docker-compose.yml

# This is the base docker-compose file which runs across all environments
# it is supplemented by environment specific compose files.

# Define common configuration for Drupal services, each service merges in
# this configuration.
x-drupal-base:
  &drupal-base
  image: "${DRUPAL_IMAGE_NAME?}"
  env_file: .env
  # Rather than hard-coding the database connection info and sync directory
  # into settings.php, we pass it to Drupal using the `DRUPAL_` environment
  # variables. Drupal will use these at runtime, rather than looking in
  # `settings.php`.
  # Note that support for these is added in a patch, see the `patches`
  # section of the `composer.json` for details.
  environment:
    DRUPAL_CONFIG_SYNC_DIR: "../config/sync"
    DRUPAL_DB_DRIVER: "mysql"
    DRUPAL_DB_NAME: ${MARIADB_DATABASE?}
    DRUPAL_DB_USERNAME: ${MARIADB_USER?}
    DRUPAL_DB_PASSWORD: ${MARIADB_PASSWORD?}
    DRUPAL_DB_HOST: "mariadb"
    DRUPAL_DB_PORT: "3306"
  tmpfs: [ /tmp ]
  read_only: true
  security_opt: [ no-new-privileges=true ]
  user: "${ENV_USER_ID?}:${ENV_GROUP_ID?}"

services:

  nginx:
    image: nginx:alpine
    volumes:
      - ./docker/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./web:/app/web:ro
    tmpfs: [ /tmp ]
    ports: [ 80:8080 ]
    depends_on: [ drupal ]
    networks: [ web ]
    read_only: true
    security_opt: [ no-new-privileges=true ]
    restart: on-failure

  drupal:
    << : *drupal-base
    build: ./docker
    volumes:
      - ./docker/drupal-php.ini:/usr/local/etc/php/conf.d/drupal-php.ini:ro
      - ${DATA_DIR?}/private_files:/private_files:rw
      - ./web/sites/default/files:/app/web/sites/default/files:rw
      - ./:/app:ro
    depends_on: [ mariadb ]
    networks: [ web, db ]
    restart: on-failure

  # The drupal-cli service is used by the `./cli` script. This allows us
  # to give this service write permissions to the entrie project for
  # Composer and Drush. The drupal service only has write permissions to
  # the files directories to mitigate against any potential Remote Code
  # Execution (RCE) vulnerabilities.
  drupal-cli:
    << : *drupal-base
    volumes:
      - ./docker/drupal-php.ini:/usr/local/etc/php/conf.d/drupal-php.ini:ro
      - ${DATA_DIR?}/private_files:/private_files:rw
      - ./:/app:rw
      # Both Composer and Drush store various things in the user's home
      # folder, including: configuration, caching, SSH keys, and Drush
      # backups. It was simplier and less friction to just mount the
      # entire home folder, rather than those individual folders. This
      # also allows directories like drush-backups to be created as the
      # user.
      #
      # On production environments, the application should be running under
      # its own user, so there shouldn't be a security concern here.
      #
      # Additionally, when using Drush sql:sync, the rsync path that
      # Drush uses on the remote side is the same path that Drush on the
      # remote running in the drupal-cli container dumped the sql to, so
      # this path needs to be consistent both inside and outside of the
      # drupal-cli container. Since $HOME/drush-backups is one of the
      # default locations Drush uses, this also made sense to use.
      - ${HOME?}:${HOME?}:rw
      # Mount /etc/passwd and /etc/group in the container so that Composer
      # and Drush can locate the user's home folder, and so that they can
      # start remote SSH connections, as ssh-client does not work without
      # the current user being listed in passwd.
      - /etc/passwd:/etc/passwd:ro
      - /etc/group:/etc/group:ro
    networks: [ db ]
    # Specify a profile so that this service is not created by default
    # when running `./cli` it creates the drupal-cli service as a
    # temporary container.
    profiles: [ cli ]
    # Override the entrypoint to use the custom cli entrypoint script
    entrypoint: "/cli-docker-entrypoint.sh"

  cron:
    << : *drupal-base
    volumes:
      - ./docker/drupal-php.ini:/usr/local/etc/php/conf.d/drupal-php.ini:ro
      - ${DATA_DIR?}/private_files:/private_files:rw
      - ./web/sites/default/files:/app/web/sites/default/files:rw
      - ./:/app:ro
    networks: [ db ]
    restart: on-failure
    entrypoint: "/usr/local/bin/supercronic"
    command: "/app/docker/crontab"

  mariadb:
    image: mariadb
    environment:
      # Set the db user, pass and name from the current environment to ensure that
      # these values have been set and ensure that the env.sh script was sourced.
      MARIADB_USER: ${MARIADB_USER?}
      MARIADB_PASSWORD: ${MARIADB_PASSWORD?}
      MARIADB_DATABASE: ${MARIADB_DATABASE?}
      # Use a randomly generated password for database root user to improve security.
      # The password is printed in the Docker log when the container is first setup
      # and can be reset later if needed.
      MARIADB_RANDOM_ROOT_PASSWORD: "true"
    tmpfs: [ /tmp, /run/mysqld ]
    networks: [ db ]
    read_only: true
    restart: on-failure
    security_opt: [ no-new-privileges=true ]
    volumes:
      - ${DATA_DIR?}/mysql:/var/lib/mysql:rw
    user: "${ENV_USER_ID?}:${ENV_GROUP_ID?}"

networks:
  web:
    driver: bridge
  db:
    driver: bridge