From 23128f0195a77bcc5c6d6e4b9c70ddc77ee25a93 Mon Sep 17 00:00:00 2001 From: Jay Rogers Date: Tue, 20 Oct 2026 20:02:10 +0000 Subject: [PATCH 1/2] Upgrade FrankenPHP to v1.13.1 and skip compression for the Mercure hub --- src/variations/frankenphp/Dockerfile | 2 +- src/variations/frankenphp/etc/frankenphp/Caddyfile | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/variations/frankenphp/Dockerfile b/src/variations/frankenphp/Dockerfile index 9bdc0639..67654bc3 100644 --- a/src/variations/frankenphp/Dockerfile +++ b/src/variations/frankenphp/Dockerfile @@ -2,7 +2,7 @@ ARG BASE_OS_VERSION='trixie' ARG PHP_VERSION='8.5' ARG BASE_IMAGE="php:${PHP_VERSION}-zts-${BASE_OS_VERSION}" -ARG FRANKENPHP_VERSION='1.13.0' +ARG FRANKENPHP_VERSION='1.13.1' ARG GOLANG_VERSION='1.27' ######################## diff --git a/src/variations/frankenphp/etc/frankenphp/Caddyfile b/src/variations/frankenphp/etc/frankenphp/Caddyfile index 907a0224..4c3103c6 100644 --- a/src/variations/frankenphp/etc/frankenphp/Caddyfile +++ b/src/variations/frankenphp/etc/frankenphp/Caddyfile @@ -45,7 +45,9 @@ (php-app-common) { root * {$CADDY_SERVER_ROOT:/var/www/html/public} - encode zstd br gzip + # Compressed SSE streams cost memory per subscriber and enable BREACH-style attacks. + @compressible not path /.well-known/mercure + encode @compressible zstd br gzip # Match serversideup/php log levels to Caddy address log levels import log-level/address/{$LOG_OUTPUT_LEVEL:info}.caddyfile From 48c0d16cc70a119c9af08127566d0d34d000ad05 Mon Sep 17 00:00:00 2001 From: Jay Rogers Date: Tue, 20 Oct 2026 20:25:01 +0000 Subject: [PATCH 2/2] Fail the FrankenPHP build when an extension install fails --- src/variations/frankenphp/Dockerfile | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/variations/frankenphp/Dockerfile b/src/variations/frankenphp/Dockerfile index 67654bc3..c4edbcbb 100644 --- a/src/variations/frankenphp/Dockerfile +++ b/src/variations/frankenphp/Dockerfile @@ -243,8 +243,8 @@ COPY --from=frankenphp-build /usr/local/lib/libwatcher* /usr/local/lib/ COPY src/variations/frankenphp/etc/frankenphp/ /etc/frankenphp/ RUN \ - docker-php-serversideup-dep-install-alpine "${DEPENDENCY_PACKAGES_ALPINE}"; \ - docker-php-serversideup-dep-install-debian "${DEPENDENCY_PACKAGES_DEBIAN}"; \ + docker-php-serversideup-dep-install-alpine "${DEPENDENCY_PACKAGES_ALPINE}" && \ + docker-php-serversideup-dep-install-debian "${DEPENDENCY_PACKAGES_DEBIAN}" && \ # Fix for the file watcher on arm if cat /etc/os-release | grep -q 'alpine'; then \ ldconfig /usr/local/lib; \ @@ -253,7 +253,7 @@ RUN \ else \ echo "Unsupported OS"; \ exit 1; \ - fi; \ + fi && \ # Make composer cache directory mkdir -p "${COMPOSER_HOME}" && \ chown -R www-data:www-data "${COMPOSER_HOME}" && \ @@ -262,9 +262,9 @@ RUN \ echo "${REPOSITORY_BUILD_VERSION}" > /etc/serversideup-php-version && \ \ # Install PHP Extension installer - docker-php-serversideup-install-php-ext-installer; \ + docker-php-serversideup-install-php-ext-installer && \ # Install default PHP extensions - docker-php-serversideup-install-php-extensions "${DEPENDENCY_PHP_EXTENSIONS}" "${PHP_EXTENSION_OVERRIDES}"; \ + docker-php-serversideup-install-php-extensions "${DEPENDENCY_PHP_EXTENSIONS}" "${PHP_EXTENSION_OVERRIDES}" && \ # Ensure permissions are set for www-data docker-php-serversideup-set-file-permissions --owner www-data:www-data --service frankenphp