D9 images don't allow for easy silent composer requires

[jddh]

Scenario: Drupal now recommends installing modules via composer. Indeed it is required for modules that have vendor library dependencies. Thus we may want to run some composer require commands when creating our containers.

Indeed one might do this as a command in Docker Compose, or aggregate a few in a shell script. However, the D9 images come with no config.add-plugins information in their composer.json. Whereas if I install Drupal 9 via Composer today, its composer.json will include:

"allow-plugins": {
            "composer/installers": true,
            "drupal/core-composer-scaffold": true,
            "drupal/core-project-message": true,
            "dealerdirect/phpcodesniffer-composer-installer": true
        },

Without this, composer require commands will require user input to trust the plugins. This will hold up a shell script from completing. If we were to avoid the hangup with the --no-interaction flag on the composer require, then Composer will assume the plugins are untrusted and download a different drupal/core package, installing it over drupal/recommended-project, which is what these images use. That can mess up an installation.

I'm not sure why these Dockerfile installs result in a composer.json that is missing this important parameter, but I recommend that it's included.

[yosifkit]

We just use the composer.json provided by drupal/recommended-project and both 9.4 and 9.3 have an allow-plugins section:

$ docker run -it --rm drupal:9.3.18 cat composer.json | grep -A5 allow-
        "allow-plugins": {
            "composer/installers": true,
            "drupal/core-composer-scaffold": true,
            "drupal/core-project-message": true,
            "dealerdirect/phpcodesniffer-composer-installer": true
        },
$ docker run -it --rm drupal:9.4.2 cat composer.json | grep -A5 allow-
        "allow-plugins": {
            "composer/installers": true,
            "drupal/core-composer-scaffold": true,
            "drupal/core-project-message": true,
            "dealerdirect/phpcodesniffer-composer-installer": true
        },

[jddh]

I see — it was an issue in Core resolved in 9.3.18. I was using a slightly older version. Thank you for the clarification.