From 344232fb758e65cac6b778ce539b4f48cab638d3 Mon Sep 17 00:00:00 2001 From: Stefan Bethke Date: Sun, 15 Nov 2026 11:36:49 +0100 Subject: [PATCH] fix: Hardens web container - document root is owned by root and not writable by www-data (the base image ships /var/www/html as www-data with mode 1777) - uses php.ini-production, so errors are not shown to clients - disables directory listings, expose_php and the detailed server signature --- web/Containerfile | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/web/Containerfile b/web/Containerfile index e8b5998..c84f8a7 100644 --- a/web/Containerfile +++ b/web/Containerfile @@ -1,4 +1,17 @@ FROM docker.io/library/php:apache RUN docker-php-ext-install mysqli bcmath -COPY ./www/* /var/www/html \ No newline at end of file + +# Use PHP's production defaults (no error output to clients) and hide the PHP version. +RUN cp "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini" \ + && printf 'expose_php = Off\n' > "$PHP_INI_DIR/conf.d/zz-hardening.ini" + +# Disable directory listings and reduce the server signature. +RUN sed -i 's/^\(\s*Options\) Indexes FollowSymLinks/\1 FollowSymLinks/' /etc/apache2/apache2.conf \ + && sed -i -e 's/^ServerTokens .*/ServerTokens Prod/' -e 's/^ServerSignature .*/ServerSignature Off/' /etc/apache2/conf-available/security.conf + +COPY ./www/* /var/www/html + +# The web server must not be able to create or modify files in the document root. +RUN chown -R root:root /var/www/html \ + && chmod -R u=rwX,go=rX /var/www/html