cleanstart/drupal repository overview

Verified DRUPAL Container Image

A hardened, minimal DRUPAL container image built from source with verifiable software provenance and an SBOM, designed for secure production deployments.

For additional versions including FIPS support, explore CleanStart Images — secure, hardened container images⁠

⁠Pull Latest Image

Download the container image from the registry

docker pull cleanstart/drupal:latest

docker pull cleanstart/drupal:latest-dev

CleanStart’s Drupal image runs as a non-root user (uid 65532) for better security — but the baked-in log directory is owned by root, so Apache can’t write to it and crashes on startup. The volume mount gives Apache a log directory it actually owns.

⁠Production Deployment

Deploy with production security settings

mkdir -p ./logs && sudo chown 65532:65532 ./logs

docker run -d --name drupal-prod \
  --security-opt=no-new-privileges \
  --user 65532:65532 \
  --restart unless-stopped \
  -v "$(pwd)/logs:/var/log/apache2" \
  -p 80:80 \
  cleanstart/drupal:latest-dev

Volume Mount Mount local directory for persistent data

mkdir -p ./logs && sudo chown 65532:65532 ./logs

docker run -it --rm --name drupal \
  -v "$(pwd)/logs:/var/log/apache2" \
  cleanstart/drupal:latest-dev

Port Forwarding Run with custom port mappings

docker run -it --rm --name drupal \
  -p 8080:80 \
  -v "$(pwd)/logs:/var/log/apache2" \
  cleanstart/drupal:latest-dev

Why Use CleanStart Images⁠

• Verified — Built from source with verifiable software provenance
• Hardened — Minimal software footprint designed for secure deployment
• Transparent — SBOM available for visibility into image contents
• Production-ready — Built for modern container environments