From 7340cc16a8331a07a31072e8e80ace14d1d4d7a8 Mon Sep 17 00:00:00 2001 From: yeasy Date: Thu, 16 Jul 2026 23:20:25 -0700 Subject: [PATCH] fix(security): avoid world-writable storage in Laravel multi-stage examples MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 两处 Laravel 多阶段构建示例把 storage 目录设为 chmod -R 777，且全文没有任何 警告或说明，读者复制粘贴即得到 session/cache/log 目录全局可写的生产镜像。 这与本书 7.11（USER）与第 18 章的最小权限指引相矛盾。 改为将 storage 归属 www-data（php:8.3-fpm-alpine 中 php-fpm worker 的运行用户） 并设为 775：构建期 artisan 以 root 运行不受影响，运行期 www-data 仍可写。 --- 07_dockerfile/7.18_multistage_builds_laravel.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/07_dockerfile/7.18_multistage_builds_laravel.md b/07_dockerfile/7.18_multistage_builds_laravel.md index e097b9e..8d2e2bf 100644 --- a/07_dockerfile/7.18_multistage_builds_laravel.md +++ b/07_dockerfile/7.18_multistage_builds_laravel.md @@ -121,7 +121,8 @@ RUN set -x ; cd ${LARAVEL_PATH} \ && mkdir -p storage/framework/testing \ && mkdir -p storage/framework/views \ && mkdir -p storage/logs \ - && chmod -R 777 storage \ + && chown -R www-data:www-data storage \ + && chmod -R 775 storage \ && php artisan package:discover ``` @@ -226,7 +227,8 @@ RUN set -x ; cd ${LARAVEL_PATH} \ && mkdir -p storage/framework/testing \ && mkdir -p storage/framework/views \ && mkdir -p storage/logs \ - && chmod -R 777 storage \ + && chown -R www-data:www-data storage \ + && chmod -R 775 storage \ && php artisan package:discover FROM nginx:1.28-alpine as nginx