dementev/php-fpm-with-ext repository overview

⁠php-fpm-with-ext — PHP-FPM / CLI with the extensions preinstalled

PHP-FPM and PHP-CLI images with the extensions most PHP projects actually reach for already compiled in (gd, intl, imagick, redis, memcached, pdo_mysql, pdo_pgsql, opcache, soap, zip, zstd, …), a healthcheck that verifies the pool rather than the socket, and a small LD_PRELOAD shim for the PrestaShop chmod(0) cache bug.

Defaults are sized for PrestaShop-class applications — 1 GB memory_limit, long max_execution_time, large uploads. Drop your own .ini at /usr/local/etc/php/conf.d/99-php.ini to override anything.

⁠Tags

{version}-{flavor}. There is no latest: a PHP image whose tag doesn't name the version is a trap.

Multi-arch: linux/amd64, linux/arm64. Every image carries an SBOM, max-mode build provenance and a keyless Cosign signature:

cosign verify dementev/php-fpm-with-ext:8.5-fpm \
  --certificate-identity-regexp '^https://github\.com/vdementev/docker-php-fpm-with-ext/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

⁠What's inside (FPM)

• PHP-FPM (alpine for 7.0 – 8.0, debian trixie for 8.1+) with a consistent extension set: exif, gd, igbinary, imagick, intl, memcached, mysqli, opcache, pcntl, pdo_mysql, pdo_pgsql, redis, soap, zip, zstd.
• fpm-health wired up as a Docker HEALTHCHECK: it wraps php-fpm-healthcheck (renatomefi), requires a real status page back rather than just an open socket, and walks every pool listed in FPM_HEALTH_PORTS (comma-separated, default 9000) so a container running more than one pool reports unhealthy when any of them dies. pm.status_path = /status and ping.path = /ping are set in the bundled www.conf — a replacement www.conf has to keep pm.status_path, or the healthcheck will (correctly) fail.
• STOPSIGNAL SIGQUIT so docker stop triggers FPM's graceful worker drain instead of an immediate SIGTERM kill.
• Tools: jq, less, mariadb-client, nano, procps, rsync, unzip, zip, zstd, fcgi/libfcgi-bin (for the healthcheck binary). unzip is a separate package from zip — deploy scripts that shell out to it need both.
• Runs as www-data by default. WORKDIR /app.

⁠What's inside (CLI / CLI-builder)

• cli: same extension set as FPM, minus the FPM healthcheck and shim. Adds git on top of the FPM tool list.
• cli-builder: adds git, composer, Node 24 LTS (bundled npm, npx, corepack; 7.4 keeps the Alpine 3.16 nodejs package, which Node 24 cannot run on), semantic-release, brotli, sqlite3, pdo_sqlite for CI usage.
• Default CMD ["sh"] on cli-builder. Runs as www-data.

⁠PrestaShop chmod(0) shim

PrestaShop's cache regeneration (module reset/install, cache clear, debug-mode toggle) invalidates files like appParameters.php, class_index.php, and namespaced_class_stub.php by calling chmod($file, 0000) and then rewriting them. If the rewrite fails or races, the files stay at mode 0000 and every subsequent request returns a 500 until permissions are manually fixed. Reported upstream since PS 1.7.4, still present in 8.2.x (PS issues #10998, #13050, #30786, #37666).

The FPM images ship /usr/local/lib/php-chmod-sanitize.so, an LD_PRELOAD shim that intercepts chmod, fchmod, and fchmodat. When called with mode 0, the shim promotes the call to 0644 for regular files and 0755 for directories. Non-zero modes pass through. Not active by default — enable it per project:

services:
  php:
    image: dementev/php-fpm-with-ext:8.3-fpm
    environment:
      LD_PRELOAD: /usr/local/lib/php-chmod-sanitize.so

LD_PRELOAD applies to every process in the container (FPM workers, CLI, composer), so any genuine chmod($x, 0) anywhere will also be rewritten — for PrestaShop that's the desired behavior. CLI / CLI- builder variants do not ship the shim. The shim masks the bug rather than fixing it — track upstream PS fixes.

⁠Override config

FROM dementev/php-fpm-with-ext:8.3-fpm
COPY 99-app.ini /usr/local/etc/php/conf.d/99-app.ini
COPY www.conf  /usr/local/etc/php-fpm.d/www.conf

01-php.ini is the image-default; anything in 99-*.ini overrides it.

Defaults worth knowing before you override them:

• disable_functions blocks the process-spawning family as a whole (exec, shell_exec, passthru, system, popen, proc_*, pcntl_exec) plus dl, show_source/highlight_file. It does not block getmypid/getmyuid/diskfreespace — those break real libraries and blocked nothing (posix_getpid, disk_free_space). The cli-builder images set no disable_functions at all, since composer and npm need to spawn processes.
• OPcache follows PrestaShop's tuning guide, with max_accelerated_files = 32531, enable_file_override = 0 and JIT off (opcache.jit = disable, jit_buffer_size = 0).

⁠Security

Published digests are signed and carry an SBOM and build provenance. This image is deprecated and gets no further fixes: a vulnerability found in it is fixed in lotuswebagency/php⁠, not here. See SECURITY.md⁠.

⁠Related images

One family, built by the same pipeline, meant to run together — a proxy in front, an app runtime, a database, and a way into it.

⁠Maintainer

Built and maintained by Vasilii Dementev⁠ at Lotus Web Agency⁠. These images are not a side project — they are the base layer under the client and product systems we run, which is why they are gated, tested and signed rather than pushed by hand.

Issues and pull requests go to the successor, github.com/LotusWebAgency/php⁠. Need this kind of infrastructure built or maintained for your own stack? lotuswebagency.com⁠.

Packaging in this repository is MIT licensed — see LICENSE⁠. The software inside the image keeps its own upstream licenses.