Hacker News Reader

Comment by andrelaszlo | Hacker News Reader

Just pulled the new matomo that was published on dockerhub 26 minutes ago, thinking it has the patched PHP version:

  # docker pull matomo:latest
  latest: Pulling from library/matomo
  Digest: sha256:6e63589d31ec653f78e029084d21488640fdbbd9a42c96c872098f42c8678a02
  Status: Image is up to date for matomo:latest
  docker.io/library/matomo:latest
  
  # docker run --rm matomo:latest php --version
  PHP 8.4.26 (cli) (built: Oct 21 2026 00:31:19) (NTS)
  Copyright (c) The PHP Group
  Built by https://github.com/docker-library/php
  Zend Engine v4.4.26, Copyright (c) Zend Technologies
      with Zend OPcache v8.4.26, Copyright (c), by Zend Technologies

The PHP build is from today, which is doubly misleading. 8.4.27 is the patched release, not 8.4.26. I wonder how many people will pull this image thinking they're good to go online again.

View on HN

The "official" PHP Docker images turned out to be a shit show tody. Seems like many maintainers fell for it and published updates that aren't really updates.

I'm currently waiting for a new docker image for another project, and their maintainer noticed the old PHP versions in the freshly built images and is still waiting or working on releasing a new container build.

Fully agree. Moved to FrankenPHP's static build (which was ready very quickly) to get away from it. Don't intend to ever use the "official" images again.

I'm wondering if it's not just better to use plain Debian base images.

  FROM debian:... 
  RUN apt install php ...

This will take longer on a cold build cache, and pins the PHP version to the current Debian version. But Debian once again proved very reliable to patch in time.

Those images are not even official. "Official" is just a misnomer in Docker.

There is nothing official about these images.

"Let's use this packaging some rando on the Internet built" is a strategy that is exactly as good as it seems, but that's the Docker ecosystem for you.

Packagers who actually understand the software put in good work to package that software in small and well maintained packages. Use them instead!

Yeah, took me long enough to learn that. I just trusted the "official" badge.

If you need Docker to run PHP software you're beyond any help already.

Yeah, I really enjoyed messing with php.ini back in the day! Setting it juuuust right for every different project on my dear pet.

I barely use PHP these days, but Docker seems like a great place to put it.

One more level of isolation can't hurt for PHP.

Same goes for Wordpress indeed, which I'm waiting for.

    $ docker pull wordpress:fpm && docker image inspect wordpress:fpm --format '{{.Created}}' && docker run --rm wordpress:fpm php --version
    fpm: Pulling from library/wordpress
    Digest: sha256:c6d271a445510a3e08cfcc487750ac014f4464165ad6df6356da04680be8e907
    Status: Image is up to date for wordpress:fpm
    docker.io/library/wordpress:fpm
    2026-10-21T01:27:06.695704995Z
    PHP 8.3.35 (cli) (built: Oct 21 2026 00:33:17) (NTS)
    Copyright (c) The PHP Group
    Zend Engine v4.3.35, Copyright (c) Zend Technologies
      with Zend OPcache v8.3.35, Copyright (c), by Zend Technologies

I guess they were planning an update for today, for a moment the 8.2.35 threw me, but .35 is patched on 8.2, unpatched on 8.3 :)

I had to build and deploy my own Nextcloud images earlier today. :( Not a big deal because docker, just obnoxious that this got released into the wild and was being actively exploited before patches were available everywhere.

Reply on news.ycombinator.com