alt Hacker NewsEdit: and it's live now 1hour 43minutes after. Edit 2x: well I spoke too soon. not actually live - the 8.4.27 tag appeared, but it's still an empty shell with no amd64 image to build from. Maybe other architectures can be built from though. Ugh. Now we're at 2hours 24minutes in. I know process steps take time/can't be rushed, and I know people mean well and surely some are unappreciated for what they do. That said: this debacle is making me want to reassess my deployment pipeline choices.
how does Docker not yet have a new, official PHP image ready, given such a big heads up? https://hub.docker.com/_/php Nuts this wasn't ready to flip on at :00 (or even earlier given the PoC exploit and even the official PHP fixes were out well before). Now we are 52 minutes past due. (posting comment again, because the other thread i posted in was marked as dupe.)
Replies
I have zero internal info, just guessing, but there's a PR from 5min ago asking to add someone as a reviewer for PHP images:
https://github.com/docker-library/official-images/pull/22544
Maybe the guy that has to click OK is asleep?
Images are there for docker now, but pecl has decided to have issues . ARGH
they have a long process with multiple build steps before the images reach the registry.
https://github.com/docker-library/faq#an-images-source-chang...
Yeah, I was very surprised to wake up just now and find docker still vulnerable.
And now, at 2hrs 55mins past the PHP release, the amd64 image is available. Although it appears that the servers hosting the image are getting hugged to death because I can't actually download it.
They even committed the fixed version to the repo, but it seems no images where pushed: https://github.com/docker-library/php/commit/e3eaff845f7a9f7...
Edit: Seems like GitHub has issues with merging PRs: https://github.com/docker-library/official-images/pull/22541