frankenphp.Dockerfile

# syntax=docker/dockerfile:1
ARG PHP_VERSION="8.5"
# renovate: datasource=github-releases depName=php/pie versioning=semver
ARG PIE_VERSION="1.5.2"
# renovate: datasource=github-releases depName=php/frankenphp versioning=docker
ARG FRANKENPHP_VERSION="1.13"
# renovate: datasource=github-releases depName=composer/composer versioning=semver
ARG COMPOSER_VERSION="2.10.3"
FROM ghcr.io/php/pie:${PIE_VERSION}-bin AS pie
FROM composer:${COMPOSER_VERSION} AS composer-bin
FROM dunglas/frankenphp:${FRANKENPHP_VERSION}-php${PHP_VERSION} AS upstream
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked <<EOF
    set -eux

    export DEBIAN_FRONTEND=noninteractive
    apt-get update
    # The upstream FrankenPHP image lags the Debian security archive between
    # its own rebuilds, so apply pending security updates before anything else.
    # Without this the image ships every CVE fixed since upstream last built,
    # which is what the Trivy scan in .github/workflows/docker.yaml fails on.
    apt-get upgrade --yes
    # NOTE: soname-versioned packages (libmemcached11t64, libicu76, libzip5)
    # are tied to the Debian release of the upstream image and must be bumped
    # when it rebases onto a new Debian version.
    apt-get install \
        --yes \
        --no-install-recommends \
      postgresql-client \
      libmemcached11t64 \
      ca-certificates \
      libyaml-0-2 \
      libicu76 \
      libzip5 \
      gettext \
      openssl \
      libuv1 \
      zlib1g \
      unzip \
      curl \
      file \
    ;
EOF

FROM upstream AS builder
# renovate: datasource=packagist depName=phpredis/phpredis versioning=composer
ARG REDIS_VERSION="6.3.0"
# renovate: datasource=packagist depName=apcu/apcu versioning=composer
ARG APCU_VERSION="5.1.28"
# renovate: datasource=packagist depName=pecl/yaml versioning=composer
ARG YAML_VERSION="2.3.0"
# renovate: datasource=packagist depName=php-memcached/php-memcached versioning=composer
ARG MEMCACHED_VERSION="3.4.0"
# renovate: datasource=packagist depName=amphp/uv versioning=composer
ARG UV_VERSION="0.3.1"
# renovate: datasource=packagist depName=wikimedia/excimer versioning=composer
ARG EXCIMER_VERSION="1.2.7"

RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    --mount=type=bind,from=pie,source=/pie,target=/usr/bin/pie \
    <<EOF
    set -eux

    # region Install Dependencies
    export DEBIAN_FRONTEND=noninteractive
    apt-get update
    apt-get install \
        --yes \
        --no-install-recommends \
      ${PHPIZE_DEPS} \
      libmemcached-dev \
      libsqlite3-dev \
      libyaml-dev \
      libicu-dev \
      libzip-dev \
      zlib1g-dev \
      libuv1-dev \
      libpq-dev \
      libtool \
      git \
    ;
    # endregion

    docker-php-source extract
    export num_cpu=$(nproc)

    # region Install built-in extensions
    docker-php-ext-configure zip
    docker-php-ext-install -j${num_cpu} \
      pdo_sqlite \
      pdo_pgsql \
      sockets \
      bcmath \
      pcntl \
      intl \
      zip \
    ;

    # If we're running on PHP 8.4, install the opcache extension (it's bundled in later versions)
    if php --version | grep -q "PHP 8\.4"; then
      docker-php-ext-install -j${num_cpu} opcache
    fi

    # endregion

    # region Install PIE extensions
    pie install -j${num_cpu} "phpredis/phpredis:${REDIS_VERSION}" \
      --enable-redis \
    || (cat /tmp/pie_make_output_* 2>&1; exit 2)
    pie install -j${num_cpu} "apcu/apcu:${APCU_VERSION}" \
      --enable-apcu \
    || (cat /tmp/pie_make_output_* 2>&1; exit 2)
    pie install -j${num_cpu} "pecl/yaml:${YAML_VERSION}" \
    || (cat /tmp/pie_make_output_* 2>&1; exit 2)
    pie install -j${num_cpu} "php-memcached/php-memcached:${MEMCACHED_VERSION}" \
      --enable-memcached-session \
      --enable-memcached-json \
    || (cat /tmp/pie_make_output_* 2>&1; exit 2)
    pie install -j${num_cpu} "amphp/uv:${UV_VERSION}" \
    || (cat /tmp/pie_make_output_* 2>&1; exit 2)
    pie install -j${num_cpu} "wikimedia/excimer:${EXCIMER_VERSION}" \
    || (cat /tmp/pie_make_output_* 2>&1; exit 2)
    #pie install -j${num_cpu} csvtoolkit/fastcsv \
    #  --enable-fastcsv \
    #;
    # endregion

    # NOTE: Swoole is intentionally not built for this variant: FrankenPHP is
    # the application server here, so the CLI variants are the ones that ship
    # Swoole.
EOF

FROM upstream AS base
ARG user="php"
ARG uid="900"

RUN <<EOF
    set -eux

    # region Add a non-root user to run the application
    addgroup \
        --gid "${uid}" \
      "${user}"
    adduser \
        --home "/home/${user}" \
        --disabled-password \
        --disabled-login \
        --uid "${uid}" \
        --gid ${uid} \
        --system \
      "${user}"
    # endregion

    # Add additional capability to bind to port 80 and 443
    setcap CAP_NET_BIND_SERVICE=+eip /usr/local/bin/frankenphp

    # Create the application folder
    mkdir -p /app

    # Give write access to /data (Caddy state, Mercure Bolt DB), /config,
    # and /app
    chown -R "${uid}:${uid}" \
        /config \
        /data \
        /app
EOF

COPY --link --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/
COPY --link --from=builder /usr/local/etc/php/conf.d/ /usr/local/etc/php/conf.d/

# Copy custom PHP settings
COPY --link ./php.ini "${PHP_INI_DIR}/conf.d/99-docker.ini"
COPY --link ./Caddyfile /etc/caddy/Caddyfile

# Upstream hard-links /etc/frankenphp/Caddyfile to /etc/caddy/Caddyfile. The COPY
# above replaces the latter and breaks that link, leaving upstream's original
# config behind at the /etc/frankenphp path that its documentation points at.
# Re-link it so both paths resolve to this file.
RUN ln -f /etc/caddy/Caddyfile /etc/frankenphp/Caddyfile

FROM base AS dev
# renovate: datasource=packagist depName=xdebug/xdebug versioning=composer
ARG XDEBUG_VERSION="3.5.3"
ARG user="php"
ARG uid="900"
ENV COMPOSER_ALLOW_SUPERUSER="1"
ENV PHP_OPCACHE_VALIDATE_TIMESTAMPS="1"
ENV XDG_DATA_HOME="/data"
ENV XDG_CONFIG_HOME="/config"
ENV GODEBUG="cgocheck=0"

# Enables PHPStorm to apply the correct path mapping on Xdebug breakpoints
ENV PHP_IDE_CONFIG="serverName=Docker"

RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    --mount=type=bind,from=pie,source=/pie,target=/usr/bin/pie \
    --mount=type=bind,from=upstream,source=/usr/local/bin,target=/usr/local/bin \
    <<EOF
    set -eux
    ln -sf "${PHP_INI_DIR}/php.ini-development" "${PHP_INI_DIR}/php.ini"

    # region Install XDebug
    # libtool is required by PIE to build extensions
    # git is required by Composer to install dependencies from VCS sources
    export DEBIAN_FRONTEND=noninteractive
    apt-get update
    apt-get install \
        --yes \
        --no-install-recommends \
      libtool \
      git \
    ;

    pie install -j$(nproc) "xdebug/xdebug:${XDEBUG_VERSION}" \
    || (cat /tmp/pie_make_output_* 2>&1; exit 2)
    rm -rf /tmp/*
    # endregion

    # region Configure XDebug
    # See https://docs.docker.com/desktop/networking/#i-want-to-connect-from-a-container-to-a-service-on-the-host
    # See https://github.com/docker/for-linux/issues/264
    # The `client_host` below may optionally be replaced with `discover_client_host=yes`
    # Add `start_with_request=yes` to start debug session on each request
    echo "xdebug.client_host = host.docker.internal" >> "${PHP_INI_DIR}/conf.d/docker-php-ext-xdebug.ini";
    echo "xdebug.mode = off" >> "${PHP_INI_DIR}/conf.d/docker-php-ext-xdebug.ini";
    # endregion
EOF

COPY --link --from=composer-bin /usr/bin/composer /usr/bin/composer

WORKDIR "/app"

USER "${uid}:${uid}"

ENTRYPOINT ["docker-php-entrypoint"]
CMD ["--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
HEALTHCHECK NONE

EXPOSE 80/tcp

FROM base AS prod-pre
RUN <<EOF
    set -eux

    # region Remove Build Dependencies
    # Extensions are compiled in the `builder` stage, which this stage does not
    # descend from, so there is no build tooling here to remove. Purging
    # ${PHPIZE_DEPS} would only uninstall `file`, which the upstream stage
    # installs deliberately as a runtime dependency.
    export DEBIAN_FRONTEND=noninteractive
    apt-get purge \
        --option APT::AutoRemove::RecommendsImportant=false \
        --auto-remove \
        --yes \
    ;
    apt-get autoremove --yes

    rm -rf \
      /usr/local/bin/phpdbg \
      /usr/local/bin/php-cgi \
      /usr/local/bin/php-config \
      /usr/local/bin/install-php-extensions \
      /usr/local/bin/docker-php-source \
      /usr/local/bin/docker-php-ext-* \
      /usr/local/bin/phpize \
      /usr/local/bin/pear* \
      /usr/local/bin/phar* \
      /usr/local/bin/pecl \
      /usr/local/php/man \
      /usr/local/etc/pear.conf \
      /usr/local/lib/php/PEAR \
      /usr/local/lib/php/.registry \
      /usr/src/* \
      /var/cache/* \
      /var/log/* \
      /tmp/* \
    ;
    # endregion

    # Activate the production PHP configuration. This must happen in this
    # stage rather than in the scratch stage below: scratch stages do not
    # inherit environment variables, so PHP_INI_DIR would expand to an empty
    # string there, leaving a broken symlink at / and no loaded php.ini.
    ln -sf "${PHP_INI_DIR}/php.ini-production" "${PHP_INI_DIR}/php.ini"
EOF

FROM scratch AS prod
ARG user="php"
ARG uid="900"
ENV PHP_OPCACHE_VALIDATE_TIMESTAMPS="0"
ENV PHP_OPCACHE_MAX_ACCELERATED_FILES="10000"
ENV PHP_OPCACHE_MEMORY_CONSUMPTION="192"
ENV PHP_OPCACHE_MAX_WASTED_PERCENTAGE="10"
ENV XDG_DATA_HOME="/data"
ENV XDG_CONFIG_HOME="/config"
ENV GODEBUG="cgocheck=0"

# Scratch stages do not inherit environment variables. PHP itself does not need
# PHP_INI_DIR at runtime (the path is compiled into the binary), but images
# built FROM this one reference it, so it has to be restored here.
ENV PHP_INI_DIR="/usr/local/etc/php"

COPY --link --from=prod-pre / /

WORKDIR "/app"

USER "${uid}:${uid}"

ENTRYPOINT ["docker-php-entrypoint"]
CMD ["--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
    CMD [ "curl", "-ISsfo", "/dev/null", "http://localhost:2019/metrics" ]

EXPOSE 80/tcp
EXPOSE 443/tcp
EXPOSE 443/udp