Sign inSign up

cloudremark/processmaker

By cloudremark

•Updated about 2 months ago

Hardened ProcessMaker - non-root, read-only rootfs, 0 critical OS CVEs

Image
Integration & delivery
Databases & storage
0

285

cloudremark/processmaker repository overview

⁠ProcessMaker Community - hardened image

ProcessMaker on Red Hat UBI9, running unprivileged: UID 10001, read-only root filesystem, all capabilities dropped. Apache 2.4 + PHP-FPM 8.1 over a unix socket.

⁠Tags

3.8.3 - linux/amd64, linux/arm64.

⁠Run it

A bare docker run will not work: with a read-only rootfs the app can only write where something is mounted. Minimum needed:

services:
  web:
    image: cloudremark/processmaker:3.8.3
    user: "10001:10001"
    read_only: true
    cap_drop: [ALL]
    ports: ["127.0.0.1:8080:8080"]
    environment:
      PHP_DATE_TIMEZONE: UTC
      DB_HOST: db
      DB_DATABASE: processmaker
      DB_USERNAME: processmaker
      DB_PASSWORD: change-me
    volumes:
      - pm_workflow:/opt/processmaker/workflow
      - pm_shared:/opt/processmaker/shared
      - pm_bootstrap_cache:/opt/processmaker/bootstrap/cache
    # uid/gid required: a tmpfs mounts root:root and FPM cannot create its socket
    tmpfs:
      - /tmp:mode=1777,size=512m
      - /var/lib/php/sessions:mode=0700,uid=10001,gid=10001,size=64m
      - /run/php-fpm:mode=0750,uid=10001,gid=10001,size=8m
      - /var/run/httpd:mode=0750,uid=10001,gid=10001,size=8m
      - /var/lock/httpd:mode=0750,uid=10001,gid=10001,size=8m
    depends_on: [db]

  db:
    # required: 3.8.3's mysqlnd cannot negotiate caching_sha2_password
    image: mysql:8.0
    command: --default-authentication-plugin=mysql_native_password
    environment:
      MYSQL_DATABASE: processmaker
      MYSQL_USER: processmaker
      MYSQL_PASSWORD: change-me
      MYSQL_ROOT_PASSWORD: change-me-too
    volumes: [pm_db:/var/lib/mysql]

volumes: {pm_workflow: , pm_shared: , pm_bootstrap_cache: , pm_db: }

Open http://127.0.0.1:8080/⁠ and run the installer.

⁠Commands

web (default) - Apache + FPM · worker - queue worker · cron - scheduler · processmaker <args> / artisan <args> - CLI.

worker and cron wait for the installer to finish. That is expected.

⁠Environment

PHP_DATE_TIMEZONE (default UTC) · PHP_SESSION_COOKIE_SECURE (1 behind TLS) · DB_HOST DB_PORT DB_DATABASE DB_USERNAME DB_PASSWORD · PM_CRON_INTERVAL (default 60)

⁠Security

UID 10001, read-only rootfs, all caps dropped, no setuid binaries, 0 CRITICAL / 7 HIGH OS CVEs. Apache allowlists nine PHP entry points; every other .php returns 403.


ProcessMaker is AGPL-3.0. Built by Cloud Remark LTD., not affiliated with or endorsed by ProcessMaker Inc.

Tag summary

Content type

Image

Digest

sha256:b8bb7de78…

Size

180.3 MB

Last updated

about 2 months ago

docker pull cloudremark/processmaker:3.8.3