maidea/webserver repository overview

⁠Maidea web server

Apache + PHP (mod_php) Docker images for running a PHP app mounted as a volume: mount the app, start the container, done. Built for the CakePHP layout (document root /src/app/webroot), but works with any PHP app.

• Docker Hub: maidea/webserver⁠, source: MAIDEA/webserver⁠
• Based on the official php:<version>-apache-bookworm⁠ images (Debian 12)
• linux/amd64 only (runs through emulation on Apple Silicon)
• Maintained for our own projects and offered to the public as-is, on a best-effort basis (see Support and license below)

⁠Quick start

docker run --rm -p 8080:80 -v "$PWD/src:/src" maidea/webserver:prod-apache-php8.4

Serves ./src/app/webroot on http://localhost:8080⁠. For other layouts set APACHE_DOCUMENT_ROOT (see Configuration below).

⁠Tags

Which tag to use:

• prod-apache-php8.4, dev-apache-php8.3, … stay on that PHP version and only receive patch releases. Recommended.
• latest, prod-apache-php, prod-apache-php8, dev-apache-php, dev-apache-php8 move to the newest PHP version when one is added (e.g. 8.5), which can break your app.
• Immutable tags <tag>-<php version>-<build date> (e.g. prod-apache-php8.4.27-20261022, .2 etc. for further builds that day) are never overwritten: pin one for reproducible deploys or to roll back.

The images are rebuilt automatically when the official PHP image changes (PHP patch releases, Debian security updates), usually within a day. Older PHP versions are listed under Legacy tags below.

⁠Variants

prod: restart after code changes. OPcache does not check file timestamps, so code changed on the mounted volume is only picked up after a container restart.

⁠Included

• PHP extensions: apcu, bcmath, decimal, gd (freetype, jpeg, webp), imap, intl, opcache, pcntl, pdo_mysql, pdo_pgsql, pgsql, shmop, soap, sockets, zip, plus the extensions built into the official image (curl, mbstring, …); xdebug in dev
• wkhtmltopdf 0.12.6.1 (patched qt) at /usr/local/bin/wkhtmltopdf. It is no longer maintained upstream and uses an old browser engine: do not render untrusted HTML or URLs with it.
• MariaDB client (mysql, mysqldump)
• Apache with mod_rewrite and mod_headers; .htaccess files are honoured, directory listing is off
• Health check: Docker reports the container as healthy once Apache and PHP serve requests. It uses an internal listener on 127.0.0.1:8081 that is not reachable from outside the container and does not touch your app.

⁠Usage

Development, with Docker Compose:

services:
  app:
    image: maidea/webserver:dev-apache-php8.4
    volumes:
      - "./src:/src"
    ports:
      - "8080:80"
    # on Linux, Xdebug's default host.docker.internal needs:
    #extra_hosts:
    #  - "host.docker.internal:host-gateway"

Production, behind a reverse proxy that terminates HTTPS:

services:
  app:
    image: maidea/webserver:prod-apache-php8.4
    restart: unless-stopped
    volumes:
      - "./src:/src"
    environment:
      - PHP_MEMORY_LIMIT=512M
      # with jwilder/nginx-proxy:
      #- VIRTUAL_HOST=app.example.com
    # with Traefik:
    #labels:
    #  - "traefik.http.routers.app.rule=Host(`app.example.com`)"
    expose:
      - "80"

Good to know:

• File permissions: PHP runs as www-data (uid 33). Directories your app writes to (e.g. app/tmp) must be writable for that user.
• HTTPS: the container serves plain HTTP on port 80; terminate HTTPS at a reverse proxy. The prod images mark session cookies secure, so the app must be reached over HTTPS (or set SESSION_COOKIE_SECURE=0).
• Other frameworks: e.g. for Laravel or Symfony set APACHE_DOCUMENT_ROOT=/src/public.
• Logs: Apache and PHP log to the container output (docker logs).

⁠Configuration

All variables are read at container start.

⁠Legacy tags

Legacy tags run PHP versions that are no longer supported by the PHP project and have known vulnerabilities. Use them only if you cannot upgrade yet, and never expose them to the internet.

⁠Security fixes only: PHP 7.4 and 5.6

These receive only backported fixes for critical vulnerabilities, no other updates. They contain the fix for CVE-2026-109618 / CVE-2026-109619 (PHP advisory⁠): 7.4 with the PHP security team's backport⁠, 5.6 with Ondřej Surý's backport of the same fix. Many other known 5.6 vulnerabilities remain unfixed.

Changed with the October 2026 rebuild (mitigations recommended by the advisory):

• file uploads are limited to 100M (post_max_size 110M; Apache rejects larger request bodies)
• Apache serves one request per process (KeepAlive Off, MaxConnectionsPerChild 1): safer, but slower under load
• session upload progress is disabled, and max_input_nesting_level is 16
• opt-in PHP_MEMORY_LIMIT=-1 removes the PHP memory limit and prevents the app from setting one, which blocks the out-of-memory path of CVE-2026-109618. Only use it together with a container memory limit (e.g. mem_limit in Compose), otherwise one runaway request can use all memory of the server.

⁠Frozen: no updates

The 8.2 tags are vulnerable to the critical CVE-2026-109618 / CVE-2026-109619: move to prod-apache-php8.3 / dev-apache-php8.3.

⁠Building

Source and build instructions: github.com/MAIDEA/webserver⁠ (MAINTAINING.md⁠).

⁠Support and license

These images are maintained for MAIDEA's own projects and offered to the public as-is, on a best-effort basis: there is no support, no guaranteed response to issues, and no warranty.

Copyright (c) 2026 MAIDEA. All rights reserved. The source is published for reference; see LICENSE⁠. Third-party software in the images (Debian, PHP, Apache, wkhtmltopdf, …) is covered by its own licenses.