alpine-php
MultiArch Alpine Linux + S6 + NGINX + PHP-fpm.
This image serves as a standalone web host server, or as the base image for applications / services that use NGINX and PHP.
Based on Alpine Linux from the nginx image with the php82 package(s) installed in it.
Get the Image¶
Pull the image from Docker Hub.
Image Tags
The image is tagged respectively for the following architectures,
latest tag is annotated as multiarch so pulling without any tags should fetch the correct image for your architecture. Same goes for any of the version tags.
non-x86_64 builds have embedded binfmt_misc support and contain the qemu-user-static binary that allows for running it also inside an x86_64 environment that has support for it.
Run¶
Running the container starts the service.
docker run --rm \
--name docker_php \
-p 80:80 \
-p 443:443 \
-v $PWD/config`#(1)`:/config \
woahbase/alpine-php
- (Required) Path to your website configurations root directory.
Multi-Arch Support
If you want to run images for other architectures on a x86_64 machine, you will need to have binfmt support configured for your machine before running the image. multiarch, has made it easy for us containing that into a docker container, just run
Now images built for other architectures will also be executable. This is optional though, without the above, you can still run the image that is made for your architecture.
Configuration¶
We can customize the runtime behaviour of the container with the following environment variables.
ENV Vars | Default | Description |
---|---|---|
ROOTDIR | /config | Root directory for nginx configs or webserver files. |
NGINXDIR | /config/nginx | Default directory for nginx configurations. |
CONFSDIR | /config/nginx/conf.d | For shared configuration snippets. |
SITESDIR | /config/nginx/http.d | For webserver host configuration files. |
STREAMSDIR | /config/nginx/stream.d | For stream configuration files. (Optional, requires stream module to be enabled in configurations). |
NGINX_NO_HTTP | unset | Set to 'true' to disable default http(80) conf file, has no effect if custom site-confs exist. |
NGINX_NO_HTTPS | unset | Set to 'true' to disable default https(443) conf file, and default self-signed certificate generation on first run. |
KEYDIR | /config/keys | Default certificate/privatekey location. |
PKEYFILE | /config/keys/private.key | Default path to privatekey. (Make sure site-confs reflect the same) |
CERTFILE | /config/keys/certificate.crt | Default path to certificate. (Make sure site-confs reflect the same) |
SSLSUBJECT | see here | Default SSL Subject for self-signed certificate generation on first run. |
NGINX_NO_CERTGEN | unset | Set to 'true' to disable default self-signed certificate generation on first run. |
HTPASSWDFILE | /config/keys/.htpasswd | Default path to .htpasswd. (Make sure site-confs reflect the same) |
WEBADMIN | admin | Default admin user in .htpasswd. (Not changed if file already exists) |
PASSWORD | insecurebydefault | Default admin user password in .htpasswd. |
NGINX_NO_HTPASSWD | unset | Set to 'true' to disable default htpasswd generation on first run. |
NGINX_SKIP_FASTCGI_PARAM | unset | If set to true , skip appending custom fastcgi_param configuration. (since 1.26.2) |
WEBDIR | /config/www | For serving files, e.g. either static HTML or dynamic scripts i.e. with PHP. |
NGINX_ADD_DEFAULT_INDEX | unset | If set to true and no files exist inside WEBDIR , a static index.html is copied into it. Useful for testing. (since 1.26.2) Previously NGINX_SKIP_DEFAULT_INDEX , enabled by default. |
NGINX_PERMFIX_WEBDIR | unset | If set to true , ensures files inside $WEBDIR are owned/accessible by S6_USER . (since 1.26.2) |
PHPDIR | /etc/php82 | Root directory for php config files. |
PHPCONFDIR | /etc/php82/conf.d | Directory for php config snippets. |
PHP_MAX_EXECUTION_TIME | 30 | php.ini value for max_execution_time . (Only set if file does not exist) |
PHP_MAX_FILE_UPLOADS | 20 | php.ini value for max_file_uploads . (Only set if file does not exist) |
PHP_MEMORY_LIMIT | 128M | php.ini value for memory_limit . (Only set if file does not exist) |
PHP_POST_MAX_SIZE | 16M | php.ini value for post_max_size . (Only set if file does not exist) |
PHP_UPLOAD_MAX_FILESIZE | 16M | php.ini value for upload_max_filesize . (Only set if file does not exist) |
PHP_OPCACHE_ENABLE_CLI | 0 | php.ini value for opcache.enable_cli . (Only set if file does not exist.) (since 8.2.22) |
PHP_ADD_DEFAULT_PHPINFO | unset | If set to true and no php scripts exist inside WEBDIR , a default phpinfo.php is copied into it. Useful for testing. (since 8.2.22) Previously PHP_SKIP_DEFAULT_PHPINFO , enabled by default. |
PHP_PERMFIX_WEBDIR | unset | If set to true , ensures files inside $WEBDIR are owned/accessible by S6_USER . (since 8.2.22) |
PHPFPMCONF | /etc/php82/php-fpm.conf | php-fpm main config file. |
PHPFPMDIR | /etc/php82/php-fpm.d | Directory for php-fpm config snippets. |
PHPFPMSOCK | /var/run/php-fpm.sock | php-fpm socket file location. |
PHPFPM_ARGS | -F | Customizable arguments passed to php-fpm service at runtime. |
PHPFPM_ERROR_LOG | /proc/self/fd/2 | php-fpm.conf value for error_log . (Only set if file does not exist) |
PHPFPM_LOG_LEVEL | error | php-fpm.conf value for log_level . (Only set if file does not exist) (since 8.2.22) |
PHPFPM_CATCH_WORKERS_OUTPUT | no | php-fpm.d/www.conf value for catch_workers_output . (Only set if file does not exist) (since 8.2.22) |
PHPFPM_CLEAR_ENV | yes | php-fpm.d/www.conf value for clear_env . (Only set if file does not exist) (since 8.2.22) |
PHPFPM_PM | dynamic | php-fpm.d/www.conf value for pm . (Only set if file does not exist) (since 8.2.22) |
PHPFPM_PM_MAX_CHILDREN | 5 | php-fpm.d/www.conf value for pm.max_children . (Only set if file does not exist) (since 8.2.22) |
PHPFPM_PM_MAX_REQUESTS | 500 | php-fpm.d/www.conf value for pm.max_requests . (Only set if file does not exist) (since 8.2.22) |
PHPFPM_PM_MAX_SPARE_SERVERS | 3 | php-fpm.d/www.conf value for pm.max_spare_servers . (Only set if file does not exist) (since 8.2.22) |
PHPFPM_PM_MIN_SPARE_SERVERS | 1 | php-fpm.d/www.conf value for pm.min_spare_servers . (Only set if file does not exist) (since 8.2.22) |
PHPFPM_PM_START_SERVERS | 2 | php-fpm.d/www.conf value for pm.start_servers . (Only set if file does not exist) (since 8.2.22) |
S6_COMPOSER_REQUIRED | unset | Optional, set to true if any Composer task is required to run. (Will download and install composer for the task.) |
COMPOSER_VERSION | unset | Specific version of composer to install. |
COMPOSER_INSTALL_DIR | /usr/bin | Path to composer binary installation directory. |
COMPOSER_BIN_DIR | /usr/local/bin | Path to binaries directory for packages installed by composer . |
COMPOSER_VENDOR_DIR | /usr/local/composer | Path to vendor directory for packages installed by composer . |
S6_COMPOSER_PACKAGES | empty string | Space separated list of packages to install globally with composer . |
S6_COMPOSER_PROJECTDIR | unset | If specified, runs composer install (or update if lockfile does not exist) in this directory at runtime. |
COMPOSER_ARGS | --no-cache --no-interaction | Arguments given to composer install . |
S6_COMPOSER_SKIP_INSTALL | unset | Skips running install/update task inside S6_COMPOSER_PROJECTDIR . |
CROND_ARGS | -f -S -l 5 | Customizable arguments passed to cron daemon. |
CROND_CONF | /etc/crontabs | Default file to read configurations from. By default this file enables scripts from /etc/periodic to be executed. |
SKIP_CRON | unset | Set to true to skip starting cron daemon. |
S6_NEEDED_PACKAGES | empty string | Space-separated list of extra APK packages to install on start. E.g. "curl git tzdata" |
PUID | 1000 | Id of S6_USER . |
PGID | 100 | Group id of S6_USER . |
S6_USER | alpine | (Preset) Default non-root user for services to drop privileges to. |
S6_USERHOME | /home/alpine | (Preset) HOME directory for S6_USER . |
Did you know?
You can check your own UID/GID by running the command id
in a terminal.
Also,
-
PHP
(major)(minor)
version (e.g.82
) is available in the image as the environment variablePHPMAJMIN
, for any image built from this image, this can be used to install the correct packages for the specific PHP version installed. -
These packages below are installed by default into the image.
-
If no
php.ini
is found inside/etc/php82/
, a default (from/defaults/
, with a few options modified to suit this image) is provided. -
If no
php-fpm.conf
is found inside/etc/php82/
, a default (from/defaults/
, with a few options modified to suit this image) is provided. -
If no
www.conf
is found inside/etc/php82/php-fpm.d/
, a default (from/defaults/
, with a few options modified to suit this image) is provided. -
Cron is enabled by default to read
/etc/crontabs/
. -
Includes everything from the alpine-nginx image.
Stop the container with a timeout, (defaults to 2 seconds)
Restart the container with
Removes the container, (always better to stop it first and -f
only when needed most)
Shell access¶
Get a shell inside a already running container,
Optionally, login as a non-root user, (default is alpine
)
Or set user/group id e.g 1000/100,
Logs¶
To check logs of a running container in real time
Build Your Own¶
Feel free to clone (or fork) the repository and customize it for your own usage, build the image for yourself on your own systems, and optionally, push it to your own public (or private) repository.
Here's how...
Setting up¶
Before we clone the /repository, we must have Git, GNU make, and Docker (optionally, with buildx plugin for multi-platform images) setup on the machine. Also, for multi-platform annotations, we might require enabling experimental features of Docker.
Now, to get the code,
Clone the repository with,
To get a list of all available targets, run
Always Check Before You Make!
Did you know, we could check what any make target is going to execute before we actually run them, with
Build and Test¶
To create the image for your architecture, run the build
and test
target with
For building an image that targets another architecture, it is required to specify the ARCH
parameter when building. e.g.
Build Parameters
All images have a few common build parameters that can be customized at build time, like
ARCH
- The target architecture to build for. Defaults to host architecture, auto-detected at build-time if not specified. Also determines if binfmt support is required before build or run and runs the
regbinfmt
target automatically. Possible values areaarch64
,armhf
,armv7l
, andx86_64
.
BUILDDATE
- The date of the build. Can be used to create separate tags for images. (format:
yyyymmdd
)
DOCKERFILE
- The dockerfile to use for build. Defaults to the file Dockerfile, but if per-arch dockerfiles exist, (e.g. for x86_64 the filename would be
Dockerfile_x86_64
) that is used instead.
TESTCMD
- The command to run for testing the image after build. Runs in a bash shell.
VERSION
- The version of the app/tool, may need to be preset before starting the build (e.g. for binaries from github releases), or extracted from the image after build (e.g. for APK or pip packages).
REGISTRY
- The registry to push to, defaults to the Docker Hub Registry (
docker.io
) or any custom registry that is set via docker configurations. Does not need to be changed for local or test builds, but to override, either pass it by setting an environment variable, or with everymake
command.
ORGNAME
- The organization (or user) name under which the image repositories exist, defaults to
woahbase
. Does not need to be changed for local or test builds, but to override, either pass it by setting an environment variable, or with everymake
command.
The image may also require custom parameters (like binary architecture). Before you build, check the makefile for a complete list of parameters to see what may (or may not) need to be set.
BuildX and Self-signed certificates
If you're using a private registry (a-la docker distribution server) with self-signed certificates, that fail to validate when pulling/pushing images. You will need to configure buildx to allow insecure access to the registry. This is configured via the config.toml
file. A sample is provided in the repository, make sure to replace YOUR.PRIVATE.REGISTRY
with your own (include port if needed).
Make to Run¶
Running the image creates a container and either starts a service (for service images) or provides a shell (can be either a root-shell or usershell) to execute commands in, depending on the image. We can run the image with
But if we just need a root-shell in the container without any fance pre-tasks (e.g. for debug or to test something bespoke), we can run bash
in the container with --entrypoint /bin/bash
. This is wrapped in the makefile as
Nothing vs All vs Run vs Shell
By default, if make
is run without any arguments, it calls the target all
. In our case this is usually mapped to the target run
(which in turn may be mapped to shell
).
There may be more such targets defined as per the usage of the image. Check the makefile for more information.
Push the Image¶
If the build and test steps finish without any error, and we want to use the image on other machines, it is the next step push the image we built to a container image repository (like /hub), for that, run the push
target with
If the built image targets another architecture then it is required to specify the ARCH
parameter when pushing. e.g.
Pushing Multiple Tags
With a single make push
, we are actually pushing 3 tags of the same image, e.g. for x86_64
architecture, they're namely
alpine-php:x86_64
- The actual image that is built.
alpine-php:x86_64_(version)
- It is expected that the application is versioned when built or packaged, it can be specified in the tag, this makes pulling an image by tag possible. Usually this is obtained from the parameter
VERSION
, which by default, is set by calling a function to extract the version string from the package installed in the container, or from github releases. Can be skipped with the parameterSKIP_VERSIONTAG
to a non-empty string value like1
.
alpine-php:x86_64_(version)_(builddate)
- When building multiple versions of the same image (e.g. for providing fixes or revisions), this ensures that a more recent push does not fully replace a previously pushed image. This way, although the architecture and version tags are replaced, it is possible to roll back to the previously built image by build date (format
yyyymmdd
). This value is obtained from theBUILDDATE
parameter, and if not essential, can be skipped by setting the parameterSKIP_BUILDDATETAG
to a non-empty string value like1
.
Pushing To A Private Registry
If you want to push the image to a custom registry that is not pre-configured on your system, you can set the REGISTRY
variable either on the build environment, or as a makefile parameter, and that will be used instead of the default Docker Hub repository. Make sure to have push access set up before you actually push, and include port if needed. E.g.
or
Annotate Manifest(s)¶
For single architecture images, the above should suffice, the built image can be used in the host machine, and on other machines that have the same architecture too, i.e. after a push.
But for use-cases that need to support multiple architectures, there's a couple more things that need to be done. We need to create
(or amend
if already created beforehand) a manifest for the image(s) that we built, then annotate it to map the images to their respective architectures. And for our three tags created above we need to do it thrice.
Did you know?
We can inspect the manifest of any image by running
Tag Latest¶
Assuming we built the images for all supported architectures, to facilitate pulling the correct image for the architecture, we can create/amend the latest
manifest and annotate it to map the tags :aarch64
, :armhf
, :armv7l
, :x86_64
to the tag :latest
by running
How it works
First we create or amend the manifest with the tag latest
Then annotate the image for each architecture in the manifest with
And finally, push it to the repository using
Tag Version¶
Next, to facilitate pulling images by version, we create/amend the image-version manifest and annotate it to map the tags :aarch64_(version)
, :armhf_(version)
, :armv7l_(version)
, :x86_64_(version)
to the tag :(version)
by running
How it works
First we create or amend the manifest with the tag (version)
Then annotate the image for each architecture in the manifest with
And finally, push it to the repository using
Tag Build-Date¶
Then, (optionally) we create/amend the (version)_(builddate)
manifest and annotate it to map the tags :aarch64_(version)_(builddate)
, :armhf_(version)_(builddate)
, :armv7l_(version)_(builddate)
, :x86_64_(version)_(builddate)
to the tag :(version)_(builddate)
by running
How it works
First we create or amend the manifest with the tag (version)_(builddate)
Then annotate the image for each architecture in the manifest with
And finally, push it to the repository using
That's all folks! Happy containerizing!
Maintenance¶
Sources at Github. Built and tested at home using Buildbot. Images at Docker Hub.
Maintained (or sometimes a lack thereof?) by WOAHBase.