Repository navigation
Release 5.1: PHP patches within the hour, signed images, PHP 8.6-rc, and more - #740
Open
jaydrogers wants to merge 26 commits into
Open
jaydrogers wants to merge 26 commits into
jaydrogers wants to merge 26 commits into
Conversation
`set -oe` without an option name makes /bin/sh print every shell option to stdout. Anything reading a helper's output got that dump first, such as the watcher URL lookup and the php.net checksum lookup. Use `set -e` (and `set -eu` in the s6 installer). Thanks to @tomschlick for spotting this in #726. Co-authored-by: Tom Schlick <tom@schlick.email>
Move each version that ships in an image (s6-overlay, php-fpm-healthcheck, the extension installer, FrankenPHP, Go, watcher, phpredis) into a `dependencies` block in php-versions-base-config.yml. CI and dev.sh pass the block as build args of the same name, and the Dockerfiles declare them without defaults so a missing pin fails the build. Build redis from its GitHub source, with its liblzf submodule fetched separately, so no default build step depends on PECL. Pin watcher instead of downloading the latest release.
Stop waiting for Docker Hub's php images. A new build-php-base phase runs prepare-php-base.sh, which takes docker-library/php at a pinned commit, sets the PHP version, URL, and php.net SHA256, and removes `pecl update-channels`. Everything else matches the official images. Each base compiles once without the build cache, so OS security fixes ship on the next run, and is saved to the Depot Registry. The variations build on it through BASE_IMAGE. get-php-versions.sh no longer checks Docker Hub, and a pinned patch_versions now replaces php.net's. Release candidates such as 8.6-rc build from php.net's release-candidates feed, and php_base_overrides lets a minor version change a variation's upstream variant. PHP 8.1 builds from the last docker-library commit that had it.
The compiled PHP bases install current Debian and Alpine packages, so they already ship the patched libbrotli for CVE-2026-111497. FrankenPHP's Bookworm Brotli build stays, because cbrotli needs libbrotli 1.1 or newer.
Replace Dependabot and get-nginx-versions.sh with Renovate. It reads the `# renovate:` comments in the base config and the lint workflow, checks each OS's NGINX package on nginx.org, groups GitHub Actions monthly, and merges the weekly docker-library/php bump once every check passes. Every other pin waits for a manual merge.
A base job whose runner dropped reports cancelled, not failure, so builds still ran and failed on a base image that was never saved. Build only when the base phase succeeded or was skipped (fork PRs).
…lpine 3.23 and 3.24, Bookworm, and Trixie from the newest release candidate php.net lists. FrankenPHP uses the cli base, since docker-library builds every 8.6 image with ZTS. Upgrade install-php-extensions to 2.12.6 for its PHP 8.6 support. phpredis 6.3.0 does not compile on PHP 8.6, so 8.6 builds phpredis at 810984b, the last develop commit before an added build option that install-php-extensions answers out of order."
…ION with FRANKENPHP_VERSION for synchronized updates
Deploying serversideup-php with
|
| Latest commit: |
e1cfbf7
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://e515b7ad.serversideup-php.pages.dev |
| Branch Preview URL: | https://release-improve-builds.serversideup-php.pages.dev |
Contributor
Images for PR #740
Try it: docker run --rm -v "$PWD:/var/www/html" -p 8080:8080 serversideup/php-dev:740-8.5-fpm-nginxEvery image is on Docker Hub as All images with sizesSizes are compressed, per architecture.
Updated on every push to this PR. |
…es (#741) * Split image tests into one file per feature area Move the checks in scripts/test-image.sh into scripts/tests/image/ with shared helpers in lib.sh and PHP fixtures as real files. Every test runs even after one fails, and TEST_ONLY runs a single area. No checks were added or changed. * Test Laravel automations, startup scripts, set-id, and SSL modes Add laravel-automations.sh (a stand-in artisan records each command), entrypoint.sh, permissions.sh, and SSL mixed mode and HTTPS redirect tests. requires now also skips a single test, and build_image builds a test image from the one under test. * Test trusted proxies, PHP-FPM pool variables, and shutdown Add trusted-proxy.sh, fpm.sh, and lifecycle.sh (replacing healthcheck.sh), which also checks that docker stop finishes before Docker kills the container. The s6 images skip that check, since they wait to be killed on purpose for zero-downtime deployments (#647). Add a skip helper.
…#742) * Split image tests into one file per feature area Move the checks in scripts/test-image.sh into scripts/tests/image/ with shared helpers in lib.sh and PHP fixtures as real files. Every test runs even after one fails, and TEST_ONLY runs a single area. No checks were added or changed. * Test Laravel automations, startup scripts, set-id, and SSL modes Add laravel-automations.sh (a stand-in artisan records each command), entrypoint.sh, permissions.sh, and SSL mixed mode and HTTPS redirect tests. requires now also skips a single test, and build_image builds a test image from the one under test. * Test trusted proxies, PHP-FPM pool variables, and shutdown Add trusted-proxy.sh, fpm.sh, and lifecycle.sh (replacing healthcheck.sh), which also checks that docker stop finishes before Docker kills the container. The s6 images skip that check, since they wait to be killed on purpose for zero-downtime deployments (#647). Add a skip helper. * Add release watcher, image signing, and public vulnerability scanning * Simplifed scanning
jaydrogers
changed the title
jaydrogers
marked this pull request as ready for review
October 30, 2026 22:01
…igured minors in the release watcher
…edirects, disable_certs, or ignore_loaded_certs with SSL_MODE mixed or full
… the other variations
…has the requested UID The script moved the target user to 99<uid> instead of the user that held the UID, so the final usermod failed with "UID already in use". It now moves the conflicting user and group, and skips the move when the ID already belongs to the target.
…orers Env vars and helper commands now live in docs/content/data/*.yml and render through EnvVarExplorer and CommandExplorer. The raw markdown and llms.txt output expand them, so agents get the same reference.
check-env-var-docs.sh and check-command-docs.sh fail when env-vars.yml or commands.yml drift from src/. scripts/lint.sh runs every check CI runs, so contributors can run them locally, and service_lint.yml calls it per job. action_lint-docs.yml runs the doc checks on pull requests that only change docs, which the image workflow skips. AGENTS.md and docs/AGENTS.md are rewritten around the rules that are easy to break, and AGENTS.md gains a section on PHP versions and releases.
Shorter pages that lead with what the reader needs, with facts checked against src/. Corrects several old claims: where NGINX comes from, fpm having S6 Overlay, .ini load order, a custom NGINX example that stopped the server, and the FrankenPHP SERVER_NAME variable. Migrating from the official images moves into getting started and covers the real steps. The upgrade guide moves to its own section, the changelog points to GitHub releases, and About folds into Getting help.
Adds a Running workers page that every worker guide builds on: the stop signal, the health check, and running automations on one service only. The Laravel health-check guide moves here from the advanced guides. Fixes examples that didn't work: Nightwatch across containers, the Traefik Host() rule in Reverb, and the claim that failing containers restart. WordPress gets a working Compose file with MariaDB.
Trusted proxies and performance tuning move here from the advanced guides, and a new Health checks page covers the built-in check in each variation. Development to production folds into Packaging your app, which now shows a multi-stage build, .dockerignore, and Vite build args. Fixes the FrankenPHP SSL Compose example, stops recommending trusting X-Forwarded-For in Laravel, and adds PHP-FPM worker sizing that matches the image defaults.
The advanced guides section is gone. S6 Overlay and file permissions move under Customizing the image. The upgrade guide gets its own section with one page per major version. Verifying images, vulnerability scanning, and a new How images are built page form a Security section. Common issues grows from two entries to eight, and the start-up scripts page now covers run order, set -e, and SERVERSIDEUP_DEFAULT_COMMAND.
Adds Upgrading and Security to the navigation and drops Advanced Guides. Every removed or moved URL redirects to its new page, and SECURITY.md links point to the new paths. A Release Notes link replaces the changelog page.
Sentence-case headings, a shorter contributing section, and the Unit variation marked as removed. The Laravel example drops PHP_OPCACHE_ENABLE, since it mounts code for development.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
👨🔬 How to test
You can test this image using our serversideup/php-dev repository, which automatically builds on push to this PR.
View the available testing images →
🌎 Docs Preview
🤩 What's new
PHP security releases reach you within about an hour (#739, #742)
During the last critical PHP release (#721), we waited hours for Docker Hub's
phpimages, then PECL went down. We now compile PHP ourselves with the same Dockerfiles as the official images, so neither one can hold up a release. A new hourly check starts a build as soon as php.net lists a patch, on any day of the week.phpimages → PECL → wait for our next release or Tuesday rebuildEvery build also starts from current Debian and Alpine packages, so OS security fixes reach your image on the weekly rebuild (Tuesday 08:00 UTC). PHP 8.1 benefits most: its official images haven't been rebuilt since it reached end of life.
Verify that an image came from us (#742)
Every image is now signed with cosign and ships with an SBOM (every package inside it) and build provenance (how and where it was built). Check an image before you run it:
cosign verify serversideup/php:8.5-cli \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-identity-regexp '^https://github\.com/serversideup/docker-php/\.github/workflows/service_publish-images\.yml@refs/(heads/main|tags/v.+)$'Images published before 5.1 have provenance but no signature or SBOM. See Verifying images.
Every image is scanned for vulnerabilities (#742)
After every production build, Grype scans each published image. The results are on each run's summary page. You can see the known vulnerabilities in any image without running a scanner yourself. See Vulnerability scanning.
PHP 8.6 release candidates (#739)
Test your app on PHP 8.6 before it ships. Every rebuild uses the newest release candidate on php.net, so a new RC arrives with the next weekly rebuild. These tags are for testing only.
⬆️ Upgrading
Nothing to change. Every existing tag is still published and the images behave the same. Two things you may notice:
php -vnow saysBuilt by Server Side Upinstead ofBuilt by https://github.com/docker-library/phpinstall-php-extensionsis upgraded from 2.12.0 to 2.12.6🐛 Bug fixes
docker-php-serversideup-downloadprinted every shell option to stdout before the file when you didn't give it an output file (Compile PHP from source, drop PECL, and monitor dependencies with Renovate #739)docker-php-serversideup-set-idfailing when the requested UID is taken. If another user in the image already had the UID you passed, the script moved the wrong user and the build failed with "UID already in use". It now moves the other user or group to99<id>and gives yours the ID you asked for.🏗️ For contributors
scripts/conf/php-versions-base-config.yml, and Renovate replaces Dependabot to keep them current (Compile PHP from source, drop PECL, and monitor dependencies with Renovate #739)scripts/dev.sh --build-php-basebuilds exactly what CI builds. See How PHP is builtscripts/tests/image/, and every failure shows up in one run. New tests cover Laravel automations, startup scripts, SSL modes, trusted proxies, PHP-FPM pool variables, file permissions, and shutdown (Split image tests into one file per feature area and test more features #741)docker-php-serversideup-install-php-ext-installerinstalls the latest release when you don't give it a version (it was pinned to 2.12.0). Buildingsrc/variations/*/Dockerfiledirectly now needs the dependency build args fromscripts/conf/php-versions-base-config.yml, so usescripts/dev.sh