App image

.github/workflows/nightly-build.yml

@@ -89,6 +89,45 @@ jobs:
             --set "*.cache-from=type=gha,scope=php" \
             --set "*.cache-to=type=gha,scope=php,mode=max"
 
+  app:
+    name: App images
+    runs-on: ubuntu-24.04
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+        with:
+          platforms: amd64,arm64
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Login to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Resolve PHP FPM minor versions
+        id: versions
+        run: |
+          echo "php83_minor=$(bin/helper php-fpm-minor 8.3)" >> "$GITHUB_OUTPUT"
+          echo "php84_minor=$(bin/helper php-fpm-minor 8.4)" >> "$GITHUB_OUTPUT"
+          echo "php85_minor=$(bin/helper php-fpm-minor 8.5)" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push App images
+        env:
+          PHP83_MINOR: ${{ steps.versions.outputs.php83_minor }}
+          PHP84_MINOR: ${{ steps.versions.outputs.php84_minor }}
+          PHP85_MINOR: ${{ steps.versions.outputs.php85_minor }}
+        run: |
+          docker buildx bake -f app/docker-bake.hcl --pull --push \
+            --set "*.cache-from=type=gha,scope=app" \
+            --set "*.cache-to=type=gha,scope=app,mode=max"
+
   nginx:
     name: Nginx images
     runs-on: ubuntu-24.04

CLAUDE.md

@@ -53,6 +53,8 @@ make run-frankenphp-tests   # Run FrankenPHP image tests
 
 PHP 8.5 images exist but are not marked `latest` — PHP 8.5 is not yet considered ready for Drupal projects.
 
+See [CONFIGURATION.md](CONFIGURATION.md) for PHP extensions, binaries, certificates, and PHP ini settings across all images.
+
 ### Helper & Sidecar Images
 
 #### Nginx (`nginx/`)

CONFIGURATION.md

@@ -0,0 +1,126 @@
+# PHP Image Configuration
+
+Reference for PHP extensions, binaries, certificates, and PHP ini settings across all PHP images.
+
+## PHP Settings
+
+### Static Settings
+
+Hardcoded in `php/rootfs/etc/php/conf.d/98_custom.ini` (`php/*` images) and `app/rootfs/usr/local/etc/php/conf.d/docker-php-ext-zzz-custom.ini` (`druidfi/app`).
+
+| Setting | Value | Notes |
+|---------|-------|-------|
+| `expose_php` | `Off` | |
+| `memory_limit` | `512M` | Overridable via env var |
+| `date.timezone` | `Europe/Helsinki` | |
+| `realpath_cache_size` | `8M` | Default: 4096K |
+| `opcache.memory_consumption` | `512` | Default: 128 |
+| `opcache.interned_strings_buffer` | `64` | Default: 8 |
+| `opcache.max_accelerated_files` | `30000` | Default: 10000 |
+| `opcache.enable_file_override` | `1` | Default: 0 |
+| `opcache.validate_timestamps` | `1` (dev) / `0` (prod) | Disabled in prod via `99_production.ini` |
+| `apc.shm_size` | `64M` | Default: 32M |
+
+### Dynamic Settings (Environment Variables)
+
+Set via env vars at container startup. Template files processed by `ep` (envplate).
+
+| Env Var | Default | PHP Setting | `php/*` images | `druidfi/app` |
+|---------|---------|-------------|:--------------:|:-------------:|
+| `PHP_MEMORY_LIMIT` | `512M` | `memory_limit` | ✓ | ✓ |
+| `PHP_POST_MAX_SIZE` | `32M` | `post_max_size` | ✓ | ✓ |
+| `PHP_UPLOAD_MAX_FILESIZE` | `32M` | `upload_max_filesize` | ✓ | ✓ |
+| `PHP_MAX_EXECUTION_TIME` | `180` | `max_execution_time` | — | ✓ |
+| `PHP_MAX_INPUT_VARS` | `2000` | `max_input_vars` | — | ✓ |
+| `PHP_DISPLAY_ERRORS` | `On` | `display_errors` | — | ✓ |
+| `PHP_SENDMAIL_PATH` | `msmtp -t` / `sendmail -S host.docker.internal:1025 -t` | `sendmail_path` | ✓ | ✓ |
+
+### Xdebug
+
+Disabled by default. Set `XDEBUG_ENABLE=true` to enable at container startup.
+
+| Setting | Value |
+|---------|-------|
+| `xdebug.mode` | `debug` |
+| `xdebug.client_host` | `host.docker.internal` |
+| `xdebug.idekey` | `PHPSTORM` |
+| `xdebug.log` | `/tmp/xdebug.log` |
+
+## PHP Extensions
+
+Extensions accumulate across image layers (`php` → `php-fpm` → `drupal` → `drupal-web`). `druidfi/app` builds on the official `php:fpm-alpine` base and uses `mlocati/php-extension-installer`.
+
+| Extension | Type | `druidfi/php` | `druidfi/php-fpm` | `druidfi/drupal` | `druidfi/drupal-web` | `druidfi/app` |
+|-----------|------|:-------------:|:-----------------:|:----------------:|:--------------------:|:-------------:|
+| curl | core | ✓ | ✓ | ✓ | ✓ | ✓ |
+| fileinfo | core | ✓ | ✓ | ✓ | ✓ | ✓ |
+| iconv | core (gnu-libiconv) | ✓ | ✓ | ✓ | ✓ | ✓ |
+| mbstring | core | ✓ | ✓ | ✓ | ✓ | ✓ |
+| opcache | core | ✓ | ✓ | ✓ | ✓ | ✓ |
+| openssl | core | ✓ | ✓ | ✓ | ✓ | ✓ |
+| phar | core | ✓ | ✓ | ✓ | ✓ | ✓ |
+| session | core | ✓ | ✓ | ✓ | ✓ | ✓ |
+| zip | core | ✓ | ✓ | ✓ | ✓ | ✓ |
+| apcu | PECL | ✓ | ✓ | ✓ | ✓ | ✓ |
+| imagick | PECL | ✓ | ✓ | ✓ | ✓ | ✓ |
+| redis | PECL | ✓ | ✓ | ✓ | ✓ | ✓ |
+| uploadprogress | PECL | ✓ | ✓ | ✓ | ✓ | ✓ |
+| xdebug | PECL | ✓ | ✓ | ✓ | ✓ | ✓ |
+| bcmath | core | — | — | ✓ | ✓ | ✓ |
+| ctype | core | — | — | ✓ | ✓ | ✓ |
+| dom | core | — | — | ✓ | ✓ | ✓ |
+| exif | core | — | — | ✓ | ✓ | ✓ |
+| gd | core | — | — | ✓ | ✓ | ✓ |
+| intl | core | — | — | ✓ | ✓ | — |
+| pdo | core | — | — | ✓ | ✓ | ✓ |
+| pdo_mysql | core | — | — | ✓ | ✓ | ✓ |
+| simplexml | core | — | — | ✓ | ✓ | ✓ |
+| soap | core | — | — | ✓ | ✓ | — |
+| sockets | core | — | — | ✓ | ✓ | ✓ |
+| sodium | core | — | — | ✓ | ✓ | ✓ |
+| tokenizer | core | — | — | ✓ | ✓ | ✓ |
+| xml | core | — | — | ✓ | ✓ | ✓ |
+| xmlreader | core | — | — | ✓ | ✓ | ✓ |
+| xmlwriter | core | — | — | ✓ | ✓ | ✓ |
+| igbinary | PECL | — | — | ✓ | ✓ | ✓ |
+
+> PHP 8.5 omits `opcache` (not yet in Alpine edge/testing). `intl` and `soap` are absent in `druidfi/app` — not in the official `php:fpm-alpine` base and not explicitly installed. `igbinary` enables binary serialization for the Redis/Valkey phpredis extension (used with the Drupal redis module).
+
+## Installed Binaries
+
+| Binary | Source | `druidfi/php` | `druidfi/php-fpm` | `druidfi/drupal` | `druidfi/drupal-web` | `druidfi/app` |
+|--------|--------|:-------------:|:-----------------:|:----------------:|:--------------------:|:-------------:|
+| `php` | Alpine apk / official base | ✓ | ✓ | ✓ | ✓ | ✓ |
+| `composer` | `composer/composer:2.9-bin` | ✓ | ✓ | ✓ | ✓ | ✓ |
+| `ep` | `amazeeio/envplate:26.3.0` | ✓ | ✓ | ✓ | ✓ | ✓ |
+| `entrypoint` | `rootfs/usr/local/bin/` | ✓ | ✓ | ✓ | ✓ | ✓ |
+| `fix-permissions` | `rootfs/usr/local/bin/` | ✓ | ✓ | ✓ | ✓ | ✓ |
+| `bash` | Alpine apk | ✓ | ✓ | ✓ | ✓ | ✓ |
+| `curl` | Alpine apk | ✓ | ✓ | ✓ | ✓ | ✓ |
+| `git` | Alpine apk | ✓ | ✓ | ✓ | ✓ | ✓ |
+| `make` | Alpine apk | ✓ | ✓ | ✓ | ✓ | ✓ |
+| `msmtp` | Alpine apk | ✓ | ✓ | ✓ | ✓ | ✓ |
+| `ssmtp` | Alpine apk | ✓ | ✓ | ✓ | ✓ | ✓ |
+| `nano` | Alpine apk | ✓ | ✓ | ✓ | ✓ | ✓ |
+| `tar` | Alpine apk | ✓ | ✓ | ✓ | ✓ | ✓ |
+| `tini` | Alpine apk | ✓ | ✓ | ✓ | ✓ | ✓ |
+| `fastfetch` | Alpine apk | ✓ | ✓ | ✓ | ✓ | ✓ |
+| `patch` | Alpine apk | ✓ | ✓ | ✓ | ✓ | ✓ |
+| `unzip` | Alpine apk | ✓ | ✓ | ✓ | ✓ | ✓ |
+| `sudo` | Alpine apk | ✓ | ✓ | ✓ | ✓ | — |
+| `doas` | Alpine apk | — | — | — | — | ✓ |
+| `php-fpm` | Alpine apk / official base | — | ✓ | ✓ | ✓ | ✓ |
+| `openssh` / `openssh-client` | Alpine apk | — | — | ✓ | ✓ | ✓ |
+| `rsync` | Alpine apk | — | — | ✓ | ✓ | ✓ |
+| `mariadb-client` | Alpine apk | — | — | ✓ | ✓ | ✓ |
+| `install-php-extensions` | `mlocati/php-extension-installer` | — | — | — | — | ✓ |
+| `nginx` | Alpine apk | — | — | — | ✓ | ✓ |
+| `gdpr-dump` | GitHub releases (Smile-SA) | — | — | — | ✓ | ✓ |
+
+## Certificates
+
+Installed to `/opt/ssl/` in all images (from `rootfs/opt/ssl/` in the repo).
+
+| File | `druidfi/php` | `druidfi/php-fpm` | `druidfi/drupal` | `druidfi/drupal-web` | `druidfi/app` | Purpose |
+|------|:-------------:|:-----------------:|:----------------:|:--------------------:|:-------------:|---------|
+| `DigiCertGlobalRootCA.crt.pem` | ✓ | ✓ | ✓ | ✓ | ✓ | Azure MySQL Flexible Server |

Makefile

@@ -11,6 +11,8 @@ else
 	CURRENT_ARCH := amd64
 endif
 
+PHP_VERSIONS := 8.3 8.4 8.5
+
 include $(PROJECT_DIR)/make/*.mk
 
 PHONY += help
@@ -39,6 +41,10 @@ define get_php_minor
 $(shell bin/helper phpminor $1)
 endef
 
+define get_php_fpm_minor
+$(shell bin/helper php-fpm-minor $1)
+endef
+
 define get_frankenphp_version
 $(shell bin/helper frankenphpversion)
 endef

app/Dockerfile

@@ -0,0 +1,61 @@
+# syntax=docker/dockerfile:1
+
+#
+# App image
+#
+FROM php-base
+
+ENV KIND=druid-docker-image \
+    APP_PATH=/app \
+    DEFAULT_USER=druid \
+    DEFAULT_USER_UID=1000 \
+    APP_ENV=prod \
+    COMPOSER_HOME=/home/druid/.composer \
+    COMPOSER_AUDIT_ABANDONED=report \
+    COMPOSER_FUND=0 \
+    PATH="${PATH}:/home/druid/.composer/vendor/bin:/app/vendor/bin" \
+    DRUPAL_DB_NAME=drupal \
+    DRUPAL_DB_USER=drupal \
+    DRUPAL_DB_PASS=drupal \
+    DRUPAL_DB_HOST=db \
+    DRUPAL_DB_PORT=3306
+
+WORKDIR ${APP_PATH}
+
+COPY --link --from=composer/composer:2.9-bin /composer /usr/local/bin/
+COPY --link --from=amazeeio/envplate:26.3.0 /usr/local/bin/ep /usr/local/bin/
+COPY --link --from=mlocati/php-extension-installer /usr/bin/install-php-extensions /usr/local/bin/
+
+RUN apk --no-cache add \
+    bash curl doas fastfetch git make \
+    mariadb-client mariadb-connector-c \
+    msmtp nano nginx openssh-client patch rsync ssmtp tar tini unzip && \
+    install-php-extensions \
+    apcu bcmath exif gd igbinary imagick opcache pdo_mysql redis sockets uploadprogress xdebug zip && \
+    addgroup -S ${DEFAULT_USER} -g ${DEFAULT_USER_UID} && \
+    adduser -D -S -G ${DEFAULT_USER} -u ${DEFAULT_USER_UID} -s /bin/bash ${DEFAULT_USER} && \
+    adduser ${DEFAULT_USER} www-data && \
+    mkdir -p /home/${DEFAULT_USER}/.composer && \
+    curl -sSf https://composer.github.io/releases.pub -o /home/${DEFAULT_USER}/.composer/keys.tags.pub && \
+    curl -sSf https://composer.github.io/snapshots.pub -o /home/${DEFAULT_USER}/.composer/keys.dev.pub && \
+    chown -R ${DEFAULT_USER}:${DEFAULT_USER} /home/${DEFAULT_USER} ${APP_PATH} && \
+    chmod -R a+rwx /var/lib/nginx /var/log/nginx && \
+    curl -sSL https://github.com/Smile-SA/gdpr-dump/releases/latest/download/gdpr-dump.phar -o /usr/local/bin/gdpr-dump && \
+    chmod +x /usr/local/bin/gdpr-dump && \
+    gdpr-dump --version
+
+COPY --chown=${DEFAULT_USER}:${DEFAULT_USER} rootfs/home/druid/ /home/druid
+COPY rootfs/entrypoints/ /entrypoints/
+COPY rootfs/etc/ /etc/
+COPY rootfs/usr/local/ /usr/local/
+
+# https://learn.microsoft.com/en-us/azure/mysql/flexible-server/how-to-connect-tls-ssl
+RUN mkdir -p /opt/ssl
+COPY --chmod=644 rootfs/opt/ssl/DigiCertGlobalRootCA.crt.pem /opt/ssl/
+
+EXPOSE 8080/tcp
+
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["entrypoint"]
+USER ${DEFAULT_USER}
+SHELL ["/bin/bash", "-c"]

app/build.mk

@@ -0,0 +1,28 @@
+BAKE_FLAGS := --pull --no-cache --push
+
+PHONY += --app-bake
+--app-bake:
+	@PHP83_MINOR=$(call get_php_fpm_minor,8.3) PHP84_MINOR=$(call get_php_fpm_minor,8.4) PHP85_MINOR=$(call get_php_fpm_minor,8.5) \
+		docker buildx bake -f app/docker-bake.hcl $(BAKE_FLAGS)
+
+PHONY += app-bake-all
+app-bake-all: buildx-create --app-bake buildx-destroy ## Bake all APP images
+
+PHONY += app-bake-print
+app-bake-print: BAKE_FLAGS := --print
+app-bake-print: --app-bake ## Print bake plan for App images
+
+PHONY += app-bake-local
+app-bake-local: BAKE_FLAGS := --pull --progress plain --no-cache --load --set *.platform=linux/$(CURRENT_ARCH)
+app-bake-local: --app-bake run-app-tests ## Bake all App images locally
+
+PHONY += app-bake-test
+app-bake-test: BAKE_FLAGS := --pull --progress plain --no-cache
+app-bake-test: --app-bake run-app-tests ## CI test for App images
+
+PHONY += run-app-tests
+run-app-tests:
+	@for v in $(PHP_VERSIONS); do \
+		printf "\n\e[0;33mRun tests in ghcr.io/druidfi/app:php-$$v\e[0m\n\n"; \
+		docker run --rm -t -v $(CURDIR)/tests/scripts:/app/scripts ghcr.io/druidfi/app:php-$$v /app/scripts/tests.sh || exit 1; \
+	done

app/docker-bake.hcl

@@ -0,0 +1,92 @@
+variable "REPO_BASE" {
+  default = "druidfi/app"
+}
+
+variable "PHP83_MINOR" {}
+variable "PHP84_MINOR" {}
+variable "PHP85_MINOR" {}
+
+group "default" {
+  targets = ["php-83", "php-84", "php-85"]
+}
+
+target "common" {
+  platforms = ["linux/amd64", "linux/arm64"]
+  labels = {
+    "org.opencontainers.image.url" = "https://github.com/druidfi/docker-images"
+    "org.opencontainers.image.source" = "https://github.com/druidfi/docker-images"
+    "org.opencontainers.image.licenses" = "MIT"
+    "org.opencontainers.image.vendor" = "Druid Oy"
+    "org.opencontainers.image.created" = timestamp()
+  }
+}
+
+#
+# PHP
+#
+
+target "php" {
+  context = "./app"
+  args = {
+    PHP_MAJOR_VERSION = 8
+  }
+}
+
+target "php-83" {
+  inherits = ["common", "php"]
+  args = {
+    PHP_VERSION = "8.3"
+    PHP_SHORT_VERSION = "83"
+  }
+  contexts = {
+    php-base = "docker-image://php:${PHP83_MINOR}-fpm-alpine"
+  }
+  labels = {
+    "org.opencontainers.image.title" = "Druid App image with PHP 8.3"
+    "org.opencontainers.image.description" = "Base PHP 8.3 image"
+  }
+  tags = [
+    "ghcr.io/${REPO_BASE}:php-8.3",
+    "ghcr.io/${REPO_BASE}:php-${PHP83_MINOR}",
+  ]
+}
+
+target "php-84" {
+  inherits = ["common", "php"]
+  args = {
+    PHP_VERSION = "8.4"
+    PHP_SHORT_VERSION = "84"
+  }
+  contexts = {
+    php-base = "docker-image://php:${PHP84_MINOR}-fpm-alpine"
+  }
+  labels = {
+    "org.opencontainers.image.title" = "Druid App image with PHP 8.4"
+    "org.opencontainers.image.description" = "Base PHP 8.4 image"
+  }
+  tags = [
+    "ghcr.io/${REPO_BASE}:php-8",
+    "ghcr.io/${REPO_BASE}:php-8.4",
+    "ghcr.io/${REPO_BASE}:php-${PHP84_MINOR}",
+    "ghcr.io/${REPO_BASE}:latest",
+  ]
+}
+
+target "php-85" {
+  inherits = ["common", "php"]
+  args = {
+    PHP_VERSION = "8.5"
+    PHP_SHORT_VERSION = "85"
+  }
+  contexts = {
+    php-base = "docker-image://php:${PHP85_MINOR}-fpm-alpine"
+  }
+  labels = {
+    "org.opencontainers.image.title" = "Druid App image with PHP 8.5"
+    "org.opencontainers.image.description" = "Base PHP 8.5 image"
+  }
+  tags = [
+    "ghcr.io/${REPO_BASE}:php-8.5",
+    "ghcr.io/${REPO_BASE}:php-${PHP85_MINOR}",
+  ]
+}

app/rootfs/entrypoints/00-umask.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+# Make sure that new files generated by Docker have group write permission
+umask 002