tarnoto/php-apache repository overview

⁠High-Performance PHP-Apache Base Image

A PHP-Apache image optimized for high performance, production-ready security, and architectural flexibility. Featuring full Multi-Arch support (AMD64 & ARM64), it runs seamlessly on standard servers as well as ARM-based environments like AWS Graviton or Raspberry Pi.

⁠✨ Key Features

• Multi-Platform: Single tag supporting multiple architectures (linux/amd64, linux/arm64).
• Security First: Runs under a secure non-root user (noto) to minimize runtime security risks.
• Privileged Ports Enabled: Configured with Linux Capabilities (setcap) to allow the non-root user to securely bind to standard ports (80/443).
• Built-in Security Headers: Pre-configured with HSTS, X-Frame-Options, X-Content-Type-Options, and secure cookie overrides to shield your app from common web vulnerabilities.
• Real IP Support: Integrated with remoteip module and auto-fetch utility for Cloudflare IP ranges to log actual visitor IPs.
• Production Optimized: OPcache enabled by default with flexible adjustments via Environment Variables.
• Multimedia Ready: Pre-installed with FFmpeg and Imagick.

⁠📦 Pre-installed Packages & Extensions

This image comes equipped with a comprehensive set of system utilities and PHP extensions:

• System Utilities: ffmpeg, git, curl, zip, unzip, vim, poppler-utils (PDF to image conversions), openssl, jq.
• PHP Extensions:
  • Database: pdo_mysql, mysqli, pdo_pgsql, pgsql.
  • Graphics: gd (compiled with FreeType & JPEG support), imagick.
  • Services: ldap, memcached, mcrypt.
  • Core: intl, zip, gmp, bcmath, exif, gettext, opcache.

⁠🚀 Quick Start

Run the container using standard ports with the following command:

docker run -d --name app -e TZ=Asia/Jakarta -p 80:80 -p 443:443 tarnoto/php-apache:latest

⁠Docker Compose Setup

services:
  app:
    image: tarnoto/php-apache:latest
    ports:
      - "80:80"
      - "443:443"
    environment:
      - PHP_TIMEZONE=Asia/Jakarta
      - PHP_MEMORY_LIMIT=512M
      - PHP_DISPLAY_ERRORS=Off

⁠🛠️ Multimedia App Example (FFmpeg & PDF to Image Support)

If your application requires executing binary utilities like FFmpeg or Poppler-utils (pdftoppm) via PHP shell_exec(), you can easily unlock them by overriding the default environment variables in your docker-compose.yml:

environment:
  - PHP_ALLOW_URL_FOPEN=On # Unlock external API fetching if needed
  - PHP_DISABLE_FUNCTIONS=passthru,system,curl_multi_exec,parse_ini_file,show_source # Excluded shell_exec, exec, proc_open, popen from the blocklist

⁠⚙️ Environment Variables

Customize your PHP & Apache configurations on the fly without rewriting or rebuilding the image:

⁠🔒 Security & Ports

To deliver maximum framework compatibility and clean asset URLs, this image listens on native web ports while preserving strict container isolation:

Note: Secure low-port binding is handled internally via Linux kernel capabilities (cap_net_bind_service), keeping your deployment lightweight and resilient against privilege escalation.

The image automatically enforces hardened global HTTP Security Headers:

• HSTS (HTTP Strict Transport Security): Enforces 1-year HTTPS lock-in including subdomains and preloading options.
• X-Frame-Options (DENY): Prevents Clickjacking attacks by disallowing your site from being loaded inside an <iframe>.
• X-Content-Type-Options (nosniff): Mitigates MIME-sniffing exploits by locking down declared content-types.
• Referrer-Policy: Protects information disclosure via strict-origin filtering.
• Cookie Security Overrides: Automatically appends HttpOnly, Secure, and SameSite=Strict attributes to all cookies generated by PHP.

⁠🌐 Real IP Handling (Cloudflare & Upstream Proxies)

Every time the container initializes, it executes an embedded routine to automatically pull and populate the latest Cloudflare IP ranges. If you deploy this image behind a Load Balancer, HAProxy, or an Nginx host reverse proxy, ensure your proxy injects the standard X-Forwarded-For header. You can easily whitelist additional upstream load balancer blocks by passing them through the TRUSTED_PROXY_IP variable.