt-get update -qq && apt-get install -yqq --no-install-recommends google-cloud-cli && apt-get clean && rm -rf /var/lib/apt/lists/* && gcloud version # buildkit
RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c install-php-extensions pcntl mbstring sockets pdo_sqlite pdo_pgsql opcache zip redis ldap sodium # buildkit
RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c pip3 install --break-system-packages --no-cache-dir pypsrp paramiko cryptography requests httpx pyyaml # buildkit
COPY /wheels /tmp/pyjks-wheels # buildkit
RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c pip3 install --break-system-packages --no-cache-dir /tmp/pyjks-wheels/*.whl && rm -rf /tmp/pyjks-wheels # buildkit
RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c git clone --depth 1 https://github.com/drwetter/testssl.sh.git /opt/testssl && chmod +x /opt/testssl/testssl.sh && rm -rf /opt/testssl/.git && rm -f /opt/testssl/bin/openssl.Darwin.* /opt/testssl/bin/openssl.FreeBSD.* # buildkit
RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c arch="$(uname -m)" && case "$arch" in x86_64) _lego_arch='linux_amd64' ;; aarch64) _lego_arch='linux_arm64' ;; armv7l|armhf) _lego_arch='linux_armv7' ;; *) echo >&2 "lego: unsupported architecture $arch"; exit 1 ;; esac && curl -fsSL "https://github.com/go-acme/lego/releases/download/v4.17.4/lego_v4.17.4_${_lego_arch}.tar.gz" -o /tmp/lego.tar.gz && tar -xzf /tmp/lego.tar.gz -C /usr/local/bin lego && rm /tmp/lego.tar.gz && chmod +x /usr/local/bin/lego && /usr/local/bin/lego --version # buildkit
RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c arch="$(uname -m)" && case "$arch" in armhf) _cronic_fname='supercronic-linux-arm' ;; aarch64) _cronic_fname='supercronic-linux-arm64' ;; x86_64) _cronic_fname='supercronic-linux-amd64' ;; x86) _cronic_fname='supercronic-linux-386' ;; *) echo >&2 "error: unsupported architecture: $arch"; exit 1 ;; esac && wget -q "https://github.com/aptible/supercronic/releases/download/v0.2.38/${_cronic_fname}" -O /usr/bin/supercronic && chmod +x /usr/bin/supercronic && mkdir -p /etc/supercronic && echo "*/1 * * * * php ${ROOT}/artisan schedule:run --no-interaction" > /etc/supercronic/laravel # buildkit
RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c userdel --remove --force www-data 2>/dev/null || true && groupadd --force -g ${GROUP_ID} ${USER} && useradd -ms /bin/bash --no-log-init --no-user-group -g ${GROUP_ID} -u ${USER_ID} ${USER} && chsh -s /usr/sbin/nologin root # buildkit
RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c cp ${PHP_INI_DIR}/php.ini-production ${PHP_INI_DIR}/php.ini # buildkit
RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c echo "memory_limit = 512M" > ${PHP_INI_DIR}/conf.d/memory.ini # buildkit
COPY /usr/bin/composer /usr/bin/composer # buildkit
COPY docker/supervisord.conf /etc/supervisord.conf # buildkit
COPY docker/supervisord.*.conf /etc/supervisor/conf.d/ # buildkit
COPY docker/entrypoint.sh /usr/local/bin/start-container # buildkit
COPY docker/healthcheck.sh /usr/local/bin/healthcheck # buildkit
COPY composer.json composer.lock ./ # buildkit
COPY /app/vendor vendor # buildkit
COPY . . # buildkit
COPY /build/public/build public/build # buildkit
RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c mkdir -p storage/framework/{sessions,views,cache,testing} storage/logs bootstrap/cache && chmod +x /usr/local/bin/start-container /usr/local/bin/healthcheck && chmod +x scripts/sslbrain-ssh-run && ln -sf /app/scripts/sslbrain-ssh-run /usr/local/bin/sslbrain-ssh-run # buildkit
RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c composer dump-autoload --optimize --no-dev --no-scripts # buildkit
RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c php artisan package:discover --ansi # buildkit
RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c chown -R ${USER_ID}:${GROUP_ID} ${ROOT} # buildkit
RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c mkdir -p /data && chown ${USER_ID}:${GROUP_ID} /data # buildkit
RUN |3 USER_ID=1000 GROUP_ID=1000 TZ=UTC /bin/bash -eou pipefail -c mkdir -p /tmp/certops && chown ${USER_ID}:${GROUP_ID} /tmp/certops # buildkit
USER sslbrain
EXPOSE [443/tcp]
EXPOSE [2019/tcp]
VOLUME [/data]
ENTRYPOINT ["start-container"]
HEALTHCHECK &{["CMD-SHELL" "healthcheck || exit 1"] "10s" "3s" "10s" "0s" '\x05'}

Labels

Key Value
dev.frankenphp.base.fingerprint cd690ff0591bd7bca5cf417cce739461da9c4a963aab1e9a704e5937803e25be
maintainer FairSSL A/S <dev@fairssl.dk>
org.opencontainers.image.created 2026-03-23T04:42:40Z
org.opencontainers.image.description On-premises SSL/TLS certificate lifecycle management
org.opencontainers.image.licenses MIT
org.opencontainers.image.revision 33fcc4d5c08a5c14f3b12a3706cb2eed414bc44f
org.opencontainers.image.source https://github.com/FairSSL/sslbrain
org.opencontainers.image.title SSLBrain
org.opencontainers.image.url https://frankenphp.dev
org.opencontainers.image.vendor Kévin Dunglas
org.opencontainers.image.version v1.12.1
Details
Container
2026-05-28 21:39:39 +00:00
1
OCI / Docker
Versions (3) View all
production-5fe3e21 2026-05-28
latest 2026-05-28
0.1.0 2026-05-28