mo2g/php repository overview

English ｜ 中文⁠

⁠mo2g/php

Custom PHP-FPM base image built on the official php:<version>-fpm-alpine, adding the extensions and frontend tooling our projects need.

⁠⚠️ Security notice

Tags 8.0.11-* and 8.1.0RC2-* are end-of-life and affected by CVE-2026-109618 / CVE-2026-109619 (CVSS 9.2, unauthenticated RCE affecting all SAPIs). Do not use them in new deployments.

Recommended tag:

mo2g/php:8.3.36-fpm-alpine3.24-uglify

PHP 8.3.36 is the security release from 2026-10-21 and fixes both CVEs. Published for linux/amd64 and linux/arm64.

⁠Tag scheme

<php-version>-fpm-<alpine-version>[-uglify]

The -uglify suffix means uglifyjs and uglifycss are installed for static asset minification.

⁠Extensions

Included in the official image: Core, ctype, curl, date, dom, fileinfo, filter, hash, iconv, json, libxml, mbstring, mysqlnd, openssl, pcre, PDO, pdo_sqlite, Phar, posix, random, readline, Reflection, session, SimpleXML, sodium, SPL, sqlite3, standard, tokenizer, xml, xmlreader, xmlwriter, zlib

Added by this image:

⁠Differences from the official image

1. www-data uses UID/GID 48:48 (matching apache) to avoid permission problems on bind-mounted volumes.
2. uglifyjs / uglifycss preinstalled (only on -uglify tags).
3. mcrypt included, because legacy application code depends on MCRYPT_RIJNDAEL_256.
4. PECL extensions and docker-php-ext-* artifacts are produced in a multi-stage build, with a build-time self-check that fails the build if any extension is missing.

⁠About mcrypt

mcrypt was removed from PHP core in 7.2 and is installed here from PECL. Since PECL 1.0.7, every mcrypt_* call emits E_DEPRECATED.

Also note: MCRYPT_RIJNDAEL_256 is the 256-bit block size variant of Rijndael and is not compatible with AES-256. With ECB mode, identical plaintext blocks produce identical ciphertext blocks.

For new projects use openssl_encrypt() with aes-256-gcm instead of this extension.

⁠Build

Multi-stage build on top of php:<version>-fpm-alpine<alpine>:

1. builder — install toolchain, pecl install igbinary redis mcrypt imagick, configure and compile memcached with igbinary support, then docker-php-ext-install core extensions
2. final — copy only extensions and conf.d, install runtime libs (including imagemagick, required by imagick.so)
3. self-check — verify every extension via extension_loaded(), fail the build if one is missing

docker buildx build --platform linux/amd64,linux/arm64 \
  -t mo2g/php:<tag> --push .

⁠中文

基于官方 php:<version>-fpm-alpine 构建的自用 PHP-FPM 镜像，补齐业务所需的扩展与前端构建工具。

⁠⚠️ 安全提示

标签 8.0.11-* 与 8.1.0RC2-* 均已 EOL，且受影响于 CVE-2026-109618 / CVE-2026-109619（CVSS 9.2，未认证 RCE，影响所有 SAPI）。请勿用于新环境。

当前推荐：

mo2g/php:8.3.36-fpm-alpine3.24-uglify

PHP 8.3.36 是 2026-10-21 的安全版本，已修复上述两个 CVE，同时提供 linux/amd64 与 linux/arm64。

⁠标签命名规则

<PHP 版本>-fpm-<Alpine 版本>[-uglify]

-uglify 后缀表示镜像内额外安装了 uglifyjs 与 uglifycss，用于静态资源压缩。

⁠包含的扩展

官方镜像自带： Core、ctype、curl、date、dom、fileinfo、filter、hash、iconv、json、libxml、mbstring、mysqlnd、openssl、pcre、PDO、pdo_sqlite、Phar、posix、random、readline、Reflection、session、SimpleXML、sodium、SPL、sqlite3、standard、tokenizer、xml、xmlreader、xmlwriter、zlib

本镜像额外编译：

⁠与官方镜像的差异

1. www-data 的 UID/GID 改为 48:48（与 apache 一致），解决宿主机挂载目录的读写权限问题。
2. 内置 uglifyjs / uglifycss（仅 -uglify 标签）。
3. 内置 mcrypt，因为存量业务代码依赖 MCRYPT_RIJNDAEL_256。
4. PECL 扩展与 docker-php-ext-* 产物由多阶段构建产出，构建期逐个校验扩展是否加载，缺一个即构建失败。

⁠关于 mcrypt

mcrypt 自 PHP 7.2 起已移出核心，本镜像通过 PECL 安装。自 PECL 1.0.7 起，mcrypt_* 函数每次调用都会产生 E_DEPRECATED 告警。

同时注意：MCRYPT_RIJNDAEL_256 是 256 位分组的 Rijndael 变体，与 AES-256 不兼容；若使用 ECB 模式，相同明文块会产生相同密文块。

新项目请直接使用 openssl_encrypt() + aes-256-gcm，不要引入该扩展。

⁠构建

基于 php:<version>-fpm-alpine<alpine> 的多阶段构建：

1. builder 阶段 — 安装编译依赖，pecl install igbinary redis mcrypt imagick，自行 configure 编译 memcached（带 igbinary 支持），再 docker-php-ext-install 核心扩展
2. 最终阶段 — 只复制 extensions 与 conf.d，安装运行期依赖（含 imagemagick，供 imagick.so 加载）
3. 构建期自检 — 逐个 extension_loaded() 校验，缺一个就失败

docker buildx build --platform linux/amd64,linux/arm64 \
  -t mo2g/php:<tag> --push .