README

The Docker setup of Drago Project: a PHP 8 Apache server with the project in the image, live sync of changes for development and secure defaults for production.

Requirements

• PHP >= 8.3, < 9
• Drago Project
• Docker

Installation

composer require drago-ex/project-docker

Project Tools copies docker/, docker-compose.yaml and .dockerignore into the project, where you adapt them. Drago Project installs the package by itself.

Project in the Image

The project is copied into the image (docker/Dockerfile-app) instead of being mounted from your disk, which is slow on Windows. Run docker compose watch (or npm run docker:dev) while you work: it copies every change of app/ and www/ into the running container and builds a new image when composer.lock changes. Only log/ and www/upload/ are mounted, so logs are visible and uploaded files outlast a new image; what .dockerignore lists is not copied. After changing vendor/ without composer.lock, build the image again with docker compose up -d --build.

PHP Extensions

The image has GD (JPEG, PNG, WebP) for resizing uploaded images and intl for slugs made from names; docker/php.ini sets the upload limits (64 MB) and memory_limit (256 MB, enough to resize photos).

Security

• Debug mode (Tracy) is off unless asked for: npm run docker:dev loads docker/.env.development (NETTE_DEBUG=1, and PHP_EXCEPTION_IGNORE_ARGS=0 keeps function arguments in stack traces), a plain docker compose up and npm run docker:production run without it.
• The server listens only on 127.0.0.1:8080. To publish it on every interface, set SERVER_PORT=8080; Docker bypasses firewalls such as ufw, so in production prefer an HTTPS reverse proxy in front of it.
• PHP never runs in www/upload/, and an uploaded .htaccess is ignored. Files from there are served with a Content-Security-Policy that runs no script, so an uploaded SVG or HTML file opened directly cannot attack the site.
• docker/php.ini hides the PHP version, logs errors instead of showing them, leaves function arguments out of stack traces outside development (also when PHP_EXCEPTION_IGNORE_ARGS is not set), limits max_execution_time to 60 s and makes session cookies strict, HttpOnly and SameSite. disable_functions is ready to uncomment when nothing in the container runs shell commands (the PHP CLI, e.g. Composer, reads the same file).
• Behind a reverse proxy, tell Nette to trust it in app.neon, so it sees the visitor's IP address and HTTPS:

  http:
  	proxy: 172.16.0.0/12  # the address or range of your proxy

  Without it every request comes from the proxy's address, so the sign-in limit of project-auth would block all visitors at once, and Nette would not mark the session cookie secure (it does so by itself on HTTPS).
• Apache hides its version (docker/conf/security.conf) and sends X-Content-Type-Options and Referrer-Policy.
• Rebuild the image regularly with docker compose build --pull to get security fixes of PHP and Debian.

Docker Commands

Drago Project has the npm scripts of package.json: