Laravel and Docker

Hello,

I just had a discussion with my former boss about Laravel and Docker. Now I continue to work with him as a freelance, I don't do anything on Docker for him, but I'd like to advise him.

He knows Docker, not me. I know Laravel, not him.

In development mode, I'm using sail ; and in production I'm using docker-compose.

We have developed an application and put it in production with Docker. To do that, I have followed the series https://laracasts.com/series/the-docker-tutorial.

Here is an example of what I have done.

// docker-compose.prod.yml

services:
  nginx:
    build:
      context: .
      dockerfile: ./docker-services/nginx.dockerfile
    container_name: yggdra-nginx
    ports:
      - 80:80
    volumes:
      - .:/var/www/html
    depends_on:
      mariadb:
        condition: service_started
      php:
        condition: service_started
  ...

// nginx configuration

server {
    listen 80;
    index index.php index.html;
    server_name _;
    root /var/www/html/public;
    client_max_body_size 100M;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location /app/ {
        proxy_pass http://soketi:6001;
        proxy_http_version 1.1;
        proxy_set_header Upgrade 'websocket';
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass php:9000;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
    }
}

What seems to perturb my former boss is this.

volumes:
  - .:/var/www/html

He is afraid that if a hacker enters a container, he will have access to all informations and he wanted to move several folders and files (like node_modules, .env, ...) inside another folder to avoid exposing some informations.

But I'm not sure it's a good idea because Laravel is structured to have all these folders and files to work properly. Furthermore the nginx configuration is set to not let people access to the Laravel files.

root /var/www/html/public;

The /var/www/html folder contains all Laravel files (it's the root of the project). And inside this folder, there is the public folder, exactly like in a standard Laravel application.

What would be your first reaction ? Is there any risk around security with this configuration, with Laravel ? with Docker ? What other informations would you need to answer my question ?

Thanks for your help to understand what could be risky.

V