endava/php repository overview

⁠endava/docker-php

This is a docker php image is based on an alpine (and ubuntu) distribution including some tools and php extensions. You can find more details at the respective release pages on github.

⁠Usage

The images are published for linux/amd64 and linux/arm64 to:

• Docker Hub⁠: endava/php
• Quay⁠: quay.io/endava/php
• GitHub Container Registry⁠: ghcr.io/endava/docker-php

Each release ships a cli image and one image per web server variant:

Run a php application with nginx unit:

$ mkdir public
$ echo '<?php phpinfo();' > public/index.php
$ docker run --rm -p 8080:8080 -v `pwd`/public:/usr/src/app/public endava/php:8.5.12-unit

and open http://localhost:8080⁠. See the README of the respective release branch for more examples (apache2, php-fpm with nginx, cron).

⁠Supported Versions

Version	Branch	Latest Release	Status	Vulnerability Report	Fitness Functions
8.5	release/8.5⁠
8.4	release/8.4⁠
8.3	release/8.3⁠
8.2	release/8.2⁠

⁠Experimental Versions

Version	Branch	Latest Release	Status	Vulnerability Report	Fitness Functions
8.5 (ZTS)	release/8.5-zts⁠				—
8.4 (ZTS)	release/8.4-zts⁠
8.3 (ZTS)	release/8.3-zts⁠
8.2 (ZTS)	release/8.2-zts⁠
8.5 (Ubuntu)	release/8.5-ubuntu⁠				—
8.4 (Ubuntu)	release/8.4-ubuntu⁠
8.3 (Ubuntu)	release/8.3-ubuntu⁠
8.2 (Ubuntu)	release/8.2-ubuntu⁠

⁠Unsupported Versions

Unsupported as of php's eol list at https://www.php.net/eol.php⁠

Version	Branch	Latest Release	Status	Vulnerability Report
8.1	release/8.1⁠
8.1 (Ubuntu)	release/8.1-ubuntu⁠
8.0	release/8.0⁠

⁠Overview

This is the successor of the deprecated exozet/php-fpm⁠ docker image. We collected ideas on how a new (including breaking changes) version of our heavily used php-fpm image could look like.

We figured that our old approach had some disadvantages (it was a php-fpm build based on official docker php images⁠):

• it is based on a source build from php, so we could not use any packages from alpine/debian to speed up the build time
• there are differences between the php package on debian/alpine
• there is no official alpine apache2 build
• we cannot add nginx unit to alpine build, as it lacks php embed SAPI comment on php!1355⁠
• the non-alpine image has lots of (fixable) CVEs, we cannot fix (e.g. trivy image --ignore-unfixed php:8.1.13-fpm-buster says: Total: 23)
• depends on what the docker library team thinks fits into a docker image for php, it is not the php team releasing it

The new approach has some advantages:

• It uses the latest package distributed by alpine team/community (which is pretty fast when it comes to security updates - 1 or 2 days after release) and official ubuntu packages
• The precompiled packages (e.g. xdebug) are very fast installed
• No need for custom scripts like docker-php-ext-install⁠
• It ships with httpd binary (for apache2), unitd binary (for nginx unit) and php-fpm binary (for php fpm) to execute php web requests. The ZTS variants additionally ship a frankenphp variant
• For apache2 and nginx unit variants an external webserver (like nginx) is not necessary anymore
• It ships linux/arm64/v8 and linux/amd64 version of the image
• The web server and the web requests are executed as non-privileged user www-data
• The github release notes (including tool versions and php extension versions) is automatically generated if a commit is tagged
• Each release is available as endava/php:8.5.12 (cli) plus the -fpm, -apache2 and -unit variants (and -frankenphp for ZTS); ubuntu and ZTS lines add a -ubuntu or -zts suffix. There are no separate -root, -xdebug, -alpine or -sudo images
• The CI/CD pipeline includes tests to validate the image as nginx unit, apache2 and php-fpm delivery and the cron setup
• The CI/CD pipeline only builds the latest version (if necessary we can git checkout -b 8.1.13 if you really want to fix something in a release)

The new approach has a disadvantage:

• We depend on the release of php packages at alpine and ubuntu (e.g. on 2023/01/03 the php82 was not officially packaged on alpine including nginx unit - so we cannot support it. at the same time it is available as docker image on official docker php). If the packaged package version number is not available on alpine anymore - we cannot recreate the docker image (we have a workaround to build older apk's for it - takes more time, but is 100% viable solution!)

⁠Release Branch Maintenance

Each release/X.Y branch is an independent image line. Its PHP point version is pinned in that branch's Dockerfile; changes to main do not update release branches automatically.

For a release update:

1. Fork the repository and create a branch from the matching release/X.Y branch.
2. Update the branch's Dockerfile and workflow configuration as required.
3. Open a pull request from the fork to the matching Endava release branch.
4. Wait for the amd64, ARM64, test, scan, and upload checks to pass.
5. After review and merge, create the semver release tag through the normal Endava release flow.

ARM64 jobs run on GitHub-hosted ubuntu-24.04-arm runners. This README update is ready to merge only after each corresponding release tag, vulnerability report, and image-size artifact exists; unreleased versions must not be published in the live README.

The "Latest Release" links in this README are updated automatically: after each security scan, the README Latest Releases workflow opens a pull request that points every release line to its newest release with uploaded vulnerability and size reports. Merging that pull request also updates the Docker Hub overview.

⁠Contributing

Please refer to CONTRIBUTING.md⁠.

⁠Maintaining this project

See the Maintainer Guide⁠ for recurring maintenance and release tasks.

⁠License

Please refer to LICENSE⁠.