Repository navigation
Compile PHP from source, drop PECL, and monitor dependencies with Renovate - #739
Merged
jaydrogers merged 10 commits intoOct 29, 2026
Merged
Conversation
`set -oe` without an option name makes /bin/sh print every shell option to stdout. Anything reading a helper's output got that dump first, such as the watcher URL lookup and the php.net checksum lookup. Use `set -e` (and `set -eu` in the s6 installer). Thanks to @tomschlick for spotting this in #726. Co-authored-by: Tom Schlick <tom@schlick.email>
Move each version that ships in an image (s6-overlay, php-fpm-healthcheck, the extension installer, FrankenPHP, Go, watcher, phpredis) into a `dependencies` block in php-versions-base-config.yml. CI and dev.sh pass the block as build args of the same name, and the Dockerfiles declare them without defaults so a missing pin fails the build. Build redis from its GitHub source, with its liblzf submodule fetched separately, so no default build step depends on PECL. Pin watcher instead of downloading the latest release.
Stop waiting for Docker Hub's php images. A new build-php-base phase runs prepare-php-base.sh, which takes docker-library/php at a pinned commit, sets the PHP version, URL, and php.net SHA256, and removes `pecl update-channels`. Everything else matches the official images. Each base compiles once without the build cache, so OS security fixes ship on the next run, and is saved to the Depot Registry. The variations build on it through BASE_IMAGE. get-php-versions.sh no longer checks Docker Hub, and a pinned patch_versions now replaces php.net's. Release candidates such as 8.6-rc build from php.net's release-candidates feed, and php_base_overrides lets a minor version change a variation's upstream variant. PHP 8.1 builds from the last docker-library commit that had it.
The compiled PHP bases install current Debian and Alpine packages, so they already ship the patched libbrotli for CVE-2026-111497. FrankenPHP's Bookworm Brotli build stays, because cbrotli needs libbrotli 1.1 or newer.
Replace Dependabot and get-nginx-versions.sh with Renovate. It reads the `# renovate:` comments in the base config and the lint workflow, checks each OS's NGINX package on nginx.org, groups GitHub Actions monthly, and merges the weekly docker-library/php bump once every check passes. Every other pin waits for a manual merge.
Contributor
Images for PR #739
Try it: docker run --rm -v "$PWD:/var/www/html" -p 8080:8080 serversideup/php-dev:739-8.5-fpm-nginxEvery image is on Docker Hub as All images with sizesSizes are compressed, per architecture.
Updated on every push to this PR. |
A base job whose runner dropped reports cancelled, not failure, so builds still ran and failed on a base image that was never saved. Build only when the base phase succeeded or was skipped (fork PRs).
Deploying serversideup-php with
|
| Latest commit: |
11d041c
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://fa8c6c81.serversideup-php.pages.dev |
| Branch Preview URL: | https://build-php-from-source-renova.serversideup-php.pages.dev |
…lpine 3.23 and 3.24, Bookworm, and Trixie from the newest release candidate php.net lists. FrankenPHP uses the cli base, since docker-library builds every 8.6 image with ZTS. Upgrade install-php-extensions to 2.12.6 for its PHP 8.6 support. phpredis 6.3.0 does not compile on PHP 8.6, so 8.6 builds phpredis at 810984b, the last develop commit before an added build option that install-php-extensions answers out of order."
…ION with FRANKENPHP_VERSION for synchronized updates
This was referenced Oct 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
During the last critical PHP release (#721), we waited hours for Docker Hub's
phpimages, then PECL went down. This PR takes both out of our build.flowchart LR subgraph Before direction LR A1[php.net] -. hours .-> A2[Docker Hub php images] --> A3[Our build] --> A4[PECL] --> A5[Publish] end subgraph After direction LR B1[php.net] --> B2[We compile PHP] --> B3[Our build] --> B4[Publish] endWhat changes
Built byname, and the removedpecl update-channelscall.redisbuilds from its GitHub source.scripts/conf/php-versions-base-config.yml). Renovate watches it and replaces Dependabot.8.6-rctags.set -oebug printed shell options into helper output. The Brotli workaround from Security: Patch Brotli for CVE-2026-111497 and upgrade FrankenPHP to 1.13.4 #737 is gone, because freshly compiled images already have the patched library.No breaking changes
All 79 existing images were compared against what's live today (the 18
8.6-rcimages are new):php -vSpecial Thanks
Thanks to @tomschlick for #726, which started this.