[byjg]

Summary

PIE instead of PECL (PHP 8.3+)

• The 8.3–8.6 configs use pie: instead of pecl:. Older versions keep pecl:, since PIE needs PHP 8.1+ and those configs were not migrated.
• On 8.6, imagick, memcached and yaml are built with PIE from pinned commits, because their latest releases do not compile on 8.6 yet.
• The images ship pie (1.5.2, checksum verified) and a pie-install helper. The helper adds the build tools, runs pie install, and removes the tools again.
• install-sqlsvr.sh uses PIE when it is available. It skips the PHP extension when it does not build, and now detects aarch64.

php-disable-module

• New php-disable-module helper in every image:
  • php-disable-module <module>... disables the modules, plus the modules that require them (e.g. dom also disables xmlreader and xsl).
  • --all-except <module>... keeps the given modules and the ones they require, and disables the rest.
  • --list lists the modules that can be disabled.
• A module is found by the extension line of its ini file, not by the file name.
• A module already disabled is not an error, so it is safe to run again.
• After disabling, it fails if PHP does not start cleanly.

Runtime environment variables

• New PHP_DISABLE_MODULES and PHP_ENABLED_MODULES (comma or space separated).
• For both, errors are always shown and stop the container. A restart works, because already-disabled modules are not an error.
• DISABLEMODULE_<name> still works but is deprecated: it prints a warning and never stops the container.

Other

• The generator keeps a # inside a word, for PIE constraints such as vendor/pkg:dev-master#<commit>.
• entrypoint.sh and php-disable-module pass shellcheck with no warnings.
• Docs updated: building.md, dockerfile.md, environment.md, security.md, and the image index.html.

Testing

• I compared the generated Dockerfiles with the ones from master. The only change for versions without PIE is the php-disable-module copy. In the 8.5 set, cli, fpm, fpm-apache, fpm-nginx and nginx are unchanged.

• I tested php-disable-module and entrypoint.sh by mounting them into the existing 8.5 and 8.6 images (cli, fpm, fpm-nginx, fpm-apache):

  • disabling modules, including their dependents;
  • --all-except;
  • typos, which stop the container;
  • docker restart;
  • VERBOSE output;
  • PIE-built modules on 8.6.

  For the web images I checked the loaded modules over HTTP.

• Not tested yet: a full image build from this branch. The CI run on this PR builds the images; it does not push them.