milanzdravkovic/php7.4-apache2-deb repository overview

⁠Hardened PHP 7.4 FPM on Debian 13 (trixie)

A small, locked-down PHP-FPM 7.4.33 image on debian:trixie-slim, built from packages.sury.org⁠ with backported security fixes, including CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). Made for running legacy PHP 7.4 apps safely.

PHP-FPM only (port 9000). Put nginx, Apache or Caddy in front of it.

⁠Tags

⁠Features

• Extensions: opcache, curl, intl, mbstring, mysql (mysqli / PDO), xml, zip + core
• Runs as non-root user php (UID/GID 10001), no setuid binaries
• Works with --read-only, --cap-drop ALL and no-new-privileges
• Base image pinned by digest, Sury key verified by fingerprint, PHP packages version-locked
• Safe PHP defaults: open_basedir, no remote includes, dangerous functions disabled in FPM, strict session cookies, conservative limits
• Logs to stdout/stderr, built-in HEALTHCHECK

⁠Quick start

docker run -d --name php \
  --read-only \
  --tmpfs /tmp:rw,noexec,nosuid,nodev,size=64m \
  --tmpfs /var/lib/php/sessions:rw,noexec,nosuid,nodev,size=16m,mode=1733 \
  --cap-drop ALL --security-opt no-new-privileges:true \
  -v "$PWD/app:/var/www/html:ro" \
  milanzdravkovic/php7.4-apache2-deb:v1.0.0

nginx location block:

location ~ \.php$ {
    try_files $uri =404;
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME /var/www/html$fastcgi_script_name;
    fastcgi_pass php:9000;
}

⁠Configuration

• Env vars: FPM uses clear_env = yes. Pass what PHP needs via a pool file in /etc/php/7.4/fpm/pool.d/, e.g. env[DB_HOST] = $DB_HOST.
• PHP settings: mount an .ini into /etc/php/7.4/fpm/conf.d/ (e.g. zz-app.ini).
• Sessions use Secure cookies (HTTPS only). Set session.cookie_secure = 0 for local HTTP.
• Build args: PHP_EXTENSIONS, PHP_DISABLE_FUNCTIONS, PHP_UID, PHP_VERSION.