build(docker): optimize image size and security

- add mysql client binaries for database operations
- reduce php extensions to production essentials
- bind mysql and phpmyadmin to localhost only
- replace php-fpm.conf with php.ini for upload limits

.dockerignore

@@ -1,3 +1,3 @@
 *
 !docker/entrypoint.sh
-!docker/php-fpm.conf
+!docker/php.ini

compose.yaml

@@ -26,11 +26,10 @@ services:
     volumes:
       - ./:/var/www
 
-
   mysql:
     image: mysql:8.0
     ports:
-      - "${DB_PORT:-3306}:3306"
+      - "127.0.0.1:${DB_PORT:-3306}:3306"
     environment:
       - MYSQL_DATABASE=${DB_DATABASE}
       - MYSQL_USER=${DB_USERNAME}
@@ -44,9 +43,11 @@ services:
     image: phpmyadmin:latest
     restart: unless-stopped
     ports:
-      - "8080:80"
+      - "127.0.0.1:8080:80"
     environment:
       - PMA_HOST=mysql
+      - PMA_USER=root
+      - PMA_PASSWORD=${DB_ROOT_PASSWORD}
       - PMA_PORT=${DB_PORT:-3306}
       - UPLOAD_LIMIT=100M
     depends_on:

docker/Dockerfile

@@ -1,11 +1,15 @@
+FROM mysql:8.0 AS mysql
+
 FROM php:8.3-fpm
 
+COPY --from=mysql /usr/bin/mysql /usr/bin/mysql
+COPY --from=mysql /usr/bin/mysqldump /usr/bin/mysqldump
+
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    libpng-dev libonig-dev libxml2-dev libzip-dev \
+    libonig-dev \
-    zip unzip git gosu \
+    gosu netcat-traditional \
-    netcat-traditional \
+ && docker-php-ext-install pdo_mysql mbstring \
-&& docker-php-ext-install pdo_mysql mbstring exif pcntl bcmath gd zip \
+ && apt-get clean && rm -rf /var/lib/apt/lists/*
-&& apt-get clean && rm -rf /var/lib/apt/lists/*
 
 COPY --from=composer:latest /usr/bin/composer /usr/bin/composer
 
@@ -26,6 +30,8 @@ RUN if getent group ${GID}; then \
 RUN sed -i "s/user = www-data/user = www/g" /usr/local/etc/php-fpm.d/www.conf && \
     sed -i "s/group = www-data/group = $group_name/g" /usr/local/etc/php-fpm.d/www.conf
 
+COPY --chmod=644 ./docker/php.ini /usr/local/etc/php/conf.d/laravel.ini
+
 COPY ./docker/entrypoint.sh /usr/local/bin/
 RUN chmod +x /usr/local/bin/entrypoint.sh
 

docker/php.ini

@@ -0,0 +1,2 @@
+post_max_size = 20M
+upload_max_filesize = 20M

justfile

@@ -24,8 +24,12 @@ shell:
   docker compose exec --user www php-fpm bash
 
 # Generate API documentation
-docs:
+docs *args:
-  docker compose exec --user www php-fpm php artisan scribe:generate
+  docker compose exec --user www php-fpm php artisan scribe:generate {{ args }}
+
+# Regenerate DB and docs
+docs-fresh:
+  just db && just docs --force
 
 # Reset database with fresh migration and seeding
 db:
@@ -34,3 +38,7 @@ db:
 # Run tests
 test:
   docker compose exec --user www php-fpm php artisan test
+
+# Run Pint
+lint:
+  docker compose exec --user www php-fpm php ./vendor/bin/pint