Skip to main content

Security Best Practices

php-ci is a public Docker image for CI workloads, not production web serving. Apply these practices to keep pipelines safe and reproducible.

Pin by digest​

Tags like :8.3 can move when rebuilt. Pin an immutable digest in critical pipelines:

container:
  image: himanshuramavat/php-ci:8.3@sha256:YOUR_DIGEST_HERE

Resolve digests from Docker Hub or GHCR. Document digest bumps in your changelog.

Prefer :8.3 over :latest in CI​

The :latest tag tracks the recommended PHP line but can change without notice. Explicit minor tags (8.2, 8.3, 8.4) make matrix upgrades deliberate. See Docker Tags.

Secrets in CI​

  • Store API keys and deploy credentials in your CI provider's secret store — never commit them to the repository
  • Do not bake secrets into custom images derived from php-ci
  • For deploy jobs using :8.4-deploy, restrict SSH keys to the minimum host scope — see Deploy Variant

Scan images​

Periodically scan php-ci and any custom extensions you build:

docker scout cves himanshuramavat/php-ci:8.3
# or trivy image himanshuramavat/php-ci:8.3

Report vulnerabilities through the Security Policy — do not open public issues for undisclosed CVEs.

Non-root usage​

php-ci runs CI commands as a non-root user by default. When extending the image, avoid switching to USER root unless you need package installs, and return to an unprivileged user for test steps.

Supply chain​

  • Verify composer.lock is committed and use composer install --prefer-dist
  • Enable dependency auditing in your project (composer audit) inside the same container for consistent results