PHP and Composer with Docker build: failed to clone git

Question

I am trying to create a Dockerfile to automate the installation of HumHub following the install guide: https://www.humhub.org/docs/guide-admin-installation.html

However, whenever the build script runs composer, I get the following error:

Changed current directory to /root/.composer
./composer.json has been created
Loading composer repositories with package information
Updating dependencies (including require-dev)
- Installing fxp/composer-asset-plugin (v1.1.1)
    Downloading: Connecting...    Failed to download fxp/composer-asset-plugin from dist: Could not authenticate against github.com
    Now trying to download from source
- Installing fxp/composer-asset-plugin (v1.1.1)
    Cloning daca454b94539a4e6d30937dfc6b817eceb03f28

Writing lock file
Generating autoload files
Loading composer repositories with package information
Updating dependencies (including require-dev)
Failed to clone the git@github.com:jquery/jquery-dist.git repository, try running in interactive mode so that you can enter your GitHub credentials

[RuntimeException]                                                          
Failed to execute git clone --mirror 'git@github.com:jquery/jquery-dist.git' '/root/.composer/cache/vcs/git-github.com-jquery-jquery-dist.git/'  

Presumably this is caused by composer using git to install jquery and expecting git to be pre-configured with git access credentials. However, it makes no sense to provide git access credentials for a Docker build script.

I have attempted to force both git and composer to use https (see How to force Composer to use https:// instead of git://? ) however it does not appear to have the desired effect. Could this be caused by a bug in the composer plugin composer-asset-plugin?

Here's the build file:

FROM orukami/alpine-php:5.6

ENV WWW_ROOT /var/www
ENV PUBLIC_ROOT /var/www/public

COPY nginx /etc/nginx
COPY fpm /etc/php/fpm
COPY supervisord.conf /etc/supervisord.conf
COPY entrypoint.sh /

RUN apk add -U nginx supervisor git curl && \
    mkdir -p /var/www && mkdir -p ${WWW_ROOT} && \
    rm -rf /var/cache/apk/* && \
    chmod +x /entrypoint.sh

RUN git clone https://github.com/humhub/humhub.git /var/www/public
RUN cd /var/www/public && curl -sS https://getcomposer.org/installer | php
RUN git config --global url."https://".insteadOf "git://" && cd /var/www/public && \
    ./composer.phar config --global github-protocols https && \
    ./composer.phar global require "fxp/composer-asset-plugin:~1.1.0" && \
    ./composer.phar update

WORKDIR ${WWW_ROOT}

EXPOSE 80 443

VOLUME /var/www/public

ENTRYPOINT ["/entrypoint.sh"]

CMD ["/usr/bin/supervisord"]

This must be a very common problem, however I can't find any solutions at all online.

Answer 1

The problem was eventually traced to the composer-asset-plugin not respecting the instruction to load over https instead of git://. The solution is to copy over a file like this one: https://github.com/djcf/humhub-docker/blob/master/config.json into /root/.composer.

Answer 2

The accepted solution could work but it could also be insecure because there is a github token hardcoded into the config.json file. See here for a detailed explanation and more secure solution: https://www.previousnext.com.au/blog/managing-composer-github-access-personal-access-tokens

The root cause is that github limits the number of api calls made by a client like composer. Composer uses github api to download the files to your vendor directory and when it reaches de limit ( https://docs.github.com/en/rest/overview/resources-in-the-rest-api#rate-limiting ) you will see that error message.

In certain circumstances (like mine which is not exactly the @DMCoding 's situation), if you have no way to generate the token because, for example, the repository is not under your control, another alternative is to reduce the number of api requests composer does by setting the parameter no-api to true in composer.json, for example:

"repositories": [
  {
    "type": "vcs",
    "url": "https://github.com/user/repo",
    "no-api": true
  }
]

Composer will reduce the calls per repo from around 20 to just one: the call to download the zipped repo from github. There is a way to set the option for all packages from github: that way composer will download the zipped repo only once and try to run git pull in every update: https://getcomposer.org/doc/06-config.md#use-github-api