feat: switch Apache Debian image to Docker hardened image (dhi.io/httpd)

.github/workflows/publish.yml

@@ -88,6 +88,13 @@ jobs:
           username: ${{ secrets.dockerhub_user }}
           password: ${{ secrets.dockerhub_token }}
 
+      - name: Login to Docker Hardened Images registry
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # docker/login-action@v3.5.0
+        with:
+          registry: dhi.io
+          username: ${{ secrets.dockerhub_user }}
+          password: ${{ secrets.dockerhub_token }}
+
       - name: Login to GitHub Container Registry
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # ratchet:docker/login-action@v4.4.0
         with:

.github/workflows/verifyimage.yml

@@ -64,6 +64,13 @@ jobs:
         with:
           driver-opts: image=moby/buildkit:master
 
+      - name: Login to Docker Hardened Images registry
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # docker/login-action@v3.5.0
+        with:
+          registry: dhi.io
+          username: ${{ secrets.dockerhub_user }}
+          password: ${{ secrets.dockerhub_token }}
+
       - name: Login to GitHub Container Registry
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # ratchet:docker/login-action@v4.4.0
         with:

README.md

@@ -67,7 +67,7 @@ Examples:
 * nginx – *ModSecurity v3.0.16 on Nginx 1.30.4 official stable base image, and latest stable OWASP CRS 4.28.0*
    * [nginx](https://github.com/coreruleset/modsecurity-crs-docker/blob/master/nginx/Dockerfile)
    * [nginx-alpine](https://github.com/coreruleset/modsecurity-crs-docker/blob/master/nginx/Dockerfile-alpine)
-* Apache httpd – *ModSecurity v2.9.14 on Apache 2.4.68 official stable base image, and latest stable OWASP CRS 4.28.0*
+* Apache httpd – *ModSecurity v2.9.14 on Apache 2.4.68 Docker hardened base image, and latest stable OWASP CRS 4.28.0*
    * [apache](https://github.com/coreruleset/modsecurity-crs-docker/blob/master/apache/Dockerfile)
    * [apache-alpine](https://github.com/coreruleset/modsecurity-crs-docker/blob/master/apache/Dockerfile-alpine)
 

apache/Dockerfile

@@ -3,7 +3,7 @@
 
 ARG HTTPD_VERSION="n/a"
 
-FROM image AS build
+FROM build_image AS build
 
 ARG MODSEC2_VERSION="n/a"
 ARG MODSEC2_FLAGS="n/a"
@@ -38,7 +38,7 @@ RUN set -eux; \
     make install; \
     make clean
 
-FROM image AS crs_release
+FROM build_image AS crs_release
 
 ARG CRS_RELEASE
 
@@ -58,6 +58,53 @@ RUN set -eux; \
     rm -f v${CRS_RELEASE}-minimal.tar.gz coreruleset-${CRS_RELEASE}-minimal.tar.gz.asc; \
     mv -v /opt/owasp-crs/crs-setup.conf.example /opt/owasp-crs/crs-setup.conf
 
+FROM build_image AS runtime_deps
+
+ARG LUA_VERSION="n/a"
+ARG LUA_MODULES=""
+
+# hadolint ignore=DL3008,SC2086
+RUN set -eux; \
+    echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections; \
+    apt-get update -qq; \
+    apt-get install -y -qq --no-install-recommends --no-install-suggests \
+        ca-certificates \
+        curl \
+        ed \
+        iproute2 \
+        libcurl3-gnutls \
+        libfuzzy2 \
+        liblua${LUA_VERSION} \
+        ${LUA_MODULES} \
+        libpcre2-8-0 \
+        libxml2 \
+        libyajl2; \
+    update-ca-certificates -f; \
+    mkdir /staging; \
+    for pkg in \
+        ca-certificates \
+        curl \
+        ed \
+        iproute2 \
+        libcurl3-gnutls \
+        libfuzzy2 \
+        liblua${LUA_VERSION} \
+        libpcre2-8-0 \
+        libxml2 \
+        libyajl2 \
+        ${LUA_MODULES}; \
+    do \
+        dpkg -L "${pkg}" 2>/dev/null \
+        | grep -Ev "^(/usr/share/doc/|/usr/share/man/|/usr/share/lintian/)|\.$" \
+        | while IFS= read -r f; do \
+            if [ -f "${f}" ] || [ -L "${f}" ]; then \
+                cp --parents -d "${f}" /staging/; \
+            fi; \
+        done; \
+    done; \
+    apt-get clean; \
+    rm -rf /var/lib/apt/lists/*
+
 FROM image
 
 ARG MODSEC2_VERSION
@@ -167,28 +214,9 @@ COPY apache/conf/extra/*.conf /usr/local/apache2/conf/extra/
 COPY src/etc/modsecurity.d/*.conf /etc/modsecurity.d/
 COPY src/opt/modsecurity/* /opt/modsecurity/
 COPY apache/docker-entrypoint.sh /
+COPY --from=runtime_deps /staging/ /
 
-RUN set -eux; \
-    echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections; \
-    apt-get update -qq; \
-    apt-get install -qq -y --no-install-recommends --no-install-suggests \
-        ca-certificates \
-        curl \
-        ed \
-        gnupg \
-        iproute2 \
-        libcurl3-gnutls \
-        libfuzzy2 \
-        liblua${LUA_VERSION} \
-        ${LUA_MODULES} \
-        libpcre2-8-0 \
-        libxml2 \
-        libyajl2; \
-    update-ca-certificates -f; \
-    apt-get clean; \
-    rm -rf /var/lib/apt/lists/*
-
-RUN useradd --system httpd
+USER 0
 
 RUN set -eux; \
     mkdir -p /etc/modsecurity.d/; \
@@ -221,15 +249,15 @@ RUN set -eux; \
     echo 'Include conf/extra/httpd-locations.conf' >> /usr/local/apache2/conf/httpd.conf; \
     echo 'Include conf/extra/httpd-modsecurity.conf' >> /usr/local/apache2/conf/httpd.conf; \
     sed -i -E 's|(MaxRequestWorkers[ ]*)[0-9]*|\1${WORKER_CONNECTIONS}|' /usr/local/apache2/conf/extra/httpd-mpm.conf; \
-    chown -R httpd:httpd \
+    chown -R www-data:www-data \
         /var/log/ \
         /var/log/modsecurity/audit/ \
         /usr/local/apache2/ \
         /etc/modsecurity.d \
         /tmp/modsecurity \
         /opt/owasp-crs
 
-USER httpd
+USER www-data
 
 ENTRYPOINT ["/docker-entrypoint.sh"]
 

docker-bake.hcl

@@ -157,14 +157,16 @@ target "apache" {
             {
                 name = "debian"
                 dockerfile="apache/Dockerfile"
-                image = "docker-image://httpd:${httpd-version}"
+                image = "docker-image://dhi.io/httpd:${httpd-version}"
+                build_image = "docker-image://httpd:${httpd-version}"
                 lua_modules = join(" ", lua-modules-debian)
                 tag_base = "apache"
             },
             {
                 name = "alpine"
                 dockerfile = "apache/Dockerfile-alpine"
                 image = "docker-image://httpd:${httpd-version}-alpine"
+                build_image = "docker-image://httpd:${httpd-version}-alpine"
                 lua_modules = join(" ", lua-modules-alpine)
                 tag_base = "apache-alpine"
             }
@@ -175,6 +177,7 @@ target "apache" {
     name = "apache-${base.name}-${crs_entry.tag}"
     contexts = {
         image = base.image
+        build_image = base.build_image
     }
     dockerfile = base.dockerfile
     args = {