feat: add v2026.1 image variant (ADR 2026-07-08) - #231
Draft
Soner (shyim) wants to merge 7 commits into
Draft
Conversation
Implements the first iteration of the Docker Image Variant v2 ADR alongside the existing v1 images: - Debian-based FrankenPHP production image, base pinned by digest, extension installer and all PECL extensions pinned to exact versions - grpc and opentelemetry shipped but not loaded; enabled at runtime via PHP_EXTENSION_GRPC=1 / PHP_EXTENSION_OPENTELEMETRY=1 (PHP_INI_SCAN_DIR, works on read-only rootfs) - No Shopware application env baked into the image; only PHP_*/COMPOSER_* infrastructure defaults remain - Lifecycle dates baked as env + OCI labels with escalating startup warnings (warn-only), best-effort ONBUILD build-time check - HEALTHCHECK via Caddy admin endpoint, SBOM + provenance attestations - Dev image on top of FrankenPHP (Node 22/24, no supervisord), profilers shipped disabled and enabled via PHP_PROFILER - Per-version layout: v2026.1/ holds contexts and its own docker-bake.hcl; build workflow scoped to that directory - update-php-matrix.mjs refreshes digest pins in all v*/docker-bake.hcl Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Replaces the custom build-bake-publish composite action (Namespace-powered buildx) with Docker's official reusable bake workflow for the v2026.1 images: - native arm64 runners (ubuntu-24.04-arm) instead of QEMU/remote builders - signed SLSA provenance + SBOM attestations (keyless, GitHub OIDC) — covers the cosign item from the ADR - one reusable-workflow call per bake target: a prepare job derives the PHP/Node matrices from the bake definition via 'bake --print', so the bake file stays the single source of truth - tags move to meta-images/meta-tags inputs in CI (github-builder replaces bake-defined tags); the tags in the bake file now apply to local builds only - v1 workflows keep using the composite action unchanged Pinned to a main commit — docker/github-builder has no release tag yet. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The pinned docker/dockerfile:1.7 frontend (2024) does not know the source.git.checksum capability that docker/github-builder's git-context builds pass, making every CI build fail with: failed to resolve dockerfile: unknown API capability source.git.checksum The floating :1 tag resolves to the latest stable frontend, which supports it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Addresses the supply-chain concern of the floating docker/dockerfile:1 tag: the frontend is now pinned by manifest digest like the base images, and update-php-matrix.mjs refreshes the pin in every versioned directory. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
First iteration of the Docker Image Variant v2 ADR (#150), published alongside the existing v1 images — nothing in the v1 build chain changes (root
docker-bake.hclis untouched).New images
ghcr.io/shopware/docker-base:<php>-frankenphp-v2026.1(+ Docker Hub)ghcr.io/shopware/docker-dev:<php>-node<22|24>-v2026.1Layout
One directory per calendar version:
v2026.1/contains thefrankenphpanddevbuild contexts and its owndocker-bake.hcl, built by a workflow scoped to that directory (build-v2026.1.yml). The sharedbuild-bake-publishaction gained afilesinput (defaults to the root bake file, v1 workflows unaffected).ADR items implemented
dunglas/frankenphppinned by digest (frankenphpDigestMatrix, refreshed byupdate-php-matrix.mjs)install-php-extensions2.11.12,redis-6.3.0,apcu-5.1.28,amqp-2.2.0,zstd-0.18.0,grpc-1.83.0,opentelemetry-1.2.1,xdebug-3.5.3; all pins live as bake variables (single source of truth for prod + dev). No more amqp git pin / grpc patch stack — plain PECL builds on DebianPHP_INI_SCAN_DIRwhenPHP_EXTENSION_GRPC=1/PHP_EXTENSION_OPENTELEMETRY=1(no fs writes, read-only rootfs safe)APP_ENV,LOCK_DSN,MAILER_DSN,SHOPWARE_*,INSTALL_*removed; onlyPHP_*/COMPOSER_*infrastructure defaults remainSHOPWARE_IMAGE_{VERSION,SECURITY_ONLY,EOL}env +com.shopware.image.*labels;shopware-image-lifecycleprints escalating startup warnings (notice → prominent ≤90d → loud past EOL), suppressible viaSHOPWARE_DOCKER_SUPPRESS_EOL_WARNING=1; best-effortONBUILDbuild-time check. Strictly warn-onlyprovenance=mode=maxattestations, OCI source/revision/version/created labels,HEALTHCHECKvia the Caddy admin endpointPHP_PROFILER=<name>; uid 1000 as in v1 dev (base image keeps uid/gid 82 for v1 parity)CI
build-v2026.1.ymlbuilds both targets and asserts the contract: optional extensions absent by default / loadable via env, no app env baked, uid/gid 82, dev container-structure tests (18 tests). The security scan matrix includes the new variant.Verified locally (arm64, PHP 8.4)
healthy), and all structure tests passupdate-php-matrix.mjsround-trips idempotently and auto-discoversv*/docker-bake.hclfiles (futurev2027.1/needs no script change)Deliberately out of scope (follow-ups per ADR migration outline)
🤖 Generated with Claude Code