Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions Dockerfile
Original file line number Diff line number Diff line change
@@ -1,5 +1,25 @@
ARG BASEIMAGE="php:8.4.11-cli-alpine3.22"

# Update max buffer length for /bin/sh, to allow paste larger than 2k characters
FROM $BASEIMAGE AS busybox

ENV BUSYBOX_VERSION="1.36.1" \
MAX_PASTE_LENGTH="65536"

RUN apk add --no-cache busybox-extras build-base openssl-dev gcc perl musl-dev make linux-headers wget

RUN wget https://busybox.net/downloads/busybox-${BUSYBOX_VERSION}.tar.bz2 && \
tar xf busybox-${BUSYBOX_VERSION}.tar.bz2 && \
mv busybox-${BUSYBOX_VERSION} busybox

WORKDIR /busybox

RUN make defconfig && \
sed -i 's/CONFIG_FEATURE_EDITING_MAX_LEN=.*/CONFIG_FEATURE_EDITING_MAX_LEN=8192/' .config && \
yes "" | make oldconfig

RUN make -j$(nproc)

FROM $BASEIMAGE AS compile

ENV PHP_REDIS_VERSION="6.2.0" \
Expand Down Expand Up @@ -210,6 +230,7 @@ RUN \

WORKDIR /usr/src/code

COPY --from=busybox /busybox/busybox /bin/busybox
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check what /bin/sh points to in the Alpine base image
docker run --rm php:8.4.11-cli-alpine3.22 ls -la /bin/sh /bin/busybox 2>/dev/null || echo "Could not inspect symlinks"
docker run --rm php:8.4.11-cli-alpine3.22 readlink -f /bin/sh

Repository: appwrite/docker-base

Length of output: 154


🏁 Script executed:

#!/bin/bash
# Explore the Dockerfile context around line 233
head -n 240 Dockerfile | tail -n 20

Repository: appwrite/docker-base

Length of output: 1325


🏁 Script executed:

#!/bin/bash
# Search for any documentation or comments about busybox/sh in the codebase
rg -i "busybox|/bin/sh" --type-list | head -20
rg -i "busybox" . -A 3 -B 3

Repository: appwrite/docker-base

Length of output: 2209


🏁 Script executed:

#!/bin/bash
# Check entire Dockerfile for any sh symlink setup
grep -n "sh\|symlink\|ln -s" Dockerfile

Repository: appwrite/docker-base

Length of output: 229


🌐 Web query:

Alpine Linux busybox /bin/sh symlink default

💡 Result:

By default Alpine links /bin/sh to BusyBox's ash (the BusyBox-provided /bin/ash implementation). You can replace it (e.g. install dash-binsh or bash) if you need a different /bin/sh. [1][2]


Create a symlink from /bin/sh to /bin/busybox after copying the binary.

Alpine defaults to linking /bin/sh to BusyBox's ash. The Dockerfile copies a custom busybox (with CONFIG_FEATURE_EDITING_MAX_LEN=8192) to /bin/busybox, but this won't update /bin/sh unless you explicitly establish the symlink. Add RUN ln -sf /bin/busybox /bin/sh after the COPY statement to ensure the custom binary is actually used for shell operations.

🤖 Prompt for AI Agents
In `@Dockerfile` at line 233, The Dockerfile copies a custom BusyBox binary with
COPY --from=busybox /busybox/busybox /bin/busybox but does not update the
default shell link, so /bin/sh may still point to the old ash; after that COPY,
create or update the symlink so /bin/sh points to /bin/busybox by running a
command to force-create the symlink (e.g., use ln -sf /bin/busybox /bin/sh) to
ensure the custom BusyBox is used for shell operations.

COPY --from=swoole /usr/local/lib/php/extensions/no-debug-non-zts-20240924/swoole.so /usr/local/lib/php/extensions/no-debug-non-zts-20240924/
COPY --from=redis /usr/local/lib/php/extensions/no-debug-non-zts-20240924/redis.so /usr/local/lib/php/extensions/no-debug-non-zts-20240924/
COPY --from=imagick /usr/local/lib/php/extensions/no-debug-non-zts-20240924/imagick.so /usr/local/lib/php/extensions/no-debug-non-zts-20240924/
Expand Down
4 changes: 4 additions & 0 deletions tests.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,10 @@
schemaVersion: '2.0.0'

commandTests:
- name: 'Busybox command'
command: "busybox"
args: ["whoami"]
expectedOutput: ["root"]
- name: 'Imagemagick command'
command: "magick"
args: ["--version"]
Expand Down
Loading