dockerls 1.0.0__py3-none-any.whl

dockerls/infrastructure/templates/hardening/java-debian.dockerfile

@@ -0,0 +1,50 @@
+# Dockerfile.hardened.java-debian
+# Hardened template for Java 21 (Eclipse Temurin JRE Debian Bookworm)
+
+ARG JDK_VERSION=21-jdk
+ARG JRE_VERSION=21-jre
+
+# Stage 1: Build
+FROM eclipse-temurin:${JDK_VERSION} AS builder
+
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y --no-install-recommends maven \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY pom.xml ./
+COPY src ./src
+RUN mvn clean package -DskipTests || true
+
+# Stage 2: Runtime
+FROM eclipse-temurin:${JRE_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+ENV JAVA_OPTS="-XX:+UseContainerSupport -XX:MaxRAMPercentage=75.0 -Djava.security.egd=file:/dev/./urandom"
+
+RUN apt-get update && apt-get upgrade -y \
+    && groupadd -g 10001 appgroup \
+    && useradd -u 10001 -g appgroup -s /usr/sbin/nologin -m appuser \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+WORKDIR /app
+
+COPY --from=builder --chown=appuser:appgroup /app/target/*.jar /app/app.jar
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+    CMD [ -f /app/app.jar ] || exit 1
+
+EXPOSE 8080
+
+ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar /app/app.jar"]

dockerls/infrastructure/templates/hardening/java-distroless.dockerfile

@@ -0,0 +1,39 @@
+# Dockerfile.hardened.java-distroless
+# Hardened template for Java 21 (Google Distroless - No Shell)
+
+ARG JDK_VERSION=21-jdk-alpine
+
+# Stage 1: Build
+FROM eclipse-temurin:${JDK_VERSION} AS builder
+
+WORKDIR /app
+
+RUN apk add --no-cache maven
+
+COPY pom.xml ./
+COPY src ./src
+RUN mvn clean package -DskipTests || true
+
+# Stage 2: Distroless Java 21 Runtime (No Shell)
+FROM gcr.io/distroless/java21-debian12:nonroot
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+WORKDIR /app
+
+COPY --from=builder /app/target/*.jar /app/app.jar
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+# nonroot user in Distroless
+USER 65532:65532
+
+EXPOSE 8080
+
+ENTRYPOINT ["java", "-XX:+UseContainerSupport", "-XX:MaxRAMPercentage=75.0", "-jar", "/app/app.jar"]

dockerls/infrastructure/templates/hardening/java-ubuntu.dockerfile

@@ -0,0 +1,54 @@
+# Dockerfile.hardened.java-ubuntu
+# Hardened template for Java 21 (Eclipse Temurin JRE Ubuntu 24.04)
+
+ARG UBUNTU_VERSION=24.04
+
+# Stage 1: Build
+FROM ubuntu:${UBUNTU_VERSION} AS builder
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    openjdk-21-jdk maven ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY pom.xml ./
+COPY src ./src
+RUN mvn clean package -DskipTests || true
+
+# Stage 2: Runtime
+FROM ubuntu:${UBUNTU_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    JAVA_OPTS="-XX:+UseContainerSupport -XX:MaxRAMPercentage=75.0 -Djava.security.egd=file:/dev/./urandom"
+
+RUN apt-get update && apt-get upgrade -y \
+    && apt-get install -y --no-install-recommends openjdk-21-jre-headless ca-certificates \
+    && groupadd -g 10001 appgroup \
+    && useradd -u 10001 -g appgroup -s /usr/sbin/nologin -m appuser \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+WORKDIR /app
+
+COPY --from=builder --chown=appuser:appgroup /app/target/*.jar /app/app.jar
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+    CMD [ -f /app/app.jar ] || exit 1
+
+EXPOSE 8080
+
+ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar /app/app.jar"]

dockerls/infrastructure/templates/hardening/java.dockerfile

@@ -0,0 +1,60 @@
+# Dockerfile.hardened.java
+# Hardened template for Java / JVM - Production Ready (Eclipse Temurin 21)
+
+# Stage 1: Builder
+FROM eclipse-temurin:21-jdk-alpine AS builder
+
+WORKDIR /app
+
+# Copy build output from Maven or Gradle
+COPY pom.xml* mvnw* ./
+COPY .mvn ./.mvn
+COPY build.gradle* settings.gradle* gradlew* ./
+COPY gradle ./gradle
+
+# Download dependencies
+RUN if [ -f "./mvnw" ]; then ./mvnw dependency:go-offline; \
+    elif [ -f "./gradlew" ]; then ./gradlew --no-daemon dependencies; fi || true
+
+COPY src ./src
+
+# Compile the jar package
+RUN if [ -f "./mvnw" ]; then ./mvnw clean package -DskipTests; \
+    elif [ -f "./gradlew" ]; then ./gradlew --no-daemon bootJar || ./gradlew --no-daemon build -x test; \
+    fi || true
+
+RUN find target build/libs -name "*.jar" ! -name "*sources*" ! -name "*javadoc*" -exec cp {} /app/app.jar \; || touch /app/app.jar
+
+# Stage 2: Runtime Minimal
+FROM eclipse-temurin:21-jre-alpine
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="your-team@company.com"
+LABEL security.cve-contact="security@company.com"
+
+# JVM flags tuned for containers and security
+ENV JAVA_OPTS="-XX:+UseContainerSupport -XX:MaxRAMPercentage=75.0 -Djava.security.egd=file:/dev/./urandom"
+
+RUN addgroup -g 10001 appgroup && \
+    adduser -D -u 10001 -G appgroup -h /home/appuser appuser
+
+WORKDIR /app
+
+COPY --from=builder --chown=appuser:appgroup /app/app.jar /app/app.jar
+
+# Build metadata
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+    CMD nc -z localhost 8080 || exit 1
+
+EXPOSE 8080
+
+ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar /app/app.jar"]

dockerls/infrastructure/templates/hardening/maven-alpine.dockerfile

@@ -0,0 +1,56 @@
+# Dockerfile.hardened.maven-alpine
+# Hardened template for a Java application built with Maven (Alpine).
+#
+# The build uses the official Maven image, which carries the JDK and the
+# tool; the runtime uses only the JRE. This separation keeps the compiler,
+# the Maven cache, and the build dependency tree out of the image that ships
+# to production -- none of it is needed to *run* the application, and each
+# one is attack surface and CVEs to triage later.
+
+ARG MAVEN_VERSION=3.9-eclipse-temurin-21-alpine
+ARG JRE_VERSION=21-jre-alpine
+
+# Stage 1: Build
+FROM maven:${MAVEN_VERSION} AS builder
+
+WORKDIR /app
+
+# The POM goes in alone first: that way the dependency layer is only
+# rebuilt when the POM changes, not on every code change.
+COPY pom.xml ./
+RUN mvn -B dependency:go-offline
+
+COPY src ./src
+RUN mvn -B clean package -DskipTests
+
+# Stage 2: Runtime
+FROM eclipse-temurin:${JRE_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+ENV JAVA_OPTS="-XX:+UseContainerSupport -XX:MaxRAMPercentage=75.0 -Djava.security.egd=file:/dev/./urandom"
+
+RUN apk upgrade --no-cache \
+    && addgroup -g 10001 appgroup \
+    && adduser -u 10001 -G appgroup -s /sbin/nologin -D appuser
+
+WORKDIR /app
+
+COPY --from=builder --chown=appuser:appgroup /app/target/*.jar /app/app.jar
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+    CMD [ -f /app/app.jar ] || exit 1
+
+EXPOSE 8080
+
+ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar /app/app.jar"]

dockerls/infrastructure/templates/hardening/maven.dockerfile

@@ -0,0 +1,57 @@
+# Dockerfile.hardened.maven
+# Hardened template for a Java application built with Maven (Debian slim).
+#
+# The build uses the official Maven image, which carries the JDK and the
+# tool; the runtime uses only the JRE. This separation keeps the compiler,
+# the Maven cache, and the build dependency tree out of the image that ships
+# to production -- none of it is needed to *run* the application, and each
+# one is attack surface and CVEs to triage later.
+
+ARG MAVEN_VERSION=3.9-eclipse-temurin-21
+ARG JRE_VERSION=21-jre
+
+# Stage 1: Build
+FROM maven:${MAVEN_VERSION} AS builder
+
+WORKDIR /app
+
+# The POM goes in alone first: that way the dependency layer is only
+# rebuilt when the POM changes, not on every code change.
+COPY pom.xml ./
+RUN mvn -B dependency:go-offline
+
+COPY src ./src
+RUN mvn -B clean package -DskipTests
+
+# Stage 2: Runtime
+FROM eclipse-temurin:${JRE_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+ENV JAVA_OPTS="-XX:+UseContainerSupport -XX:MaxRAMPercentage=75.0 -Djava.security.egd=file:/dev/./urandom"
+
+RUN apt-get update && apt-get upgrade -y --no-install-recommends \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd -g 10001 appgroup \
+    && useradd -u 10001 -g appgroup -s /usr/sbin/nologin -m appuser
+
+WORKDIR /app
+
+COPY --from=builder --chown=appuser:appgroup /app/target/*.jar /app/app.jar
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+    CMD [ -f /app/app.jar ] || exit 1
+
+EXPOSE 8080
+
+ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar /app/app.jar"]

dockerls/infrastructure/templates/hardening/node-alpine.dockerfile

@@ -0,0 +1,47 @@
+# Dockerfile.hardened.node-alpine
+# Hardened template for Node.js 22 (Alpine Linux musl)
+
+ARG NODE_VERSION=22-alpine
+
+# Stage 1: Builder
+FROM node:${NODE_VERSION} AS builder
+
+WORKDIR /app
+
+RUN apk add --no-cache python3 make g++ && rm -rf /var/cache/apk/*
+
+COPY package*.json ./
+RUN npm ci --only=production && npm cache clean --force
+
+COPY . .
+RUN npm run build || true
+
+# Stage 2: Runtime
+FROM node:${NODE_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+ENV NODE_ENV=production
+
+WORKDIR /app
+
+COPY --from=builder --chown=node:node /app/node_modules ./node_modules
+COPY --chown=node:node . .
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER node
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD node -e "require('http').get('http://localhost:3000/health', (r) => {if (r.statusCode !== 200) process.exit(1)}).on('error', () => process.exit(1))"
+
+EXPOSE 3000
+
+ENTRYPOINT ["node"]
+CMD ["--enable-source-maps", "dist/index.js"]

dockerls/infrastructure/templates/hardening/node-debian.dockerfile

@@ -0,0 +1,54 @@
+# Dockerfile.hardened.node-debian
+# Hardened template for Node.js 22 (Debian Bookworm Slim - glibc)
+
+ARG NODE_VERSION=22-bookworm-slim
+
+# Stage 1: Builder
+FROM node:${NODE_VERSION} AS builder
+
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential python3 ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY package*.json ./
+RUN npm ci --only=production && npm cache clean --force
+
+COPY . .
+RUN npm run build || true
+
+# Stage 2: Runtime
+FROM node:${NODE_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+ENV NODE_ENV=production
+
+# Update OS security packages
+RUN apt-get update && apt-get upgrade -y \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+WORKDIR /app
+
+# The 'node' user (UID 1000) already exists in the official Debian Node image
+COPY --from=builder --chown=node:node /app/node_modules ./node_modules
+COPY --chown=node:node . .
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER node
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD node -e "require('http').get('http://localhost:3000/health', (r) => {if (r.statusCode !== 200) process.exit(1)}).on('error', () => process.exit(1))"
+
+EXPOSE 3000
+
+ENTRYPOINT ["node"]
+CMD ["--enable-source-maps", "dist/index.js"]

dockerls/infrastructure/templates/hardening/node-distroless.dockerfile

@@ -0,0 +1,46 @@
+# Dockerfile.hardened.node-distroless
+# Hardened template for Node.js 22 (Google Distroless - No Shell)
+
+ARG NODE_VERSION=22-alpine
+
+# Stage 1: Builder
+FROM node:${NODE_VERSION} AS builder
+
+WORKDIR /app
+
+RUN apk add --no-cache python3 make g++ && rm -rf /var/cache/apk/*
+
+COPY package*.json ./
+RUN npm ci --only=production && npm cache clean --force
+
+COPY . .
+RUN npm run build || true
+
+# Stage 2: Distroless Runtime (Zero Shell)
+FROM gcr.io/distroless/nodejs22-debian12:nonroot
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+ENV NODE_ENV=production
+
+WORKDIR /app
+
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/dist ./dist
+COPY --from=builder /app/package.json ./package.json
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+# nonroot user in Distroless is 65532:65532
+USER 65532:65532
+
+EXPOSE 3000
+
+ENTRYPOINT ["/nodejs/bin/node"]
+CMD ["--enable-source-maps", "dist/index.js"]

dockerls/infrastructure/templates/hardening/node-ubuntu.dockerfile

@@ -0,0 +1,63 @@
+# Dockerfile.hardened.node-ubuntu
+# Hardened template for Node.js 22 (Ubuntu 24.04 LTS)
+
+ARG UBUNTU_VERSION=24.04
+
+# Stage 1: Builder
+FROM ubuntu:${UBUNTU_VERSION} AS builder
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl ca-certificates build-essential \
+    && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
+    && apt-get install -y --no-install-recommends nodejs \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci --only=production && npm cache clean --force
+
+COPY . .
+RUN npm run build || true
+
+# Stage 2: Runtime
+FROM ubuntu:${UBUNTU_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV NODE_ENV=production
+
+RUN apt-get update && apt-get upgrade -y \
+    && apt-get install -y --no-install-recommends curl ca-certificates \
+    && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
+    && apt-get install -y --no-install-recommends nodejs \
+    && groupadd -g 10001 nodeuser \
+    && useradd -u 10001 -g nodeuser -s /usr/sbin/nologin -m nodeuser \
+    && apt-get purge -y curl \
+    && apt-get autoremove -y \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+WORKDIR /app
+
+COPY --from=builder --chown=nodeuser:nodeuser /app/node_modules ./node_modules
+COPY --chown=nodeuser:nodeuser . .
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER nodeuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD node -e "require('http').get('http://localhost:3000/health', (r) => {if (r.statusCode !== 200) process.exit(1)}).on('error', () => process.exit(1))"
+
+EXPOSE 3000
+
+ENTRYPOINT ["node"]
+CMD ["--enable-source-maps", "dist/index.js"]

dockerls/infrastructure/templates/hardening/node.dockerfile

@@ -0,0 +1,61 @@
+# Dockerfile.hardened.node
+# Hardened template for Node.js - Production Ready
+
+ARG NODE_VERSION=22-alpine
+
+# Stage 1: Builder
+FROM node:${NODE_VERSION} AS builder
+
+WORKDIR /app
+
+# Install build dependencies if needed (stay only in the builder)
+RUN apk add --no-cache \
+    python3 \
+    make \
+    g++ \
+    && rm -rf /var/cache/apk/*
+
+# Copy package manifests and install clean dependencies
+COPY package*.json ./
+RUN npm ci --only=production \
+    && npm cache clean --force
+
+# Copy source and build
+COPY . .
+RUN npm run build || true
+
+# Stage 2: Runtime
+FROM node:${NODE_VERSION}
+
+# Security labels
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="your-team@company.com"
+LABEL security.cve-contact="security@company.com"
+
+# Production environment variables
+ENV NODE_ENV=production
+
+WORKDIR /app
+
+# Copy only the necessary artifacts with ownership for the 'node' user
+COPY --from=builder --chown=node:node /app/node_modules ./node_modules
+COPY --chown=node:node . .
+
+# Build metadata
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER node
+
+# Secure native health check
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD node -e "require('http').get('http://localhost:3000/health', (r) => {if (r.statusCode !== 200) process.exit(1)}).on('error', () => process.exit(1))"
+
+EXPOSE 3000
+
+# No shell - exec form
+ENTRYPOINT ["node"]
+CMD ["--enable-source-maps", "dist/index.js"]

dockerls/infrastructure/templates/hardening/php-alpine.dockerfile

@@ -0,0 +1,45 @@
+# Dockerfile.hardened.php-alpine
+# Hardened template for PHP 8.3 (Alpine Linux)
+
+ARG PHP_VERSION=8.3-cli-alpine
+ARG COMPOSER_VERSION=2
+
+# Stage 1: Composer dependencies
+FROM composer:${COMPOSER_VERSION} AS vendor
+
+WORKDIR /app
+COPY composer.json composer.lock ./
+RUN composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader || true
+
+# Stage 2: PHP Runtime
+FROM php:${PHP_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+RUN apk update && apk upgrade --no-cache \
+    && addgroup -g 10001 appgroup \
+    && adduser -u 10001 -G appgroup -s /sbin/nologin -D appuser \
+    && rm -rf /var/cache/apk/*
+
+WORKDIR /app
+
+COPY --from=vendor --chown=appuser:appgroup /app/vendor ./vendor
+COPY --chown=appuser:appgroup . .
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
+    CMD php -v || exit 1
+
+EXPOSE 8000
+
+ENTRYPOINT ["php"]
+CMD ["-S", "0.0.0.0:8000", "-t", "public"]

dockerls/infrastructure/templates/hardening/php-debian.dockerfile

@@ -0,0 +1,45 @@
+# Dockerfile.hardened.php-debian
+# Hardened template for PHP 8.3 (Debian Bookworm Slim)
+
+ARG PHP_VERSION=8.3-cli-bookworm
+ARG COMPOSER_VERSION=2
+
+# Stage 1: Composer dependencies
+FROM composer:${COMPOSER_VERSION} AS vendor
+
+WORKDIR /app
+COPY composer.json composer.lock ./
+RUN composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader || true
+
+# Stage 2: PHP Runtime
+FROM php:${PHP_VERSION}
+
+LABEL security.scanner="dockerls"
+LABEL security.hardened="true"
+LABEL maintainer="security@company.com"
+LABEL security.cve-contact="security@company.com"
+
+RUN apt-get update && apt-get upgrade -y \
+    && groupadd -g 10001 appgroup \
+    && useradd -u 10001 -g appgroup -s /usr/sbin/nologin -m appuser \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+WORKDIR /app
+
+COPY --from=vendor --chown=appuser:appgroup /app/vendor ./vendor
+COPY --chown=appuser:appgroup . .
+
+ARG GIT_SHA=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.revision="${GIT_SHA}"
+LABEL org.opencontainers.image.created="${BUILD_TIME}"
+
+USER appuser
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
+    CMD php -v || exit 1
+
+EXPOSE 8000
+
+ENTRYPOINT ["php"]
+CMD ["-S", "0.0.0.0:8000", "-t", "public"]