progrium/buildstep — pull request #109 by yabawock (2014-09-26 23:06:40+00:00)
Title: Modernize buildstep for cedar-14 stack and Heroku buildpack requirements

# Goal

Modernization of the builder architecture so that the build process more closely resembles the Heroku
workflow. This involves the following high level changes:

* ubuntu-deboostrap:14.04 base image for a smaller surface area to begin with.
* unmodified cedar-14 stack install script from Heroku. Ensures the installed packages match closely.
* integrate the flynn buildback installer. Removes code duplication and allows versioning installed buildpacks
* correctly identify the stack as cedar-14 so that the buildpacks know which binaries to install
* switch to Heroku buildpacks for Go and PHP
* Remove all preinstalled custom buildpacks. Lesser maintenance burden, fair for all custom buildpack authors

# Actions

## Removed packages

The following packages are no longer be installed on build:
* `libjpeg62`, `libpng12-0`, `libpng12-dev`, `libreadline5`
By choosing the right binaries for the stack these packages are no longer required
* `libmagickcore-dev`, `postgresql-server-dev-9.3`
These packages are implicitly installed due to dependencies of other packages
* `nodejs`
The official heroku buildpacks install a node version if it is required
* `libssl0.9.8`
Superseded by libssl1.0.0
* `mercurial`
The official heroku buildpacks install mercurial as required
* `openjdk-7-jdk`, `openjdk-7-jre-headless`
Will be automatically installed by the java buildpack, otherwise the multi buildpack should be used
* `postgresql-client`, `mysql-client`
Open for discussion. In favor of an unmodified cedar-14 stack I removed them since the benefit of having them in the container is small with a database server that should be reachable from the admin workstation.
* `libsqlite3-dev`, `sqlite3`
SQLite is not available on cedar-14 and not really useful on ephemeral filesystems
* `libmcrypt-dev`
Removed in favor of an unmodified cedar-14 stack image. Could be installed by a custom buildpack if required.

## Removed custom buildpacks

The following custom buildpacks are no longer preinstalled in the buildstep image:

* Metorite - `https://github.com/oortcloud/heroku-buildpack-meteorite.git`
* Perl - `https://github.com/miyagawa/heroku-buildpack-perl.git`
* Dart - `https://github.com/igrigorik/heroku-buildpack-dart.git`
* NGINX - `https://github.com/rhy-jot/buildpack-nginx.git`
* Apache - `https://github.com/Kloadut/heroku-buildpack-static-apache.git`
* Jekyll - `https://github.com/bacongobbler/heroku-buildpack-jekyll.git`

# Validation

Validation of buildstep has been performed with all sample apps provided on the [Getting Started on Heroku](https://devcenter.heroku.com/start) website.

The following deploys worked without modification:

* Ruby - OK (Ruby 2.0.0, PostgreSQL)
* PHP - OK (PHP 5.5.11, Apache 2.4.10)
* node.js - OK (Node.JS 0.10.32)
* Python - OK (Python 2.7.8)
* Java - OK (OpenJDK 1.7, Jetty 7.6.0.v20120127)
* Clojure - OK (OpenJDK 1.6, Leinigen 2.4.2, Jetty 7.x.y-SNAPSHOT)
* Scala - OK (OpenJDK 1.7, SBT 0.13.5, Scala 2.10.4)

# Known Quirks

Since buildstep runs as root within the container newer PHP Versions (after 5.5.11) don't work without a modified php-fpm.conf. Due to CVE-2014-0185 PHP changed the default permissions for the listening socket from 0666 to 0660. Since PHP-FPM and Apache both get run as root this results in the PHP-FPM process creating the listening socket belonging to `root:root` with mode 0660 and Apache running as `daemon:daemon` which can't read the PHP socket.

The workaround for dokku involves telling PHP-FPM to set the socket to 0666 mode:

Tell the startup script to include a config fragment for PHP-FPM:
**Procfile**
```
web: vendor/bin/heroku-php-apache2 -F conf/php-fpm.inc.conf web/
```

Add a conf folder with the following `php-fpm.inc.conf` to your application
**php-fpm.inc.conf**
```
listen.owner = nobody
listen.mode = 0666
```

With this workaround enable the example app has been validated using PHP 5.5.16 and PHP 5.6.0 as well.
Heroku doesn't have this problems as the daemons don't get started as root and run as the same unprivileged user.

# Results

## Closed issues

These changes should close the following issues:

* #36 Allow to switch the buildpack branch (due to flynn buildpack installer)
* #61 Ruby 1.8 app won't start on image generated with buildstep (bundler is no longer installed globally)
* #66 Use $app_root and $build_root instead of hard coding /app and /build
* #80 scala buildpack is broken due to config_vars and quoting
* #82 HHVM support (switch to official PHP buildpack with HHVM)
* #84 Cannot pull down buildpack for Ruby 2.0
* #91 `make build` fails because rubygems are not installed
* #93 PHP after switch to Trusty (PHP buildback defaulted to `cedar` stack binaries due to missing STACK env var)
* #94 update-alternatives fails in prepare script (no longer gets called)

## Closed pull requests

These changes should close the following pull requests:

* #38 - Generate en_US.UTF-8 locale
* #41 - Install language-pack-en-base
* #71 - Removed old perl buildpack, using new one
* #95 - locale utf8 issue solved
* #97 - Use official php buildpack
* #103 - Copy and run prepare before builder to better leverage docker caching
* #104 - Fix bundler cache that was not working.
* #106 - Make sure libreadline5 is installed.
* #107 - Hardcode stack name
* #108 - Replaced CHH's buildpack with official one.