92 lines
2.3 KiB
Docker
92 lines
2.3 KiB
Docker
# --- Stage 1: Build PHP ---
|
|
FROM alpine:3.22 AS builder
|
|
|
|
ENV PHP_VERSION=8.5.0
|
|
|
|
# Build dependencies
|
|
RUN apk add --no-cache \
|
|
build-base autoconf bison re2c \
|
|
postgresql-dev \
|
|
curl tar \
|
|
libxml2-dev openssl-dev sqlite-dev zlib-dev pcre2-dev libzip-dev oniguruma-dev \
|
|
freetype-dev libpng-dev libjpeg-turbo-dev libwebp-dev \
|
|
curl-dev
|
|
|
|
WORKDIR /tmp
|
|
|
|
# Download + extract
|
|
RUN curl -fSL https://www.php.net/distributions/php-$PHP_VERSION.tar.gz -o php.tar.gz \
|
|
&& tar -zxf php.tar.gz
|
|
|
|
WORKDIR /tmp/php-$PHP_VERSION
|
|
|
|
# Configure static PHP build
|
|
RUN ./configure \
|
|
--prefix=/usr/local/php \
|
|
--with-config-file-path=/usr/local/php \
|
|
--with-config-file-scan-dir=/usr/local/php/conf.d \
|
|
--enable-fpm \
|
|
--with-fpm-user=php \
|
|
--with-fpm-group=php \
|
|
--enable-mbstring \
|
|
--enable-opcache \
|
|
--with-pcre2 \
|
|
--with-zlib \
|
|
--with-openssl \
|
|
--with-curl \
|
|
--with-zip \
|
|
--with-xml \
|
|
--with-sqlite3 \
|
|
--with-pdo-sqlite \
|
|
--with-pdo-pgsql \
|
|
--with-gd \
|
|
--with-jpeg \
|
|
--with-webp \
|
|
--with-freetype
|
|
|
|
RUN make -j$(nproc) && make install
|
|
|
|
# PHP production config
|
|
RUN cp php.ini-production /usr/local/php/php.ini
|
|
|
|
# Cleanup
|
|
RUN rm -rf /tmp/* /var/cache/apk/*
|
|
RUN rm -rf /usr/local/php/lib/php/build
|
|
RUN rm -rf /usr/local/php/include
|
|
RUN rm -rf /usr/local/php/php/man
|
|
|
|
# Strip
|
|
RUN strip --strip-all /usr/local/php/bin/php || true
|
|
RUN strip --strip-all /usr/local/php/sbin/php-fpm || true
|
|
RUN find /usr/local/php -name "*.so" -exec strip --strip-unneeded {} \; || true
|
|
|
|
# --- Stage 2: Runtime ---
|
|
FROM alpine:3.22
|
|
|
|
# Runtime libraries only
|
|
RUN apk add --no-cache \
|
|
libxml2 openssl zlib libzip pcre2 oniguruma \
|
|
freetype libpng libjpeg-turbo libwebp \
|
|
postgresql-libs
|
|
|
|
RUN addgroup -S php && adduser -S -D -H -G php php
|
|
RUN mkdir -p /usr/local/php/conf.d /var/run/php
|
|
|
|
# Copy compiled PHP
|
|
COPY --from=builder /usr/local/php /usr/local/php
|
|
|
|
# Copy hardened configs on top
|
|
COPY php-fpm.conf /usr/local/php/php-fpm.conf
|
|
COPY php-fpm.d/www.conf /usr/local/php/php-fpm.d/www.conf
|
|
COPY conf.d/security.ini /usr/local/php/conf.d/security.ini
|
|
|
|
EXPOSE 9000
|
|
|
|
USER php
|
|
|
|
CMD ["/usr/local/php/sbin/php-fpm", "--nodaemonize"]
|
|
|
|
# Healthcheck
|
|
HEALTHCHECK --interval=30s --timeout=3s --retries=3 CMD /usr/local/php/bin/php-fpm -t >/dev/null 2>&1 || exit 1
|
|
|