eriktonon/php repository overview

⁠Hardened Base Container Images & Multi-Stage Dockerfiles (eriktonon/*)

Production-grade, hardened container images pre-configured for Brazilian Enterprise Timezones (America/Sao_Paulo), UTF-8 Locales (pt_BR.UTF-8), Non-Root Execution, and Build-to-Manage Readiness Probes.

With 283,000+ cumulative pulls on Docker Hub across eriktonon/php⁠ and eriktonon/postgres⁠, this repository maintains both Modern Enterprise LTS multi-stage images (PHP 8.2/8.3/8.4 FPM Alpine & Bookworm, PostgreSQL 16/17 Alpine, MySQL 8.4 LTS) and Hardened Legacy Brownfield images (PHP 5.6 through 8.0, PostgreSQL 9.6–12, MySQL 5.7–8.0) for enterprise workloads undergoing modernization.

⁠Architecture & Build-to-Manage Principles

Every Dockerfile in this repository enforces strict Platform Engineering, SRE (Build to Manage), and Shift-Left AppSec controls:

• Multi-Stage Builds & Minimal Runtime Footprint: Build dependencies ($PHPIZE_DEPS, header libraries, compilers) are isolated in dedicated build stages or purged in single-layer transactions (--no-install-recommends + rm -rf /var/lib/apt/lists/*).
• Cryptographic Supply-Chain Verification (CWE-494): All PECL packages (redis, xdebug, imagick, sqlsrv, pdo_sqlsrv) are downloaded via HTTPS with pinned versions and verified against immutable SHA-256 checksums (sha256sum -c -) before installation.
• Least-Privilege Non-Root Execution (CWE-250): All containers drop root privileges at runtime (USER www-data, USER postgres, USER mysql).
• Deterministic Readiness & Liveness (HEALTHCHECK): Native container health probes (php-fpm -t, pg_isready, mysqladmin ping, HTTP loopback checks) built into every image metadata layer.
• Hardened Production Configuration (CWE-918 / OWASP A05):
  • PHP uses php.ini-production with expose_php = Off, display_errors = Off, session.cookie_httponly = 1, session.use_strict_mode = 1, and OPcache JIT enabled on PHP 8.2–8.4.
  • Apache 2.4 enforces ServerTokens Prod, ServerSignature Off, X-Content-Type-Options: nosniff, and X-Frame-Options: SAMEORIGIN.
  • Xdebug (where present in legacy brownfield tags) is locked down with xdebug.discover_client_host = 0 and xdebug.start_with_request = trigger.

⁠Container Catalog & Tag Matrix

⁠1. PHP (eriktonon/php) — 147,690+ Pulls

⁠2. PostgreSQL (eriktonon/postgres) — 134,064+ Pulls

⁠3. MySQL (eriktonon/mysql)

⁠4. phpMyAdmin (eriktonon/phpmyadmin)

⁠Quick Start

# Modern PHP 8.4 FPM Alpine (Multi-Stage, OPcache JIT, America/Sao_Paulo)
docker pull eriktonon/php:8.4-fpm-alpine

# Modern PostgreSQL 17 Alpine (America/Sao_Paulo, pt_BR.UTF-8)
docker pull eriktonon/postgres:17-alpine

# Modern MySQL 8.4 LTS (America/Sao_Paulo)
docker pull eriktonon/mysql:8.4-lts

⁠Author & Governance

Erik Tonon — Head of Platform Engineering & GenAI @ IBM Consulting | Principal SRE & Build-to-Manage Advisor

• Website: eriktonon.com⁠
• LinkedIn: linkedin.com/in/eriktonon⁠
• Docker Hub: hub.docker.com/u/eriktonon⁠