This repository is the source of truth for the official Docker 'wordpress' image. In production it generates and maintains a matrix of Dockerfiles covering three release channels (latest, beta, and a WP-CLI-only 'cli' variant) across PHP 8.2-8.5 and runtime variants (apache, fpm, fpm-alpine, alpine). The generated images download the WordPress tarball at build time with SHA1 verification, compile the exact PHP extension set WordPress requires (gd with AVIF/WebP/FreeType/Jpeg, mysqli, intl, imagick, zip, bcmath, exif), and install hardened PHP ini settings plus Apache mod_rewrite/remoteip configuration for proxy-aware logging. The build system is template-driven: versions.sh queries the WordPress.org API and wp-cli GitHub releases to discover current versions and checksums into versions.json, then apply-templates.sh renders Dockerfile.template (a jq/awk template) into every variant directory. CI (GitHub Actions) rebuilds and tests all variants using the bashbrew toolchain and verifies templating is committed. At container runtime, docker-entrypoint.sh performs idempotent first-run initialization: it detects a missing WordPress install, copies it from /usr/src/wordpress via tar while preserving ownership, intelligently skips pluggable content (wp-content/plugins/*, .htaccess) that already exists in a mounted volume to prevent downgrades, then generates wp-config.php from WORDPRESS_* environment variables if absent, replacing insecure default salts with /dev/urandom-derived values. The most reusable artifacts are docker-entrypoint.sh (a reference-quality container first-run pattern with careful non-root/uid handling and NFS-tolerant chown), wp-config-docker.php (the getenv_docker env_FILE→env→default fallback pattern, a clean 12-factor secret-handling approach), and the Dockerfile.template build logic, which demonstrates a non-obvious apt-mark/ldd/dpkg-query pipeline to strip build dependencies while retaining only the runtime shared libraries required by compiled PHP extensions — a meaningful image-size optimization. The repo is actively maintained, version-pinned with cryptographic checksums, and shows strong supply-chain hygiene; its only real weakness is thin test coverage (one integration test for the install path).