gnbit/php8.0-apache repository overview

⁠GNBIT PHP 8.0 Apache

PHP 8.0 with Apache and common extensions for legacy web applications. Maintained by Benjamin Gonzales - GNBIT.

⁠Image tags

Previous unpatched image versions have been removed from this repository. Only the latest PHP 8.0 build with the security backports is published. Check the Tags tab⁠ for available tags.

gnbit/php8.0-apache:latest

The patched build reports PHP 8.0.30 and includes the official PHP-8.0-CVE-2026-109618-109619 source-backports. An original PHP 8.0.30 build without these backports is not equivalent: the PHP version string alone is not proof that the fixes are present. latest, when available, is a moving tag and does not automatically update existing containers.

⁠Quick start

services:
  php:
    image: gnbit/php8.0-apache:latest
    ports:
      - "127.0.0.1:8080:80"
    volumes:
      - ./app:/var/www

Apache serves /var/www/public; place public application files in ./app/public.

⁠Included PHP extensions

The current security-backport build includes:

• GD with FreeType, JPEG, and WebP support
• BCMath
• MySQLi
• Calendar
• Gettext
• Intl
• Exif
• Zip
• PDO MySQL
• PDO PostgreSQL
• LDAP
• OPcache
• Redis
• Memcached
• Imagick

Extension versions depend on the published build.

⁠Included tools and libraries

• Composer
• ImageMagick
• Ghostscript
• Git
• unzip
• OpenSSL
• locales
• sshpass
• unixODBC libraries
• libmcrypt

The security-backport build separates build-time dependencies from runtime libraries. System libmcrypt/unixODBC libraries do not enable PHP extensions by themselves. Redis and Memcached servers are not bundled. ImageMagick PDF support is subject to its security policy.

⁠Custom PHP configuration

Add a read-only INI mount to your service:

volumes:
  - ./app:/var/www
  - ./myphp.ini:/usr/local/etc/php/conf.d/myphp.ini:ro

Create the INI file first and restart PHP after editing it. Repository test profiles are not automatically included in the image.

⁠Updating

Back up application data, test compatibility, and update the image tag first:

docker compose pull
docker compose up -d

Pulling alone does not update running containers; they must be recreated.

⁠Security

CVE-2026-109618 and CVE-2026-109619: fixed in this repository's PHP 8.0.30 build compiled from the official security-backport branch. Older unpatched images must not be used. See the official PHP security advisory⁠.

PHP 8.0 is end of life. The exceptional CVE backports are minimal fixes for two specific vulnerabilities, not restored general support or a guarantee of safety. Migrate to a supported PHP branch. Additional extensions do not fix PHP core. This build uses archived Debian Bullseye packages for reproducibility, not a continuously maintained operating-system base.

⁠Maintainer

Benjamin Gonzales - GNBIT