Comment by spenvo
12 hours ago
how does Docker not yet have a new, official PHP image ready, given such a big heads up? https://hub.docker.com/_/php Nuts this wasn't ready to flip on at :00 (or even earlier given the PoC exploit and even the official PHP fixes were out well before). Now we are 27 minutes past due.
Yes, it's embarrassing for Docker. Makes me wish I still had the classic LAMP stack.
A PR was posted within a minute or two of PHP's source code update. Then within a minute of the PR's CI job completing, it was merged, and the build took a while but is now complete: https://github.com/docker-library/php/actions/runs/396158697...
It would not be easy (or reasonable) to take a public build like that private to build a 'secret' image version, and I'm not sure GitHub even has the capability to do that. I would not trust a build pushed to Docker Hub separate from the established / public / auditable process they have in place.
This is just the first step. See here for the full process: https://github.com/docker-library/faq#an-images-source-chang...
All dependent (official) images need to go through the same process, so that makes it fairly problematic, and I think Docker needs to take a look at it for the future.
1 reply →
It would however be reasonable to expect a maintainer to be available to start the CI faster than 30 minutes after the PR was created.
1 reply →
Docker have been carrying a broken python build for months.
they are wanting people to pay for the hardened version.