Dockerfile.v2

ARG VERSION=8.3-cli-alpine

FROM public.ecr.aws/docker/library/php:${VERSION}
ARG PHPVERSION
ARG BASEOS
ARG S6_OVERLAY_VERSION=v3.2.1.0
ARG TARGETARCH
ARG BUILD_DATE
ARG VCS_REF
ARG VERSION

# Set environment variables
ENV DEBIAN_FRONTEND=noninteractive

COPY extras/retry.sh /usr/local/bin/retry
RUN chmod +x /usr/local/bin/retry

# OCI standard labels
LABEL org.opencontainers.image.title="php-docker" \
      org.opencontainers.image.description="PHP runtime with s6-overlay and curated extensions" \
      org.opencontainers.image.version="${VERSION}" \
      org.opencontainers.image.created="${BUILD_DATE}" \
      org.opencontainers.image.revision="${VCS_REF}" \
      org.opencontainers.image.source="https://github.com/KingPin/php-docker" \
      org.opencontainers.image.licenses="MIT" \
      com.sumguy.php-docker.php.version="${PHPVERSION}" \
      com.sumguy.php-docker.os.base="${BASEOS}" \
      com.sumguy.php-docker.s6_overlay_version="${S6_OVERLAY_VERSION}"

# Install build dependencies, PHP extensions, runtime libraries, and s6-overlay
# Then clean up build-only packages in a single layer to minimize image size
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=apt-$BASEOS \
    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked,id=aptlists-$BASEOS \
    if [ "$BASEOS" = "trixie" ] || [ "$BASEOS" = "bookworm" ]; then \
        apt-get update && \
        apt-get -y upgrade && \
        # Install build tools, dev packages, and runtime libraries together
        apt-get install -y --no-install-recommends \
            build-essential \
            curl git zip unzip wget ca-certificates xz-utils \
            ghostscript imagemagick optipng gifsicle pngcrush jpegoptim \
            libjpeg-turbo-progs pngquant webp && \
        # Install dev + runtime packages for extensions (Trixie uses t64 variants)
        if [ "$BASEOS" = "trixie" ]; then \
            apt-get install -y --no-install-recommends \
                libmemcached-dev libmemcachedutil2t64 libmemcached11t64 \
                libmagickwand-dev libmagickcore-7.q16-10 libmagickwand-7.q16-10 \
                libvips-dev libvips42t64 \
                libpng-dev libpng16-16t64 \
                libavif-dev libavif16 \
                libsnmp-dev libsnmp40t64 \
                librabbitmq-dev librabbitmq4 \
                libpq-dev libpq5 \
                libssl-dev libssl3t64 \
                libzip-dev libzip5 \
                libbz2-dev \
                libicu-dev libicu76 \
                libldap2-dev libldap2 \
                libtidy-dev libtidy58 \
                libxslt1-dev libxslt1.1 \
                libyaml-dev libyaml-0-2 \
                uuid-dev libuuid1 \
                libzstd-dev \
                libsnappy1v5 \
                libwebp7 \
                libxpm4 \
                libxpm-dev \
                equivs && \
            echo 'Package: libmemcachedutil2' > /tmp/libmemcachedutil2.control && \
            echo 'Version: 999.0' >> /tmp/libmemcachedutil2.control && \
            echo 'Architecture: all' >> /tmp/libmemcachedutil2.control && \
            echo 'Maintainer: nobody' >> /tmp/libmemcachedutil2.control && \
            echo 'Description: Dummy package for t64 transition' >> /tmp/libmemcachedutil2.control && \
            echo 'Provides: libmemcachedutil2' >> /tmp/libmemcachedutil2.control && \
            equivs-build /tmp/libmemcachedutil2.control && \
            dpkg -i libmemcachedutil2_999.0_all.deb && \
            rm /tmp/libmemcachedutil2.control libmemcachedutil2_999.0_all.deb && \
            echo 'Package: libssl3' > /tmp/libssl3.control && \
            echo 'Version: 999.0' >> /tmp/libssl3.control && \
            echo 'Architecture: all' >> /tmp/libssl3.control && \
            echo 'Maintainer: nobody' >> /tmp/libssl3.control && \
            echo 'Description: Dummy package for t64 transition - provides libssl3' >> /tmp/libssl3.control && \
            echo 'Depends: libssl3t64' >> /tmp/libssl3.control && \
            echo 'Provides: libssl3' >> /tmp/libssl3.control && \
            equivs-build /tmp/libssl3.control && \
            dpkg -i libssl3_999.0_all.deb && \
            rm /tmp/libssl3.control libssl3_999.0_all.deb; \
        else \
            apt-get install -y --no-install-recommends \
                libmemcached-dev libmemcachedutil2 libmemcached11 \
                libmagickwand-dev libmagickcore-6.q16-6 libmagickwand-6.q16-6 \
                libvips-dev libvips42 \
                libpng-dev libpng16-16 \
                libavif-dev libavif15 \
                libsnmp-dev libsnmp40 \
                librabbitmq-dev librabbitmq4 \
                libpq-dev libpq5 \
                libssl-dev libssl3 \
                libzip-dev libzip4 \
                libbz2-dev \
                libicu-dev \
                libldap2-dev libldap-2.5-0 \
                libtidy-dev libtidy5deb1 \
                libxslt1-dev libxslt1.1 \
                libyaml-dev libyaml-0-2 \
                uuid-dev libuuid1 \
                libzstd-dev \
                libxpm-dev; \
        fi; \
    elif [ "$BASEOS" = "alpine" ]; then \
        apk update && \
        apk add --no-cache \
            build-base \
            curl git zip unzip wget ca-certificates xz \
            ghostscript imagemagick optipng gifsicle pngcrush jpegoptim \
            libjpeg-turbo libjpeg-turbo-utils pngquant libwebp-tools \
            rabbitmq-c rabbitmq-c-dev \
            libpng libpng-dev \
            imagemagick-dev \
            c-client \
            snappy snappy-dev \
            libpq postgresql-dev \
            net-snmp-libs net-snmp-dev \
            tidyhtml-libs tidyhtml-dev \
            vips vips-dev \
            libxslt libxslt-dev \
            yaml yaml-dev \
            libzip libzip-dev \
            libmemcached libmemcached-dev \
            libavif libavif-dev \
            icu-libs icu-dev \
            openldap openldap-dev \
            libuuid util-linux-dev \
            libxpm libxpm-dev; \
    fi && \
    # Download PHP extension installer with retry
    retry 3 curl -sSLf -o /usr/local/bin/install-php-extensions \
        https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions && \
    chmod +x /usr/local/bin/install-php-extensions && \
    # Install PHP extensions
    install-php-extensions \
        json mysqli pdo_mysql pdo_pgsql pgsql soap sockets \
        opcache redis memcached zstd \
        zip bz2 \
        amqp bcmath calendar ctype exif intl imagick imap ldap mbstring mcrypt \
        mongodb snmp tidy timezonedb uuid vips xsl yaml \
        @composer && \
    # Enable Apache modules if applicable
    if command -v a2enmod; then a2enmod rewrite headers; fi && \
    # Install GD with architecture-specific configuration
    case $(uname -m) in \
        x86_64|aarch64) install-php-extensions gd ;; \
        armv7l) IPE_GD_WITHOUTAVIF=1 install-php-extensions gd ;; \
        *) install-php-extensions gd ;; \
    esac && \
    # Install S6 Overlay - map Docker platform to s6 architecture
    case "${TARGETARCH}" in \
        amd64) S6_ARCH="x86_64" ;; \
        arm64) S6_ARCH="aarch64" ;; \
        arm|armv7) S6_ARCH="armhf" ;; \
        *) S6_ARCH="x86_64" ;; \
    esac && \
    echo "Downloading s6-overlay ${S6_OVERLAY_VERSION} for ${S6_ARCH}" && \
    retry 3 wget -O /tmp/s6-overlay-noarch.tar.xz \
        https://github.com/just-containers/s6-overlay/releases/download/${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz && \
    retry 3 wget -O /tmp/s6-overlay-${S6_ARCH}.tar.xz \
        https://github.com/just-containers/s6-overlay/releases/download/${S6_OVERLAY_VERSION}/s6-overlay-${S6_ARCH}.tar.xz && \
    tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz && \
    tar -C / -Jxpf /tmp/s6-overlay-${S6_ARCH}.tar.xz && \
    rm /tmp/s6-overlay-noarch.tar.xz /tmp/s6-overlay-${S6_ARCH}.tar.xz && \
    # Clean up build dependencies to reduce image size
    if [ "$BASEOS" = "trixie" ]; then \
        apt-mark manual \
            curl git zip unzip wget ca-certificates xz-utils \
            ghostscript imagemagick optipng gifsicle pngcrush jpegoptim \
            libjpeg-turbo-progs pngquant webp \
            libmemcachedutil2t64 libmemcached11t64 \
            libmagickcore-7.q16-10 libmagickwand-7.q16-10 \
            libvips42t64 libpng16-16t64 libavif16 \
            libsnmp40t64 librabbitmq4 libpq5 \
            libssl3t64 libzip5 libicu76 \
            libldap2 libtidy58 libxslt1.1 \
            libyaml-0-2 libuuid1 libsnappy1v5 \
            libwebp7 libxpm4 && \
        apt-get purge -y --auto-remove \
            build-essential equivs \
            libmemcached-dev libmagickwand-dev libvips-dev \
            libpng-dev libavif-dev libsnmp-dev \
            librabbitmq-dev libpq-dev libssl-dev \
            libzip-dev libbz2-dev libicu-dev \
            libldap2-dev libtidy-dev libxslt1-dev \
            libyaml-dev uuid-dev libzstd-dev libxpm-dev && \
        rm -rf /var/lib/apt/lists/*; \
    elif [ "$BASEOS" = "bookworm" ]; then \
        apt-mark manual \
            curl git zip unzip wget ca-certificates xz-utils \
            ghostscript imagemagick optipng gifsicle pngcrush jpegoptim \
            libjpeg-turbo-progs pngquant webp \
            libmemcachedutil2 libmemcached11 \
            libmagickcore-6.q16-6 libmagickwand-6.q16-6 \
            libvips42 libpng16-16 libavif15 \
            libsnmp40 librabbitmq4 libpq5 \
            libssl3 libzip4 \
            libldap-2.5-0 libtidy5deb1 libxslt1.1 \
            libyaml-0-2 libuuid1 libxpm4 && \
        apt-get purge -y --auto-remove \
            build-essential \
            libmemcached-dev libmagickwand-dev libvips-dev \
            libpng-dev libavif-dev libsnmp-dev \
            librabbitmq-dev libpq-dev libssl-dev \
            libzip-dev libbz2-dev libicu-dev \
            libldap2-dev libtidy-dev libxslt1-dev \
            libyaml-dev uuid-dev libzstd-dev libxpm-dev && \
        rm -rf /var/lib/apt/lists/*; \
    elif [ "$BASEOS" = "alpine" ]; then \
        apk del \
            build-base \
            rabbitmq-c-dev libpng-dev imagemagick-dev \
            snappy-dev postgresql-dev net-snmp-dev \
            tidyhtml-dev vips-dev libxslt-dev \
            yaml-dev libzip-dev libmemcached-dev \
            libavif-dev icu-dev openldap-dev \
            util-linux-dev libxpm-dev; \
    fi && \
    test -f /init || (echo "ERROR: /init not found after s6-overlay installation" && exit 1)

# Set useful PHP environment variables with defaults
ENV PHP_MEMORY_LIMIT=256M \
    PHP_UPLOAD_MAX_FILESIZE=64M \
    PHP_POST_MAX_SIZE=64M \
    PHP_MAX_EXECUTION_TIME=300 \
    PHP_MAX_INPUT_VARS=1000 \
    PHP_ERROR_REPORTING=E_ALL \
    PHP_DISPLAY_ERRORS=Off \
    PHP_LOG_ERRORS=On \
    PHP_OPCACHE_MEMORY_CONSUMPTION=128 \
    PHP_OPCACHE_INTERNED_STRINGS_BUFFER=16 \
    PHP_OPCACHE_MAX_ACCELERATED_FILES=10000 \
    PHP_OPCACHE_REVALIDATE_FREQ=0 \
    PHP_SESSION_GC_MAXLIFETIME=1440 \
    PHP_MAX_FILE_UPLOADS=20 \
    PHP_DATE_TIMEZONE=UTC \
    S6_BEHAVIOUR_IF_STAGE2_FAILS=2

# Create non-root user, directories, and set permissions in a single layer
RUN if [ "$BASEOS" != "alpine" ]; then \
      groupadd --gid 1000 appuser && \
      useradd --uid 1000 --gid 1000 -m appuser; \
    else \
      addgroup -g 1000 -S appuser && \
      adduser -u 1000 -S appuser -G appuser; \
    fi && \
    # Create all required directories
    mkdir -p /var/www/html \
             /usr/local/etc/php/conf.d \
             /etc/cont-init.d \
             /etc/services.d/php \
             /var/run/s6 && \
    # Set ownership and permissions
    chown -R appuser:appuser /var/www/html && \
    chmod -R 755 /var/www/html \
                 /usr/local/etc/php/conf.d \
                 /var/run/s6

WORKDIR /var/www/html

# Copy S6 configuration files
COPY s6-overlay/cont-init.d/ /etc/cont-init.d/
COPY s6-overlay/services.d/ /etc/services.d/

# Set permissions for S6 scripts and convert line endings
RUN chmod -R 755 /etc/cont-init.d /etc/services.d && \
    find /etc/cont-init.d /etc/services.d -type f -exec sed -i 's/\r$//' {} +

ENTRYPOINT ["/init"]
CMD []