Repository navigation
Release 5.1: Build from source, PHP 8.6-rc, and more - #740
Draft
jaydrogers wants to merge 10 commits into
Draft
jaydrogers wants to merge 10 commits into
jaydrogers wants to merge 10 commits into
Conversation
`set -oe` without an option name makes /bin/sh print every shell option to stdout. Anything reading a helper's output got that dump first, such as the watcher URL lookup and the php.net checksum lookup. Use `set -e` (and `set -eu` in the s6 installer). Thanks to @tomschlick for spotting this in #726. Co-authored-by: Tom Schlick <tom@schlick.email>
Move each version that ships in an image (s6-overlay, php-fpm-healthcheck, the extension installer, FrankenPHP, Go, watcher, phpredis) into a `dependencies` block in php-versions-base-config.yml. CI and dev.sh pass the block as build args of the same name, and the Dockerfiles declare them without defaults so a missing pin fails the build. Build redis from its GitHub source, with its liblzf submodule fetched separately, so no default build step depends on PECL. Pin watcher instead of downloading the latest release.
Stop waiting for Docker Hub's php images. A new build-php-base phase runs prepare-php-base.sh, which takes docker-library/php at a pinned commit, sets the PHP version, URL, and php.net SHA256, and removes `pecl update-channels`. Everything else matches the official images. Each base compiles once without the build cache, so OS security fixes ship on the next run, and is saved to the Depot Registry. The variations build on it through BASE_IMAGE. get-php-versions.sh no longer checks Docker Hub, and a pinned patch_versions now replaces php.net's. Release candidates such as 8.6-rc build from php.net's release-candidates feed, and php_base_overrides lets a minor version change a variation's upstream variant. PHP 8.1 builds from the last docker-library commit that had it.
The compiled PHP bases install current Debian and Alpine packages, so they already ship the patched libbrotli for CVE-2026-111497. FrankenPHP's Bookworm Brotli build stays, because cbrotli needs libbrotli 1.1 or newer.
Replace Dependabot and get-nginx-versions.sh with Renovate. It reads the `# renovate:` comments in the base config and the lint workflow, checks each OS's NGINX package on nginx.org, groups GitHub Actions monthly, and merges the weekly docker-library/php bump once every check passes. Every other pin waits for a manual merge.
A base job whose runner dropped reports cancelled, not failure, so builds still ran and failed on a base image that was never saved. Build only when the base phase succeeded or was skipped (fork PRs).
…lpine 3.23 and 3.24, Bookworm, and Trixie from the newest release candidate php.net lists. FrankenPHP uses the cli base, since docker-library builds every 8.6 image with ZTS. Upgrade install-php-extensions to 2.12.6 for its PHP 8.6 support. phpredis 6.3.0 does not compile on PHP 8.6, so 8.6 builds phpredis at 810984b, the last develop commit before an added build option that install-php-extensions answers out of order."
…ION with FRANKENPHP_VERSION for synchronized updates
Deploying serversideup-php with
|
| Latest commit: |
f9f7c55
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://60235ba9.serversideup-php.pages.dev |
| Branch Preview URL: | https://release-improve-builds.serversideup-php.pages.dev |
Contributor
Images for PR #740
Try it: docker run --rm -v "$PWD:/var/www/html" -p 8080:8080 serversideup/php-dev:740-8.5-fpm-nginxEvery image is on Docker Hub as All images with sizesSizes are compressed, per architecture.
Updated on every push to this PR. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
👨🔬 How to test
You can test this image using our serversideup/php-dev repository, which automatically builds on push to this PR.
View the available testing images →
🌎 Docs Preview
🤩 What's new
Security releases ship as soon as php.net publishes them (#739)
During the last critical PHP release (#721), we waited hours for Docker Hub's
phpimages, then PECL went down. We now compile PHP ourselves with the same Dockerfiles as the official images, so neither one can hold up a release.phpimages → our build → PECL → publishEvery build also starts from current Debian and Alpine packages, so OS security fixes reach your image on the next weekly rebuild. PHP 8.1 benefits most: its official images haven't been rebuilt since 2025.
PHP 8.6 release candidates (#739)
Test your app on PHP 8.6 before it ships. Every rebuild uses the newest release candidate on php.net.
🐛 Bug fixes
docker-php-serversideup-downloadprinted every shell option to stdout before the file when you didn't give it an output file (Compile PHP from source, drop PECL, and monitor dependencies with Renovate #739)🏗️ For contributors
scripts/conf/php-versions-base-config.yml, and Renovate replaces Dependabot to keep them current (Compile PHP from source, drop PECL, and monitor dependencies with Renovate #739)scripts/dev.sh --build-php-basebuilds exactly what CI builds. See How PHP is built