Skip to content

Fix Redis PECL installation during Docker builds #196

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
chanonrittong-commits wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Fix Redis PECL installation during Docker builds #196

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions data/docker/Wordpress.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,8 +40,13 @@ RUN docker-php-ext-install soap \
&& docker-php-ext-install gmp

# Install Redis PHP extension
RUN pecl install redis \
&& docker-php-ext-enable redis
ARG REDIS_PECL_VERSION=6.3.0

RUN curl -fsSL -o /tmp/redis.tgz \
"https://pecl.php.net/get/redis-${REDIS_PECL_VERSION}.tgz" \
Comment on lines +45 to +46

@coderabbitai coderabbitai Bot Jun 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add timeout configuration to the curl command.

The curl command has no timeout specified, which means the build could hang indefinitely if there's a network connectivity issue or if the PECL server becomes unresponsive.

⏱️ Recommended fix to add timeout flags 
 RUN curl -fsSL -o /tmp/redis.tgz \
+    --connect-timeout 30 --max-time 300 \
     "https://pecl.php.net/get/redis-${REDIS_PECL_VERSION}.tgz" \
     && pecl install /tmp/redis.tgz \

This sets a 30-second connection timeout and a 5-minute maximum time for the entire operation.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
RUN curl -fsSL -o /tmp/redis.tgz \
"https://pecl.php.net/get/redis-${REDIS_PECL_VERSION}.tgz" \
RUN curl -fsSL -o /tmp/redis.tgz \
--connect-timeout 30 --max-time 300 \
"https://pecl.php.net/get/redis-${REDIS_PECL_VERSION}.tgz" \
&& pecl install /tmp/redis.tgz \
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@data/docker/Wordpress.Dockerfile` around lines 45 - 46, The curl command that
downloads the redis package from PECL (using REDIS_PECL_VERSION variable) lacks
timeout configuration, which could cause the build to hang indefinitely if there
are network connectivity issues or the server becomes unresponsive. Add timeout
flags to the curl command to set a 30-second connection timeout and a 5-minute
maximum time for the entire operation, ensuring the build fails fast rather than
hanging when network issues occur.

&& pecl install /tmp/redis.tgz \
&& docker-php-ext-enable redis \
&& rm -f /tmp/redis.tgz
Comment on lines +45 to +49

@coderabbitai coderabbitai Bot Jun 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Add checksum verification for the downloaded Redis tarball.

The downloaded tarball is installed without verifying its checksum or signature. This creates a supply-chain security risk: if the download is tampered with (via compromised CDN, DNS hijacking, or man-in-the-middle), a malicious extension could be installed into the image.

🔒 Recommended fix to add SHA256 checksum verification 
 ARG REDIS_PECL_VERSION=6.3.0
+ARG REDIS_PECL_SHA256=d6abeac798644a4f7e81e480f86b5e5e8c3a35cf

 RUN curl -fsSL -o /tmp/redis.tgz \
     "https://pecl.php.net/get/redis-${REDIS_PECL_VERSION}.tgz" \
+    && echo "${REDIS_PECL_SHA256}  /tmp/redis.tgz" | sha256sum -c - \
     && pecl install /tmp/redis.tgz \
     && docker-php-ext-enable redis \
     && rm -f /tmp/redis.tgz

Note: The SHA256 hash shown is a placeholder. Retrieve the actual checksum from the official PECL package page or by downloading and verifying the file manually.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@data/docker/Wordpress.Dockerfile` around lines 45 - 49, Add checksum
verification to the Redis tarball download in the curl and pecl install block.
First, define a new environment variable for the expected SHA256 checksum of the
Redis package (similar to how REDIS_PECL_VERSION is defined). After the curl
command downloads the tarball to /tmp/redis.tgz, compute its SHA256 hash using
sha256sum and compare it against the expected checksum value. Only proceed with
the pecl install command if the checksum verification succeeds; if it fails,
output an error message and exit the build. This ensures the downloaded tarball
has not been tampered with before installation.


# Install Composer
RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
Expand Down
Loading