Hardened ProcessMaker - non-root, read-only rootfs, 0 critical OS CVEs
285
ProcessMaker on Red Hat UBI9, running unprivileged: UID 10001, read-only root filesystem, all capabilities dropped. Apache 2.4 + PHP-FPM 8.1 over a unix socket.
3.8.3 - linux/amd64, linux/arm64.
A bare docker run will not work: with a read-only rootfs the app can only
write where something is mounted. Minimum needed:
services:
web:
image: cloudremark/processmaker:3.8.3
user: "10001:10001"
read_only: true
cap_drop: [ALL]
ports: ["127.0.0.1:8080:8080"]
environment:
PHP_DATE_TIMEZONE: UTC
DB_HOST: db
DB_DATABASE: processmaker
DB_USERNAME: processmaker
DB_PASSWORD: change-me
volumes:
- pm_workflow:/opt/processmaker/workflow
- pm_shared:/opt/processmaker/shared
- pm_bootstrap_cache:/opt/processmaker/bootstrap/cache
# uid/gid required: a tmpfs mounts root:root and FPM cannot create its socket
tmpfs:
- /tmp:mode=1777,size=512m
- /var/lib/php/sessions:mode=0700,uid=10001,gid=10001,size=64m
- /run/php-fpm:mode=0750,uid=10001,gid=10001,size=8m
- /var/run/httpd:mode=0750,uid=10001,gid=10001,size=8m
- /var/lock/httpd:mode=0750,uid=10001,gid=10001,size=8m
depends_on: [db]
db:
# required: 3.8.3's mysqlnd cannot negotiate caching_sha2_password
image: mysql:8.0
command: --default-authentication-plugin=mysql_native_password
environment:
MYSQL_DATABASE: processmaker
MYSQL_USER: processmaker
MYSQL_PASSWORD: change-me
MYSQL_ROOT_PASSWORD: change-me-too
volumes: [pm_db:/var/lib/mysql]
volumes: {pm_workflow: , pm_shared: , pm_bootstrap_cache: , pm_db: }
Open http://127.0.0.1:8080/ and run the installer.
web (default) - Apache + FPM · worker - queue worker · cron - scheduler ·
processmaker <args> / artisan <args> - CLI.
worker and cron wait for the installer to finish. That is expected.
PHP_DATE_TIMEZONE (default UTC) · PHP_SESSION_COOKIE_SECURE (1 behind
TLS) · DB_HOST DB_PORT DB_DATABASE DB_USERNAME DB_PASSWORD ·
PM_CRON_INTERVAL (default 60)
UID 10001, read-only rootfs, all caps dropped, no setuid binaries,
0 CRITICAL / 7 HIGH OS CVEs. Apache allowlists nine PHP entry points; every other .php returns 403.
ProcessMaker is AGPL-3.0. Built by Cloud Remark LTD., not affiliated with or endorsed by ProcessMaker Inc.
Content type
Image
Digest
sha256:b8bb7de78…
Size
180.3 MB
Last updated
about 2 months ago
docker pull cloudremark/processmaker:3.8.3