frankenphp.Dockerfile

# syntax=docker/dockerfile:1
ARG PHP_VERSION="8.5"
ARG PIE_VERSION="1.4.5"
ARG FRANKENPHP_VERSION="1.12"
ARG COMPOSER_VERSION="2"
FROM ghcr.io/php/pie:${PIE_VERSION}-bin AS pie
FROM composer:${COMPOSER_VERSION} AS composer-bin
FROM dunglas/frankenphp:${FRANKENPHP_VERSION}-php${PHP_VERSION} AS upstream
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked <<EOF
    set -eux

    export DEBIAN_FRONTEND=noninteractive
    apt-get update
    # NOTE: soname-versioned packages (libmemcached11t64, libicu76, libzip5)
    # are tied to the Debian release of the upstream image and must be bumped
    # when it rebases onto a new Debian version.
    apt-get install \
        --yes \
        --no-install-recommends \
      postgresql-client \
      libmemcached11t64 \
      ca-certificates \
      libyaml-0-2 \
      libicu76 \
      libzip5 \
      gettext \
      openssl \
      libuv1 \
      zlib1g \
      unzip \
      curl \
      file \
    ;
EOF

FROM upstream AS builder
ARG UV_VERSION="0.3.0"
ARG EXCIMER_VERSION="1.2.6"

RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    --mount=type=bind,from=pie,source=/pie,target=/usr/bin/pie \
    <<EOF
    set -eux

    # region Install Dependencies
    export DEBIAN_FRONTEND=noninteractive
    apt-get update
    apt-get install \
        --yes \
        --no-install-recommends \
      ${PHPIZE_DEPS} \
      libmemcached-dev \
      libsqlite3-dev \
      libyaml-dev \
      libicu-dev \
      libzip-dev \
      zlib1g-dev \
      libuv1-dev \
      libpq-dev \
      libtool \
      git \
    ;
    # endregion

    docker-php-source extract
    export num_cpu=$(nproc)

    # region Install PIE extensions
    pie install -j${num_cpu} phpredis/phpredis \
      --enable-redis \
    ;
    pie install -j${num_cpu} apcu/apcu \
      --enable-apcu \
    ;
    pie install -j${num_cpu} pecl/yaml
    pie install -j${num_cpu} php-memcached/php-memcached \
      --enable-memcached-session \
      --enable-memcached-json \
    ;
    #pie install -j${num_cpu} csvtoolkit/fastcsv \
    #  --enable-fastcsv \
    #;
    # endregion

    # region Install built-in extensions
    docker-php-ext-configure zip
    docker-php-ext-install -j${num_cpu} \
      pdo_sqlite \
      pdo_pgsql \
      sockets \
      bcmath \
      pcntl \
      intl \
      zip \
    ;

    # If we're running on PHP 8.4, install the opcache extension (it's bundled in later versions)
    if php --version | grep -q "PHP 8\.4"; then
      docker-php-ext-install -j${num_cpu} opcache
    fi

    # endregion

    # region Install uv extension
    pecl config-set preferred_state beta
    pecl install "uv-${UV_VERSION}"
    pecl config-set preferred_state stable
    # endregion

    # region Install PECL extensions
    pecl install "excimer-${EXCIMER_VERSION}"
    pecl clear-cache || true
    docker-php-ext-enable \
      excimer \
      uv \
    ;
    # endregion

    # NOTE: Swoole is intentionally not built for this variant: FrankenPHP is
    # the application server here, so the CLI variants are the ones that ship
    # Swoole.
EOF

FROM upstream AS base
ARG user="php"
ARG uid="900"

RUN <<EOF
    set -eux

    # region Add a non-root user to run the application
    addgroup \
        --gid "${uid}" \
      "${user}"
    adduser \
        --home "/home/${user}" \
        --disabled-password \
        --disabled-login \
        --uid "${uid}" \
        --gid ${uid} \
        --system \
      "${user}"
    # endregion

    # Add additional capability to bind to port 80 and 443
    setcap CAP_NET_BIND_SERVICE=+eip /usr/local/bin/frankenphp

    # Create the application folder
    mkdir -p /app

    # Give write access to /data (Caddy state, Mercure Bolt DB), /config,
    # and /app
    chown -R "${uid}:${uid}" \
        /config \
        /data \
        /app
EOF

COPY --link --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/
COPY --link --from=builder /usr/local/etc/php/conf.d/ /usr/local/etc/php/conf.d/

# Copy custom PHP settings
COPY --link ./php.ini "${PHP_INI_DIR}/conf.d/99-docker.ini"
COPY --link ./Caddyfile /etc/caddy/Caddyfile

FROM base AS dev
ARG user="php"
ARG uid="900"
ENV COMPOSER_ALLOW_SUPERUSER="1"
ENV PHP_OPCACHE_VALIDATE_TIMESTAMPS="1"
ENV XDG_DATA_HOME="/data"
ENV XDG_CONFIG_HOME="/config"
ENV GODEBUG="cgocheck=0"

# Enables PHPStorm to apply the correct path mapping on Xdebug breakpoints
ENV PHP_IDE_CONFIG="serverName=Docker"

RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    --mount=type=bind,from=pie,source=/pie,target=/usr/bin/pie \
    --mount=type=bind,from=upstream,source=/usr/local/bin,target=/usr/local/bin \
    <<EOF
    set -eux
    ln -sf "${PHP_INI_DIR}/php.ini-development" "${PHP_INI_DIR}/php.ini"

    # region Install XDebug
    # libtool is required by PIE to build extensions
    # git is required by Composer to install dependencies from VCS sources
    export DEBIAN_FRONTEND=noninteractive
    apt-get update
    apt-get install \
        --yes \
        --no-install-recommends \
      libtool \
      git \
    ;

    # TODO: Switch to stable when available
    if php --version | grep -q "PHP 8\.5"; then
      pie install xdebug/xdebug:@alpha
    else
      pie install xdebug/xdebug
    fi
    rm -rf /tmp/*
    # endregion

    # region Configure XDebug
    # See https://docs.docker.com/desktop/networking/#i-want-to-connect-from-a-container-to-a-service-on-the-host
    # See https://github.com/docker/for-linux/issues/264
    # The `client_host` below may optionally be replaced with `discover_client_host=yes`
    # Add `start_with_request=yes` to start debug session on each request
    echo "xdebug.client_host = host.docker.internal" >> "${PHP_INI_DIR}/conf.d/docker-php-ext-xdebug.ini";
    echo "xdebug.mode = off" >> "${PHP_INI_DIR}/conf.d/docker-php-ext-xdebug.ini";
    # endregion
EOF

COPY --link --from=composer-bin /usr/bin/composer /usr/bin/composer

WORKDIR "/app"

ONBUILD ARG user="php"
ONBUILD ARG uid="900"
USER "${uid}:${uid}"

ENTRYPOINT ["docker-php-entrypoint"]
CMD ["--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
HEALTHCHECK NONE

EXPOSE 80/tcp

FROM base AS prod-pre
RUN <<EOF
    set -eux

    # region Remove Build Dependencies
    export DEBIAN_FRONTEND=noninteractive
    apt-get remove \
        --yes \
        --purge \
      ${PHPIZE_DEPS} \
    ;
    apt-get purge \
        --option APT::AutoRemove::RecommendsImportant=false \
        --auto-remove \
        --yes \
    ;
    apt-get autoremove --yes

    rm -rf \
      /usr/local/bin/phpdbg \
      /usr/local/bin/php-cgi \
      /usr/local/bin/php-config \
      /usr/local/bin/install-php-extensions \
      /usr/local/bin/docker-php-source \
      /usr/local/bin/docker-php-ext-* \
      /usr/local/bin/phpize \
      /usr/local/bin/pear* \
      /usr/local/bin/phar* \
      /usr/local/bin/pecl \
      /usr/local/php/man \
      /usr/local/etc/pear.conf \
      /usr/local/lib/php/PEAR \
	  /usr/local/lib/php/.registry \
      /usr/src/* \
      /var/cache/* \
      /var/log/* \
      /tmp/* \
    ;
    # endregion

    # Activate the production PHP configuration. This must happen in this
    # stage rather than in the scratch stage below: scratch stages do not
    # inherit environment variables, so PHP_INI_DIR would expand to an empty
    # string there, leaving a broken symlink at / and no loaded php.ini.
    ln -sf "${PHP_INI_DIR}/php.ini-production" "${PHP_INI_DIR}/php.ini"
EOF

FROM scratch AS prod
ARG user="php"
ARG uid="900"
ENV PHP_OPCACHE_VALIDATE_TIMESTAMPS="0"
ENV PHP_OPCACHE_MAX_ACCELERATED_FILES="10000"
ENV PHP_OPCACHE_MEMORY_CONSUMPTION="192"
ENV PHP_OPCACHE_MAX_WASTED_PERCENTAGE="10"
ENV XDG_DATA_HOME="/data"
ENV XDG_CONFIG_HOME="/config"
ENV GODEBUG="cgocheck=0"

COPY --link --from=prod-pre / /

WORKDIR "/app"

ONBUILD ARG user="php"
ONBUILD ARG uid="900"
USER "${uid}:${uid}"

ENTRYPOINT ["docker-php-entrypoint"]
CMD ["--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
    CMD [ "curl", "-ISsfo", "/dev/null", "http://localhost:2019/metrics" ]

EXPOSE 80/tcp
EXPOSE 443/tcp
EXPOSE 443/udp