chore: cleanup VirtioFS workarounds, parameterize PHP version, add Makefile, and fix minor issues

Makefile

@@ -0,0 +1,60 @@
+.DEFAULT_GOAL := help
+
+.PHONY: help build build-core build-modules build-guard build-slim bake up down logs shellcheck clean prune
+
+help:
+	@echo "Usage: make <target>"
+	@echo ""
+	@echo "Build targets:"
+	@echo "  build          Build all images via docker compose"
+	@echo "  build-core     Build misp-core only"
+	@echo "  build-modules  Build misp-modules only"
+	@echo "  build-guard    Build misp-guard only"
+	@echo "  build-slim     Build all slim variant images"
+	@echo "  bake           Build all images via docker buildx bake"
+	@echo ""
+	@echo "Runtime targets:"
+	@echo "  up             Start all services in background"
+	@echo "  down           Stop all services"
+	@echo "  logs           Tail logs from all services"
+	@echo ""
+	@echo "Utility targets:"
+	@echo "  shellcheck     Lint shell scripts"
+	@echo "  clean          Stop services and remove volumes"
+	@echo "  prune          Docker system prune (cleanup)"
+
+build:
+	docker compose build
+
+build-core:
+	docker compose build misp-core
+
+build-modules:
+	docker compose build misp-modules
+
+build-guard:
+	docker compose build misp-guard
+
+build-slim:
+	docker compose build --build-arg CORE_FLAVOR=slim --build-arg MODULES_FLAVOR=slim
+
+bake:
+	docker buildx bake
+
+up:
+	docker compose up -d
+
+down:
+	docker compose down
+
+logs:
+	docker compose logs -f
+
+shellcheck:
+	shellcheck core/files/*.sh core/files/kubernetes/*.sh guard/files/*.sh
+
+clean:
+	docker compose down -v --remove-orphans
+
+prune:
+	docker system prune -af --volumes

core/Dockerfile

@@ -5,7 +5,10 @@ FROM "${DOCKER_HUB_PROXY}python:3.14-slim-trixie" AS php-base
 ENV DEBIAN_FRONTEND=noninteractive
 ARG CORE_TAG
 ARG CORE_COMMIT
-ARG PHP_VER
+ARG PHP_API_VERSION
+RUN : "${PHP_API_VERSION:?Build argument PHP_API_VERSION is required and cannot be empty.}"
+ARG PHP_PACKAGE_VERSION
+RUN : "${PHP_PACKAGE_VERSION:?Build argument PHP_PACKAGE_VERSION is required and cannot be empty.}"
 ARG CORE_FLAVOR
 
 # Uncomment when building in corporate environments
@@ -29,15 +32,15 @@ RUN <<-EOF
                 mariadb-client \
                 rsync \
                 rsyslog \
-                php8.4 \
-                php8.4-curl \
-                php8.4-xml \
-                php8.4-mbstring \
-                php8.4-mysql \
-                php8.4-redis \
-                php8.4-gd \
-                php8.4-fpm \
-                php8.4-zip \
+                php${PHP_PACKAGE_VERSION} \
+                php${PHP_PACKAGE_VERSION}-curl \
+                php${PHP_PACKAGE_VERSION}-xml \
+                php${PHP_PACKAGE_VERSION}-mbstring \
+                php${PHP_PACKAGE_VERSION}-mysql \
+                php${PHP_PACKAGE_VERSION}-redis \
+                php${PHP_PACKAGE_VERSION}-gd \
+                php${PHP_PACKAGE_VERSION}-fpm \
+                php${PHP_PACKAGE_VERSION}-zip \
                 unzip \
                 zip \
                 curl \
@@ -58,19 +61,19 @@ RUN <<-EOF
                 mariadb-client \
                 rsync \
                 rsyslog \
-                php8.4 \
-                php8.4-apcu \
-                php8.4-curl \
-                php8.4-xml \
-                php8.4-intl \
-                php8.4-bcmath \
-                php8.4-mbstring \
-                php8.4-mysql \
-                php8.4-redis \
-                php8.4-gd \
-                php8.4-fpm \
-                php8.4-zip \
-                php8.4-ldap \
+                php${PHP_PACKAGE_VERSION} \
+                php${PHP_PACKAGE_VERSION}-apcu \
+                php${PHP_PACKAGE_VERSION}-curl \
+                php${PHP_PACKAGE_VERSION}-xml \
+                php${PHP_PACKAGE_VERSION}-intl \
+                php${PHP_PACKAGE_VERSION}-bcmath \
+                php${PHP_PACKAGE_VERSION}-mbstring \
+                php${PHP_PACKAGE_VERSION}-mysql \
+                php${PHP_PACKAGE_VERSION}-redis \
+                php${PHP_PACKAGE_VERSION}-gd \
+                php${PHP_PACKAGE_VERSION}-fpm \
+                php${PHP_PACKAGE_VERSION}-zip \
+                php${PHP_PACKAGE_VERSION}-ldap \
                 libmagic1 \
                 libldap-common \
                 librdkafka1 \
@@ -122,15 +125,15 @@ RUN <<-EOF
                 g++ \
                 git \
                 make \
-                php8.4-dev \
+                php${PHP_PACKAGE_VERSION}-dev \
                 php-pear
         else
             apt-get install -y --no-install-recommends \
                 gcc \
                 g++ \
                 git \
                 make \
-                php8.4-dev \
+                php${PHP_PACKAGE_VERSION}-dev \
                 php-pear \
                 libbrotli-dev \
                 libfuzzy-dev \
@@ -141,9 +144,9 @@ RUN <<-EOF
         apt-get autoremove -y && apt-get clean -y && rm -rf /var/lib/apt/lists/*
 EOF
 
-RUN update-alternatives --set php /usr/bin/php8.4
-RUN update-alternatives --set php-config /usr/bin/php-config8.4
-RUN update-alternatives --set phpize /usr/bin/phpize8.4
+RUN update-alternatives --set php /usr/bin/php${PHP_PACKAGE_VERSION}
+RUN update-alternatives --set php-config /usr/bin/php-config${PHP_PACKAGE_VERSION}
+RUN update-alternatives --set phpize /usr/bin/phpize${PHP_PACKAGE_VERSION}
 
 RUN <<-EOF
         pecl channel-update pecl.php.net
@@ -158,28 +161,16 @@ RUN <<-EOF
             git clone --recursive --depth=1 https://github.com/JakubOnderka/pecl-text-ssdeep.git /tmp/pecl-text-ssdeep
             cd /tmp/pecl-text-ssdeep && phpize && ./configure && make && make install
             tar -czf /pecl_libs.tar.gz \
-                /usr/lib/php/${PHP_VER}/ssdeep.so \
-                /usr/lib/php/${PHP_VER}/rdkafka.so \
-                /usr/lib/php/${PHP_VER}/brotli.so \
-                /usr/lib/php/${PHP_VER}/simdjson.so \
-                /usr/lib/php/${PHP_VER}/zstd.so
+                /usr/lib/php/${PHP_API_VERSION}/ssdeep.so \
+                /usr/lib/php/${PHP_API_VERSION}/rdkafka.so \
+                /usr/lib/php/${PHP_API_VERSION}/brotli.so \
+                /usr/lib/php/${PHP_API_VERSION}/simdjson.so \
+                /usr/lib/php/${PHP_API_VERSION}/zstd.so
         fi
 EOF
 
 
 FROM php-base AS python-build
-ARG PYPI_JSONSCHEMA_VERSION
-ARG PYPI_LIEF_VERSION
-ARG PYPI_MISP_STIX_VERSION
-ARG PYPI_PLYARA_VERSION
-ARG PYPI_PYDEEP2_VERSION
-ARG PYPI_PYMISP_VERSION
-ARG PYPI_PYTHON_MAGIC_VERSION
-ARG PYPI_PYZMQ_VERSION
-ARG PYPI_REDIS_VERSION
-ARG PYPI_TAXII2_CLIENT_VERSION
-ARG PYPI_SETUPTOOLS_VERSION
-ARG PYPI_SUPERVISOR_VERSION
 
 RUN apt-get install -y --no-install-recommends \
     gcc \
@@ -199,6 +190,20 @@ RUN <<-EOF
         cd /var/www/MISP || exit; git submodule update --init --recursive .
 EOF
 
+ARG PYPI_SETUPTOOLS_VERSION
+RUN : "${PYPI_SETUPTOOLS_VERSION:?Build argument PYPI_SETUPTOOLS_VERSION is required and cannot be empty.}"
+ARG PYPI_SUPERVISOR_VERSION
+RUN : "${PYPI_SUPERVISOR_VERSION:?Build argument PYPI_SUPERVISOR_VERSION is required and cannot be empty.}"
+ARG PYPI_JSONSCHEMA_VERSION
+ARG PYPI_LIEF_VERSION
+ARG PYPI_MISP_STIX_VERSION
+ARG PYPI_PLYARA_VERSION
+ARG PYPI_PYDEEP2_VERSION
+ARG PYPI_PYMISP_VERSION
+ARG PYPI_PYTHON_MAGIC_VERSION
+ARG PYPI_PYZMQ_VERSION
+ARG PYPI_REDIS_VERSION
+ARG PYPI_TAXII2_CLIENT_VERSION
 RUN <<-EOF
         mkdir /wheels
 
@@ -254,7 +259,8 @@ ENV PATH="/var/www/MISP/app/Console:${PATH}"
 
 # Remove some defaults (kernel logging) and fix alternatives
 RUN sed -i '/imklog/s/^/#/' /etc/rsyslog.conf
-RUN update-alternatives --set php /usr/bin/php8.4
+RUN update-alternatives --set php /usr/bin/php${PHP_PACKAGE_VERSION}
+RUN ln -sf /usr/sbin/php-fpm${PHP_PACKAGE_VERSION} /usr/local/sbin/php-fpm
 RUN apt-get autoremove -y && apt-get clean -y && rm -rf /var/lib/apt/lists/*
 
 # Install python modules
@@ -309,6 +315,8 @@ EOF
 
 # Copy all our image specific files to appropriate locations
 COPY files/ /
+# Template PHP version into nginx config
+RUN sed -i "s/@PHP_PACKAGE_VERSION@/${PHP_PACKAGE_VERSION}/g" /etc/nginx/includes/misp
 ENTRYPOINT [ "/entrypoint.sh" ]
 
 # Change Workdirectory

core/files/entrypoint.sh

@@ -53,8 +53,7 @@ export MISP_MODULES_FQDN=${MISP_MODULES_FQDN:-http://misp-modules}
 export ATTACHMENTS_DIR=${ATTACHMENTS_DIR:-/var/www/MISP/app/files}
 
 export AUTOCONF_GPG=${AUTOCONF_GPG:-true}
-export AUTOCONF_ADMIN_KEY=${AUTOCONF_ADMIN_KEY:-true}
-export AUTOGEN_ADMIN_KEY=${AUTOGEN_ADMIN_KEY:-$AUTOCONF_ADMIN_KEY}
+export AUTOGEN_ADMIN_KEY=${AUTOGEN_ADMIN_KEY:-${AUTOCONF_ADMIN_KEY:-true}}
 export OIDC_ENABLE=${OIDC_ENABLE:-false}
 export OIDC_MIXEDAUTH=${OIDC_MIXEDAUTH:-false}
 export OIDC_AUTH_METHOD=${OIDC_AUTH_METHOD:-client_secret_post}

core/files/entrypoint_fpm.sh

@@ -110,7 +110,7 @@ fi
 echo "Configure PHP | Change PHP values ..." && change_php_vars
 
 echo "Configure PHP | Starting PHP FPM"
-/usr/sbin/php-fpm8.4 -R -F & master_pid=$!
+/usr/local/sbin/php-fpm -R -F & master_pid=$!
 
 # Wait for it
 wait "$master_pid"

core/files/entrypoint_nginx.sh

@@ -52,6 +52,18 @@ update_database_tls_config() {
     rm -f "$tmp"
 }
 
+# safe_sed_i avoids sed -i which creates temp files alongside the target,
+# broken on VirtioFS (Docker Desktop for Mac). Uses mktemp + cat pattern.
+safe_sed_i() {
+    local file="${@: -1}"
+    local tmp
+    tmp="$(mktemp)"
+    if sed "${@:1:$(($#-1))}" "$file" > "$tmp" && [[ -s "$tmp" ]]; then
+        cat "$tmp" > "$file"
+    fi
+    rm -f "$tmp"
+}
+
 init_mysql(){
     # Test when MySQL is ready....
     # wait for Database come ready
@@ -90,32 +102,26 @@ init_misp_data_files(){
     # Init config (shared with host)
     echo "... initialize configuration files"
     MISP_APP_CONFIG_PATH=/var/www/MISP/app/Config
-    # workaround for https://forums.docker.com/t/sed-couldnt-open-temporary-file-xyz-permission-denied-when-using-virtiofs/125473
-    # [ -f $MISP_APP_CONFIG_PATH/bootstrap.php ] || cp $MISP_APP_CONFIG_PATH.dist/bootstrap.default.php $MISP_APP_CONFIG_PATH/bootstrap.php
-    # [ -f $MISP_APP_CONFIG_PATH/database.php ] || cp $MISP_APP_CONFIG_PATH.dist/database.default.php $MISP_APP_CONFIG_PATH/database.php
-    # [ -f $MISP_APP_CONFIG_PATH/core.php ] || cp $MISP_APP_CONFIG_PATH.dist/core.default.php $MISP_APP_CONFIG_PATH/core.php
-    # [ -f $MISP_APP_CONFIG_PATH/config.php ] || cp $MISP_APP_CONFIG_PATH.dist/config.default.php $MISP_APP_CONFIG_PATH/config.php
-    # [ -f $MISP_APP_CONFIG_PATH/email.php ] || cp $MISP_APP_CONFIG_PATH.dist/email.php $MISP_APP_CONFIG_PATH/email.php
-    # [ -f $MISP_APP_CONFIG_PATH/routes.php ] || cp $MISP_APP_CONFIG_PATH.dist/routes.php $MISP_APP_CONFIG_PATH/routes.php
-    [ -s $MISP_APP_CONFIG_PATH/bootstrap.php ] || dd if=$MISP_APP_CONFIG_PATH.dist/bootstrap.default.php of=$MISP_APP_CONFIG_PATH/bootstrap.php
-    [ -s $MISP_APP_CONFIG_PATH/database.php ] || dd if=$MISP_APP_CONFIG_PATH.dist/database.default.php of=$MISP_APP_CONFIG_PATH/database.php
-    [ -s $MISP_APP_CONFIG_PATH/core.php ] || dd if=$MISP_APP_CONFIG_PATH.dist/core.default.php of=$MISP_APP_CONFIG_PATH/core.php
-    [ -s $MISP_APP_CONFIG_PATH/config.php.template ] || dd if=$MISP_APP_CONFIG_PATH.dist/config.default.php of=$MISP_APP_CONFIG_PATH/config.php.template
+    # Avoid cp/sed -i which create temp files alongside the target,
+    # broken on VirtioFS (Docker Desktop for Mac).
+    [ -s $MISP_APP_CONFIG_PATH/bootstrap.php ] || cat $MISP_APP_CONFIG_PATH.dist/bootstrap.default.php > $MISP_APP_CONFIG_PATH/bootstrap.php
+    [ -s $MISP_APP_CONFIG_PATH/database.php ] || cat $MISP_APP_CONFIG_PATH.dist/database.default.php > $MISP_APP_CONFIG_PATH/database.php
+    [ -s $MISP_APP_CONFIG_PATH/core.php ] || cat $MISP_APP_CONFIG_PATH.dist/core.default.php > $MISP_APP_CONFIG_PATH/core.php
+    [ -s $MISP_APP_CONFIG_PATH/config.php.template ] || cat $MISP_APP_CONFIG_PATH.dist/config.default.php > $MISP_APP_CONFIG_PATH/config.php.template
     [ -s $MISP_APP_CONFIG_PATH/config.php ] || echo -e "<?php\n\$config=array();\n?>" > $MISP_APP_CONFIG_PATH/config.php
-    [ -s $MISP_APP_CONFIG_PATH/email.php ] || dd if=$MISP_APP_CONFIG_PATH.dist/email.php of=$MISP_APP_CONFIG_PATH/email.php
-    [ -s $MISP_APP_CONFIG_PATH/routes.php ] || dd if=$MISP_APP_CONFIG_PATH.dist/routes.php of=$MISP_APP_CONFIG_PATH/routes.php
+    [ -s $MISP_APP_CONFIG_PATH/email.php ] || cat $MISP_APP_CONFIG_PATH.dist/email.php > $MISP_APP_CONFIG_PATH/email.php
+    [ -s $MISP_APP_CONFIG_PATH/routes.php ] || cat $MISP_APP_CONFIG_PATH.dist/routes.php > $MISP_APP_CONFIG_PATH/routes.php
 
     if ! grep -q "Detect what auth modules" "$MISP_APP_CONFIG_PATH/bootstrap.php"; then
         echo "... patch bootstrap.php settings"
         chmod +w $MISP_APP_CONFIG_PATH/bootstrap.php
-        # workaround for https://forums.docker.com/t/sed-couldnt-open-temporary-file-xyz-permission-denied-when-using-virtiofs/125473
-        sed -z "s|CakePlugin::loadAll(array(.*CakeResque.*));||g" $MISP_APP_CONFIG_PATH/bootstrap.php > tmp; cat tmp > $MISP_APP_CONFIG_PATH/bootstrap.php; rm tmp
-        sed "s|CakePlugin::load('AadAuth');||g" $MISP_APP_CONFIG_PATH/bootstrap.php > tmp; cat tmp > $MISP_APP_CONFIG_PATH/bootstrap.php; rm tmp
-        sed "s|CakePlugin::load('CertAuth');||g" $MISP_APP_CONFIG_PATH/bootstrap.php > tmp; cat tmp > $MISP_APP_CONFIG_PATH/bootstrap.php; rm tmp
-        sed "s|CakePlugin::load('LdapAuth');||g" $MISP_APP_CONFIG_PATH/bootstrap.php > tmp; cat tmp > $MISP_APP_CONFIG_PATH/bootstrap.php; rm tmp
-        sed "s|CakePlugin::load('LinOTPAuth');||g" $MISP_APP_CONFIG_PATH/bootstrap.php > tmp; cat tmp > $MISP_APP_CONFIG_PATH/bootstrap.php; rm tmp
-        sed "s|CakePlugin::load('OidcAuth');||g" $MISP_APP_CONFIG_PATH/bootstrap.php > tmp; cat tmp > $MISP_APP_CONFIG_PATH/bootstrap.php; rm tmp
-        sed "s|CakePlugin::load('ShibbAuth');||g" $MISP_APP_CONFIG_PATH/bootstrap.php > tmp; cat tmp > $MISP_APP_CONFIG_PATH/bootstrap.php; rm tmp
+        safe_sed_i -z "s|CakePlugin::loadAll(array(.*CakeResque.*));||g" $MISP_APP_CONFIG_PATH/bootstrap.php
+        safe_sed_i "s|CakePlugin::load('AadAuth');||g" $MISP_APP_CONFIG_PATH/bootstrap.php
+        safe_sed_i "s|CakePlugin::load('CertAuth');||g" $MISP_APP_CONFIG_PATH/bootstrap.php
+        safe_sed_i "s|CakePlugin::load('LdapAuth');||g" $MISP_APP_CONFIG_PATH/bootstrap.php
+        safe_sed_i "s|CakePlugin::load('LinOTPAuth');||g" $MISP_APP_CONFIG_PATH/bootstrap.php
+        safe_sed_i "s|CakePlugin::load('OidcAuth');||g" $MISP_APP_CONFIG_PATH/bootstrap.php
+        safe_sed_i "s|CakePlugin::load('ShibbAuth');||g" $MISP_APP_CONFIG_PATH/bootstrap.php
         cat <<EOT >> $MISP_APP_CONFIG_PATH/bootstrap.php
 
 /**
@@ -152,18 +158,14 @@ EOT
     fi
 
     echo "... initialize database.php settings"
-    # workaround for https://forums.docker.com/t/sed-couldnt-open-temporary-file-xyz-permission-denied-when-using-virtiofs/125473
-    # sed -i "s/localhost/$MYSQL_HOST/" $MISP_APP_CONFIG_PATH/database.php
-    # sed -i "s/db\s*login/$MYSQL_USER/" $MISP_APP_CONFIG_PATH/database.php
-    # sed -i "s/3306/$MYSQL_PORT/" $MISP_APP_CONFIG_PATH/database.php
-    # sed -i "s/db\s*password/$MYSQL_PASSWORD/" $MISP_APP_CONFIG_PATH/database.php
-    # sed -i "s/'database' => 'misp'/'database' => '$MYSQL_DATABASE'/" $MISP_APP_CONFIG_PATH/database.php
+    # Avoid sed -i which creates temp files alongside the target,
+    # broken on VirtioFS (Docker Desktop for Mac).
     chmod +w $MISP_APP_CONFIG_PATH/database.php
-    sed "s/localhost/$MYSQL_HOST/" $MISP_APP_CONFIG_PATH/database.php > tmp; cat tmp > $MISP_APP_CONFIG_PATH/database.php; rm tmp
-    sed "s/db\s*login/$MYSQL_USER/" $MISP_APP_CONFIG_PATH/database.php > tmp; cat tmp > $MISP_APP_CONFIG_PATH/database.php; rm tmp
-    sed "s/3306/$MYSQL_PORT/" $MISP_APP_CONFIG_PATH/database.php > tmp; cat tmp > $MISP_APP_CONFIG_PATH/database.php; rm tmp
-    sed "s/db\s*password/$MYSQL_PASSWORD/" $MISP_APP_CONFIG_PATH/database.php > tmp; cat tmp > $MISP_APP_CONFIG_PATH/database.php; rm tmp
-    sed "s/'database' => 'misp'/'database' => '$MYSQL_DATABASE'/" $MISP_APP_CONFIG_PATH/database.php > tmp; cat tmp > $MISP_APP_CONFIG_PATH/database.php; rm tmp
+    safe_sed_i "s/localhost/$MYSQL_HOST/" $MISP_APP_CONFIG_PATH/database.php
+    safe_sed_i "s/db\s*login/$MYSQL_USER/" $MISP_APP_CONFIG_PATH/database.php
+    safe_sed_i "s/3306/$MYSQL_PORT/" $MISP_APP_CONFIG_PATH/database.php
+    safe_sed_i "s/db\s*password/$MYSQL_PASSWORD/" $MISP_APP_CONFIG_PATH/database.php
+    safe_sed_i "s/'database' => 'misp'/'database' => '$MYSQL_DATABASE'/" $MISP_APP_CONFIG_PATH/database.php
 
     # Enable MySQL TLS immediately, as TLS requiring hosts like AWS RDS may banlist non-TLS connecting hosts
     # Conversely, this is also a good spot to disable it if required

core/files/etc/nginx/includes/misp

@@ -22,7 +22,7 @@ location / {
 
 location ~ ^/[^/]+\.php(/|$) {
     include snippets/fastcgi-php.conf;
-    fastcgi_pass unix:/var/run/php/php8.4-fpm.sock;
+    fastcgi_pass unix:/var/run/php/php@PHP_PACKAGE_VERSION@-fpm.sock;
     fastcgi_read_timeout 300s;
     fastcgi_send_timeout 300s;
     fastcgi_connect_timeout 300s;

core/files/kubernetes/entrypoint_fpm.sh

@@ -34,4 +34,4 @@ echo "Configure PHP | Change PHP values ..." && change_php_vars
 
 echo "Configure PHP | Starting PHP FPM"
 
-exec /usr/bin/tini -- /usr/sbin/php-fpm8.4 -R -F
+exec /usr/bin/tini -- /usr/local/sbin/php-fpm -R -F