sinchro.log

Делал на основе Patching PHP 7.4 for php2shell in a container | Josh Bowen’s Weblog

1. Создаём на хосте mkdir -p /opt/build/wp74-php2shell
2. Переходим туда cd /opt/build/wp74-php2shell
3. Создаем Dockerfile nano Dockerfile

Вставляем в Dockerfile блок из статьи (заменяем вторую строку на «ARG PHP_IMAGE=wordpress:php7.4-apache») —

# Change or override this for another flavor
# ARG PHP_IMAGE=php:7.4-cli 
ARG PHP_IMAGE=wordpress:php7.4-apache

FROM ${PHP_IMAGE} AS build

# "Avoid state corruption via bailout" on php-src's PHP-7.4-CVE-2026-109618-109619
ARG PHP_FIX_COMMIT=712e60f9edfd03f0960fc4fc3c2c375f42b90aa2

RUN set -eux; \
	{ \
		echo 'deb http://archive.debian.org/debian bullseye main'; \
		echo 'deb http://archive.debian.org/debian bullseye-updates main'; \
		echo 'deb http://archive.debian.org/debian-security bullseye-security main'; \
	} > /etc/apt/sources.list; \
	apt-get update; \
	apt-get install -y --no-install-recommends \
		$PHPIZE_DEPS git patch \
		libargon2-dev libcurl4-openssl-dev libonig-dev libreadline-dev libsodium-dev \
		libsqlite3-dev libssl-dev libxml2-dev zlib1g-dev \
	; \
	case "$(php-config --configure-options)" in \
		*--with-apxs2*) apt-get install -y --no-install-recommends apache2-dev ;; \
	esac

RUN set -eux; \
	git init -q /usr/src/php-fix; \
	cd /usr/src/php-fix; \
	git remote add origin https://github.com/php/php-src.git; \
	git fetch -q --depth 2 --filter=blob:none origin "$PHP_FIX_COMMIT"; \
	git diff "$PHP_FIX_COMMIT^" "$PHP_FIX_COMMIT" > /usr/src/php-fix.patch

RUN set -eux; \
	export CFLAGS="$PHP_CFLAGS" CPPFLAGS="$PHP_CPPFLAGS" LDFLAGS="$PHP_LDFLAGS"; \
	configureOptions="$(php-config --configure-options)"; \
	docker-php-source extract; \
	cd /usr/src/php; \
	patch -p1 --forward --no-backup-if-mismatch < /usr/src/php-fix.patch; \
	\
# Ship the patched source too, so docker-php-ext-install builds against it.
	mkdir -p /out/usr/src; \
	tar -cJf /out/usr/src/php.tar.xz -C /usr/src --exclude=.docker-delete-me \
		--transform 's,^php,php-7.4.33,' php; \
	\
	debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
	[ -e /usr/include/curl ] || [ -e /usr/local/include/curl ] \
		|| ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
	./configure $configureOptions; \
	make -j "$(nproc)"; \
# apxs (apache variant) wants a config dir; the image's own config is kept.
	mkdir -p /out/etc/apache2/mods-available; \
	make INSTALL_ROOT=/out install-sapi install-binaries install-build \
		install-headers install-programs install-modules; \
	rm -rf /out/etc; \
	find /out -type f -perm '/0111' -exec strip --strip-all '{}' + || :

FROM ${PHP_IMAGE}

RUN set -eux; \
	{ \
		echo 'deb http://archive.debian.org/debian bullseye main'; \
		echo 'deb http://archive.debian.org/debian bullseye-updates main'; \
		echo 'deb http://archive.debian.org/debian-security bullseye-security main'; \
	} > /etc/apt/sources.list; \
	apt-get update; \
	apt-get upgrade -y; \
	rm -rf /var/lib/apt/lists/*

COPY --from=build /out/ /

RUN set -eux; \
	rm -f /usr/src/php.tar.xz.asc; \
	php --version

4. Собираем образ — docker build -t wordpress:php7.4-apache-php2shell .

5. Проверяем образ — docker run —rm wordpress:php7.4-apache-php2shell php -v

Версия PHP не меняется, но должна измениться дата сборки php

Если всё ок, то в докере есть обновлённый образ wordpress:php7.4-apache-php2shell