From 4de057cf19426a096104547cea0e48d250739c17 Mon Sep 17 00:00:00 2001 From: Mistral OZ - MIO Date: Tue, 3 Nov 2026 18:07:13 +0100 Subject: [PATCH 1/3] Detect the changes of the PHP_* variables in the php proxy without starting PHP --- CHANGELOG.md | 3 +++ Dockerfile.slim.apache | 4 ++-- Dockerfile.slim.cli | 4 ++-- Dockerfile.slim.fpm | 4 ++-- tests-suite/php-ini.sh | 6 +++++ utils/Dockerfile.slim.blueprint | 4 ++-- utils/check_php_env_var_changes.php | 34 ----------------------------- utils/docker-entrypoint-as-root.sh | 4 ++-- utils/php_env_fingerprint.sh | 7 ++++++ utils/php_env_var_cache.php | 3 --- utils/php_proxy.sh | 24 ++++++++++---------- 11 files changed, 38 insertions(+), 59 deletions(-) delete mode 100644 utils/check_php_env_var_changes.php create mode 100644 utils/php_env_fingerprint.sh delete mode 100644 utils/php_env_var_cache.php diff --git a/CHANGELOG.md b/CHANGELOG.md index 9b5d37fb..90c16afd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,9 @@ ### Minor changes +* **2026-11-03** + * The `php` command is about 20 ms faster on each call: it detects the changes of the `PHP_*` environment variables without starting PHP a first time. The configuration is now also regenerated when a `PHP_*` variable is removed + * **2026-10-23** * Security: php2shell is fixed in the arm64 images too, now that the fixed PHP packages are published for arm64. The php2shell test fails again for a vulnerable image on every architecture * The tags of the PHP patch versions (e.g. `8.5.12-v5-cli`) are published again: they were no longer published since 2025-12-10. The `X.Y-v5-*` tags are not affected diff --git a/Dockerfile.slim.apache b/Dockerfile.slim.apache index 0a516ce8..f7cecd31 100644 --- a/Dockerfile.slim.apache +++ b/Dockerfile.slim.apache @@ -118,8 +118,8 @@ COPY utils/select_composer_version.sh /usr/local/bin/select_composer_version.sh COPY utils/utils.php /usr/local/bin/utils.php RUN mv /usr/bin/php /usr/bin/real_php COPY utils/php_proxy.sh /usr/bin/php -COPY utils/check_php_env_var_changes.php /usr/local/bin/check_php_env_var_changes.php -COPY utils/php_env_var_cache.php /opt/php_env_var_cache.php +COPY utils/php_env_fingerprint.sh /usr/local/bin/php_env_fingerprint.sh +RUN touch /opt/php_env_fingerprint COPY utils/generate_conf.php /usr/local/bin/generate_conf.php COPY utils/setup_extensions.php /usr/local/bin/setup_extensions.php diff --git a/Dockerfile.slim.cli b/Dockerfile.slim.cli index ae1d0737..92e66fca 100644 --- a/Dockerfile.slim.cli +++ b/Dockerfile.slim.cli @@ -118,8 +118,8 @@ COPY utils/select_composer_version.sh /usr/local/bin/select_composer_version.sh COPY utils/utils.php /usr/local/bin/utils.php RUN mv /usr/bin/php /usr/bin/real_php COPY utils/php_proxy.sh /usr/bin/php -COPY utils/check_php_env_var_changes.php /usr/local/bin/check_php_env_var_changes.php -COPY utils/php_env_var_cache.php /opt/php_env_var_cache.php +COPY utils/php_env_fingerprint.sh /usr/local/bin/php_env_fingerprint.sh +RUN touch /opt/php_env_fingerprint COPY utils/generate_conf.php /usr/local/bin/generate_conf.php COPY utils/setup_extensions.php /usr/local/bin/setup_extensions.php diff --git a/Dockerfile.slim.fpm b/Dockerfile.slim.fpm index 0c379670..619b8b56 100644 --- a/Dockerfile.slim.fpm +++ b/Dockerfile.slim.fpm @@ -118,8 +118,8 @@ COPY utils/select_composer_version.sh /usr/local/bin/select_composer_version.sh COPY utils/utils.php /usr/local/bin/utils.php RUN mv /usr/bin/php /usr/bin/real_php COPY utils/php_proxy.sh /usr/bin/php -COPY utils/check_php_env_var_changes.php /usr/local/bin/check_php_env_var_changes.php -COPY utils/php_env_var_cache.php /opt/php_env_var_cache.php +COPY utils/php_env_fingerprint.sh /usr/local/bin/php_env_fingerprint.sh +RUN touch /opt/php_env_fingerprint COPY utils/generate_conf.php /usr/local/bin/generate_conf.php COPY utils/setup_extensions.php /usr/local/bin/setup_extensions.php diff --git a/tests-suite/php-ini.sh b/tests-suite/php-ini.sh index 9929de7e..17075640 100755 --- a/tests-suite/php-ini.sh +++ b/tests-suite/php-ini.sh @@ -38,6 +38,12 @@ test_environmentErrorReporting() { [[ "$RESULT" == "error_reporting => 3 => 3" ]] assert_equals "error_reporting => 3 => 3" "$RESULT" "Wrong Environment error reporting" } +test_environmentChangedAfterStart() { + RESULT="$(docker run ${RUN_OPTIONS} --rm \ + "${REPO}:${TAG_PREFIX}${PHP_VERSION}-${BRANCH}-slim-${BRANCH_VARIANT}${ARCH_SUFFIX}" \ + bash -c 'PHP_INI_MEMORY_LIMIT=512M php -r "echo ini_get(\"memory_limit\"), \" \";"; php -r "echo ini_get(\"memory_limit\");"')" + assert_equals "512M -1" "$RESULT" "The configuration is not regenerated when a PHP_* variable is added or removed" +} ############################################################ ## PHP_INI_SESSION__SAVE_PATH ## Tests that environment variables with an equal sign are correctly handled diff --git a/utils/Dockerfile.slim.blueprint b/utils/Dockerfile.slim.blueprint index 0f4e75f5..a621a9e5 100644 --- a/utils/Dockerfile.slim.blueprint +++ b/utils/Dockerfile.slim.blueprint @@ -117,8 +117,8 @@ COPY utils/select_composer_version.sh /usr/local/bin/select_composer_version.sh COPY utils/utils.php /usr/local/bin/utils.php RUN mv /usr/bin/php /usr/bin/real_php COPY utils/php_proxy.sh /usr/bin/php -COPY utils/check_php_env_var_changes.php /usr/local/bin/check_php_env_var_changes.php -COPY utils/php_env_var_cache.php /opt/php_env_var_cache.php +COPY utils/php_env_fingerprint.sh /usr/local/bin/php_env_fingerprint.sh +RUN touch /opt/php_env_fingerprint COPY utils/generate_conf.php /usr/local/bin/generate_conf.php COPY utils/setup_extensions.php /usr/local/bin/setup_extensions.php diff --git a/utils/check_php_env_var_changes.php b/utils/check_php_env_var_changes.php deleted file mode 100644 index 058f3ebb..00000000 --- a/utils/check_php_env_var_changes.php +++ /dev/null @@ -1,34 +0,0 @@ - $value) { - if (substr($key, 0, strlen('PHP_')) === 'PHP_') { - if (!isset($phpEnvVarCache[$key])) { - // The env var does not exist in the cache. - $shouldGenerateConfig = true; - } else if ($phpEnvVarCache[$key] !== $value) { - // The value has changed. - $shouldGenerateConfig = true; - } - - $phpEnvVar[$key] = $value; - } -} - -if ($shouldGenerateConfig === false) { - echo "0"; - exit(0); -} - -$cacheFileContent = ' /dev/null +source /usr/local/bin/php_env_fingerprint.sh +php_env_fingerprint > /opt/php_env_fingerprint /usr/bin/real_php -d display_errors=stderr /usr/local/bin/generate_conf.php > /etc/php/${PHP_VERSION}/mods-available/generated_conf.ini PHP_VERSION="${PHP_VERSION}" /usr/bin/real_php -d display_errors=stderr /usr/local/bin/setup_extensions.php | sudo bash diff --git a/utils/php_env_fingerprint.sh b/utils/php_env_fingerprint.sh new file mode 100644 index 00000000..a59a5529 --- /dev/null +++ b/utils/php_env_fingerprint.sh @@ -0,0 +1,7 @@ +# Fingerprint of the PHP_* environment variables the PHP configuration is generated from +php_env_fingerprint() { + local name + for name in "${!PHP_@}"; do + printf '%s=%s\0' "$name" "${!name}" + done | md5sum +} diff --git a/utils/php_env_var_cache.php b/utils/php_env_var_cache.php deleted file mode 100644 index 0b67a5fe..00000000 --- a/utils/php_env_var_cache.php +++ /dev/null @@ -1,3 +0,0 @@ - /dev/null; then +source /usr/local/bin/php_env_fingerprint.sh + +# The configuration is regenerated only when the PHP_* environment variables changed since its last generation +FINGERPRINT=$(php_env_fingerprint) +read -r GENERATED_FINGERPRINT < /opt/php_env_fingerprint +if [[ "$FINGERPRINT" == "$GENERATED_FINGERPRINT" ]]; then exec /usr/bin/real_php "$@" fi -REGENERATE=$(/usr/bin/real_php -d display_errors=stderr /usr/local/bin/check_php_env_var_changes.php) - -if [[ "$REGENERATE" != "0" ]] && [[ "$REGENERATE" != "1" ]]; then - >&2 echo "Unexpected PHP proxy output:" - >&2 echo $REGENERATE - exit 1 +# Users that cannot use sudo run PHP with the current configuration +if ! sudo -n true 2> /dev/null; then + exec /usr/bin/real_php "$@" fi -if [[ "$REGENERATE" == "1" ]]; then - /usr/bin/real_php -d display_errors=stderr /usr/local/bin/generate_conf.php | sudo tee "/etc/php/${PHP_VERSION}/mods-available/generated_conf.ini" > /dev/null - PHP_VERSION="${PHP_VERSION}" /usr/bin/real_php -d display_errors=stderr /usr/local/bin/setup_extensions.php | sudo bash -fi +/usr/bin/real_php -d display_errors=stderr /usr/local/bin/generate_conf.php | sudo tee "/etc/php/${PHP_VERSION}/mods-available/generated_conf.ini" > /dev/null +PHP_VERSION="${PHP_VERSION}" /usr/bin/real_php -d display_errors=stderr /usr/local/bin/setup_extensions.php | sudo bash +echo "$FINGERPRINT" | sudo tee /opt/php_env_fingerprint > /dev/null exec /usr/bin/real_php "$@" From ea6acb405ea316b6d0be3396b6e11009a245fc67 Mon Sep 17 00:00:00 2001 From: Mistral OZ - MIO Date: Tue, 3 Nov 2026 17:49:05 +0100 Subject: [PATCH 2/3] Recommend the fpm variant with its built-in Apache and link to the v6 roadmap --- CHANGELOG.md | 1 + README.md | 30 +++++++++++++++++------------- docs/variants.md | 4 ++++ utils/README.blueprint.md | 30 +++++++++++++++++------------- 4 files changed, 39 insertions(+), 26 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 90c16afd..7cf90087 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,7 @@ * **2026-11-03** * The `php` command is about 20 ms faster on each call: it detects the changes of the `PHP_*` environment variables without starting PHP a first time. The configuration is now also regenerated when a `PHP_*` variable is removed + * The README recommends the fpm variant with its built-in Apache to serve a web application, and links to the v6 roadmap. The php2shell fix is now mentioned in the supported versions * **2026-10-23** * Security: php2shell is fixed in the arm64 images too, now that the fixed PHP packages are published for arm64. The php2shell test fails again for a vulnerable image on every architecture diff --git a/README.md b/README.md index a6c810cb..6ed5af3f 100644 --- a/README.md +++ b/README.md @@ -3,18 +3,16 @@ # General purpose PHP images for Docker -> **Security: php2shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) is fixed in all the v5 images** -> -> Pull the images again, recreate your containers and rebuild the images built from ours. **Update:** the arm64 images, -> first published without the fix, are now fixed too: pull them again. The v4 images are **not** fixed: migrate to -> v5. See [what to do](docs/security-php2shell.md). +> **The fpm variant has a built-in Apache** (`PHP_FPM_WEB_SERVER=apache`): the same features as the `apache` variant, +> with 2 to 3 times more traffic served and 4 times less memory ([benchmark](benchmarks/fpm-apache/README.md)). It is +> the recommended variant to serve a web application: see [Serving with the fpm variant](docs/fpm.md). This repository contains a set of developer-friendly, general purpose PHP images for Docker. - You can enable or disable the extensions using environment variables. - You can also modify the `php.ini` settings using environment variables. - 2 types available: `slim` (no extensions preloaded) or `fat` (most common PHP extensions are built-in) - - 3 variants available: `CLI`, `apache` and `fpm` (with an optional built-in Apache) + - 3 variants available: `CLI`, `apache` and `fpm` (with an optional built-in Apache, recommended for web applications) - Fat images are bundled with [Supercronic](https://github.com/aptible/supercronic) which is a Cron compatible task runner. Cron jobs can be configured using environment variables - All images come with [Composer](https://getcomposer.org/) installed - All variants can be installed with or without NodeJS (if you need to build your static assets). @@ -143,7 +141,8 @@ Bugs are fixed on maintained versions only. | 20 | **Not maintained** (end of life: 2026-04-30) | Images of non-maintained versions are still available but no longer receive fixes: use them at your own risk and plan your upgrade. -Critical vulnerabilities may get an exceptional fix (e.g. [php2shell](docs/security-php2shell.md)). +Critical vulnerabilities may get an exceptional fix: [php2shell](docs/security-php2shell.md) (CVE-2026-109618 and +CVE-2026-109619) is fixed in all the v5 images, not in the v4 ones. ## Usage @@ -155,22 +154,22 @@ Example with CLI: $ docker run -it --rm --name my-running-script -v "$PWD":/usr/src/app thecodingmachine/php:8.4-v5-cli php your-script.php ``` -Example with Apache: +Example with PHP-FPM and its built-in Apache (in the same container), recommended to serve a web application: ```bash -$ docker run -p 80:80 --rm --name my-apache-php-app -v "$PWD":/var/www/html thecodingmachine/php:8.4-v5-apache +$ docker run -p 80:80 --rm --name my-apache-fpm-app -e PHP_FPM_WEB_SERVER=apache -v "$PWD":/var/www/html thecodingmachine/php:8.4-v5-fpm ``` -Example with PHP-FPM: +Example with PHP-FPM alone, behind your own web server: ```bash $ docker run -p 9000:9000 --rm --name my-php-fpm -v "$PWD":/var/www/html thecodingmachine/php:8.4-v5-fpm ``` -Example with PHP-FPM and its built-in Apache (in the same container): +Example with Apache and `mod_php`: ```bash -$ docker run -p 80:80 --rm --name my-apache-fpm-app -e PHP_FPM_WEB_SERVER=apache -v "$PWD":/var/www/html thecodingmachine/php:8.4-v5-fpm +$ docker run -p 80:80 --rm --name my-apache-php-app -v "$PWD":/var/www/html thecodingmachine/php:8.4-v5-apache ``` Example with Apache + Node 24.x in a Dockerfile: @@ -198,7 +197,6 @@ Most features are configured with environment variables: | [Processes](docs/processes.md) | Startup commands, cron jobs and daemons run along with the main command | `STARTUP_COMMAND_*`, `CRON_*`, `DAEMON_*` | | [Debugging and profiling](docs/debugging.md) | Xdebug and Blackfire | `PHP_EXTENSION_XDEBUG`, `XDEBUG_CLIENT_HOST`, `BLACKFIRE_AGENT` | | [Advanced features](docs/advanced.md) | Permissions, NodeJS, Composer version, locales, SSH keys, Kubernetes | `DOCKER_USER`, `COMPOSER_VERSION`, `LOCALES` | -| [php2shell](docs/security-php2shell.md) | What to do about CVE-2026-109618 / CVE-2026-109619 | | The slim images install some tools during the build of your image with an ARG before the `FROM`: `PHP_EXTENSIONS`, `INSTALL_CRON`, `INSTALL_LOCALES`, `NODE_VERSION` and `COMPOSER_VERSION`. @@ -207,6 +205,12 @@ The slim images install some tools during the build of your image with an ARG be Check the [migration notes](MIGRATING.md). +## Roadmap + +The v5 images keep receiving fixes and backward compatible features. The next major version, v6, is planned for 2027: +Ubuntu 26.04, a FrankenPHP variant and much faster builds. Follow and discuss it in the +[roadmap issue](https://github.com/thecodingmachine/docker-images-php/issues/359). + ## Contributing The Dockerfiles and this README are generated from the templates of the `utils` directory: see the diff --git a/docs/variants.md b/docs/variants.md index 1289844e..dd48f382 100644 --- a/docs/variants.md +++ b/docs/variants.md @@ -30,6 +30,10 @@ services: Apache runs PHP with `mod_php`. The sections below also apply to the [built-in Apache of the *fpm* variant](#built-in-apache). +To serve a new application, prefer the *fpm* variant with its built-in Apache: the same features, with 2 to 3 times +more traffic served and 4 times less memory ([benchmark](../benchmarks/fpm-apache/README.md)). See +[Serving with the fpm variant](fpm.md) and its [migration notes](fpm.md#migrating-from-the-apache-variant). + ### Document root `APACHE_DOCUMENT_ROOT` sets the document root (your "public" directory). A relative path is relative to diff --git a/utils/README.blueprint.md b/utils/README.blueprint.md index 4f8cab00..2b87894a 100644 --- a/utils/README.blueprint.md +++ b/utils/README.blueprint.md @@ -2,18 +2,16 @@ # General purpose PHP images for Docker -> **Security: php2shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) is fixed in all the v5 images** -> -> Pull the images again, recreate your containers and rebuild the images built from ours. **Update:** the arm64 images, -> first published without the fix, are now fixed too: pull them again. The v4 images are **not** fixed: migrate to -> v5. See [what to do](docs/security-php2shell.md). +> **The fpm variant has a built-in Apache** (`PHP_FPM_WEB_SERVER=apache`): the same features as the `apache` variant, +> with 2 to 3 times more traffic served and 4 times less memory ([benchmark](benchmarks/fpm-apache/README.md)). It is +> the recommended variant to serve a web application: see [Serving with the fpm variant](docs/fpm.md). This repository contains a set of developer-friendly, general purpose PHP images for Docker. - You can enable or disable the extensions using environment variables. - You can also modify the `php.ini` settings using environment variables. - 2 types available: `slim` (no extensions preloaded) or `fat` (most common PHP extensions are built-in) - - 3 variants available: `CLI`, `apache` and `fpm` (with an optional built-in Apache) + - 3 variants available: `CLI`, `apache` and `fpm` (with an optional built-in Apache, recommended for web applications) - Fat images are bundled with [Supercronic](https://github.com/aptible/supercronic) which is a Cron compatible task runner. Cron jobs can be configured using environment variables - All images come with [Composer](https://getcomposer.org/) installed - All variants can be installed with or without NodeJS (if you need to build your static assets). @@ -73,7 +71,8 @@ Bugs are fixed on maintained versions only. | 20 | **Not maintained** (end of life: 2026-04-30) | Images of non-maintained versions are still available but no longer receive fixes: use them at your own risk and plan your upgrade. -Critical vulnerabilities may get an exceptional fix (e.g. [php2shell](docs/security-php2shell.md)). +Critical vulnerabilities may get an exceptional fix: [php2shell](docs/security-php2shell.md) (CVE-2026-109618 and +CVE-2026-109619) is fixed in all the v5 images, not in the v4 ones. ## Usage @@ -85,22 +84,22 @@ Example with CLI: $ docker run -it --rm --name my-running-script -v "$PWD":/usr/src/app thecodingmachine/php:{{ $image.php_version }}-v5-cli php your-script.php ``` -Example with Apache: +Example with PHP-FPM and its built-in Apache (in the same container), recommended to serve a web application: ```bash -$ docker run -p 80:80 --rm --name my-apache-php-app -v "$PWD":/var/www/html thecodingmachine/php:{{ $image.php_version }}-v5-apache +$ docker run -p 80:80 --rm --name my-apache-fpm-app -e PHP_FPM_WEB_SERVER=apache -v "$PWD":/var/www/html thecodingmachine/php:{{ $image.php_version }}-v5-fpm ``` -Example with PHP-FPM: +Example with PHP-FPM alone, behind your own web server: ```bash $ docker run -p 9000:9000 --rm --name my-php-fpm -v "$PWD":/var/www/html thecodingmachine/php:{{ $image.php_version }}-v5-fpm ``` -Example with PHP-FPM and its built-in Apache (in the same container): +Example with Apache and `mod_php`: ```bash -$ docker run -p 80:80 --rm --name my-apache-fpm-app -e PHP_FPM_WEB_SERVER=apache -v "$PWD":/var/www/html thecodingmachine/php:{{ $image.php_version }}-v5-fpm +$ docker run -p 80:80 --rm --name my-apache-php-app -v "$PWD":/var/www/html thecodingmachine/php:{{ $image.php_version }}-v5-apache ``` Example with Apache + Node {{ $image.node_version }}.x in a Dockerfile: @@ -128,7 +127,6 @@ Most features are configured with environment variables: | [Processes](docs/processes.md) | Startup commands, cron jobs and daemons run along with the main command | `STARTUP_COMMAND_*`, `CRON_*`, `DAEMON_*` | | [Debugging and profiling](docs/debugging.md) | Xdebug and Blackfire | `PHP_EXTENSION_XDEBUG`, `XDEBUG_CLIENT_HOST`, `BLACKFIRE_AGENT` | | [Advanced features](docs/advanced.md) | Permissions, NodeJS, Composer version, locales, SSH keys, Kubernetes | `DOCKER_USER`, `COMPOSER_VERSION`, `LOCALES` | -| [php2shell](docs/security-php2shell.md) | What to do about CVE-2026-109618 / CVE-2026-109619 | | The slim images install some tools during the build of your image with an ARG before the `FROM`: `PHP_EXTENSIONS`, `INSTALL_CRON`, `INSTALL_LOCALES`, `NODE_VERSION` and `COMPOSER_VERSION`. @@ -137,6 +135,12 @@ The slim images install some tools during the build of your image with an ARG be Check the [migration notes](MIGRATING.md). +## Roadmap + +The v5 images keep receiving fixes and backward compatible features. The next major version, v6, is planned for 2027: +Ubuntu 26.04, a FrankenPHP variant and much faster builds. Follow and discuss it in the +[roadmap issue](https://github.com/thecodingmachine/docker-images-php/issues/359). + ## Contributing The Dockerfiles and this README are generated from the templates of the `utils` directory: see the From fd4bfd8d9b0da9a310c3896d19a977a887748ae5 Mon Sep 17 00:00:00 2001 From: Mistral OZ - MIO Date: Tue, 3 Nov 2026 19:11:16 +0100 Subject: [PATCH 3/3] Document an application outside /var/www/html and additional pools with the fpm variant --- CHANGELOG.md | 1 + docs/fpm.md | 66 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 67 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7cf90087..97a9191b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ * **2026-11-03** * The `php` command is about 20 ms faster on each call: it detects the changes of the `PHP_*` environment variables without starting PHP a first time. The configuration is now also regenerated when a `PHP_*` variable is removed * The README recommends the fpm variant with its built-in Apache to serve a web application, and links to the v6 roadmap. The php2shell fix is now mentioned in the supported versions + * New documentation of the fpm variant: application outside `/var/www/html` and additional PHP-FPM pools (#190) * **2026-10-23** * Security: php2shell is fixed in the arm64 images too, now that the fixed PHP packages are published for arm64. The php2shell test fails again for a vulnerable image on every architecture diff --git a/docs/fpm.md b/docs/fpm.md index 801c8121..5a1f7836 100644 --- a/docs/fpm.md +++ b/docs/fpm.md @@ -93,6 +93,72 @@ server { } ``` +## Application directory + +The application does not have to be in `/var/www/html`: PHP-FPM runs the script whose path it receives from the web +server. Mount the application in another directory and give its path to the web server: `APACHE_DOCUMENT_ROOT` with +the built-in Apache (an absolute path), the `root` of nginx... Also set the working directory: by default, the +commands run with the owner of the working directory (see [Permissions](advanced.md#permissions)). + +```yml +services: + app: + image: thecodingmachine/php:8.4-v5-fpm + working_dir: /var/www + environment: + PHP_FPM_WEB_SERVER: apache + APACHE_DOCUMENT_ROOT: /var/www/public + volumes: + - .:/var/www +``` + +## Several pools + +The `www` pool of PHP-FPM processes all the PHP requests. Another pool can process some of them with its own +settings: number of workers, `php.ini` parameters... for instance the back office of a WordPress site, with more +memory and fewer workers. Add a pool file listening on another port: + +```ini +; admin-pool.conf +[admin] +listen = 9001 +; Same user as the www pool (with the built-in Apache, the PHP-FPM master process runs as root) +user = ${APACHE_RUN_USER} +group = ${APACHE_RUN_GROUP} +clear_env = no +catch_workers_output = yes +decorate_workers_output = no +pm = ondemand +pm.max_children = 2 +php_admin_value[memory_limit] = 512M +``` + +With the built-in Apache, send the requests of the back office to this pool: + +```apache +# apache-admin-pool.conf + + + SetHandler "proxy:fcgi://127.0.0.1:9001" + + +``` + +```yml +services: + app: + image: thecodingmachine/php:8.4-v5-fpm + environment: + PHP_FPM_WEB_SERVER: apache + volumes: + - .:/var/www/html + - ./admin-pool.conf:/etc/php/8.4/fpm/pool.d/admin.conf:ro + - ./apache-admin-pool.conf:/etc/apache2/conf-enabled/admin-pool.conf:ro +``` + +With your own web server, send these requests to the port of the pool (`fastcgi_pass php:9001;` in a `location` of +nginx). + ## Constraints of PHP-FPM ### Number of workers and memory