Upgrade CanastaBase to Debian 13 (Trixie) and align PHP-FPM runtime wiring

Dockerfile

@@ -1,13 +1,17 @@
-FROM debian:12.8 AS base
+FROM debian:13 AS base
 
 LABEL maintainers=""
 LABEL org.opencontainers.image.source=https://github.com/CanastaWiki/CanastaBase
 
 ARG MW_VERSION=REL1_43
 ARG MW_CORE_VERSION=1.43.9
+ARG PHP_SERIES=8.2
+ARG LUASANDBOX_VERSION=4.1.3
+ARG LUASANDBOX_SHA256=b373705508fa3fe5a6f09c05c223b7c281dd29069b34b4f0e57ca30301ab01d8
 
 ENV MW_VERSION=${MW_VERSION} \
 	MW_CORE_VERSION=${MW_CORE_VERSION} \
+	PHP_SERIES=${PHP_SERIES} \
 	WWW_ROOT=/var/www/mediawiki \
 	MW_HOME=/var/www/mediawiki/w \
 	MW_LOG=/var/log/mediawiki \
@@ -26,15 +30,18 @@ LABEL wiki.canasta.mediawiki.version="$MW_CORE_VERSION" \
 RUN set -x; \
 	apt-get clean \
 	&& apt-get update \
-	&& apt-get install -y --no-install-recommends aptitude \
+	&& apt-get install -y --no-install-recommends aptitude ca-certificates curl \
+	&& curl -fsSLo /tmp/debsuryorg-archive-keyring.deb https://packages.sury.org/debsuryorg-archive-keyring.deb \
+	&& dpkg -i /tmp/debsuryorg-archive-keyring.deb \
+	&& rm /tmp/debsuryorg-archive-keyring.deb \
+	&& echo "deb [signed-by=/usr/share/keyrings/debsuryorg-archive-keyring.gpg] https://packages.sury.org/php/ trixie main" > /etc/apt/sources.list.d/php.list \
+	&& apt-get update \
 	&& aptitude -y upgrade \
 	&& aptitude install -y --without-recommends \
 	git \
 	inotify-tools \
 	apache2 \
-	software-properties-common \
 	gpg \
-	apt-transport-https \
 	ca-certificates \
 	wget \
 	lsb-release \
@@ -54,24 +61,42 @@ RUN set -x; \
 	default-mysql-client \
 	rsync \
 	lynx \
-	php \
-	php-mysql \
-	php-cli \
-	php-gd \
-	php-mbstring \
-	php-xml \
-	php-intl \
-	php-opcache \
-	php-apcu \
-	php-redis \
-	php-curl \
-	php-zip \
-	php8.2-fpm \
-	php-yaml \
-	php-ldap \
-	php-bcmath \
-	php-luasandbox \
+	php${PHP_SERIES} \
+	php${PHP_SERIES}-mysql \
+	php${PHP_SERIES}-cli \
+	php${PHP_SERIES}-gd \
+	php${PHP_SERIES}-mbstring \
+	php${PHP_SERIES}-xml \
+	php${PHP_SERIES}-intl \
+	php${PHP_SERIES}-opcache \
+	php${PHP_SERIES}-apcu \
+	php${PHP_SERIES}-redis \
+	php${PHP_SERIES}-curl \
+	php${PHP_SERIES}-zip \
+	php${PHP_SERIES}-fpm \
+	php${PHP_SERIES}-yaml \
+	php${PHP_SERIES}-ldap \
+	php${PHP_SERIES}-bcmath \
+	liblua5.1-0 \
 	libapache2-mod-fcgid \
+	build-essential \
+	liblua5.1-0-dev \
+	php${PHP_SERIES}-dev \
+	&& curl -fsSLo /tmp/luasandbox.tar.gz "https://github.com/wikimedia/mediawiki-php-luasandbox/archive/refs/tags/${LUASANDBOX_VERSION}.tar.gz" \
+	&& echo "${LUASANDBOX_SHA256}  /tmp/luasandbox.tar.gz" | sha256sum -c - \
+	&& mkdir /tmp/luasandbox \
+	&& tar -xzf /tmp/luasandbox.tar.gz --strip-components=1 -C /tmp/luasandbox \
+	&& cd /tmp/luasandbox \
+	&& phpize${PHP_SERIES} \
+	&& ./configure --with-php-config=/usr/bin/php-config${PHP_SERIES} \
+	&& make -j"$(nproc)" \
+	&& make install \
+	&& echo "extension=luasandbox.so" > /etc/php/${PHP_SERIES}/mods-available/luasandbox.ini \
+	&& phpenmod -v "${PHP_SERIES}" luasandbox \
+	&& cd / \
+	&& rm -rf /tmp/luasandbox /tmp/luasandbox.tar.gz \
+	&& apt-get purge -y --auto-remove build-essential liblua5.1-0-dev php${PHP_SERIES}-dev \
+	&& php${PHP_SERIES} -m | grep -Fx luasandbox \
 	&& aptitude clean \
 	&& rm -rf /var/lib/apt/lists/*
 
@@ -85,7 +110,7 @@ RUN set -x; \
     && a2enmod rewrite \
 	# enabling mpm_event and php-fpm
 	&& a2dismod mpm_prefork \
-	&& a2enconf php8.2-fpm \
+	&& a2enconf php${PHP_SERIES}-fpm \
 	&& a2enmod mpm_event \
 	&& a2enmod proxy_fcgi \
     # Create directories
@@ -209,11 +234,11 @@ ENV MW_AUTOUPDATE=true \
 
 COPY _sources/configs/mediawiki.conf /etc/apache2/sites-enabled/
 COPY _sources/configs/status.conf /etc/apache2/mods-available/
-COPY _sources/configs/php_error_reporting.ini _sources/configs/php_upload_max_filesize.ini _sources/configs/php_memory_limit.ini /etc/php/8.2/cli/conf.d/
-COPY _sources/configs/php_error_reporting.ini _sources/configs/php_upload_max_filesize.ini _sources/configs/php_memory_limit.ini /etc/php/8.2/fpm/conf.d/
-COPY _sources/configs/php_max_input_vars.ini /etc/php/8.2/fpm/conf.d/
-COPY _sources/configs/php_timeouts.ini /etc/php/8.2/fpm/conf.d/
-COPY _sources/configs/php-fpm-www.conf /etc/php/8.2/fpm/pool.d/www.conf
+COPY _sources/configs/php_error_reporting.ini _sources/configs/php_upload_max_filesize.ini _sources/configs/php_memory_limit.ini /etc/php/${PHP_SERIES}/cli/conf.d/
+COPY _sources/configs/php_error_reporting.ini _sources/configs/php_upload_max_filesize.ini _sources/configs/php_memory_limit.ini /etc/php/${PHP_SERIES}/fpm/conf.d/
+COPY _sources/configs/php_max_input_vars.ini /etc/php/${PHP_SERIES}/fpm/conf.d/
+COPY _sources/configs/php_timeouts.ini /etc/php/${PHP_SERIES}/fpm/conf.d/
+COPY _sources/configs/php-fpm-www.conf /etc/php/${PHP_SERIES}/fpm/pool.d/www.conf
 COPY _sources/scripts/*.sh /
 COPY _sources/scripts/maintenance-scripts/*.sh /maintenance-scripts/
 COPY _sources/scripts/*.php $MW_HOME/maintenance/
@@ -248,7 +273,7 @@ RUN set -x; \
 	&& a2enmod expires remoteip\
 	&& a2disconf other-vhosts-access-log \
 	# Enable environment variables for FPM workers
-	&& sed -i '/clear_env/s/^;//' /etc/php/8.2/fpm/pool.d/www.conf
+	&& sed -i '/clear_env/s/^;//' /etc/php/${PHP_SERIES}/fpm/pool.d/www.conf
 
 COPY _sources/images/Powered-by-Canasta.png /var/www/mediawiki/w/resources/assets/
 

README.md

@@ -3,4 +3,6 @@ A MediaWiki stack for easy deployment of enterprise-ready MediaWiki on productio
 
 This repository is for the Docker image CanastaBase, which, as its name implies, serves as the base image for the Canasta Docker image. It includes all of the Canasta functionality except for extensions and skins, and a few extensions' related scripts. CanastaBase can also easily be used as a base image for any other Canasta-like MediaWiki distribution, which can then apply its own set of extensions, scripts and utilities.
 
+Current base OS: Debian 13 (Trixie).
+
 For complete documentation on the overall Canasta tech stack, including installation instructions, please visit https://canasta.wiki/.

RELEASE_NOTES.md

@@ -27,3 +27,4 @@ CanastaBase version history:
 - 1.3.12 - July 1, 2026 - Fail the image build if there are Git errors during extension and skin setup (#190)
 - 1.3.13 - July 2, 2026 - Idempotent Apache/.htaccess generation (#197); fail the build on Composer and Git errors (#195); maintenance-script fixes (#194); Dockerfile hardening (#198)
 - 1.3.14 - July 2, 2026 - Fix public_assets file serving (logo, favicon) for wikis.yaml with indented entries (#202)
+- 1.3.15 - July 23, 2026 - Upgrade base image from Debian 12 to Debian 13 (Trixie); install PHP 8.2 from Sury's repository for MediaWiki 1.43 compatibility; move PHP-FPM wiring from hardcoded paths/binaries to PHP_SERIES so Apache/FPM config, runtime scripts, and copied PHP ini files stay aligned; remove deprecated apt-transport-https from the package install list (HTTPS transport is built into modern apt).

_sources/configs/php-fpm-www.conf

@@ -33,7 +33,7 @@ group = "${WWW_GROUP}"
 ;                            (IPv6 and IPv4-mapped) on a specific port;
 ;   '/path/to/unix/socket' - to listen on a unix socket.
 ; Note: This value is mandatory.
-listen = /run/php/php8.2-fpm.sock
+listen = /run/php/php${PHP_SERIES}-fpm.sock
 
 ; Set listen(2) backlog.
 ; Default Value: 511 (-1 on FreeBSD and OpenBSD)

_sources/scripts/run-php-fpm.sh

@@ -5,4 +5,4 @@ set -x
 echo "starting php-fpm"
 # Running php-fpm
 mkdir -p /run/php
-exec /usr/sbin/php-fpm8.2
+exec /usr/sbin/php-fpm"${PHP_SERIES:-8.2}"

tests/test_debian_trixie_upgrade.py

@@ -0,0 +1,42 @@
+import os
+
+
+REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+
+
+def _read(path):
+    with open(os.path.join(REPO_ROOT, path)) as f:
+        return f.read()
+
+
+def test_dockerfile_uses_debian_13_trixie():
+    content = _read("Dockerfile")
+    assert "FROM debian:13 AS base" in content
+    assert "FROM debian:12.8 AS base" not in content
+
+
+def test_php_fpm_version_is_configured_via_php_series():
+    dockerfile = _read("Dockerfile")
+    run_php_fpm = _read("_sources/scripts/run-php-fpm.sh")
+    php_fpm_pool = _read("_sources/configs/php-fpm-www.conf")
+
+    assert "ARG PHP_SERIES=8.2" in dockerfile
+    assert "https://packages.sury.org/debsuryorg-archive-keyring.deb" in dockerfile
+    assert "https://packages.sury.org/php/ trixie main" in dockerfile
+    assert "php${PHP_SERIES}-mysql" in dockerfile
+    assert "php${PHP_SERIES}-fpm" in dockerfile
+    assert "/etc/php/${PHP_SERIES}/fpm" in dockerfile
+    assert 'php-fpm"${PHP_SERIES:-8.2}"' in run_php_fpm
+    assert "/run/php/php${PHP_SERIES}-fpm.sock" in php_fpm_pool
+
+
+def test_luasandbox_is_built_for_configured_php_series():
+    dockerfile = _read("Dockerfile")
+
+    assert "php${PHP_SERIES}-luasandbox" not in dockerfile
+    assert "ARG LUASANDBOX_VERSION=4.1.3" in dockerfile
+    assert "mediawiki-php-luasandbox/archive/refs/tags/${LUASANDBOX_VERSION}.tar.gz" in dockerfile
+    assert '${LUASANDBOX_SHA256}  /tmp/luasandbox.tar.gz' in dockerfile
+    assert "phpize${PHP_SERIES}" in dockerfile
+    assert "--with-php-config=/usr/bin/php-config${PHP_SERIES}" in dockerfile
+    assert "phpenmod -v \"${PHP_SERIES}\" luasandbox" in dockerfile