timoreymann/php-app repository overview

⁠php-app

Docker image for running PHP apps in a single container with nginx and PHP-fpm

⁠Features

• Running as non-root
• Run PHP apps with secure defaults

⁠Requirements

• Docker⁠

⁠Usage

⁠Basic

For basic usage with no further extensions, you just copy your sources to /app

FROM timoreymann/php-app
COPY --chown=application:application ./code /app

⁠Build your image with sources and install composer dependencies

When you use composer for external dependencies you can easily install them in the build process.

The composer-install script downloads the installer from GitHub, installs the depencies and removes the phar file.

FROM timoreymann/php-app
WORKDIR /app
COPY --chown=application:application ./code ./
RUN composer-install

⁠Configure index.php for PHP-based routing

When you build a modern web app with PHP, chances are high that you will have routing within your index.php. To make it work, nginx needs to route all requests to the index.php, if the file does not exist in the webroot (e.g. assets).

FROM timoreymann/php-app
WORKDIR /app
COPY --chown=application:application ./code ./
RUN composer-install && configure-index-rewrite

⁠Block multipart requests temporarily

For the CVEs CVE-2026-109618 and CVE-2026-109619⁠ ("PHP2Shell") you can block every request with a multipart content type before it reaches PHP. This breaks all file uploads. Use it only until your PHP version contains the fix.

FROM timoreymann/php-app
WORKDIR /app
COPY --chown=application:application ./code ./
RUN block-multipart

The script keeps the setting after a rebuilt image only if you run the script again. Remove the RUN block-multipart line from your Dockerfile after PHP published the fix and rebuild.

⁠Documentation

⁠Components

The image consists of:

• multirun - Small util for executing multiple processes with proper signal handling
• PHP 8 FPM - Execution of PHP files
• nginx - Serve evaluated files from FPM

PHP 8 extensions that are common are also pre-installed:

• curl
• ctype
• dom
• freetype
• gd
• jpeg
• mysqli
• mbstring
• opcache
• openssl
• pdo
• pdo_mysql
• phar
• simplexml
• xml
• zip

⁠Ports

• 8080: HTTP-Server

⁠Contributing

I love your input! I want to make contributing to this project as easy and transparent as possible, whether it's:

• Reporting a bug
• Discussing the current state of the configuration
• Submitting a fix
• Proposing new features
• Becoming a maintainer

To get started please read the Contribution Guidelines⁠.

⁠Development

⁠Requirements

• Docker⁠