code
6ddd151ed1
Rebuild on the official PHP image instead of Sury's repo on bare Debian. Fixes surfaced along the way: missing pkg-config/libonig-dev broke the zip/mbstring extension builds, purging libzip-dev also auto-removed the libzip5 runtime lib the compiled zip.so needs, phpredis needed bumping to 6.3.0 for PHP 8.5 header compatibility, and the php-fpm.conf listen directive sed didn't match the commented-out default line so FPM never created its unix socket, causing 503s from Apache's proxy_fcgi handler. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
122 lines
4.4 KiB
Docker
122 lines
4.4 KiB
Docker
FROM php:8.5.8-fpm-trixie
|
|
|
|
ARG PHP_REDIS_VERSION=6.3.0
|
|
|
|
WORKDIR /data
|
|
|
|
# Install Apache + build deps for the PHP extensions we need
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
logrotate \
|
|
ssl-cert \
|
|
apache2 \
|
|
libzip-dev \
|
|
libonig-dev \
|
|
pkg-config \
|
|
$PHPIZE_DEPS \
|
|
&& echo "ServerName localhost" >> /etc/apache2/apache2.conf \
|
|
\
|
|
# PHP extensions (mysqli/pdo_mysql, mbstring, zip, redis)
|
|
# xml + curl are already built into the base image
|
|
&& docker-php-ext-install mysqli pdo_mysql mbstring zip \
|
|
&& pecl install redis-${PHP_REDIS_VERSION} \
|
|
&& docker-php-ext-enable redis \
|
|
\
|
|
# Keep the runtime shared libs the compiled extensions link against;
|
|
# only the -dev/headers packages and build toolchain get dropped below
|
|
&& apt-mark manual libzip5 libonig5 \
|
|
\
|
|
# Drop the build-only toolchain and headers now that the extensions are built
|
|
&& apt-get purge -y --auto-remove \
|
|
$PHPIZE_DEPS \
|
|
libzip-dev \
|
|
libonig-dev \
|
|
&& rm -rf /var/lib/apt/lists/* /tmp/*
|
|
|
|
# Apache + PHP-FPM configuration + performance tuning
|
|
RUN \
|
|
# Enable modules
|
|
a2enmod proxy_fcgi setenvif expires headers rewrite remoteip socache_shmcb ssl deflate \
|
|
\
|
|
# Switch to MPM event
|
|
&& a2dismod mpm_prefork \
|
|
&& a2enmod mpm_event \
|
|
\
|
|
# Remote IP config
|
|
&& echo 'RemoteIPHeader X-Forwarded-For' > /etc/apache2/conf-available/remoteip.conf \
|
|
&& echo 'RemoteIPTrustedProxy 127.0.0.1' >> /etc/apache2/conf-available/remoteip.conf \
|
|
&& a2enconf remoteip \
|
|
&& sed -ri 's/([[:space:]]*LogFormat[[:space:]]+"[^"]*)%h([^"]*")/\1%a\2/g' /etc/apache2/*.conf \
|
|
\
|
|
# Security headers
|
|
&& echo 'Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"' >> /etc/apache2/conf-available/security.conf \
|
|
&& echo 'Header always set X-Content-Type-Options "nosniff"' >> /etc/apache2/conf-available/security.conf \
|
|
&& echo 'Header always set X-Frame-Options "SAMEORIGIN"' >> /etc/apache2/conf-available/security.conf \
|
|
\
|
|
# Compression
|
|
&& echo 'AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css application/javascript application/json' > /etc/apache2/conf-available/compression.conf \
|
|
&& a2enconf compression \
|
|
\
|
|
# KeepAlive tuning
|
|
&& printf '%s\n' \
|
|
'KeepAlive On' \
|
|
'MaxKeepAliveRequests 100' \
|
|
'KeepAliveTimeout 2' \
|
|
> /etc/apache2/conf-available/keepalive.conf \
|
|
&& a2enconf keepalive \
|
|
\
|
|
# MPM Event tuning
|
|
&& printf '%s\n' \
|
|
'<IfModule mpm_event_module>' \
|
|
' StartServers 2' \
|
|
' MinSpareThreads 25' \
|
|
' MaxSpareThreads 75' \
|
|
' ThreadLimit 64' \
|
|
' ThreadsPerChild 25' \
|
|
' MaxRequestWorkers 150' \
|
|
' MaxConnectionsPerChild 1000' \
|
|
'</IfModule>' \
|
|
> /etc/apache2/conf-available/mpm-event-tuning.conf \
|
|
&& a2enconf mpm-event-tuning \
|
|
\
|
|
# Logrotate
|
|
&& printf '%s\n' \
|
|
'/var/log/apache2/*.log {' \
|
|
' weekly' \
|
|
' missingok' \
|
|
' rotate 4' \
|
|
' compress' \
|
|
' delaycompress' \
|
|
' notifempty' \
|
|
' create 640 root adm' \
|
|
'}' \
|
|
> /etc/logrotate.d/apache2 \
|
|
\
|
|
# PHP-FPM tuning (unix socket, to match the Apache vhost's proxy_fcgi handler)
|
|
&& mkdir -p /run/php \
|
|
&& sed -i \
|
|
-e 's|^;*listen = .*|listen = /run/php/php-fpm.sock|' \
|
|
-e 's/^;*listen.owner = .*/listen.owner = www-data/' \
|
|
-e 's/^;*listen.group = .*/listen.group = www-data/' \
|
|
-e 's/^;*listen.mode = .*/listen.mode = 0660/' \
|
|
-e 's/^pm = .*/pm = dynamic/' \
|
|
-e 's/^pm.max_children = .*/pm.max_children = 20/' \
|
|
-e 's/^pm.start_servers = .*/pm.start_servers = 2/' \
|
|
-e 's/^pm.min_spare_servers = .*/pm.min_spare_servers = 2/' \
|
|
-e 's/^pm.max_spare_servers = .*/pm.max_spare_servers = 5/' \
|
|
/usr/local/etc/php-fpm.d/www.conf
|
|
|
|
# PHP custom config — /php is layered in front of the image's default conf.d
|
|
ENV PHP_INI_SCAN_DIR="/php:${PHP_INI_DIR}/conf.d"
|
|
|
|
COPY php.ini /php/php.ini
|
|
COPY 000-default.conf /etc/apache2/sites-available/000-default.conf
|
|
COPY --chmod=755 start.sh /start.sh
|
|
|
|
RUN a2ensite 000-default
|
|
|
|
EXPOSE 80
|
|
|
|
CMD ["/start.sh"]
|