diff --git a/.github/actions/build-image/action.yml b/.github/actions/build-image/action.yml
new file mode 100644
index 0000000..8bac9e2
--- /dev/null
+++ b/.github/actions/build-image/action.yml
@@ -0,0 +1,94 @@
+name: Build image
+description: >
+ Builds one image for the runner's architecture and tests it. The image is pushed either to the
+ job's local registry, or by digest to ghcr, recording the digest for the publish workflow.
+
+inputs:
+ image:
+ description: Image name without registry, e.g. php-dev.
+ required: true
+ tag:
+ description: Image tag, e.g. 7.4-apache.
+ required: true
+ arch:
+ description: Runner architecture (amd64 or arm64).
+ required: true
+ context:
+ description: Build context.
+ required: true
+ file:
+ description: Dockerfile path, relative to the repository root.
+ default: ''
+ build-args:
+ description: Build arguments.
+ default: ''
+ build-contexts:
+ description: Additional named build contexts.
+ default: ''
+ push:
+ description: Where to push the image, "local" or "ghcr".
+ default: local
+ cache-write:
+ description: Export the build cache to ghcr.
+ default: 'false'
+ no-cache:
+ description: Ignore the build cache.
+ default: 'false'
+ test:
+ description: Make directory whose "test" target checks the image; empty to skip testing.
+ default: ''
+
+outputs:
+ ref:
+ description: Reference to the built image, usable as BASE_IMAGE.
+ value: ${{ steps.ref.outputs.ref }}
+
+runs:
+ using: composite
+ steps:
+ - name: Build ${{ inputs.image }}
+ id: build
+ uses: docker/build-push-action@v5
+ with:
+ context: ${{ inputs.context }}
+ file: ${{ inputs.file }}
+ build-args: ${{ inputs.build-args }}
+ build-contexts: ${{ inputs.build-contexts }}
+ no-cache: ${{ inputs.no-cache == 'true' }}
+ cache-from: type=registry,ref=ghcr.io/chialab/${{ inputs.image }}:cache-${{ inputs.tag }}-${{ inputs.arch }}
+ cache-to: ${{ inputs.cache-write == 'true' && format('type=registry,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true,ref=ghcr.io/chialab/{0}:cache-{1}-{2}', inputs.image, inputs.tag, inputs.arch) || '' }}
+ tags: ${{ inputs.push == 'local' && format('localhost:5000/chialab/{0}:{1}', inputs.image, inputs.tag) || '' }}
+ push: ${{ inputs.push == 'local' }}
+ outputs: ${{ inputs.push == 'ghcr' && format('type=image,name=ghcr.io/chialab/{0},push-by-digest=true,name-canonical=true,push=true', inputs.image) || '' }}
+
+ - name: Resolve ${{ inputs.image }} reference
+ id: ref
+ shell: bash
+ env:
+ IMAGE: ${{ inputs.image }}
+ TAG: ${{ inputs.tag }}
+ DIGEST: ${{ steps.build.outputs.digest }}
+ PUSH: ${{ inputs.push }}
+ run: |
+ if [[ "$PUSH" == 'ghcr' ]]; then
+ echo "ref=ghcr.io/chialab/$IMAGE@$DIGEST" >> "$GITHUB_OUTPUT"
+ mkdir -p "$RUNNER_TEMP/digests/$IMAGE"
+ touch "$RUNNER_TEMP/digests/$IMAGE/${DIGEST#sha256:}"
+ else
+ echo "ref=localhost:5000/chialab/$IMAGE:$TAG" >> "$GITHUB_OUTPUT"
+ fi
+
+ - name: Test ${{ inputs.image }}
+ if: ${{ inputs.test != '' }}
+ shell: bash
+ env:
+ REGISTRY: localhost:5000/
+ VERSION: ${{ inputs.tag }}
+ IMAGE: ${{ inputs.image }}
+ REF: ${{ steps.ref.outputs.ref }}
+ MAKE_DIR: ${{ inputs.test }}
+ run: |
+ docker pull "$REF"
+ # the Makefile looks the image up by tag
+ docker tag "$REF" "localhost:5000/chialab/$IMAGE:$VERSION"
+ make -C "$MAKE_DIR" test
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index c4cabe8..c41fdb1 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,6 +6,8 @@ updates:
# Maintain dependencies for GitHub Actions
- package-ecosystem: "github-actions"
- directory: "/"
+ directories:
+ - "/"
+ - "/.github/actions/build-image"
schedule:
interval: "daily"
diff --git a/.github/workflows/build-images.yml b/.github/workflows/build-images.yml
new file mode 100644
index 0000000..4a9ba02
--- /dev/null
+++ b/.github/workflows/build-images.yml
@@ -0,0 +1,195 @@
+name: Build and test images
+
+# Builds and tests each version × flavor natively on amd64 and arm64. Pull requests push to a local
+# registry; runs on main push by digest to ghcr and upload the digests for publish-images.yml.
+
+on:
+ workflow_call:
+ inputs:
+ versions:
+ description: JSON list of PHP versions.
+ type: string
+ required: true
+ flavors:
+ description: JSON list of flavors.
+ type: string
+ default: '[""]'
+ exclude:
+ description: JSON list of version/flavor combinations to skip.
+ type: string
+ default: '[]'
+ secrets:
+ pull-username:
+ required: true
+ pull-password:
+ required: true
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.ref }}
+ cancel-in-progress: true
+
+jobs:
+ build:
+ name: ${{ matrix.version }}${{ matrix.flavor }} (${{ matrix.arch }})
+ runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
+ strategy:
+ fail-fast: false
+ matrix:
+ version: ${{ fromJSON(inputs.versions) }}
+ flavor: ${{ fromJSON(inputs.flavors) }}
+ arch: [ 'amd64', 'arm64' ]
+ exclude: ${{ fromJSON(inputs.exclude) }}
+ services:
+ registry:
+ image: ${{ github.event_name == 'pull_request' && 'registry:2' || '' }}
+ ports:
+ - 5000:5000
+ env:
+ PUSH: ${{ github.event_name == 'pull_request' && 'local' || 'ghcr' }}
+ CACHE_WRITE: ${{ github.event_name != 'pull_request' }}
+ # Scheduled runs rebuild the extension layers, so they pick up new extension and OS package
+ # versions; the patched PHP base is only rebuilt when its inputs change.
+ NO_CACHE: ${{ github.event_name == 'schedule' }}
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4
+
+ - name: Plan
+ id: plan
+ env:
+ VERSION: ${{ matrix.version }}
+ FLAVOR: ${{ matrix.flavor }}
+ ARCH: ${{ matrix.arch }}
+ run: |
+ tag="$VERSION$FLAVOR"
+ flavorDir="${FLAVOR#-}"
+ eolDir="eol/$VERSION/${flavorDir:-cli}"
+ [[ -d "$eolDir" ]] && eol=true || eol=false
+ [[ "$tag" == *alpine* ]] && dockerfile=Dockerfile.alpine || dockerfile=Dockerfile
+ [[ "$VERSION" == '5.6' && "$ARCH" == 'arm64' ]] && dev=false || dev=true
+ [[ "$VERSION" == '5.6' || "$VERSION" == '7.0' ]] && pcov=false || pcov=true
+ [[ "$ARCH" == 'amd64' ]] && xhprof=true || xhprof=false
+ [[ "$VERSION" == 8.* || "$VERSION" == 'latest' || "$VERSION" == 'alpine' ]] && otel=true || otel=false
+ {
+ echo "tag=$tag"
+ echo "eol=$eol"
+ echo "eol-dir=$eolDir"
+ echo "dockerfile=$dockerfile"
+ echo "dev=$dev"
+ echo "pcov=$pcov"
+ echo "xhprof=$xhprof"
+ echo "otel=$otel"
+ } >> "$GITHUB_OUTPUT"
+
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v3
+ with:
+ driver-opts: network=host
+
+ - name: Login to DockerHub
+ uses: docker/login-action@v3
+ with:
+ username: ${{ secrets.pull-username }}
+ password: ${{ secrets.pull-password }}
+
+ - name: Login to GitHub Container Registry
+ uses: docker/login-action@v3
+ with:
+ registry: ghcr.io
+ username: ${{ github.repository_owner }}
+ password: ${{ secrets.GITHUB_TOKEN }}
+
+ - name: Build patched PHP base image
+ id: base
+ if: ${{ steps.plan.outputs.eol == 'true' }}
+ uses: ./.github/actions/build-image
+ with:
+ image: php-base
+ tag: ${{ steps.plan.outputs.tag }}
+ arch: ${{ matrix.arch }}
+ context: ${{ steps.plan.outputs.eol-dir }}
+ build-contexts: |
+ patches=eol/patches
+ scripts=eol/scripts
+ push: ${{ env.PUSH }}
+ cache-write: ${{ env.CACHE_WRITE }}
+
+ - name: Build PHP image
+ id: php
+ uses: ./.github/actions/build-image
+ with:
+ image: php
+ tag: ${{ steps.plan.outputs.tag }}
+ arch: ${{ matrix.arch }}
+ context: .
+ file: ${{ steps.plan.outputs.dockerfile }}
+ build-args: BASE_IMAGE=${{ steps.plan.outputs.eol == 'true' && steps.base.outputs.ref || format('php:{0}', steps.plan.outputs.tag) }}
+ push: ${{ env.PUSH }}
+ cache-write: ${{ env.CACHE_WRITE }}
+ no-cache: ${{ env.NO_CACHE }}
+ test: .
+
+ - name: Build dev image
+ if: ${{ steps.plan.outputs.dev == 'true' }}
+ uses: ./.github/actions/build-image
+ with:
+ image: php-dev
+ tag: ${{ steps.plan.outputs.tag }}
+ arch: ${{ matrix.arch }}
+ context: ./dev
+ build-args: BASE_IMAGE=${{ steps.php.outputs.ref }}
+ push: ${{ env.PUSH }}
+ cache-write: ${{ env.CACHE_WRITE }}
+ no-cache: ${{ env.NO_CACHE }}
+ test: dev
+
+ - name: Build PCOV image
+ if: ${{ steps.plan.outputs.pcov == 'true' }}
+ uses: ./.github/actions/build-image
+ with:
+ image: php-pcov
+ tag: ${{ steps.plan.outputs.tag }}
+ arch: ${{ matrix.arch }}
+ context: ./pcov
+ build-args: BASE_IMAGE=${{ steps.php.outputs.ref }}
+ push: ${{ env.PUSH }}
+ cache-write: ${{ env.CACHE_WRITE }}
+ no-cache: ${{ env.NO_CACHE }}
+ test: pcov
+
+ - name: Build xhprof image
+ if: ${{ steps.plan.outputs.xhprof == 'true' }}
+ uses: ./.github/actions/build-image
+ with:
+ image: php-xhprof
+ tag: ${{ steps.plan.outputs.tag }}
+ arch: ${{ matrix.arch }}
+ context: ./xhprof
+ build-args: BASE_IMAGE=${{ steps.php.outputs.ref }}
+ push: ${{ env.PUSH }}
+ cache-write: ${{ env.CACHE_WRITE }}
+ no-cache: ${{ env.NO_CACHE }}
+ test: xhprof
+
+ - name: Build OTel image
+ if: ${{ steps.plan.outputs.otel == 'true' }}
+ uses: ./.github/actions/build-image
+ with:
+ image: php-otel
+ tag: ${{ steps.plan.outputs.tag }}
+ arch: ${{ matrix.arch }}
+ context: ./otel
+ build-args: BASE_IMAGE=${{ steps.php.outputs.ref }}
+ push: ${{ env.PUSH }}
+ cache-write: ${{ env.CACHE_WRITE }}
+ no-cache: ${{ env.NO_CACHE }}
+ test: otel
+
+ - name: Upload digests
+ if: ${{ env.PUSH == 'ghcr' }}
+ uses: actions/upload-artifact@v4
+ with:
+ name: digests-${{ steps.plan.outputs.tag }}-${{ matrix.arch }}
+ path: ${{ runner.temp }}/digests/
+ if-no-files-found: error
+ retention-days: 7
diff --git a/.github/workflows/publish-images.yml b/.github/workflows/publish-images.yml
new file mode 100644
index 0000000..f727624
--- /dev/null
+++ b/.github/workflows/publish-images.yml
@@ -0,0 +1,92 @@
+name: Publish images
+
+# Publishes the images built and tested by the triggering build-images.yml run: merges each
+# image's per-arch digests into a multi-arch tag on ghcr, then copies it to Docker Hub. Nothing is
+# rebuilt, and nothing is read from Docker Hub, so publishing doesn't count against its pull limits.
+# Callers must skip runs whose commit is no longer the head of main (github.sha), so an older
+# commit whose tests finished late can't overwrite the tags of a newer one.
+
+on:
+ workflow_call:
+ inputs:
+ versions:
+ description: JSON list of PHP versions.
+ type: string
+ required: true
+ flavors:
+ description: JSON list of flavors.
+ type: string
+ default: '[""]'
+ exclude:
+ description: JSON list of version/flavor combinations to skip.
+ type: string
+ default: '[]'
+ secrets:
+ push-username:
+ required: true
+ push-password:
+ required: true
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.ref }}
+ cancel-in-progress: true
+
+jobs:
+ publish:
+ name: ${{ matrix.version }}${{ matrix.flavor }}
+ runs-on: ubuntu-24.04
+ strategy:
+ fail-fast: false
+ matrix:
+ version: ${{ fromJSON(inputs.versions) }}
+ flavor: ${{ fromJSON(inputs.flavors) }}
+ exclude: ${{ fromJSON(inputs.exclude) }}
+ steps:
+ - name: Download digests
+ uses: actions/download-artifact@v4
+ with:
+ pattern: digests-${{ matrix.version }}${{ matrix.flavor }}-{amd64,arm64}
+ path: ${{ runner.temp }}/digests
+ run-id: ${{ github.event.workflow_run.id }}
+ github-token: ${{ secrets.GITHUB_TOKEN }}
+
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v3
+
+ - name: Login to GitHub Container Registry
+ uses: docker/login-action@v3
+ with:
+ registry: ghcr.io
+ username: ${{ github.repository_owner }}
+ password: ${{ secrets.GITHUB_TOKEN }}
+
+ - name: Create multi-arch tags
+ env:
+ TAG: ${{ matrix.version }}${{ matrix.flavor }}
+ GHCR_USERNAME: ${{ github.repository_owner }}
+ GHCR_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
+ DOCKERHUB_USERNAME: ${{ secrets.push-username }}
+ DOCKERHUB_PASSWORD: ${{ secrets.push-password }}
+ run: |
+ shopt -s nullglob
+ cd "$RUNNER_TEMP/digests"
+ for arch in amd64 arm64; do
+ if [[ ! -d "digests-$TAG-$arch" ]]; then
+ echo "Missing the $arch build of $TAG" >&2
+ exit 1
+ fi
+ done
+ for image in $(find . -mindepth 2 -maxdepth 2 -type d -printf '%f\n' | sort -u); do
+ sources=()
+ for digest in digests-*/"$image"/*; do
+ sources+=("ghcr.io/chialab/$image@sha256:$(basename "$digest")")
+ done
+ docker buildx imagetools create -t "ghcr.io/chialab/$image:$TAG" "${sources[@]}"
+ # The patched base image is internal and stays on ghcr.
+ if [[ "$image" != 'php-base' ]]; then
+ skopeo copy --all --preserve-digests \
+ --src-creds "$GHCR_USERNAME:$GHCR_PASSWORD" \
+ --dest-creds "$DOCKERHUB_USERNAME:$DOCKERHUB_PASSWORD" \
+ "docker://ghcr.io/chialab/$image:$TAG" "docker://docker.io/chialab/$image:$TAG"
+ fi
+ done
diff --git a/.github/workflows/publish.5.yml b/.github/workflows/publish.5.yml
index a89608e..52d554d 100644
--- a/.github/workflows/publish.5.yml
+++ b/.github/workflows/publish.5.yml
@@ -8,90 +8,16 @@ on:
jobs:
publish-5:
- name: Build and publish PHP 5 images
- runs-on: ubuntu-22.04
- if: ${{ github.event_name != 'pull_request' && !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
- strategy:
- fail-fast: false
- matrix:
- version: [ '5.6' ]
- flavor: [ '', '-apache', '-fpm', '-alpine', '-fpm-alpine' ]
- exclude:
- - version: '5.6'
- flavor: '-alpine'
- - version: '5.6'
- flavor: '-fpm-alpine'
- steps:
- - name: Checkout
- uses: actions/checkout@v4
-
- - name: Set up QEMU
- uses: docker/setup-qemu-action@v3
-
- - name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v3
- with:
- driver-opts: network=host
-
- - name: Login to DockerHub (pull)
- uses: docker/login-action@v3
- with:
- username: ${{ secrets.DOCKER_PULL_USER_1 }}
- password: ${{ secrets.DOCKER_PULL_PASS_1 }}
-
- - name: Pull base image
- run: docker pull chialab/php:${{ matrix.version }}${{ matrix.flavor }}
-
- - name: Login to DockerHub (push)
- uses: docker/login-action@v3
- with:
- username: ${{ secrets.DOCKER_USERNAME }}
- password: ${{ secrets.DOCKER_PASSWORD }}
-
- - name: Login to GitHub Container Registry
- uses: docker/login-action@v3
- with:
- registry: ghcr.io
- username: ${{ github.repository_owner }}
- password: ${{ secrets.GITHUB_TOKEN }}
-
- - name: Build image and push to registry
- uses: docker/build-push-action@v5
- with:
- platforms: linux/amd64,linux/arm64
-# cache-from: type=registry,ref=ghcr.io/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- cache-to: type=inline
- context: .
- file: ${{ ((contains(matrix.flavor, 'alpine') || matrix.version == 'alpine') && 'Dockerfile.alpine') || 'Dockerfile' }}
- build-args: |
- BASE_IMAGE=php:${{ matrix.version }}${{ matrix.flavor }}
- tags: |
- chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- ghcr.io/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- push: true
-
- - name: Build dev image and push to registry
- uses: docker/build-push-action@v5
- with:
- platforms: linux/amd64
- cache-to: type=inline
- context: ./dev
- build-args: |
- BASE_IMAGE=ghcr.io/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- tags: |
- chialab/php-dev:${{ matrix.version }}${{ matrix.flavor }}
- ghcr.io/chialab/php-dev:${{ matrix.version }}${{ matrix.flavor }}
- push: true
-
- - name: Build xhprof image and push to registry
- uses: docker/build-push-action@v5
- with:
- platforms: linux/amd64
- cache-to: type=inline
- context: ./xhprof
- build-args: |
- BASE_IMAGE=ghcr.io/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- tags: |
- chialab/php-xhprof:${{ matrix.version }}${{ matrix.flavor }}
- ghcr.io/chialab/php-xhprof:${{ matrix.version }}${{ matrix.flavor }}
- push: true
+ name: Publish PHP 5 images
+ if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && github.event.workflow_run.head_sha == github.sha }}
+ permissions:
+ actions: read
+ contents: read
+ packages: write
+ uses: ./.github/workflows/publish-images.yml
+ with:
+ versions: '["5.6"]'
+ flavors: '["", "-apache", "-fpm"]'
+ secrets:
+ push-username: ${{ secrets.DOCKER_USERNAME }}
+ push-password: ${{ secrets.DOCKER_PASSWORD }}
diff --git a/.github/workflows/publish.7.yml b/.github/workflows/publish.7.yml
index 56cbb8b..47634dc 100644
--- a/.github/workflows/publish.7.yml
+++ b/.github/workflows/publish.7.yml
@@ -8,103 +8,17 @@ on:
jobs:
publish-7:
- name: Build and publish PHP 7 images
- runs-on: ubuntu-22.04
- if: ${{ github.event.workflow_run.conclusion == 'success' && !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
- strategy:
- fail-fast: false
- matrix:
- version: [ '7.0', '7.1', '7.2', '7.3', '7.4' ]
- flavor: [ '', '-apache', '-fpm', '-alpine', '-fpm-alpine' ]
- exclude:
- - version: '7.0'
- flavor: '-alpine'
- - version: '7.0'
- flavor: '-fpm-alpine'
- steps:
- - name: Checkout
- uses: actions/checkout@v4
-
- - name: Set up QEMU
- uses: docker/setup-qemu-action@v3
-
- - name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v3
- with:
- driver-opts: network=host
-
- - name: Login to DockerHub (pull)
- uses: docker/login-action@v3
- with:
- username: ${{ secrets.DOCKER_PULL_USER_2 }}
- password: ${{ secrets.DOCKER_PULL_PASS_2 }}
-
- - name: Pull base image
- run: docker pull chialab/php:${{ matrix.version }}${{ matrix.flavor }}
-
- - name: Login to DockerHub (push)
- uses: docker/login-action@v3
- with:
- username: ${{ secrets.DOCKER_USERNAME }}
- password: ${{ secrets.DOCKER_PASSWORD }}
-
- - name: Login to GitHub Container Registry
- uses: docker/login-action@v3
- with:
- registry: ghcr.io
- username: ${{ github.repository_owner }}
- password: ${{ secrets.GITHUB_TOKEN }}
-
- - name: Build image and push to registry
- uses: docker/build-push-action@v5
- with:
- platforms: linux/amd64,linux/arm64
-# cache-from: type=registry,ref=ghcr.io/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- cache-to: type=inline
- context: .
- file: ${{ ((contains(matrix.flavor, 'alpine') || matrix.version == 'alpine') && 'Dockerfile.alpine') || 'Dockerfile' }}
- build-args: |
- BASE_IMAGE=php:${{ matrix.version }}${{ matrix.flavor }}
- tags: |
- chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- ghcr.io/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- push: true
-
- - name: Build dev image and push to registry
- uses: docker/build-push-action@v5
- with:
- platforms: linux/amd64,linux/arm64
- cache-to: type=inline
- context: ./dev
- build-args: |
- BASE_IMAGE=ghcr.io/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- tags: |
- chialab/php-dev:${{ matrix.version }}${{ matrix.flavor }}
- ghcr.io/chialab/php-dev:${{ matrix.version }}${{ matrix.flavor }}
- push: true
-
- - name: Build PCOV image and push to registry
- if: ${{ matrix.version >= 7.1 }}
- uses: docker/build-push-action@v5
- with:
- platforms: linux/amd64,linux/arm64
- cache-to: type=inline
- context: ./pcov
- build-args: |
- BASE_IMAGE=ghcr.io/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- tags: |
- chialab/php-pcov:${{ matrix.version }}${{ matrix.flavor }}
- ghcr.io/chialab/php-pcov:${{ matrix.version }}${{ matrix.flavor }}
- push: true
-
- - name: Build xhprof image (amd64 only) and push to registry
- uses: docker/build-push-action@v5
- with:
- cache-to: type=inline
- context: ./xhprof
- build-args: |
- BASE_IMAGE=ghcr.io/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- tags: |
- chialab/php-xhprof:${{ matrix.version }}${{ matrix.flavor }}
- ghcr.io/chialab/php-xhprof:${{ matrix.version }}${{ matrix.flavor }}
- push: true
+ name: Publish PHP 7 images
+ if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && github.event.workflow_run.head_sha == github.sha }}
+ permissions:
+ actions: read
+ contents: read
+ packages: write
+ uses: ./.github/workflows/publish-images.yml
+ with:
+ versions: '["7.0", "7.1", "7.2", "7.3", "7.4"]'
+ flavors: '["", "-apache", "-fpm", "-alpine", "-fpm-alpine"]'
+ exclude: '[{"version": "7.0", "flavor": "-alpine"}, {"version": "7.0", "flavor": "-fpm-alpine"}]'
+ secrets:
+ push-username: ${{ secrets.DOCKER_USERNAME }}
+ push-password: ${{ secrets.DOCKER_PASSWORD }}
diff --git a/.github/workflows/publish.8.yml b/.github/workflows/publish.8.yml
index ad6ae3f..6ab667e 100644
--- a/.github/workflows/publish.8.yml
+++ b/.github/workflows/publish.8.yml
@@ -8,110 +8,16 @@ on:
jobs:
publish-8:
- name: Build and publish PHP 8 images
- runs-on: ubuntu-latest
- if: ${{ github.event.workflow_run.conclusion == 'success' && !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
- strategy:
- fail-fast: false
- matrix:
- version: [ '8.0', '8.1', '8.2', '8.3', '8.4', '8.5' ]
- flavor: [ '', '-apache', '-fpm', '-alpine', '-fpm-alpine' ]
- steps:
- - name: Checkout
- uses: actions/checkout@v4
-
- - name: Set up QEMU
- uses: docker/setup-qemu-action@v3
-
- - name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v3
- with:
- driver-opts: network=host
-
- - name: Login to DockerHub (pull)
- uses: docker/login-action@v3
- with:
- username: ${{ secrets.DOCKER_PULL_USER_3 }}
- password: ${{ secrets.DOCKER_PULL_PASS_3 }}
-
- - name: Pull base image
- run: docker pull chialab/php:${{ matrix.version }}${{ matrix.flavor }}
-
- - name: Login to DockerHub (push)
- uses: docker/login-action@v3
- with:
- username: ${{ secrets.DOCKER_USERNAME }}
- password: ${{ secrets.DOCKER_PASSWORD }}
-
- - name: Login to GitHub Container Registry
- uses: docker/login-action@v3
- with:
- registry: ghcr.io
- username: ${{ github.repository_owner }}
- password: ${{ secrets.GITHUB_TOKEN }}
-
- - name: Build image and push to registry
- uses: docker/build-push-action@v5
- with:
- platforms: linux/amd64,linux/arm64
-# cache-from: type=registry,ref=ghcr.io/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- cache-to: type=inline
- context: .
- file: ${{ ((contains(matrix.flavor, 'alpine') || matrix.version == 'alpine') && 'Dockerfile.alpine') || 'Dockerfile' }}
- build-args: |
- BASE_IMAGE=php:${{ matrix.version }}${{ matrix.flavor }}
- tags: |
- chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- ghcr.io/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- push: true
-
- - name: Build dev image and push to registry
- uses: docker/build-push-action@v5
- with:
- platforms: linux/amd64,linux/arm64
- cache-to: type=inline
- context: ./dev
- build-args: |
- BASE_IMAGE=ghcr.io/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- tags: |
- chialab/php-dev:${{ matrix.version }}${{ matrix.flavor }}
- ghcr.io/chialab/php-dev:${{ matrix.version }}${{ matrix.flavor }}
- push: true
-
- - name: Build PCOV image and push to registry
- uses: docker/build-push-action@v5
- with:
- platforms: linux/amd64,linux/arm64
- cache-to: type=inline
- context: ./pcov
- build-args: |
- BASE_IMAGE=ghcr.io/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- tags: |
- chialab/php-pcov:${{ matrix.version }}${{ matrix.flavor }}
- ghcr.io/chialab/php-pcov:${{ matrix.version }}${{ matrix.flavor }}
- push: true
-
- - name: Build xhprof image (amd64 only) and push to registry
- uses: docker/build-push-action@v5
- with:
- cache-to: type=inline
- context: ./xhprof
- build-args: |
- BASE_IMAGE=ghcr.io/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- tags: |
- chialab/php-xhprof:${{ matrix.version }}${{ matrix.flavor }}
- ghcr.io/chialab/php-xhprof:${{ matrix.version }}${{ matrix.flavor }}
- push: true
-
- - name: Build OTel image and push to registry
- uses: docker/build-push-action@v5
- with:
- platforms: linux/amd64,linux/arm64
- cache-to: type=inline
- context: ./otel
- build-args: |
- BASE_IMAGE=ghcr.io/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- tags: |
- chialab/php-otel:${{ matrix.version }}${{ matrix.flavor }}
- ghcr.io/chialab/php-otel:${{ matrix.version }}${{ matrix.flavor }}
- push: true
+ name: Publish PHP 8 images
+ if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && github.event.workflow_run.head_sha == github.sha }}
+ permissions:
+ actions: read
+ contents: read
+ packages: write
+ uses: ./.github/workflows/publish-images.yml
+ with:
+ versions: '["8.0", "8.1", "8.2", "8.3", "8.4", "8.5"]'
+ flavors: '["", "-apache", "-fpm", "-alpine", "-fpm-alpine"]'
+ secrets:
+ push-username: ${{ secrets.DOCKER_USERNAME }}
+ push-password: ${{ secrets.DOCKER_PASSWORD }}
diff --git a/.github/workflows/publish.compat.yml b/.github/workflows/publish.compat.yml
index 59bd4f3..d1b4d68 100644
--- a/.github/workflows/publish.compat.yml
+++ b/.github/workflows/publish.compat.yml
@@ -6,11 +6,17 @@ on:
branches: [main]
types: [completed]
+# Every completed test run starts this workflow; runs that won't publish get their own group, so
+# they can't cancel a publish in progress.
+concurrency:
+ group: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && github.event.workflow_run.head_sha == github.sha && github.workflow || github.run_id }}
+ cancel-in-progress: true
+
jobs:
publish-compat:
name: Build and publish compatibility images
runs-on: ubuntu-22.04
- if: ${{ github.event.workflow_run.conclusion == 'success' && !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
+ if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && github.event.workflow_run.head_sha == github.sha }}
strategy:
fail-fast: false
matrix:
@@ -57,6 +63,7 @@ jobs:
# cache-from: type=registry,ref=ghcr.io/chialab/php-compat:${{ matrix.version }}${{ matrix.flavor }}
cache-to: type=inline
context: ./compat
+ build-contexts: patches=eol/patches
file: ${{ format('compat/{0}.{1}{2}', 'Dockerfile', matrix.version, matrix.flavor) }}
tags: |
chialab/php-compat:${{ matrix.version }}${{ matrix.flavor }}
diff --git a/.github/workflows/publish.latest.yml b/.github/workflows/publish.latest.yml
index 3f7fdf4..7a2a66a 100644
--- a/.github/workflows/publish.latest.yml
+++ b/.github/workflows/publish.latest.yml
@@ -7,110 +7,16 @@ on:
types: [completed]
jobs:
- publish-8:
- name: Build and publish PHP 8 images
- runs-on: ubuntu-latest
- if: ${{ github.event.workflow_run.conclusion == 'success' && !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
- strategy:
- fail-fast: false
- matrix:
- version: [ 'latest', 'alpine' ]
- steps:
- - name: Checkout
- uses: actions/checkout@v4
-
- - name: Set up QEMU
- uses: docker/setup-qemu-action@v3
-
- - name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v3
- with:
- driver-opts: network=host
-
- - name: Login to DockerHub (pull)
- uses: docker/login-action@v3
- with:
- username: ${{ secrets.DOCKER_PULL_USER_5 }}
- password: ${{ secrets.DOCKER_PULL_PASS_5 }}
-
- - name: Pull base image
- run: docker pull chialab/php:${{ matrix.version }}
-
- - name: Login to DockerHub (push)
- uses: docker/login-action@v3
- with:
- username: ${{ secrets.DOCKER_USERNAME }}
- password: ${{ secrets.DOCKER_PASSWORD }}
-
- - name: Login to GitHub Container Registry
- uses: docker/login-action@v3
- with:
- registry: ghcr.io
- username: ${{ github.repository_owner }}
- password: ${{ secrets.GITHUB_TOKEN }}
-
- - name: Build image and push to registry
- uses: docker/build-push-action@v5
- with:
- platforms: linux/amd64,linux/arm64
-# cache-from: type=registry,ref=ghcr.io/chialab/php:${{ matrix.version }}
- cache-to: type=inline
- context: .
- file: ${{ ((contains(matrix.flavor, 'alpine') || matrix.version == 'alpine') && 'Dockerfile.alpine') || 'Dockerfile' }}
- build-args: |
- BASE_IMAGE=php:${{ matrix.version }}
- tags: |
- chialab/php:${{ matrix.version }}
- ghcr.io/chialab/php:${{ matrix.version }}
- push: true
-
- - name: Build dev image and push to registry
- uses: docker/build-push-action@v5
- with:
- platforms: linux/amd64,linux/arm64
- cache-to: type=inline
- context: ./dev
- build-args: |
- BASE_IMAGE=ghcr.io/chialab/php:${{ matrix.version }}
- tags: |
- chialab/php-dev:${{ matrix.version }}
- ghcr.io/chialab/php-dev:${{ matrix.version }}
- push: true
-
- - name: Build PCOV image and push to registry
- uses: docker/build-push-action@v5
- with:
- platforms: linux/amd64,linux/arm64
- cache-to: type=inline
- context: ./pcov
- build-args: |
- BASE_IMAGE=ghcr.io/chialab/php:${{ matrix.version }}
- tags: |
- chialab/php-pcov:${{ matrix.version }}
- ghcr.io/chialab/php-pcov:${{ matrix.version }}
- push: true
-
- - name: Build xhprof image (amd64 only) and push to registry
- uses: docker/build-push-action@v5
- with:
- cache-to: type=inline
- context: ./xhprof
- build-args: |
- BASE_IMAGE=ghcr.io/chialab/php:${{ matrix.version }}
- tags: |
- chialab/php-xhprof:${{ matrix.version }}
- ghcr.io/chialab/php-xhprof:${{ matrix.version }}
- push: true
-
- - name: Build OTel image and push to registry
- uses: docker/build-push-action@v5
- with:
- platforms: linux/amd64,linux/arm64
- cache-to: type=inline
- context: ./otel
- build-args: |
- BASE_IMAGE=ghcr.io/chialab/php:${{ matrix.version }}
- tags: |
- chialab/php-otel:${{ matrix.version }}
- ghcr.io/chialab/php-otel:${{ matrix.version }}
- push: true
+ publish-latest:
+ name: Publish latest PHP images
+ if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && github.event.workflow_run.head_sha == github.sha }}
+ permissions:
+ actions: read
+ contents: read
+ packages: write
+ uses: ./.github/workflows/publish-images.yml
+ with:
+ versions: '["latest", "alpine"]'
+ secrets:
+ push-username: ${{ secrets.DOCKER_USERNAME }}
+ push-password: ${{ secrets.DOCKER_PASSWORD }}
diff --git a/.github/workflows/test.5.yml b/.github/workflows/test.5.yml
index 09f8b72..f8235cb 100644
--- a/.github/workflows/test.5.yml
+++ b/.github/workflows/test.5.yml
@@ -12,79 +12,13 @@ on:
jobs:
test-5:
name: Build and test PHP 5 images
- runs-on: ubuntu-22.04
- if: ${{ !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
- strategy:
- fail-fast: false
- matrix:
- version: [ '5.6' ]
- flavor: [ '', '-apache', '-fpm', '-alpine', '-fpm-alpine' ]
- exclude:
- - version: '5.6'
- flavor: '-alpine'
- - version: '5.6'
- flavor: '-fpm-alpine'
- services:
- registry:
- image: registry:2
- ports:
- - 5000:5000
- steps:
- - name: Checkout
- uses: actions/checkout@v4
-
- - name: Login to DockerHub
- uses: docker/login-action@v3
- with:
- username: ${{ secrets.DOCKER_PULL_USER_1 }}
- password: ${{ secrets.DOCKER_PULL_PASS_1 }}
-
- - name: Build image for testing
- uses: docker/build-push-action@v5
- with:
-# cache-from: type=registry,ref=ghcr.io/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- cache-to: type=inline
- context: .
- file: ${{ ((contains(matrix.flavor, 'alpine') || matrix.version == 'alpine') && 'Dockerfile.alpine') || 'Dockerfile' }}
- build-args: |
- BASE_IMAGE=php:${{ matrix.version }}${{ matrix.flavor }}
- tags: localhost:5000/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- push: true
-
- - name: Test image
- env:
- REGISTRY: localhost:5000/
- VERSION: ${{ matrix.version }}${{ matrix.flavor }}
- run: 'docker pull localhost:5000/chialab/php:${{ matrix.version }}${{ matrix.flavor }} && make test'
-
- - name: Build dev image for testing
- uses: docker/build-push-action@v5
- with:
- cache-to: type=inline
- context: ./dev
- build-args: |
- BASE_IMAGE=localhost:5000/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- tags: localhost:5000/chialab/php-dev:${{ matrix.version }}${{ matrix.flavor }}
- push: true
-
- - name: Test dev image
- env:
- REGISTRY: localhost:5000/
- VERSION: ${{ matrix.version }}${{ matrix.flavor }}
- run: 'docker pull localhost:5000/chialab/php-dev:${{ matrix.version }}${{ matrix.flavor }} && make -C dev test'
-
- - name: Build xhprof image for testing
- uses: docker/build-push-action@v5
- with:
- cache-to: type=inline
- context: ./xhprof
- build-args: |
- BASE_IMAGE=localhost:5000/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- tags: localhost:5000/chialab/php-xhprof:${{ matrix.version }}${{ matrix.flavor }}
- push: true
-
- - name: Test xhprof image
- env:
- REGISTRY: localhost:5000/
- VERSION: ${{ matrix.version }}${{ matrix.flavor }}
- run: 'docker pull localhost:5000/chialab/php-xhprof:${{ matrix.version }}${{ matrix.flavor }} && make -C xhprof test'
+ permissions:
+ contents: read
+ packages: write
+ uses: ./.github/workflows/build-images.yml
+ with:
+ versions: '["5.6"]'
+ flavors: '["", "-apache", "-fpm"]'
+ secrets:
+ pull-username: ${{ secrets.DOCKER_PULL_USER_1 }}
+ pull-password: ${{ secrets.DOCKER_PULL_PASS_1 }}
diff --git a/.github/workflows/test.7.yml b/.github/workflows/test.7.yml
index 5debe58..5c71041 100644
--- a/.github/workflows/test.7.yml
+++ b/.github/workflows/test.7.yml
@@ -12,97 +12,14 @@ on:
jobs:
test-7:
name: Build and test PHP 7 images
- runs-on: ubuntu-22.04
- if: ${{ !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
- strategy:
- fail-fast: false
- matrix:
- version: [ '7.0', '7.1', '7.2', '7.3', '7.4' ]
- flavor: [ '', '-apache', '-fpm', '-alpine', '-fpm-alpine' ]
- exclude:
- - version: '7.0'
- flavor: '-alpine'
- - version: '7.0'
- flavor: '-fpm-alpine'
- services:
- registry:
- image: registry:2
- ports:
- - 5000:5000
- steps:
- - name: Checkout
- uses: actions/checkout@v4
-
- - name: Login to DockerHub
- uses: docker/login-action@v3
- with:
- username: ${{ secrets.DOCKER_PULL_USER_2 }}
- password: ${{ secrets.DOCKER_PULL_PASS_2 }}
-
- - name: Build image for testing
- uses: docker/build-push-action@v5
- with:
-# cache-from: type=registry,ref=ghcr.io/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- cache-to: type=inline
- context: .
- file: ${{ ((contains(matrix.flavor, 'alpine') || matrix.version == 'alpine') && 'Dockerfile.alpine') || 'Dockerfile' }}
- build-args: |
- BASE_IMAGE=php:${{ matrix.version }}${{ matrix.flavor }}
- tags: localhost:5000/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- push: true
-
- - name: Test image
- env:
- REGISTRY: localhost:5000/
- VERSION: ${{ matrix.version }}${{ matrix.flavor }}
- run: 'docker pull localhost:5000/chialab/php:${{ matrix.version }}${{ matrix.flavor }} && make test'
-
- - name: Build dev image for testing
- uses: docker/build-push-action@v5
- with:
- cache-to: type=inline
- context: ./dev
- build-args: |
- BASE_IMAGE=localhost:5000/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- tags: localhost:5000/chialab/php-dev:${{ matrix.version }}${{ matrix.flavor }}
- push: true
-
- - name: Test dev image
- env:
- REGISTRY: localhost:5000/
- VERSION: ${{ matrix.version }}${{ matrix.flavor }}
- run: 'docker pull localhost:5000/chialab/php-dev:${{ matrix.version }}${{ matrix.flavor }} && make -C dev test'
-
- - name: Build PCOV image for testing
- if: ${{ matrix.version >= 7.1 }}
- uses: docker/build-push-action@v5
- with:
- cache-to: type=inline
- context: ./pcov
- build-args: |
- BASE_IMAGE=localhost:5000/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- tags: localhost:5000/chialab/php-pcov:${{ matrix.version }}${{ matrix.flavor }}
- push: true
-
- - name: Test PCOV image
- if: ${{ matrix.version >= 7.1 }}
- env:
- REGISTRY: localhost:5000/
- VERSION: ${{ matrix.version }}${{ matrix.flavor }}
- run: 'docker pull localhost:5000/chialab/php-pcov:${{ matrix.version }}${{ matrix.flavor }} && make -C pcov test'
-
- - name: Build xhprof image for testing
- uses: docker/build-push-action@v5
- with:
- cache-to: type=inline
- context: ./xhprof
- build-args: |
- BASE_IMAGE=localhost:5000/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- tags: localhost:5000/chialab/php-xhprof:${{ matrix.version }}${{ matrix.flavor }}
- push: true
-
- - name: Test xhprof image
- env:
- REGISTRY: localhost:5000/
- VERSION: ${{ matrix.version }}${{ matrix.flavor }}
- run: 'docker pull localhost:5000/chialab/php-xhprof:${{ matrix.version }}${{ matrix.flavor }} && make -C xhprof test'
+ permissions:
+ contents: read
+ packages: write
+ uses: ./.github/workflows/build-images.yml
+ with:
+ versions: '["7.0", "7.1", "7.2", "7.3", "7.4"]'
+ flavors: '["", "-apache", "-fpm", "-alpine", "-fpm-alpine"]'
+ exclude: '[{"version": "7.0", "flavor": "-alpine"}, {"version": "7.0", "flavor": "-fpm-alpine"}]'
+ secrets:
+ pull-username: ${{ secrets.DOCKER_PULL_USER_2 }}
+ pull-password: ${{ secrets.DOCKER_PULL_PASS_2 }}
diff --git a/.github/workflows/test.8.yml b/.github/workflows/test.8.yml
index 2dc55b5..70146e0 100644
--- a/.github/workflows/test.8.yml
+++ b/.github/workflows/test.8.yml
@@ -12,106 +12,13 @@ on:
jobs:
test-8:
name: Build and test PHP 8 images
- runs-on: ubuntu-latest
- if: ${{ !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
- strategy:
- fail-fast: false
- matrix:
- version: [ '8.0', '8.1', '8.2', '8.3', '8.4', '8.5' ]
- flavor: [ '', '-apache', '-fpm', '-alpine', '-fpm-alpine' ]
- services:
- registry:
- image: registry:2
- ports:
- - 5000:5000
- steps:
- - name: Checkout
- uses: actions/checkout@v4
-
- - name: Login to DockerHub
- uses: docker/login-action@v3
- with:
- username: ${{ secrets.DOCKER_PULL_USER_3 }}
- password: ${{ secrets.DOCKER_PULL_PASS_3 }}
-
- - name: Build image for testing
- uses: docker/build-push-action@v5
- with:
-# cache-from: type=registry,ref=ghcr.io/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- cache-to: type=inline
- context: .
- file: ${{ ((contains(matrix.flavor, 'alpine') || matrix.version == 'alpine') && 'Dockerfile.alpine') || 'Dockerfile' }}
- build-args: |
- BASE_IMAGE=php:${{ matrix.version }}${{ matrix.flavor }}
- tags: localhost:5000/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- push: true
-
- - name: Test image
- env:
- REGISTRY: localhost:5000/
- VERSION: ${{ matrix.version }}${{ matrix.flavor }}
- run: 'docker pull localhost:5000/chialab/php:${{ matrix.version }}${{ matrix.flavor }} && make test'
-
- - name: Build dev image for testing
- uses: docker/build-push-action@v5
- with:
- cache-to: type=inline
- context: ./dev
- build-args: |
- BASE_IMAGE=localhost:5000/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- tags: localhost:5000/chialab/php-dev:${{ matrix.version }}${{ matrix.flavor }}
- push: true
-
- - name: Test dev image
- env:
- REGISTRY: localhost:5000/
- VERSION: ${{ matrix.version }}${{ matrix.flavor }}
- run: 'docker pull localhost:5000/chialab/php-dev:${{ matrix.version }}${{ matrix.flavor }} && make -C dev test'
-
- - name: Build PCOV image for testing
- uses: docker/build-push-action@v5
- with:
- cache-to: type=inline
- context: ./pcov
- build-args: |
- BASE_IMAGE=localhost:5000/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- tags: localhost:5000/chialab/php-pcov:${{ matrix.version }}${{ matrix.flavor }}
- push: true
-
- - name: Test PCOV image
- env:
- REGISTRY: localhost:5000/
- VERSION: ${{ matrix.version }}${{ matrix.flavor }}
- run: 'docker pull localhost:5000/chialab/php-pcov:${{ matrix.version }}${{ matrix.flavor }} && make -C pcov test'
-
- - name: Build xhprof image for testing
- uses: docker/build-push-action@v5
- with:
- cache-to: type=inline
- context: ./xhprof
- build-args: |
- BASE_IMAGE=localhost:5000/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- tags: localhost:5000/chialab/php-xhprof:${{ matrix.version }}${{ matrix.flavor }}
- push: true
-
- - name: Test xhprof image
- env:
- REGISTRY: localhost:5000/
- VERSION: ${{ matrix.version }}${{ matrix.flavor }}
- run: 'docker pull localhost:5000/chialab/php-xhprof:${{ matrix.version }}${{ matrix.flavor }} && make -C xhprof test'
-
- - name: Build OTel image for testing
- uses: docker/build-push-action@v5
- with:
- cache-to: type=inline
- context: ./otel
- build-args: |
- BASE_IMAGE=localhost:5000/chialab/php:${{ matrix.version }}${{ matrix.flavor }}
- tags: localhost:5000/chialab/php-otel:${{ matrix.version }}${{ matrix.flavor }}
- push: true
-
- - name: Test OTel image
- env:
- REGISTRY: localhost:5000/
- VERSION: ${{ matrix.version }}${{ matrix.flavor }}
- run: 'docker pull localhost:5000/chialab/php-otel:${{ matrix.version }}${{ matrix.flavor }} && make -C otel test'
+ permissions:
+ contents: read
+ packages: write
+ uses: ./.github/workflows/build-images.yml
+ with:
+ versions: '["8.0", "8.1", "8.2", "8.3", "8.4", "8.5"]'
+ flavors: '["", "-apache", "-fpm", "-alpine", "-fpm-alpine"]'
+ secrets:
+ pull-username: ${{ secrets.DOCKER_PULL_USER_3 }}
+ pull-password: ${{ secrets.DOCKER_PULL_PASS_3 }}
diff --git a/.github/workflows/test.compat.yml b/.github/workflows/test.compat.yml
index 8c77ea7..90cbac2 100644
--- a/.github/workflows/test.compat.yml
+++ b/.github/workflows/test.compat.yml
@@ -9,11 +9,14 @@ on:
pull_request:
types: [opened, synchronize]
+concurrency:
+ group: ${{ github.workflow }}-${{ github.ref }}
+ cancel-in-progress: true
+
jobs:
test-compat:
name: Build and test compatibility images
runs-on: ubuntu-22.04
- if: ${{ !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
strategy:
fail-fast: false
matrix:
@@ -40,6 +43,7 @@ jobs:
# cache-from: type=registry,ref=ghcr.io/chialab/php-compat:${{ matrix.version }}${{ matrix.flavor }}
cache-to: type=inline
context: ./compat
+ build-contexts: patches=eol/patches
file: ${{ format('compat/{0}.{1}{2}', 'Dockerfile', matrix.version, matrix.flavor) }}
tags: localhost:5000/chialab/php-compat:${{ matrix.version }}${{ matrix.flavor }}
push: true
diff --git a/.github/workflows/test.latest.yml b/.github/workflows/test.latest.yml
index 86d69ce..2ab5a62 100644
--- a/.github/workflows/test.latest.yml
+++ b/.github/workflows/test.latest.yml
@@ -12,105 +12,12 @@ on:
jobs:
test-latest:
name: Build and test latest PHP images
- runs-on: ubuntu-latest
- if: ${{ !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
- strategy:
- fail-fast: false
- matrix:
- version: [ 'latest', 'alpine' ]
- services:
- registry:
- image: registry:2
- ports:
- - 5000:5000
- steps:
- - name: Checkout
- uses: actions/checkout@v4
-
- - name: Login to DockerHub
- uses: docker/login-action@v3
- with:
- username: ${{ secrets.DOCKER_PULL_USER_5 }}
- password: ${{ secrets.DOCKER_PULL_PASS_5 }}
-
- - name: Build image for testing
- uses: docker/build-push-action@v5
- with:
-# cache-from: type=registry,ref=ghcr.io/chialab/php:${{ matrix.version }}
- cache-to: type=inline
- context: .
- file: ${{ ((contains(matrix.flavor, 'alpine') || matrix.version == 'alpine') && 'Dockerfile.alpine') || 'Dockerfile' }}
- build-args: |
- BASE_IMAGE=php:${{ matrix.version }}
- tags: localhost:5000/chialab/php:${{ matrix.version }}
- push: true
-
- - name: Test image
- env:
- REGISTRY: localhost:5000/
- VERSION: ${{ matrix.version }}
- run: 'docker pull localhost:5000/chialab/php:${{ matrix.version }} && make test'
-
- - name: Build dev image for testing
- uses: docker/build-push-action@v5
- with:
- cache-to: type=inline
- context: ./dev
- build-args: |
- BASE_IMAGE=localhost:5000/chialab/php:${{ matrix.version }}
- tags: localhost:5000/chialab/php-dev:${{ matrix.version }}
- push: true
-
- - name: Test dev image
- env:
- REGISTRY: localhost:5000/
- VERSION: ${{ matrix.version }}
- run: 'docker pull localhost:5000/chialab/php-dev:${{ matrix.version }} && make -C dev test'
-
- - name: Build PCOV image for testing
- uses: docker/build-push-action@v5
- with:
- cache-to: type=inline
- context: ./pcov
- build-args: |
- BASE_IMAGE=localhost:5000/chialab/php:${{ matrix.version }}
- tags: localhost:5000/chialab/php-pcov:${{ matrix.version }}
- push: true
-
- - name: Test PCOV image
- env:
- REGISTRY: localhost:5000/
- VERSION: ${{ matrix.version }}
- run: 'docker pull localhost:5000/chialab/php-pcov:${{ matrix.version }} && make -C pcov test'
-
- - name: Build xhprof image for testing
- uses: docker/build-push-action@v5
- with:
- cache-to: type=inline
- context: ./xhprof
- build-args: |
- BASE_IMAGE=localhost:5000/chialab/php:${{ matrix.version }}
- tags: localhost:5000/chialab/php-xhprof:${{ matrix.version }}
- push: true
-
- - name: Test xhprof image
- env:
- REGISTRY: localhost:5000/
- VERSION: ${{ matrix.version }}
- run: 'docker pull localhost:5000/chialab/php-xhprof:${{ matrix.version }} && make -C xhprof test'
-
- - name: Build OTel image for testing
- uses: docker/build-push-action@v5
- with:
- cache-to: type=inline
- context: ./otel
- build-args: |
- BASE_IMAGE=localhost:5000/chialab/php:${{ matrix.version }}
- tags: localhost:5000/chialab/php-otel:${{ matrix.version }}
- push: true
-
- - name: Test OTel image
- env:
- REGISTRY: localhost:5000/
- VERSION: ${{ matrix.version }}
- run: 'docker pull localhost:5000/chialab/php-otel:${{ matrix.version }} && make -C otel test'
+ permissions:
+ contents: read
+ packages: write
+ uses: ./.github/workflows/build-images.yml
+ with:
+ versions: '["latest", "alpine"]'
+ secrets:
+ pull-username: ${{ secrets.DOCKER_PULL_USER_5 }}
+ pull-password: ${{ secrets.DOCKER_PULL_PASS_5 }}
diff --git a/Makefile b/Makefile
index 725a58e..e0018cc 100644
--- a/Makefile
+++ b/Makefile
@@ -1,11 +1,17 @@
SHELL := /bin/bash
ALL: build
-.PHONY: build test push
+.PHONY: build build-base test push
PARENT_IMAGE := php
+BASE_IMAGE_NAME := chialab/php-base
IMAGE := chialab/php
VERSION ?= latest
PHP_VERSION = $(firstword $(subst -, ,$(VERSION)))
+FLAVOR = $(if $(findstring -,$(VERSION)),$(patsubst $(PHP_VERSION)-%,%,$(VERSION)),cli)
+# EOL versions are built from eol/ instead of the official images.
+EOL_DIR = $(wildcard eol/$(PHP_VERSION)/$(FLAVOR))
+BASE_IMAGE = $(if $(EOL_DIR),$(REGISTRY)$(BASE_IMAGE_NAME):$(VERSION),$(PARENT_IMAGE):$(VERSION))
+DOCKERFILE = $(if $(findstring alpine,$(VERSION)),Dockerfile.alpine,Dockerfile)
# Extensions.
EXTENSIONS := \
@@ -42,13 +48,21 @@ ifeq (,$(findstring $(PHP_VERSION), 7.0 7.1 7.2 7.3 7.4 8.0 8.1 8.2 8.3 8.4 8.5
EXTENSIONS += mysql
endif
-build:
+build: $(if $(EOL_DIR),build-base)
@echo " =====> Building $(REGISTRY)$(IMAGE):$(VERSION)..."
- docker image build --quiet --build-arg 'BASE_IMAGE=$(PARENT_IMAGE):$(VERSION)' -t $(REGISTRY)$(IMAGE):$(VERSION) .
+ docker image build --quiet --build-arg 'BASE_IMAGE=$(BASE_IMAGE)' -f $(DOCKERFILE) -t $(REGISTRY)$(IMAGE):$(VERSION) .
+
+build-base:
+ @if [[ -z "$(EOL_DIR)" ]]; then \
+ echo 'No eol/ Dockerfile for $(VERSION)'; \
+ exit 1; \
+ fi
+ @echo " =====> Building $(BASE_IMAGE)..."
+ docker image build --quiet --build-context patches=eol/patches --build-context scripts=eol/scripts -t $(BASE_IMAGE) $(EOL_DIR)
test:
@echo -e "=====> Testing loaded extensions... \c"
- @if [[ -z `docker image ls $(REGISTRY)$(IMAGE) | grep "\s$(VERSION)\s"` ]]; then \
+ @if ! docker image inspect $(REGISTRY)$(IMAGE):$(VERSION) > /dev/null 2>&1; then \
echo 'FAIL [Missing image!!!]'; \
exit 1; \
fi
@@ -71,6 +85,16 @@ test:
exit 1; \
fi \
fi
+ @if [[ "$(VERSION)" == *'-fpm'* ]]; then \
+ if ! docker container run --rm $(REGISTRY)$(IMAGE):$(VERSION) php-fpm -t > /dev/null 2>&1; then \
+ echo 'FAIL [php-fpm]'; \
+ exit 1; \
+ fi \
+ fi
+ @if [[ -n "$(EOL_DIR)" && -z `docker container run --rm $(REGISTRY)$(IMAGE):$(VERSION) sh -c '/bin/echo $$PHP_PATCHES'` ]]; then \
+ echo 'FAIL [PHP_PATCHES]'; \
+ exit 1; \
+ fi
@if [[ -z `docker container run --rm $(REGISTRY)$(IMAGE):$(VERSION) composer --version 2> /dev/null | grep '^Composer version 2\.[0-9][0-9]*'` ]]; then \
echo 'FAIL [Composer]'; \
exit 1; \
diff --git a/README.md b/README.md
index fef962f..188a166 100644
--- a/README.md
+++ b/README.md
@@ -57,6 +57,11 @@ If you are really desperate and need PHP 5.6 with support for MySQL 8.x, check t
As you might have guessed, all tags are built on top of the corresponding tag of the official image. Not all tags are supported in order to easen maintenance.
+### Security backports for EOL versions
+The official images of unsupported PHP versions (5.6 to 8.1) no longer receive security fixes. For those versions we rebuild PHP from the official images' Dockerfiles (see [`eol/`](eol/)), on the same OS release, with security patches applied to the PHP sources. The image layout doesn't change, so `docker-php-ext-*` and `install-php-extensions` keep working.
+
+The `PHP_PATCHES` environment variable and the `it.chialab.php.patches` label list what has been applied. `PHP_VERSION` and `php -v` still report the upstream version, so vulnerability scanners may keep flagging fixed issues.
+
## Installed extensions
The following modules and extensions have been enabled,
in addition to those you can already find in the [official PHP image](https://hub.docker.com/r/_/php/):
diff --git a/compat/Dockerfile.5.6 b/compat/Dockerfile.5.6
index 975eb76..b00390b 100644
--- a/compat/Dockerfile.5.6
+++ b/compat/Dockerfile.5.6
@@ -107,6 +107,13 @@ RUN set -xe; \
COPY --from=php:5.6 /usr/local/bin/docker-php-source /usr/local/bin/
+# Security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=5.6,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
RUN set -eux; \
\
savedAptMark="$(apt-mark showmanual)"; \
diff --git a/compat/Dockerfile.5.6-apache b/compat/Dockerfile.5.6-apache
index adc9a7d..5aaa4d6 100644
--- a/compat/Dockerfile.5.6-apache
+++ b/compat/Dockerfile.5.6-apache
@@ -167,6 +167,13 @@ RUN set -xe; \
COPY --from=php:5.6-apache /usr/local/bin/docker-php-source /usr/local/bin/
+# Security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=5.6,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
RUN set -eux; \
\
savedAptMark="$(apt-mark showmanual)"; \
diff --git a/compat/Dockerfile.5.6-fpm b/compat/Dockerfile.5.6-fpm
index 4d70f67..dbc6e41 100644
--- a/compat/Dockerfile.5.6-fpm
+++ b/compat/Dockerfile.5.6-fpm
@@ -108,6 +108,13 @@ RUN set -xe; \
COPY --from=php:5.6-fpm /usr/local/bin/docker-php-source /usr/local/bin/
+# Security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=5.6,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
RUN set -eux; \
\
savedAptMark="$(apt-mark showmanual)"; \
diff --git a/compat/Makefile b/compat/Makefile
index d03ab9c..283ca91 100644
--- a/compat/Makefile
+++ b/compat/Makefile
@@ -43,11 +43,11 @@ endif
build:
@echo " =====> Building $(REGISTRY)$(IMAGE):$(VERSION)..."
- docker image build --quiet -t $(REGISTRY)$(IMAGE):$(VERSION) .
+ docker image build --quiet --build-context patches=../eol/patches -f Dockerfile.$(VERSION) -t $(REGISTRY)$(IMAGE):$(VERSION) .
test:
@echo -e "=====> Testing loaded extensions... \c"
- @if [[ -z `docker image ls $(REGISTRY)$(IMAGE) | grep "\s$(VERSION)\s"` ]]; then \
+ @if ! docker image inspect $(REGISTRY)$(IMAGE):$(VERSION) > /dev/null 2>&1; then \
echo 'FAIL [Missing image!!!]'; \
exit 1; \
fi
@@ -74,6 +74,10 @@ test:
echo 'FAIL [Composer]'; \
exit 1; \
fi
+ @if [[ -z `docker container run --rm $(REGISTRY)$(IMAGE):$(VERSION) sh -c '/bin/echo $$PHP_PATCHES'` ]]; then \
+ echo 'FAIL [PHP_PATCHES]'; \
+ exit 1; \
+ fi
@mariadbClientApi=`docker container run --rm $(REGISTRY)$(IMAGE):$(VERSION) php -i | grep -e "Client API.*MariaDB" | wc -l`; \
if [[ "$${mariadbClientApi}" -lt 4 ]]; then \
echo 'FAIL [MariaDB]'; \
diff --git a/dev/Makefile b/dev/Makefile
index 4c4fd4a..8b15f9b 100644
--- a/dev/Makefile
+++ b/dev/Makefile
@@ -49,7 +49,7 @@ build:
test:
@echo -e "=====> Testing loaded extensions... \c"
- @if [[ -z `docker image ls $(REGISTRY)$(IMAGE) | grep "\s$(VERSION)\s"` ]]; then \
+ @if ! docker image inspect $(REGISTRY)$(IMAGE):$(VERSION) > /dev/null 2>&1; then \
echo 'FAIL [Missing image!!!]'; \
exit 1; \
fi
diff --git a/eol/5.6/apache/Dockerfile b/eol/5.6/apache/Dockerfile
new file mode 100644
index 0000000..0df7ef2
--- /dev/null
+++ b/eol/5.6/apache/Dockerfile
@@ -0,0 +1,286 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/fab49d4cb1c61e4f74c2dffe06961408212f054c/5.6/stretch/apache),
+# with the changes marked "chialab:".
+#
+
+FROM debian:stretch-slim
+
+# chialab: Debian stretch has been moved to archive.debian.org.
+RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+ -e 's/security.debian.org/archive.debian.org/g' \
+ -e '/stretch-updates/d' /etc/apt/sources.list
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN apt-get update && apt-get install -y \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ --no-install-recommends && rm -r /var/lib/apt/lists/*
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+####
+ENV APACHE_CONFDIR /etc/apache2
+ENV APACHE_ENVVARS $APACHE_CONFDIR/envvars
+
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends apache2; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+# generically convert lines like
+# export APACHE_RUN_USER=www-data
+# into
+# : ${APACHE_RUN_USER:=www-data}
+# export APACHE_RUN_USER
+# so that they can be overridden at runtime ("-e APACHE_RUN_USER=...")
+ sed -ri 's/^export ([^=]+)=(.*)$/: ${\1:=\2}\nexport \1/' "$APACHE_ENVVARS"; \
+ \
+# setup directories and permissions
+ . "$APACHE_ENVVARS"; \
+ for dir in \
+ "$APACHE_LOCK_DIR" \
+ "$APACHE_RUN_DIR" \
+ "$APACHE_LOG_DIR" \
+ ; do \
+ rm -rvf "$dir"; \
+ mkdir -p "$dir"; \
+ chown "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$dir"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ chmod 777 "$dir"; \
+ done; \
+ \
+# delete the "index.html" that installing Apache drops in here
+ rm -rvf /var/www/html/*; \
+ \
+# logs should go to stdout / stderr
+ ln -sfT /dev/stderr "$APACHE_LOG_DIR/error.log"; \
+ ln -sfT /dev/stdout "$APACHE_LOG_DIR/access.log"; \
+ ln -sfT /dev/stdout "$APACHE_LOG_DIR/other_vhosts_access.log"; \
+ chown -R --no-dereference "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$APACHE_LOG_DIR"
+
+# Apache + PHP requires preforking Apache for best results
+RUN a2dismod mpm_event && a2enmod mpm_prefork
+
+# PHP files should be handled by PHP, and should be preferred over any other file type
+RUN { \
+ echo ''; \
+ echo '\tSetHandler application/x-httpd-php'; \
+ echo ''; \
+ echo; \
+ echo 'DirectoryIndex disabled'; \
+ echo 'DirectoryIndex index.php index.html'; \
+ echo; \
+ echo ''; \
+ echo '\tOptions -Indexes'; \
+ echo '\tAllowOverride All'; \
+ echo ''; \
+ } | tee "$APACHE_CONFDIR/conf-available/docker-php.conf" \
+ && a2enconf docker-php
+
+ENV PHP_EXTRA_BUILD_DEPS apache2-dev
+ENV PHP_EXTRA_CONFIGURE_ARGS --with-apxs2 --disable-cgi
+####
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
+# https://github.com/docker-library/php/issues/272
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -Wl,--hash-style=both -pie"
+
+ENV GPG_KEYS 0BD78B5F97500D450838F95DFE857D9A90D90EC1 6E4F6AB321FDC07F2C332E3AC2BF0BC433CFC8B3
+
+ENV PHP_VERSION 5.6.40
+# chialab: the php.net mirror redirector is gone.
+ENV PHP_URL="https://www.php.net/distributions/php-5.6.40.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-5.6.40.tar.xz.asc"
+ENV PHP_SHA256="1369a51eee3995d7fbd1c5342e5cc917760e276d561595b6052b21ace2656d1c" PHP_MD5=""
+
+RUN set -xe; \
+ \
+ fetchDeps=' \
+ wget \
+ '; \
+ if ! command -v gpg > /dev/null; then \
+ fetchDeps="$fetchDeps \
+ dirmngr \
+ gnupg \
+ "; \
+ fi; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends $fetchDeps; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ wget -O php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ if [ -n "$PHP_MD5" ]; then \
+ echo "$PHP_MD5 *php.tar.xz" | md5sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ wget -O php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+# chialab: the SKS keyserver pool is gone.
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ command -v gpgconf > /dev/null && gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=5.6,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ libcurl4-openssl-dev \
+ libedit-dev \
+ libsqlite3-dev \
+ libssl1.0-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ${PHP_EXTRA_BUILD_DEPS:-} \
+ ; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors intead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+ \
+ --with-curl \
+ --with-libedit \
+ --with-openssl \
+ --with-zlib \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+ ${PHP_EXTRA_CONFIGURE_ARGS:-} \
+ ; \
+ make -j "$(nproc)"; \
+ make install; \
+ find /usr/local/bin /usr/local/sbin -type f -executable -exec strip --strip-all '{}' + || true; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { print $(NF-1) }' \
+ | sort -u \
+ | xargs -r dpkg-query --search \
+ | cut -d: -f1 \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ \
+ php --version; \
+ \
+# https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/5.6 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/5.6 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/5.6 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/apache /usr/local/bin/docker-php-entrypoint
+
+ENTRYPOINT ["docker-php-entrypoint"]
+####
+# chialab: from eol/scripts.
+COPY --from=scripts apache2-foreground /usr/local/bin/
+WORKDIR /var/www/html
+
+EXPOSE 80
+CMD ["apache2-foreground"]
+####
diff --git a/eol/5.6/cli/Dockerfile b/eol/5.6/cli/Dockerfile
new file mode 100644
index 0000000..a0b59d5
--- /dev/null
+++ b/eol/5.6/cli/Dockerfile
@@ -0,0 +1,221 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/fab49d4cb1c61e4f74c2dffe06961408212f054c/5.6/stretch/cli),
+# with the changes marked "chialab:".
+#
+
+FROM debian:stretch-slim
+
+# chialab: Debian stretch has been moved to archive.debian.org.
+RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+ -e 's/security.debian.org/archive.debian.org/g' \
+ -e '/stretch-updates/d' /etc/apt/sources.list
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN apt-get update && apt-get install -y \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ --no-install-recommends && rm -r /var/lib/apt/lists/*
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+####
+####
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
+# https://github.com/docker-library/php/issues/272
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -Wl,--hash-style=both -pie"
+
+ENV GPG_KEYS 0BD78B5F97500D450838F95DFE857D9A90D90EC1 6E4F6AB321FDC07F2C332E3AC2BF0BC433CFC8B3
+
+ENV PHP_VERSION 5.6.40
+# chialab: the php.net mirror redirector is gone.
+ENV PHP_URL="https://www.php.net/distributions/php-5.6.40.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-5.6.40.tar.xz.asc"
+ENV PHP_SHA256="1369a51eee3995d7fbd1c5342e5cc917760e276d561595b6052b21ace2656d1c" PHP_MD5=""
+
+RUN set -xe; \
+ \
+ fetchDeps=' \
+ wget \
+ '; \
+ if ! command -v gpg > /dev/null; then \
+ fetchDeps="$fetchDeps \
+ dirmngr \
+ gnupg \
+ "; \
+ fi; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends $fetchDeps; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ wget -O php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ if [ -n "$PHP_MD5" ]; then \
+ echo "$PHP_MD5 *php.tar.xz" | md5sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ wget -O php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+# chialab: the SKS keyserver pool is gone.
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ command -v gpgconf > /dev/null && gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=5.6,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ libcurl4-openssl-dev \
+ libedit-dev \
+ libsqlite3-dev \
+ libssl1.0-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ${PHP_EXTRA_BUILD_DEPS:-} \
+ ; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors intead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+ \
+ --with-curl \
+ --with-libedit \
+ --with-openssl \
+ --with-zlib \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+ ${PHP_EXTRA_CONFIGURE_ARGS:-} \
+ ; \
+ make -j "$(nproc)"; \
+ make install; \
+ find /usr/local/bin /usr/local/sbin -type f -executable -exec strip --strip-all '{}' + || true; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { print $(NF-1) }' \
+ | sort -u \
+ | xargs -r dpkg-query --search \
+ | cut -d: -f1 \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ \
+ php --version; \
+ \
+# https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/5.6 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/5.6 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/5.6 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/cli /usr/local/bin/docker-php-entrypoint
+
+ENTRYPOINT ["docker-php-entrypoint"]
+####
+CMD ["php", "-a"]
+####
diff --git a/eol/5.6/fpm/Dockerfile b/eol/5.6/fpm/Dockerfile
new file mode 100644
index 0000000..6649c59
--- /dev/null
+++ b/eol/5.6/fpm/Dockerfile
@@ -0,0 +1,261 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/fab49d4cb1c61e4f74c2dffe06961408212f054c/5.6/stretch/fpm),
+# with the changes marked "chialab:".
+#
+
+FROM debian:stretch-slim
+
+# chialab: Debian stretch has been moved to archive.debian.org.
+RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+ -e 's/security.debian.org/archive.debian.org/g' \
+ -e '/stretch-updates/d' /etc/apt/sources.list
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN apt-get update && apt-get install -y \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ --no-install-recommends && rm -r /var/lib/apt/lists/*
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+####
+ENV PHP_EXTRA_CONFIGURE_ARGS --enable-fpm --with-fpm-user=www-data --with-fpm-group=www-data --disable-cgi
+####
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
+# https://github.com/docker-library/php/issues/272
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -Wl,--hash-style=both -pie"
+
+ENV GPG_KEYS 0BD78B5F97500D450838F95DFE857D9A90D90EC1 6E4F6AB321FDC07F2C332E3AC2BF0BC433CFC8B3
+
+ENV PHP_VERSION 5.6.40
+# chialab: the php.net mirror redirector is gone.
+ENV PHP_URL="https://www.php.net/distributions/php-5.6.40.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-5.6.40.tar.xz.asc"
+ENV PHP_SHA256="1369a51eee3995d7fbd1c5342e5cc917760e276d561595b6052b21ace2656d1c" PHP_MD5=""
+
+RUN set -xe; \
+ \
+ fetchDeps=' \
+ wget \
+ '; \
+ if ! command -v gpg > /dev/null; then \
+ fetchDeps="$fetchDeps \
+ dirmngr \
+ gnupg \
+ "; \
+ fi; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends $fetchDeps; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ wget -O php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ if [ -n "$PHP_MD5" ]; then \
+ echo "$PHP_MD5 *php.tar.xz" | md5sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ wget -O php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+# chialab: the SKS keyserver pool is gone.
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ command -v gpgconf > /dev/null && gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=5.6,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ libcurl4-openssl-dev \
+ libedit-dev \
+ libsqlite3-dev \
+ libssl1.0-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ${PHP_EXTRA_BUILD_DEPS:-} \
+ ; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors intead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+ \
+ --with-curl \
+ --with-libedit \
+ --with-openssl \
+ --with-zlib \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+ ${PHP_EXTRA_CONFIGURE_ARGS:-} \
+ ; \
+ make -j "$(nproc)"; \
+ make install; \
+ find /usr/local/bin /usr/local/sbin -type f -executable -exec strip --strip-all '{}' + || true; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { print $(NF-1) }' \
+ | sort -u \
+ | xargs -r dpkg-query --search \
+ | cut -d: -f1 \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ \
+ php --version; \
+ \
+# https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/5.6 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/5.6 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/5.6 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/fpm /usr/local/bin/docker-php-entrypoint
+
+ENTRYPOINT ["docker-php-entrypoint"]
+####
+WORKDIR /var/www/html
+
+RUN set -ex \
+ && cd /usr/local/etc \
+ && if [ -d php-fpm.d ]; then \
+ # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf"
+ sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \
+ cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \
+ else \
+ # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency
+ mkdir php-fpm.d; \
+ cp php-fpm.conf.default php-fpm.d/www.conf; \
+ { \
+ echo '[global]'; \
+ echo 'include=etc/php-fpm.d/*.conf'; \
+ } | tee php-fpm.conf; \
+ fi \
+ && { \
+ echo '[global]'; \
+ echo 'error_log = /proc/self/fd/2'; \
+ echo; \
+ echo '[www]'; \
+ echo '; if we send this to /proc/self/fd/1, it never appears'; \
+ echo 'access.log = /proc/self/fd/2'; \
+ echo; \
+ echo 'clear_env = no'; \
+ echo; \
+ echo '; Ensure worker stdout and stderr are sent to the main error log.'; \
+ echo 'catch_workers_output = yes'; \
+ } | tee php-fpm.d/docker.conf \
+ && { \
+ echo '[global]'; \
+ echo 'daemonize = no'; \
+ echo; \
+ echo '[www]'; \
+ echo 'listen = 9000'; \
+ } | tee php-fpm.d/zz-docker.conf
+
+EXPOSE 9000
+CMD ["php-fpm"]
+####
diff --git a/eol/7.0/apache/Dockerfile b/eol/7.0/apache/Dockerfile
new file mode 100644
index 0000000..847cd11
--- /dev/null
+++ b/eol/7.0/apache/Dockerfile
@@ -0,0 +1,280 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/0e5c984e02d9027c25794bfb5002a2f9da26a7ec/7.0/stretch/apache),
+# with the changes marked "chialab:".
+#
+
+FROM debian:stretch-slim
+
+# chialab: Debian stretch has been moved to archive.debian.org.
+RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+ -e 's/security.debian.org/archive.debian.org/g' \
+ -e '/stretch-updates/d' /etc/apt/sources.list
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN apt-get update && apt-get install -y \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ --no-install-recommends && rm -r /var/lib/apt/lists/*
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN mkdir -p $PHP_INI_DIR/conf.d
+
+####
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+ apache2 \
+ && rm -rf /var/lib/apt/lists/*
+
+ENV APACHE_CONFDIR /etc/apache2
+ENV APACHE_ENVVARS $APACHE_CONFDIR/envvars
+
+RUN set -eux; \
+ \
+# generically convert lines like
+# export APACHE_RUN_USER=www-data
+# into
+# : ${APACHE_RUN_USER:=www-data}
+# export APACHE_RUN_USER
+# so that they can be overridden at runtime ("-e APACHE_RUN_USER=...")
+ sed -ri 's/^export ([^=]+)=(.*)$/: ${\1:=\2}\nexport \1/' "$APACHE_ENVVARS"; \
+ \
+# setup directories and permissions
+ . "$APACHE_ENVVARS"; \
+ for dir in \
+ "$APACHE_LOCK_DIR" \
+ "$APACHE_RUN_DIR" \
+ "$APACHE_LOG_DIR" \
+ /var/www/html \
+ ; do \
+ rm -rvf "$dir"; \
+ mkdir -p "$dir"; \
+ chown "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$dir"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ chmod 777 "$dir"; \
+ done; \
+ \
+# logs should go to stdout / stderr
+ ln -sfT /dev/stderr "$APACHE_LOG_DIR/error.log"; \
+ ln -sfT /dev/stdout "$APACHE_LOG_DIR/access.log"; \
+ ln -sfT /dev/stdout "$APACHE_LOG_DIR/other_vhosts_access.log"; \
+ chown -R --no-dereference "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$APACHE_LOG_DIR"
+
+# Apache + PHP requires preforking Apache for best results
+RUN a2dismod mpm_event && a2enmod mpm_prefork
+
+# PHP files should be handled by PHP, and should be preferred over any other file type
+RUN { \
+ echo ''; \
+ echo '\tSetHandler application/x-httpd-php'; \
+ echo ''; \
+ echo; \
+ echo 'DirectoryIndex disabled'; \
+ echo 'DirectoryIndex index.php index.html'; \
+ echo; \
+ echo ''; \
+ echo '\tOptions -Indexes'; \
+ echo '\tAllowOverride All'; \
+ echo ''; \
+ } | tee "$APACHE_CONFDIR/conf-available/docker-php.conf" \
+ && a2enconf docker-php
+
+ENV PHP_EXTRA_BUILD_DEPS apache2-dev
+ENV PHP_EXTRA_CONFIGURE_ARGS --with-apxs2 --disable-cgi
+####
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
+# https://github.com/docker-library/php/issues/272
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -Wl,--hash-style=both -pie"
+
+ENV GPG_KEYS 1A4E8B7277C42E53DBA9C7B9BCAA30EA9C0D5763 6E4F6AB321FDC07F2C332E3AC2BF0BC433CFC8B3
+
+ENV PHP_VERSION 7.0.33
+# chialab: the php.net mirror redirector is gone.
+ENV PHP_URL="https://www.php.net/distributions/php-7.0.33.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.0.33.tar.xz.asc"
+ENV PHP_SHA256="ab8c5be6e32b1f8d032909dedaaaa4bbb1a209e519abb01a52ce3914f9a13d96" PHP_MD5=""
+
+RUN set -xe; \
+ \
+ fetchDeps=' \
+ wget \
+ '; \
+ if ! command -v gpg > /dev/null; then \
+ fetchDeps="$fetchDeps \
+ dirmngr \
+ gnupg \
+ "; \
+ fi; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends $fetchDeps; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ wget -O php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ if [ -n "$PHP_MD5" ]; then \
+ echo "$PHP_MD5 *php.tar.xz" | md5sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ wget -O php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+# chialab: the SKS keyserver pool is gone.
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ command -v gpgconf > /dev/null && gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.0,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ libcurl4-openssl-dev \
+ libedit-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ${PHP_EXTRA_BUILD_DEPS:-} \
+ ; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors intead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+ \
+ --with-curl \
+ --with-libedit \
+ --with-openssl \
+ --with-zlib \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+ ${PHP_EXTRA_CONFIGURE_ARGS:-} \
+ ; \
+ make -j "$(nproc)"; \
+ make install; \
+ find /usr/local/bin /usr/local/sbin -type f -executable -exec strip --strip-all '{}' + || true; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { print $(NF-1) }' \
+ | sort -u \
+ | xargs -r dpkg-query --search \
+ | cut -d: -f1 \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ \
+ php --version; \
+ \
+# https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/5.6 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/5.6 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/5.6 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/apache /usr/local/bin/docker-php-entrypoint
+
+ENTRYPOINT ["docker-php-entrypoint"]
+####
+# chialab: from eol/scripts.
+COPY --from=scripts apache2-foreground /usr/local/bin/
+WORKDIR /var/www/html
+
+EXPOSE 80
+CMD ["apache2-foreground"]
+####
diff --git a/eol/7.0/cli/Dockerfile b/eol/7.0/cli/Dockerfile
new file mode 100644
index 0000000..045ba66
--- /dev/null
+++ b/eol/7.0/cli/Dockerfile
@@ -0,0 +1,215 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/0e5c984e02d9027c25794bfb5002a2f9da26a7ec/7.0/stretch/cli),
+# with the changes marked "chialab:".
+#
+
+FROM debian:stretch-slim
+
+# chialab: Debian stretch has been moved to archive.debian.org.
+RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+ -e 's/security.debian.org/archive.debian.org/g' \
+ -e '/stretch-updates/d' /etc/apt/sources.list
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN apt-get update && apt-get install -y \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ --no-install-recommends && rm -r /var/lib/apt/lists/*
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN mkdir -p $PHP_INI_DIR/conf.d
+
+####
+####
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
+# https://github.com/docker-library/php/issues/272
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -Wl,--hash-style=both -pie"
+
+ENV GPG_KEYS 1A4E8B7277C42E53DBA9C7B9BCAA30EA9C0D5763 6E4F6AB321FDC07F2C332E3AC2BF0BC433CFC8B3
+
+ENV PHP_VERSION 7.0.33
+# chialab: the php.net mirror redirector is gone.
+ENV PHP_URL="https://www.php.net/distributions/php-7.0.33.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.0.33.tar.xz.asc"
+ENV PHP_SHA256="ab8c5be6e32b1f8d032909dedaaaa4bbb1a209e519abb01a52ce3914f9a13d96" PHP_MD5=""
+
+RUN set -xe; \
+ \
+ fetchDeps=' \
+ wget \
+ '; \
+ if ! command -v gpg > /dev/null; then \
+ fetchDeps="$fetchDeps \
+ dirmngr \
+ gnupg \
+ "; \
+ fi; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends $fetchDeps; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ wget -O php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ if [ -n "$PHP_MD5" ]; then \
+ echo "$PHP_MD5 *php.tar.xz" | md5sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ wget -O php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+# chialab: the SKS keyserver pool is gone.
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ command -v gpgconf > /dev/null && gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.0,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ libcurl4-openssl-dev \
+ libedit-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ${PHP_EXTRA_BUILD_DEPS:-} \
+ ; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors intead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+ \
+ --with-curl \
+ --with-libedit \
+ --with-openssl \
+ --with-zlib \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+ ${PHP_EXTRA_CONFIGURE_ARGS:-} \
+ ; \
+ make -j "$(nproc)"; \
+ make install; \
+ find /usr/local/bin /usr/local/sbin -type f -executable -exec strip --strip-all '{}' + || true; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { print $(NF-1) }' \
+ | sort -u \
+ | xargs -r dpkg-query --search \
+ | cut -d: -f1 \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ \
+ php --version; \
+ \
+# https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/5.6 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/5.6 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/5.6 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/cli /usr/local/bin/docker-php-entrypoint
+
+ENTRYPOINT ["docker-php-entrypoint"]
+####
+CMD ["php", "-a"]
+####
diff --git a/eol/7.0/fpm/Dockerfile b/eol/7.0/fpm/Dockerfile
new file mode 100644
index 0000000..e3d4094
--- /dev/null
+++ b/eol/7.0/fpm/Dockerfile
@@ -0,0 +1,255 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/0e5c984e02d9027c25794bfb5002a2f9da26a7ec/7.0/stretch/fpm),
+# with the changes marked "chialab:".
+#
+
+FROM debian:stretch-slim
+
+# chialab: Debian stretch has been moved to archive.debian.org.
+RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+ -e 's/security.debian.org/archive.debian.org/g' \
+ -e '/stretch-updates/d' /etc/apt/sources.list
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN apt-get update && apt-get install -y \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ --no-install-recommends && rm -r /var/lib/apt/lists/*
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN mkdir -p $PHP_INI_DIR/conf.d
+
+####
+ENV PHP_EXTRA_CONFIGURE_ARGS --enable-fpm --with-fpm-user=www-data --with-fpm-group=www-data --disable-cgi
+####
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
+# https://github.com/docker-library/php/issues/272
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -Wl,--hash-style=both -pie"
+
+ENV GPG_KEYS 1A4E8B7277C42E53DBA9C7B9BCAA30EA9C0D5763 6E4F6AB321FDC07F2C332E3AC2BF0BC433CFC8B3
+
+ENV PHP_VERSION 7.0.33
+# chialab: the php.net mirror redirector is gone.
+ENV PHP_URL="https://www.php.net/distributions/php-7.0.33.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.0.33.tar.xz.asc"
+ENV PHP_SHA256="ab8c5be6e32b1f8d032909dedaaaa4bbb1a209e519abb01a52ce3914f9a13d96" PHP_MD5=""
+
+RUN set -xe; \
+ \
+ fetchDeps=' \
+ wget \
+ '; \
+ if ! command -v gpg > /dev/null; then \
+ fetchDeps="$fetchDeps \
+ dirmngr \
+ gnupg \
+ "; \
+ fi; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends $fetchDeps; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ wget -O php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ if [ -n "$PHP_MD5" ]; then \
+ echo "$PHP_MD5 *php.tar.xz" | md5sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ wget -O php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+# chialab: the SKS keyserver pool is gone.
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ command -v gpgconf > /dev/null && gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.0,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ libcurl4-openssl-dev \
+ libedit-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ${PHP_EXTRA_BUILD_DEPS:-} \
+ ; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors intead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+ \
+ --with-curl \
+ --with-libedit \
+ --with-openssl \
+ --with-zlib \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+ ${PHP_EXTRA_CONFIGURE_ARGS:-} \
+ ; \
+ make -j "$(nproc)"; \
+ make install; \
+ find /usr/local/bin /usr/local/sbin -type f -executable -exec strip --strip-all '{}' + || true; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { print $(NF-1) }' \
+ | sort -u \
+ | xargs -r dpkg-query --search \
+ | cut -d: -f1 \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ \
+ php --version; \
+ \
+# https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/5.6 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/5.6 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/5.6 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/fpm /usr/local/bin/docker-php-entrypoint
+
+ENTRYPOINT ["docker-php-entrypoint"]
+####
+WORKDIR /var/www/html
+
+RUN set -ex \
+ && cd /usr/local/etc \
+ && if [ -d php-fpm.d ]; then \
+ # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf"
+ sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \
+ cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \
+ else \
+ # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency
+ mkdir php-fpm.d; \
+ cp php-fpm.conf.default php-fpm.d/www.conf; \
+ { \
+ echo '[global]'; \
+ echo 'include=etc/php-fpm.d/*.conf'; \
+ } | tee php-fpm.conf; \
+ fi \
+ && { \
+ echo '[global]'; \
+ echo 'error_log = /proc/self/fd/2'; \
+ echo; \
+ echo '[www]'; \
+ echo '; if we send this to /proc/self/fd/1, it never appears'; \
+ echo 'access.log = /proc/self/fd/2'; \
+ echo; \
+ echo 'clear_env = no'; \
+ echo; \
+ echo '; Ensure worker stdout and stderr are sent to the main error log.'; \
+ echo 'catch_workers_output = yes'; \
+ } | tee php-fpm.d/docker.conf \
+ && { \
+ echo '[global]'; \
+ echo 'daemonize = no'; \
+ echo; \
+ echo '[www]'; \
+ echo 'listen = 9000'; \
+ } | tee php-fpm.d/zz-docker.conf
+
+EXPOSE 9000
+CMD ["php-fpm"]
+####
diff --git a/eol/7.1/alpine/Dockerfile b/eol/7.1/alpine/Dockerfile
new file mode 100644
index 0000000..7ce1c21
--- /dev/null
+++ b/eol/7.1/alpine/Dockerfile
@@ -0,0 +1,197 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/2bf33a859340cf4932a7bce5ae7bc935fc778b9d/7.1/alpine3.10/cli),
+# with the changes marked "chialab:".
+#
+
+FROM alpine:3.10
+
+# dependencies required for running "phpize"
+# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev dpkg \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkgconf \
+ re2c
+
+# persistent / runtime deps
+RUN apk add --no-cache \
+ ca-certificates \
+ curl \
+ tar \
+ xz \
+# https://github.com/docker-library/php/issues/494
+ openssl
+
+# ensure www-data user exists
+RUN set -eux; \
+ addgroup -g 82 -S www-data; \
+ adduser -u 82 -D -S -G www-data www-data
+# 82 is the standard uid/gid for "www-data" in Alpine
+# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.9-stable
+# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.9-stable
+# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.9-stable
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+####
+####
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -Wl,--hash-style=both -pie"
+
+ENV GPG_KEYS A917B1ECDA84AEC2B568FED6F50ABC807BD5DCD0 528995BFEDFBA7191D46839EF9BA0ADA31CBD89E 1729F83938DA44E27BA0F4D3DBDB397470D12172
+
+ENV PHP_VERSION 7.1.33
+# chialab: the php.net mirror redirector is gone.
+ENV PHP_URL="https://www.php.net/distributions/php-7.1.33.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.1.33.tar.xz.asc"
+ENV PHP_SHA256="bd7c0a9bd5433289ee01fd440af3715309faf583f75832b64fe169c100d52968" PHP_MD5=""
+
+RUN set -eux; \
+ \
+ apk add --no-cache --virtual .fetch-deps gnupg; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ if [ -n "$PHP_MD5" ]; then \
+ echo "$PHP_MD5 *php.tar.xz" | md5sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+# chialab: the SKS keyserver pool is gone.
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apk del --no-network .fetch-deps
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.1,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ apk add --no-cache --virtual .build-deps \
+ $PHPIZE_DEPS \
+ coreutils \
+ curl-dev \
+ libedit-dev \
+ libxml2-dev \
+ openssl-dev \
+ sqlite-dev \
+ ; \
+ \
+ export CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors intead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-libedit \
+ --with-openssl \
+ --with-zlib \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-musl' && echo '--without-pcre-jit') \
+ \
+ ${PHP_EXTRA_CONFIGURE_ARGS:-} \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find /usr/local/bin /usr/local/sbin -type f -perm +0111 -exec strip --strip-all '{}' + || true; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+ runDeps="$( \
+ scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
+ | tr ',' '\n' \
+ | sort -u \
+ | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+ )"; \
+ apk add --no-cache $runDeps; \
+ \
+ apk del --no-network .build-deps; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/5.6 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.1 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.1 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/cli /usr/local/bin/docker-php-entrypoint
+
+ENTRYPOINT ["docker-php-entrypoint"]
+####
+CMD ["php", "-a"]
+####
diff --git a/eol/7.1/apache/Dockerfile b/eol/7.1/apache/Dockerfile
new file mode 100644
index 0000000..f588db2
--- /dev/null
+++ b/eol/7.1/apache/Dockerfile
@@ -0,0 +1,294 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/2bf33a859340cf4932a7bce5ae7bc935fc778b9d/7.1/buster/apache),
+# with the changes marked "chialab:".
+#
+
+FROM debian:buster-slim
+
+# chialab: Debian buster has been moved to archive.debian.org.
+RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+ -e 's/security.debian.org/archive.debian.org/g' \
+ -e '/buster-updates/d' /etc/apt/sources.list
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ ; \
+ rm -rf /var/lib/apt/lists/*
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+####
+ENV APACHE_CONFDIR /etc/apache2
+ENV APACHE_ENVVARS $APACHE_CONFDIR/envvars
+
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends apache2; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+# generically convert lines like
+# export APACHE_RUN_USER=www-data
+# into
+# : ${APACHE_RUN_USER:=www-data}
+# export APACHE_RUN_USER
+# so that they can be overridden at runtime ("-e APACHE_RUN_USER=...")
+ sed -ri 's/^export ([^=]+)=(.*)$/: ${\1:=\2}\nexport \1/' "$APACHE_ENVVARS"; \
+ \
+# setup directories and permissions
+ . "$APACHE_ENVVARS"; \
+ for dir in \
+ "$APACHE_LOCK_DIR" \
+ "$APACHE_RUN_DIR" \
+ "$APACHE_LOG_DIR" \
+ ; do \
+ rm -rvf "$dir"; \
+ mkdir -p "$dir"; \
+ chown "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$dir"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ chmod 777 "$dir"; \
+ done; \
+ \
+# delete the "index.html" that installing Apache drops in here
+ rm -rvf /var/www/html/*; \
+ \
+# logs should go to stdout / stderr
+ ln -sfT /dev/stderr "$APACHE_LOG_DIR/error.log"; \
+ ln -sfT /dev/stdout "$APACHE_LOG_DIR/access.log"; \
+ ln -sfT /dev/stdout "$APACHE_LOG_DIR/other_vhosts_access.log"; \
+ chown -R --no-dereference "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$APACHE_LOG_DIR"
+
+# Apache + PHP requires preforking Apache for best results
+RUN a2dismod mpm_event && a2enmod mpm_prefork
+
+# PHP files should be handled by PHP, and should be preferred over any other file type
+RUN { \
+ echo ''; \
+ echo '\tSetHandler application/x-httpd-php'; \
+ echo ''; \
+ echo; \
+ echo 'DirectoryIndex disabled'; \
+ echo 'DirectoryIndex index.php index.html'; \
+ echo; \
+ echo ''; \
+ echo '\tOptions -Indexes'; \
+ echo '\tAllowOverride All'; \
+ echo ''; \
+ } | tee "$APACHE_CONFDIR/conf-available/docker-php.conf" \
+ && a2enconf docker-php
+
+ENV PHP_EXTRA_BUILD_DEPS apache2-dev
+ENV PHP_EXTRA_CONFIGURE_ARGS --with-apxs2 --disable-cgi
+####
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -Wl,--hash-style=both -pie"
+
+ENV GPG_KEYS A917B1ECDA84AEC2B568FED6F50ABC807BD5DCD0 528995BFEDFBA7191D46839EF9BA0ADA31CBD89E 1729F83938DA44E27BA0F4D3DBDB397470D12172
+
+ENV PHP_VERSION 7.1.33
+# chialab: the php.net mirror redirector is gone.
+ENV PHP_URL="https://www.php.net/distributions/php-7.1.33.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.1.33.tar.xz.asc"
+ENV PHP_SHA256="bd7c0a9bd5433289ee01fd440af3715309faf583f75832b64fe169c100d52968" PHP_MD5=""
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends gnupg dirmngr; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ if [ -n "$PHP_MD5" ]; then \
+ echo "$PHP_MD5 *php.tar.xz" | md5sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+# chialab: the SKS keyserver pool is gone.
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apt-mark auto '.*' > /dev/null; \
+ apt-mark manual $savedAptMark > /dev/null; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.1,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ libcurl4-openssl-dev \
+ libedit-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ${PHP_EXTRA_BUILD_DEPS:-} \
+ ; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors intead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-libedit \
+ --with-openssl \
+ --with-zlib \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+ ${PHP_EXTRA_CONFIGURE_ARGS:-} \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find /usr/local/bin /usr/local/sbin -type f -executable -exec strip --strip-all '{}' + || true; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { print $(NF-1) }' \
+ | sort -u \
+ | xargs -r dpkg-query --search \
+ | cut -d: -f1 \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/5.6 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.1 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.1 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/apache /usr/local/bin/docker-php-entrypoint
+
+# temporary "freetype-config" workaround for https://github.com/docker-library/php/issues/865 (https://bugs.php.net/bug.php?id=76324)
+RUN { echo '#!/bin/sh'; echo 'exec pkg-config "$@" freetype2'; } > /usr/local/bin/freetype-config && chmod +x /usr/local/bin/freetype-config
+
+ENTRYPOINT ["docker-php-entrypoint"]
+####
+# https://httpd.apache.org/docs/2.4/stopping.html#gracefulstop
+STOPSIGNAL SIGWINCH
+
+# chialab: from eol/scripts.
+COPY --from=scripts apache2-foreground /usr/local/bin/
+WORKDIR /var/www/html
+
+EXPOSE 80
+CMD ["apache2-foreground"]
+####
diff --git a/eol/7.1/cli/Dockerfile b/eol/7.1/cli/Dockerfile
new file mode 100644
index 0000000..ba46a86
--- /dev/null
+++ b/eol/7.1/cli/Dockerfile
@@ -0,0 +1,226 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/2bf33a859340cf4932a7bce5ae7bc935fc778b9d/7.1/buster/cli),
+# with the changes marked "chialab:".
+#
+
+FROM debian:buster-slim
+
+# chialab: Debian buster has been moved to archive.debian.org.
+RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+ -e 's/security.debian.org/archive.debian.org/g' \
+ -e '/buster-updates/d' /etc/apt/sources.list
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ ; \
+ rm -rf /var/lib/apt/lists/*
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+####
+####
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -Wl,--hash-style=both -pie"
+
+ENV GPG_KEYS A917B1ECDA84AEC2B568FED6F50ABC807BD5DCD0 528995BFEDFBA7191D46839EF9BA0ADA31CBD89E 1729F83938DA44E27BA0F4D3DBDB397470D12172
+
+ENV PHP_VERSION 7.1.33
+# chialab: the php.net mirror redirector is gone.
+ENV PHP_URL="https://www.php.net/distributions/php-7.1.33.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.1.33.tar.xz.asc"
+ENV PHP_SHA256="bd7c0a9bd5433289ee01fd440af3715309faf583f75832b64fe169c100d52968" PHP_MD5=""
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends gnupg dirmngr; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ if [ -n "$PHP_MD5" ]; then \
+ echo "$PHP_MD5 *php.tar.xz" | md5sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+# chialab: the SKS keyserver pool is gone.
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apt-mark auto '.*' > /dev/null; \
+ apt-mark manual $savedAptMark > /dev/null; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.1,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ libcurl4-openssl-dev \
+ libedit-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ${PHP_EXTRA_BUILD_DEPS:-} \
+ ; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors intead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-libedit \
+ --with-openssl \
+ --with-zlib \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+ ${PHP_EXTRA_CONFIGURE_ARGS:-} \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find /usr/local/bin /usr/local/sbin -type f -executable -exec strip --strip-all '{}' + || true; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { print $(NF-1) }' \
+ | sort -u \
+ | xargs -r dpkg-query --search \
+ | cut -d: -f1 \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/5.6 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.1 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.1 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/cli /usr/local/bin/docker-php-entrypoint
+
+# temporary "freetype-config" workaround for https://github.com/docker-library/php/issues/865 (https://bugs.php.net/bug.php?id=76324)
+RUN { echo '#!/bin/sh'; echo 'exec pkg-config "$@" freetype2'; } > /usr/local/bin/freetype-config && chmod +x /usr/local/bin/freetype-config
+
+ENTRYPOINT ["docker-php-entrypoint"]
+####
+CMD ["php", "-a"]
+####
diff --git a/eol/7.1/fpm-alpine/Dockerfile b/eol/7.1/fpm-alpine/Dockerfile
new file mode 100644
index 0000000..fc1c2f1
--- /dev/null
+++ b/eol/7.1/fpm-alpine/Dockerfile
@@ -0,0 +1,241 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/2bf33a859340cf4932a7bce5ae7bc935fc778b9d/7.1/alpine3.10/fpm),
+# with the changes marked "chialab:".
+#
+
+FROM alpine:3.10
+
+# dependencies required for running "phpize"
+# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev dpkg \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkgconf \
+ re2c
+
+# persistent / runtime deps
+RUN apk add --no-cache \
+ ca-certificates \
+ curl \
+ tar \
+ xz \
+# https://github.com/docker-library/php/issues/494
+ openssl
+
+# ensure www-data user exists
+RUN set -eux; \
+ addgroup -g 82 -S www-data; \
+ adduser -u 82 -D -S -G www-data www-data
+# 82 is the standard uid/gid for "www-data" in Alpine
+# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.9-stable
+# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.9-stable
+# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.9-stable
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+####
+ENV PHP_EXTRA_CONFIGURE_ARGS --enable-fpm --with-fpm-user=www-data --with-fpm-group=www-data --disable-cgi
+####
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -Wl,--hash-style=both -pie"
+
+ENV GPG_KEYS A917B1ECDA84AEC2B568FED6F50ABC807BD5DCD0 528995BFEDFBA7191D46839EF9BA0ADA31CBD89E 1729F83938DA44E27BA0F4D3DBDB397470D12172
+
+ENV PHP_VERSION 7.1.33
+# chialab: the php.net mirror redirector is gone.
+ENV PHP_URL="https://www.php.net/distributions/php-7.1.33.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.1.33.tar.xz.asc"
+ENV PHP_SHA256="bd7c0a9bd5433289ee01fd440af3715309faf583f75832b64fe169c100d52968" PHP_MD5=""
+
+RUN set -eux; \
+ \
+ apk add --no-cache --virtual .fetch-deps gnupg; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ if [ -n "$PHP_MD5" ]; then \
+ echo "$PHP_MD5 *php.tar.xz" | md5sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+# chialab: the SKS keyserver pool is gone.
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apk del --no-network .fetch-deps
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.1,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ apk add --no-cache --virtual .build-deps \
+ $PHPIZE_DEPS \
+ coreutils \
+ curl-dev \
+ libedit-dev \
+ libxml2-dev \
+ openssl-dev \
+ sqlite-dev \
+ ; \
+ \
+ export CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors intead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-libedit \
+ --with-openssl \
+ --with-zlib \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-musl' && echo '--without-pcre-jit') \
+ \
+ ${PHP_EXTRA_CONFIGURE_ARGS:-} \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find /usr/local/bin /usr/local/sbin -type f -perm +0111 -exec strip --strip-all '{}' + || true; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+ runDeps="$( \
+ scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
+ | tr ',' '\n' \
+ | sort -u \
+ | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+ )"; \
+ apk add --no-cache $runDeps; \
+ \
+ apk del --no-network .build-deps; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/5.6 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.1 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.1 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/fpm /usr/local/bin/docker-php-entrypoint
+
+ENTRYPOINT ["docker-php-entrypoint"]
+####
+WORKDIR /var/www/html
+
+RUN set -eux; \
+ cd /usr/local/etc; \
+ if [ -d php-fpm.d ]; then \
+ # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf"
+ sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \
+ cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \
+ else \
+ # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency
+ mkdir php-fpm.d; \
+ cp php-fpm.conf.default php-fpm.d/www.conf; \
+ { \
+ echo '[global]'; \
+ echo 'include=etc/php-fpm.d/*.conf'; \
+ } | tee php-fpm.conf; \
+ fi; \
+ { \
+ echo '[global]'; \
+ echo 'error_log = /proc/self/fd/2'; \
+ echo; \
+ echo '[www]'; \
+ echo '; if we send this to /proc/self/fd/1, it never appears'; \
+ echo 'access.log = /proc/self/fd/2'; \
+ echo; \
+ echo 'clear_env = no'; \
+ echo; \
+ echo '; Ensure worker stdout and stderr are sent to the main error log.'; \
+ echo 'catch_workers_output = yes'; \
+ } | tee php-fpm.d/docker.conf; \
+ { \
+ echo '[global]'; \
+ echo 'daemonize = no'; \
+ echo; \
+ echo '[www]'; \
+ echo 'listen = 9000'; \
+ } | tee php-fpm.d/zz-docker.conf
+
+# Override stop signal to stop process gracefully
+# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163
+STOPSIGNAL SIGQUIT
+
+EXPOSE 9000
+CMD ["php-fpm"]
+####
diff --git a/eol/7.1/fpm/Dockerfile b/eol/7.1/fpm/Dockerfile
new file mode 100644
index 0000000..0f3fd20
--- /dev/null
+++ b/eol/7.1/fpm/Dockerfile
@@ -0,0 +1,270 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/2bf33a859340cf4932a7bce5ae7bc935fc778b9d/7.1/buster/fpm),
+# with the changes marked "chialab:".
+#
+
+FROM debian:buster-slim
+
+# chialab: Debian buster has been moved to archive.debian.org.
+RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+ -e 's/security.debian.org/archive.debian.org/g' \
+ -e '/buster-updates/d' /etc/apt/sources.list
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ ; \
+ rm -rf /var/lib/apt/lists/*
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+####
+ENV PHP_EXTRA_CONFIGURE_ARGS --enable-fpm --with-fpm-user=www-data --with-fpm-group=www-data --disable-cgi
+####
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -Wl,--hash-style=both -pie"
+
+ENV GPG_KEYS A917B1ECDA84AEC2B568FED6F50ABC807BD5DCD0 528995BFEDFBA7191D46839EF9BA0ADA31CBD89E 1729F83938DA44E27BA0F4D3DBDB397470D12172
+
+ENV PHP_VERSION 7.1.33
+# chialab: the php.net mirror redirector is gone.
+ENV PHP_URL="https://www.php.net/distributions/php-7.1.33.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.1.33.tar.xz.asc"
+ENV PHP_SHA256="bd7c0a9bd5433289ee01fd440af3715309faf583f75832b64fe169c100d52968" PHP_MD5=""
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends gnupg dirmngr; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ if [ -n "$PHP_MD5" ]; then \
+ echo "$PHP_MD5 *php.tar.xz" | md5sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+# chialab: the SKS keyserver pool is gone.
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apt-mark auto '.*' > /dev/null; \
+ apt-mark manual $savedAptMark > /dev/null; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.1,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ libcurl4-openssl-dev \
+ libedit-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ${PHP_EXTRA_BUILD_DEPS:-} \
+ ; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors intead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-libedit \
+ --with-openssl \
+ --with-zlib \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+ ${PHP_EXTRA_CONFIGURE_ARGS:-} \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find /usr/local/bin /usr/local/sbin -type f -executable -exec strip --strip-all '{}' + || true; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { print $(NF-1) }' \
+ | sort -u \
+ | xargs -r dpkg-query --search \
+ | cut -d: -f1 \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/5.6 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.1 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.1 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/fpm /usr/local/bin/docker-php-entrypoint
+
+# temporary "freetype-config" workaround for https://github.com/docker-library/php/issues/865 (https://bugs.php.net/bug.php?id=76324)
+RUN { echo '#!/bin/sh'; echo 'exec pkg-config "$@" freetype2'; } > /usr/local/bin/freetype-config && chmod +x /usr/local/bin/freetype-config
+
+ENTRYPOINT ["docker-php-entrypoint"]
+####
+WORKDIR /var/www/html
+
+RUN set -eux; \
+ cd /usr/local/etc; \
+ if [ -d php-fpm.d ]; then \
+ # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf"
+ sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \
+ cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \
+ else \
+ # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency
+ mkdir php-fpm.d; \
+ cp php-fpm.conf.default php-fpm.d/www.conf; \
+ { \
+ echo '[global]'; \
+ echo 'include=etc/php-fpm.d/*.conf'; \
+ } | tee php-fpm.conf; \
+ fi; \
+ { \
+ echo '[global]'; \
+ echo 'error_log = /proc/self/fd/2'; \
+ echo; \
+ echo '[www]'; \
+ echo '; if we send this to /proc/self/fd/1, it never appears'; \
+ echo 'access.log = /proc/self/fd/2'; \
+ echo; \
+ echo 'clear_env = no'; \
+ echo; \
+ echo '; Ensure worker stdout and stderr are sent to the main error log.'; \
+ echo 'catch_workers_output = yes'; \
+ } | tee php-fpm.d/docker.conf; \
+ { \
+ echo '[global]'; \
+ echo 'daemonize = no'; \
+ echo; \
+ echo '[www]'; \
+ echo 'listen = 9000'; \
+ } | tee php-fpm.d/zz-docker.conf
+
+# Override stop signal to stop process gracefully
+# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163
+STOPSIGNAL SIGQUIT
+
+EXPOSE 9000
+CMD ["php-fpm"]
+####
diff --git a/eol/7.2/alpine/Dockerfile b/eol/7.2/alpine/Dockerfile
new file mode 100644
index 0000000..8e6d372
--- /dev/null
+++ b/eol/7.2/alpine/Dockerfile
@@ -0,0 +1,200 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/20ebff40bb865416f3767540df06ad1df384337d/7.2/alpine3.12/cli),
+# with the changes marked "chialab:".
+#
+
+FROM alpine:3.12
+
+# dependencies required for running "phpize"
+# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev dpkg \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkgconf \
+ re2c
+
+# persistent / runtime deps
+RUN apk add --no-cache \
+ ca-certificates \
+ curl \
+ tar \
+ xz \
+# https://github.com/docker-library/php/issues/494
+ openssl
+
+# ensure www-data user exists
+RUN set -eux; \
+ addgroup -g 82 -S www-data; \
+ adduser -u 82 -D -S -G www-data www-data
+# 82 is the standard uid/gid for "www-data" in Alpine
+# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.9-stable
+# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.9-stable
+# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.9-stable
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS 1729F83938DA44E27BA0F4D3DBDB397470D12172 B1B44D8F021E4E2D6021E995DC9FF8D3EE5AF27F
+
+ENV PHP_VERSION 7.2.34
+ENV PHP_URL="https://www.php.net/distributions/php-7.2.34.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.2.34.tar.xz.asc"
+ENV PHP_SHA256="409e11bc6a2c18707dfc44bc61c820ddfd81e17481470f3405ee7822d8379903"
+
+RUN set -eux; \
+ \
+ apk add --no-cache --virtual .fetch-deps gnupg; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+# chialab: the SKS keyserver pool is gone.
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apk del --no-network .fetch-deps
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.2,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ apk add --no-cache --virtual .build-deps \
+ $PHPIZE_DEPS \
+ argon2-dev \
+ coreutils \
+ curl-dev \
+ libedit-dev \
+ libsodium-dev \
+ libxml2-dev \
+ openssl-dev \
+ sqlite-dev \
+ ; \
+ \
+ export CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash (7.2+)
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-libedit \
+ --with-openssl \
+ --with-zlib \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-musl' && echo '--without-pcre-jit') \
+ \
+ ${PHP_EXTRA_CONFIGURE_ARGS:-} \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find /usr/local/bin /usr/local/sbin -type f -perm +0111 -exec strip --strip-all '{}' + || true; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+ runDeps="$( \
+ scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
+ | tr ',' '\n' \
+ | sort -u \
+ | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+ )"; \
+ apk add --no-cache $runDeps; \
+ \
+ apk del --no-network .build-deps; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.2 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.2 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/cli /usr/local/bin/docker-php-entrypoint
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+ENTRYPOINT ["docker-php-entrypoint"]
+CMD ["php", "-a"]
diff --git a/eol/7.2/apache/Dockerfile b/eol/7.2/apache/Dockerfile
new file mode 100644
index 0000000..c9626a0
--- /dev/null
+++ b/eol/7.2/apache/Dockerfile
@@ -0,0 +1,298 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/20ebff40bb865416f3767540df06ad1df384337d/7.2/buster/apache),
+# with the changes marked "chialab:".
+#
+
+FROM debian:buster-slim
+
+# chialab: Debian buster has been moved to archive.debian.org.
+RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+ -e 's/security.debian.org/archive.debian.org/g' \
+ -e '/buster-updates/d' /etc/apt/sources.list
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ ; \
+ rm -rf /var/lib/apt/lists/*
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+ENV APACHE_CONFDIR /etc/apache2
+ENV APACHE_ENVVARS $APACHE_CONFDIR/envvars
+
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends apache2; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+# generically convert lines like
+# export APACHE_RUN_USER=www-data
+# into
+# : ${APACHE_RUN_USER:=www-data}
+# export APACHE_RUN_USER
+# so that they can be overridden at runtime ("-e APACHE_RUN_USER=...")
+ sed -ri 's/^export ([^=]+)=(.*)$/: ${\1:=\2}\nexport \1/' "$APACHE_ENVVARS"; \
+ \
+# setup directories and permissions
+ . "$APACHE_ENVVARS"; \
+ for dir in \
+ "$APACHE_LOCK_DIR" \
+ "$APACHE_RUN_DIR" \
+ "$APACHE_LOG_DIR" \
+ ; do \
+ rm -rvf "$dir"; \
+ mkdir -p "$dir"; \
+ chown "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$dir"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ chmod 777 "$dir"; \
+ done; \
+ \
+# delete the "index.html" that installing Apache drops in here
+ rm -rvf /var/www/html/*; \
+ \
+# logs should go to stdout / stderr
+ ln -sfT /dev/stderr "$APACHE_LOG_DIR/error.log"; \
+ ln -sfT /dev/stdout "$APACHE_LOG_DIR/access.log"; \
+ ln -sfT /dev/stdout "$APACHE_LOG_DIR/other_vhosts_access.log"; \
+ chown -R --no-dereference "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$APACHE_LOG_DIR"
+
+# Apache + PHP requires preforking Apache for best results
+RUN a2dismod mpm_event && a2enmod mpm_prefork
+
+# PHP files should be handled by PHP, and should be preferred over any other file type
+RUN { \
+ echo ''; \
+ echo '\tSetHandler application/x-httpd-php'; \
+ echo ''; \
+ echo; \
+ echo 'DirectoryIndex disabled'; \
+ echo 'DirectoryIndex index.php index.html'; \
+ echo; \
+ echo ''; \
+ echo '\tOptions -Indexes'; \
+ echo '\tAllowOverride All'; \
+ echo ''; \
+ } | tee "$APACHE_CONFDIR/conf-available/docker-php.conf" \
+ && a2enconf docker-php
+
+ENV PHP_EXTRA_BUILD_DEPS apache2-dev
+ENV PHP_EXTRA_CONFIGURE_ARGS --with-apxs2 --disable-cgi
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS 1729F83938DA44E27BA0F4D3DBDB397470D12172 B1B44D8F021E4E2D6021E995DC9FF8D3EE5AF27F
+
+ENV PHP_VERSION 7.2.34
+ENV PHP_URL="https://www.php.net/distributions/php-7.2.34.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.2.34.tar.xz.asc"
+ENV PHP_SHA256="409e11bc6a2c18707dfc44bc61c820ddfd81e17481470f3405ee7822d8379903"
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends gnupg dirmngr; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+# chialab: the SKS keyserver pool is gone.
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apt-mark auto '.*' > /dev/null; \
+ apt-mark manual $savedAptMark > /dev/null; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.2,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ libargon2-dev \
+ libcurl4-openssl-dev \
+ libedit-dev \
+ libsodium-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ${PHP_EXTRA_BUILD_DEPS:-} \
+ ; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash (7.2+)
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-libedit \
+ --with-openssl \
+ --with-zlib \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+ ${PHP_EXTRA_CONFIGURE_ARGS:-} \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find /usr/local/bin /usr/local/sbin -type f -executable -exec strip --strip-all '{}' + || true; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { print $(NF-1) }' \
+ | sort -u \
+ | xargs -r dpkg-query --search \
+ | cut -d: -f1 \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.2 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.2 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/apache /usr/local/bin/docker-php-entrypoint
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+# temporary "freetype-config" workaround for https://github.com/docker-library/php/issues/865 (https://bugs.php.net/bug.php?id=76324)
+RUN { echo '#!/bin/sh'; echo 'exec pkg-config "$@" freetype2'; } > /usr/local/bin/freetype-config && chmod +x /usr/local/bin/freetype-config
+
+ENTRYPOINT ["docker-php-entrypoint"]
+# https://httpd.apache.org/docs/2.4/stopping.html#gracefulstop
+STOPSIGNAL SIGWINCH
+
+# chialab: from eol/scripts.
+COPY --from=scripts apache2-foreground /usr/local/bin/
+WORKDIR /var/www/html
+
+EXPOSE 80
+CMD ["apache2-foreground"]
diff --git a/eol/7.2/cli/Dockerfile b/eol/7.2/cli/Dockerfile
new file mode 100644
index 0000000..ea0a79c
--- /dev/null
+++ b/eol/7.2/cli/Dockerfile
@@ -0,0 +1,229 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/20ebff40bb865416f3767540df06ad1df384337d/7.2/buster/cli),
+# with the changes marked "chialab:".
+#
+
+FROM debian:buster-slim
+
+# chialab: Debian buster has been moved to archive.debian.org.
+RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+ -e 's/security.debian.org/archive.debian.org/g' \
+ -e '/buster-updates/d' /etc/apt/sources.list
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ ; \
+ rm -rf /var/lib/apt/lists/*
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS 1729F83938DA44E27BA0F4D3DBDB397470D12172 B1B44D8F021E4E2D6021E995DC9FF8D3EE5AF27F
+
+ENV PHP_VERSION 7.2.34
+ENV PHP_URL="https://www.php.net/distributions/php-7.2.34.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.2.34.tar.xz.asc"
+ENV PHP_SHA256="409e11bc6a2c18707dfc44bc61c820ddfd81e17481470f3405ee7822d8379903"
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends gnupg dirmngr; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+# chialab: the SKS keyserver pool is gone.
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apt-mark auto '.*' > /dev/null; \
+ apt-mark manual $savedAptMark > /dev/null; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.2,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ libargon2-dev \
+ libcurl4-openssl-dev \
+ libedit-dev \
+ libsodium-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ${PHP_EXTRA_BUILD_DEPS:-} \
+ ; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash (7.2+)
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-libedit \
+ --with-openssl \
+ --with-zlib \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+ ${PHP_EXTRA_CONFIGURE_ARGS:-} \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find /usr/local/bin /usr/local/sbin -type f -executable -exec strip --strip-all '{}' + || true; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { print $(NF-1) }' \
+ | sort -u \
+ | xargs -r dpkg-query --search \
+ | cut -d: -f1 \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.2 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.2 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/cli /usr/local/bin/docker-php-entrypoint
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+# temporary "freetype-config" workaround for https://github.com/docker-library/php/issues/865 (https://bugs.php.net/bug.php?id=76324)
+RUN { echo '#!/bin/sh'; echo 'exec pkg-config "$@" freetype2'; } > /usr/local/bin/freetype-config && chmod +x /usr/local/bin/freetype-config
+
+ENTRYPOINT ["docker-php-entrypoint"]
+CMD ["php", "-a"]
diff --git a/eol/7.2/fpm-alpine/Dockerfile b/eol/7.2/fpm-alpine/Dockerfile
new file mode 100644
index 0000000..bcd88cd
--- /dev/null
+++ b/eol/7.2/fpm-alpine/Dockerfile
@@ -0,0 +1,245 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/20ebff40bb865416f3767540df06ad1df384337d/7.2/alpine3.12/fpm),
+# with the changes marked "chialab:".
+#
+
+FROM alpine:3.12
+
+# dependencies required for running "phpize"
+# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev dpkg \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkgconf \
+ re2c
+
+# persistent / runtime deps
+RUN apk add --no-cache \
+ ca-certificates \
+ curl \
+ tar \
+ xz \
+# https://github.com/docker-library/php/issues/494
+ openssl
+
+# ensure www-data user exists
+RUN set -eux; \
+ addgroup -g 82 -S www-data; \
+ adduser -u 82 -D -S -G www-data www-data
+# 82 is the standard uid/gid for "www-data" in Alpine
+# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.9-stable
+# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.9-stable
+# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.9-stable
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+ENV PHP_EXTRA_CONFIGURE_ARGS --enable-fpm --with-fpm-user=www-data --with-fpm-group=www-data --disable-cgi
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS 1729F83938DA44E27BA0F4D3DBDB397470D12172 B1B44D8F021E4E2D6021E995DC9FF8D3EE5AF27F
+
+ENV PHP_VERSION 7.2.34
+ENV PHP_URL="https://www.php.net/distributions/php-7.2.34.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.2.34.tar.xz.asc"
+ENV PHP_SHA256="409e11bc6a2c18707dfc44bc61c820ddfd81e17481470f3405ee7822d8379903"
+
+RUN set -eux; \
+ \
+ apk add --no-cache --virtual .fetch-deps gnupg; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+# chialab: the SKS keyserver pool is gone.
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apk del --no-network .fetch-deps
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.2,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ apk add --no-cache --virtual .build-deps \
+ $PHPIZE_DEPS \
+ argon2-dev \
+ coreutils \
+ curl-dev \
+ libedit-dev \
+ libsodium-dev \
+ libxml2-dev \
+ openssl-dev \
+ sqlite-dev \
+ ; \
+ \
+ export CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash (7.2+)
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-libedit \
+ --with-openssl \
+ --with-zlib \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-musl' && echo '--without-pcre-jit') \
+ \
+ ${PHP_EXTRA_CONFIGURE_ARGS:-} \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find /usr/local/bin /usr/local/sbin -type f -perm +0111 -exec strip --strip-all '{}' + || true; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+ runDeps="$( \
+ scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
+ | tr ',' '\n' \
+ | sort -u \
+ | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+ )"; \
+ apk add --no-cache $runDeps; \
+ \
+ apk del --no-network .build-deps; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.2 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.2 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/fpm /usr/local/bin/docker-php-entrypoint
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+ENTRYPOINT ["docker-php-entrypoint"]
+WORKDIR /var/www/html
+
+RUN set -eux; \
+ cd /usr/local/etc; \
+ if [ -d php-fpm.d ]; then \
+ # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf"
+ sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \
+ cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \
+ else \
+ # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency
+ mkdir php-fpm.d; \
+ cp php-fpm.conf.default php-fpm.d/www.conf; \
+ { \
+ echo '[global]'; \
+ echo 'include=etc/php-fpm.d/*.conf'; \
+ } | tee php-fpm.conf; \
+ fi; \
+ { \
+ echo '[global]'; \
+ echo 'error_log = /proc/self/fd/2'; \
+ echo; \
+ echo '[www]'; \
+ echo '; if we send this to /proc/self/fd/1, it never appears'; \
+ echo 'access.log = /proc/self/fd/2'; \
+ echo; \
+ echo 'clear_env = no'; \
+ echo; \
+ echo '; Ensure worker stdout and stderr are sent to the main error log.'; \
+ echo 'catch_workers_output = yes'; \
+ } | tee php-fpm.d/docker.conf; \
+ { \
+ echo '[global]'; \
+ echo 'daemonize = no'; \
+ echo; \
+ echo '[www]'; \
+ echo 'listen = 9000'; \
+ } | tee php-fpm.d/zz-docker.conf
+
+# Override stop signal to stop process gracefully
+# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163
+STOPSIGNAL SIGQUIT
+
+EXPOSE 9000
+CMD ["php-fpm"]
diff --git a/eol/7.2/fpm/Dockerfile b/eol/7.2/fpm/Dockerfile
new file mode 100644
index 0000000..a50e629
--- /dev/null
+++ b/eol/7.2/fpm/Dockerfile
@@ -0,0 +1,274 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/20ebff40bb865416f3767540df06ad1df384337d/7.2/buster/fpm),
+# with the changes marked "chialab:".
+#
+
+FROM debian:buster-slim
+
+# chialab: Debian buster has been moved to archive.debian.org.
+RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+ -e 's/security.debian.org/archive.debian.org/g' \
+ -e '/buster-updates/d' /etc/apt/sources.list
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ ; \
+ rm -rf /var/lib/apt/lists/*
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+ENV PHP_EXTRA_CONFIGURE_ARGS --enable-fpm --with-fpm-user=www-data --with-fpm-group=www-data --disable-cgi
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS 1729F83938DA44E27BA0F4D3DBDB397470D12172 B1B44D8F021E4E2D6021E995DC9FF8D3EE5AF27F
+
+ENV PHP_VERSION 7.2.34
+ENV PHP_URL="https://www.php.net/distributions/php-7.2.34.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.2.34.tar.xz.asc"
+ENV PHP_SHA256="409e11bc6a2c18707dfc44bc61c820ddfd81e17481470f3405ee7822d8379903"
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends gnupg dirmngr; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+# chialab: the SKS keyserver pool is gone.
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apt-mark auto '.*' > /dev/null; \
+ apt-mark manual $savedAptMark > /dev/null; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.2,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ libargon2-dev \
+ libcurl4-openssl-dev \
+ libedit-dev \
+ libsodium-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ${PHP_EXTRA_BUILD_DEPS:-} \
+ ; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash (7.2+)
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-libedit \
+ --with-openssl \
+ --with-zlib \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+ ${PHP_EXTRA_CONFIGURE_ARGS:-} \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find /usr/local/bin /usr/local/sbin -type f -executable -exec strip --strip-all '{}' + || true; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { print $(NF-1) }' \
+ | sort -u \
+ | xargs -r dpkg-query --search \
+ | cut -d: -f1 \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.2 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.2 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/fpm /usr/local/bin/docker-php-entrypoint
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+# temporary "freetype-config" workaround for https://github.com/docker-library/php/issues/865 (https://bugs.php.net/bug.php?id=76324)
+RUN { echo '#!/bin/sh'; echo 'exec pkg-config "$@" freetype2'; } > /usr/local/bin/freetype-config && chmod +x /usr/local/bin/freetype-config
+
+ENTRYPOINT ["docker-php-entrypoint"]
+WORKDIR /var/www/html
+
+RUN set -eux; \
+ cd /usr/local/etc; \
+ if [ -d php-fpm.d ]; then \
+ # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf"
+ sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \
+ cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \
+ else \
+ # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency
+ mkdir php-fpm.d; \
+ cp php-fpm.conf.default php-fpm.d/www.conf; \
+ { \
+ echo '[global]'; \
+ echo 'include=etc/php-fpm.d/*.conf'; \
+ } | tee php-fpm.conf; \
+ fi; \
+ { \
+ echo '[global]'; \
+ echo 'error_log = /proc/self/fd/2'; \
+ echo; \
+ echo '[www]'; \
+ echo '; if we send this to /proc/self/fd/1, it never appears'; \
+ echo 'access.log = /proc/self/fd/2'; \
+ echo; \
+ echo 'clear_env = no'; \
+ echo; \
+ echo '; Ensure worker stdout and stderr are sent to the main error log.'; \
+ echo 'catch_workers_output = yes'; \
+ } | tee php-fpm.d/docker.conf; \
+ { \
+ echo '[global]'; \
+ echo 'daemonize = no'; \
+ echo; \
+ echo '[www]'; \
+ echo 'listen = 9000'; \
+ } | tee php-fpm.d/zz-docker.conf
+
+# Override stop signal to stop process gracefully
+# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163
+STOPSIGNAL SIGQUIT
+
+EXPOSE 9000
+CMD ["php-fpm"]
diff --git a/eol/7.3/alpine/Dockerfile b/eol/7.3/alpine/Dockerfile
new file mode 100644
index 0000000..1c34115
--- /dev/null
+++ b/eol/7.3/alpine/Dockerfile
@@ -0,0 +1,215 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/35d0a696b273c31f41ae224f189c19e794df91ae/7.3/alpine3.15/cli),
+# with the changes marked "chialab:".
+#
+
+FROM alpine:3.15
+
+# dependencies required for running "phpize"
+# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev dpkg \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkgconf \
+ re2c
+
+# persistent / runtime deps
+RUN apk add --no-cache \
+ ca-certificates \
+ curl \
+ tar \
+ xz \
+# https://github.com/docker-library/php/issues/494
+ openssl
+
+# ensure www-data user exists
+RUN set -eux; \
+ adduser -u 82 -D -S -G www-data www-data
+# 82 is the standard uid/gid for "www-data" in Alpine
+# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable
+# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable
+# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS CBAF69F173A0FEA4B537F470D66C9593118BCCB6 F38252826ACD957EF380D39F2F7956BC5DA04B5D
+
+ENV PHP_VERSION 7.3.33
+ENV PHP_URL="https://www.php.net/distributions/php-7.3.33.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.3.33.tar.xz.asc"
+ENV PHP_SHA256="166eaccde933381da9516a2b70ad0f447d7cec4b603d07b9a916032b215b90cc"
+
+RUN set -eux; \
+ \
+ apk add --no-cache --virtual .fetch-deps gnupg; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apk del --no-network .fetch-deps
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.3,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ apk add --no-cache --virtual .build-deps \
+ $PHPIZE_DEPS \
+ argon2-dev \
+ coreutils \
+ curl-dev \
+ gnu-libiconv-dev \
+ libsodium-dev \
+ libxml2-dev \
+ openssl-dev \
+ readline-dev \
+ sqlite-dev \
+ ; \
+ \
+# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php)
+ rm -vf /usr/include/iconv.h; \
+# PHP < 8 doesn't know to look deeper for GNU libiconv: https://github.com/php/php-src/commit/b480e6841ecd5317faa136647a2b8253a4c2d0df
+ ln -sv /usr/include/gnu-libiconv/*.h /usr/include/; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-iconv=/usr \
+ --with-openssl \
+ --with-readline \
+ --with-zlib \
+ \
+# https://github.com/docker-library/php/pull/1259
+ --enable-phpdbg \
+ --enable-phpdbg-readline \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/bullseye/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-musl' && echo '--without-pcre-jit') \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find \
+ /usr/local \
+ -type f \
+ -perm '/0111' \
+ -exec sh -euxc ' \
+ strip --strip-all "$@" || : \
+ ' -- '{}' + \
+ ; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+ runDeps="$( \
+ scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
+ | tr ',' '\n' \
+ | sort -u \
+ | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+ )"; \
+ apk add --no-cache $runDeps; \
+ \
+ apk del --no-network .build-deps; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.3 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.3 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/cli /usr/local/bin/docker-php-entrypoint
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+ENTRYPOINT ["docker-php-entrypoint"]
+CMD ["php", "-a"]
diff --git a/eol/7.3/apache/Dockerfile b/eol/7.3/apache/Dockerfile
new file mode 100644
index 0000000..a4208b4
--- /dev/null
+++ b/eol/7.3/apache/Dockerfile
@@ -0,0 +1,307 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/35d0a696b273c31f41ae224f189c19e794df91ae/7.3/bullseye/apache),
+# with the changes marked "chialab:".
+#
+
+FROM debian:bullseye-slim
+
+# chialab: Debian bullseye has been moved to archive.debian.org.
+RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+ -e 's/security.debian.org/archive.debian.org/g' \
+ -e '/bullseye-updates/d' /etc/apt/sources.list
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ ; \
+ rm -rf /var/lib/apt/lists/*
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+ENV APACHE_CONFDIR /etc/apache2
+ENV APACHE_ENVVARS $APACHE_CONFDIR/envvars
+
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends apache2; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+# generically convert lines like
+# export APACHE_RUN_USER=www-data
+# into
+# : ${APACHE_RUN_USER:=www-data}
+# export APACHE_RUN_USER
+# so that they can be overridden at runtime ("-e APACHE_RUN_USER=...")
+ sed -ri 's/^export ([^=]+)=(.*)$/: ${\1:=\2}\nexport \1/' "$APACHE_ENVVARS"; \
+ \
+# setup directories and permissions
+ . "$APACHE_ENVVARS"; \
+ for dir in \
+ "$APACHE_LOCK_DIR" \
+ "$APACHE_RUN_DIR" \
+ "$APACHE_LOG_DIR" \
+ ; do \
+ rm -rvf "$dir"; \
+ mkdir -p "$dir"; \
+ chown "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$dir"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ chmod 777 "$dir"; \
+ done; \
+ \
+# delete the "index.html" that installing Apache drops in here
+ rm -rvf /var/www/html/*; \
+ \
+# logs should go to stdout / stderr
+ ln -sfT /dev/stderr "$APACHE_LOG_DIR/error.log"; \
+ ln -sfT /dev/stdout "$APACHE_LOG_DIR/access.log"; \
+ ln -sfT /dev/stdout "$APACHE_LOG_DIR/other_vhosts_access.log"; \
+ chown -R --no-dereference "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$APACHE_LOG_DIR"
+
+# Apache + PHP requires preforking Apache for best results
+RUN a2dismod mpm_event && a2enmod mpm_prefork
+
+# PHP files should be handled by PHP, and should be preferred over any other file type
+RUN { \
+ echo ''; \
+ echo '\tSetHandler application/x-httpd-php'; \
+ echo ''; \
+ echo; \
+ echo 'DirectoryIndex disabled'; \
+ echo 'DirectoryIndex index.php index.html'; \
+ echo; \
+ echo ''; \
+ echo '\tOptions -Indexes'; \
+ echo '\tAllowOverride All'; \
+ echo ''; \
+ } | tee "$APACHE_CONFDIR/conf-available/docker-php.conf" \
+ && a2enconf docker-php
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS CBAF69F173A0FEA4B537F470D66C9593118BCCB6 F38252826ACD957EF380D39F2F7956BC5DA04B5D
+
+ENV PHP_VERSION 7.3.33
+ENV PHP_URL="https://www.php.net/distributions/php-7.3.33.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.3.33.tar.xz.asc"
+ENV PHP_SHA256="166eaccde933381da9516a2b70ad0f447d7cec4b603d07b9a916032b215b90cc"
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends gnupg dirmngr; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apt-mark auto '.*' > /dev/null; \
+ apt-mark manual $savedAptMark > /dev/null; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.3,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ apache2-dev \
+ libargon2-dev \
+ libcurl4-openssl-dev \
+ libreadline-dev \
+ libsodium-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-iconv \
+ --with-openssl \
+ --with-readline \
+ --with-zlib \
+ \
+# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.")
+ --disable-phpdbg \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/bullseye/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+ --disable-cgi \
+ \
+ --with-apxs2 \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find \
+ /usr/local \
+ -type f \
+ -perm '/0111' \
+ -exec sh -euxc ' \
+ strip --strip-all "$@" || : \
+ ' -- '{}' + \
+ ; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { print $(NF-1) }' \
+ | sort -u \
+ | xargs -r dpkg-query --search \
+ | cut -d: -f1 \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.3 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.3 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/apache /usr/local/bin/docker-php-entrypoint
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+# temporary "freetype-config" workaround for https://github.com/docker-library/php/issues/865 (https://bugs.php.net/bug.php?id=76324)
+RUN { echo '#!/bin/sh'; echo 'exec pkg-config "$@" freetype2'; } > /usr/local/bin/freetype-config && chmod +x /usr/local/bin/freetype-config
+
+ENTRYPOINT ["docker-php-entrypoint"]
+# https://httpd.apache.org/docs/2.4/stopping.html#gracefulstop
+STOPSIGNAL SIGWINCH
+
+# chialab: from eol/scripts.
+COPY --from=scripts apache2-foreground /usr/local/bin/
+WORKDIR /var/www/html
+
+EXPOSE 80
+CMD ["apache2-foreground"]
diff --git a/eol/7.3/cli/Dockerfile b/eol/7.3/cli/Dockerfile
new file mode 100644
index 0000000..5fd38d0
--- /dev/null
+++ b/eol/7.3/cli/Dockerfile
@@ -0,0 +1,240 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/35d0a696b273c31f41ae224f189c19e794df91ae/7.3/bullseye/cli),
+# with the changes marked "chialab:".
+#
+
+FROM debian:bullseye-slim
+
+# chialab: Debian bullseye has been moved to archive.debian.org.
+RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+ -e 's/security.debian.org/archive.debian.org/g' \
+ -e '/bullseye-updates/d' /etc/apt/sources.list
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ ; \
+ rm -rf /var/lib/apt/lists/*
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS CBAF69F173A0FEA4B537F470D66C9593118BCCB6 F38252826ACD957EF380D39F2F7956BC5DA04B5D
+
+ENV PHP_VERSION 7.3.33
+ENV PHP_URL="https://www.php.net/distributions/php-7.3.33.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.3.33.tar.xz.asc"
+ENV PHP_SHA256="166eaccde933381da9516a2b70ad0f447d7cec4b603d07b9a916032b215b90cc"
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends gnupg dirmngr; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apt-mark auto '.*' > /dev/null; \
+ apt-mark manual $savedAptMark > /dev/null; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.3,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ libargon2-dev \
+ libcurl4-openssl-dev \
+ libreadline-dev \
+ libsodium-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-iconv \
+ --with-openssl \
+ --with-readline \
+ --with-zlib \
+ \
+# https://github.com/docker-library/php/pull/1259
+ --enable-phpdbg \
+ --enable-phpdbg-readline \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/bullseye/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+# https://github.com/docker-library/php/pull/939#issuecomment-730501748
+ --enable-embed \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find \
+ /usr/local \
+ -type f \
+ -perm '/0111' \
+ -exec sh -euxc ' \
+ strip --strip-all "$@" || : \
+ ' -- '{}' + \
+ ; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { print $(NF-1) }' \
+ | sort -u \
+ | xargs -r dpkg-query --search \
+ | cut -d: -f1 \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.3 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.3 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/cli /usr/local/bin/docker-php-entrypoint
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+# temporary "freetype-config" workaround for https://github.com/docker-library/php/issues/865 (https://bugs.php.net/bug.php?id=76324)
+RUN { echo '#!/bin/sh'; echo 'exec pkg-config "$@" freetype2'; } > /usr/local/bin/freetype-config && chmod +x /usr/local/bin/freetype-config
+
+ENTRYPOINT ["docker-php-entrypoint"]
+CMD ["php", "-a"]
diff --git a/eol/7.3/fpm-alpine/Dockerfile b/eol/7.3/fpm-alpine/Dockerfile
new file mode 100644
index 0000000..158829a
--- /dev/null
+++ b/eol/7.3/fpm-alpine/Dockerfile
@@ -0,0 +1,265 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/35d0a696b273c31f41ae224f189c19e794df91ae/7.3/alpine3.15/fpm),
+# with the changes marked "chialab:".
+#
+
+FROM alpine:3.15
+
+# dependencies required for running "phpize"
+# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev dpkg \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkgconf \
+ re2c
+
+# persistent / runtime deps
+RUN apk add --no-cache \
+ ca-certificates \
+ curl \
+ tar \
+ xz \
+# https://github.com/docker-library/php/issues/494
+ openssl
+
+# ensure www-data user exists
+RUN set -eux; \
+ adduser -u 82 -D -S -G www-data www-data
+# 82 is the standard uid/gid for "www-data" in Alpine
+# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable
+# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable
+# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS CBAF69F173A0FEA4B537F470D66C9593118BCCB6 F38252826ACD957EF380D39F2F7956BC5DA04B5D
+
+ENV PHP_VERSION 7.3.33
+ENV PHP_URL="https://www.php.net/distributions/php-7.3.33.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.3.33.tar.xz.asc"
+ENV PHP_SHA256="166eaccde933381da9516a2b70ad0f447d7cec4b603d07b9a916032b215b90cc"
+
+RUN set -eux; \
+ \
+ apk add --no-cache --virtual .fetch-deps gnupg; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apk del --no-network .fetch-deps
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.3,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ apk add --no-cache --virtual .build-deps \
+ $PHPIZE_DEPS \
+ argon2-dev \
+ coreutils \
+ curl-dev \
+ gnu-libiconv-dev \
+ libsodium-dev \
+ libxml2-dev \
+ openssl-dev \
+ readline-dev \
+ sqlite-dev \
+ ; \
+ \
+# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php)
+ rm -vf /usr/include/iconv.h; \
+# PHP < 8 doesn't know to look deeper for GNU libiconv: https://github.com/php/php-src/commit/b480e6841ecd5317faa136647a2b8253a4c2d0df
+ ln -sv /usr/include/gnu-libiconv/*.h /usr/include/; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-iconv=/usr \
+ --with-openssl \
+ --with-readline \
+ --with-zlib \
+ \
+# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.")
+ --disable-phpdbg \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/bullseye/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-musl' && echo '--without-pcre-jit') \
+ \
+ --disable-cgi \
+ \
+ --enable-fpm \
+ --with-fpm-user=www-data \
+ --with-fpm-group=www-data \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find \
+ /usr/local \
+ -type f \
+ -perm '/0111' \
+ -exec sh -euxc ' \
+ strip --strip-all "$@" || : \
+ ' -- '{}' + \
+ ; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+ runDeps="$( \
+ scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
+ | tr ',' '\n' \
+ | sort -u \
+ | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+ )"; \
+ apk add --no-cache $runDeps; \
+ \
+ apk del --no-network .build-deps; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.3 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.3 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/fpm /usr/local/bin/docker-php-entrypoint
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+ENTRYPOINT ["docker-php-entrypoint"]
+WORKDIR /var/www/html
+
+RUN set -eux; \
+ cd /usr/local/etc; \
+ if [ -d php-fpm.d ]; then \
+ # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf"
+ sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \
+ cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \
+ else \
+ # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency
+ mkdir php-fpm.d; \
+ cp php-fpm.conf.default php-fpm.d/www.conf; \
+ { \
+ echo '[global]'; \
+ echo 'include=etc/php-fpm.d/*.conf'; \
+ } | tee php-fpm.conf; \
+ fi; \
+ { \
+ echo '[global]'; \
+ echo 'error_log = /proc/self/fd/2'; \
+ echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \
+ echo; \
+ echo '[www]'; \
+ echo '; if we send this to /proc/self/fd/1, it never appears'; \
+ echo 'access.log = /proc/self/fd/2'; \
+ echo; \
+ echo 'clear_env = no'; \
+ echo; \
+ echo '; Ensure worker stdout and stderr are sent to the main error log.'; \
+ echo 'catch_workers_output = yes'; \
+ echo 'decorate_workers_output = no'; \
+ } | tee php-fpm.d/docker.conf; \
+ { \
+ echo '[global]'; \
+ echo 'daemonize = no'; \
+ echo; \
+ echo '[www]'; \
+ echo 'listen = 9000'; \
+ } | tee php-fpm.d/zz-docker.conf
+
+# Override stop signal to stop process gracefully
+# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163
+STOPSIGNAL SIGQUIT
+
+EXPOSE 9000
+CMD ["php-fpm"]
diff --git a/eol/7.3/fpm/Dockerfile b/eol/7.3/fpm/Dockerfile
new file mode 100644
index 0000000..91c2142
--- /dev/null
+++ b/eol/7.3/fpm/Dockerfile
@@ -0,0 +1,287 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/35d0a696b273c31f41ae224f189c19e794df91ae/7.3/bullseye/fpm),
+# with the changes marked "chialab:".
+#
+
+FROM debian:bullseye-slim
+
+# chialab: Debian bullseye has been moved to archive.debian.org.
+RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+ -e 's/security.debian.org/archive.debian.org/g' \
+ -e '/bullseye-updates/d' /etc/apt/sources.list
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ ; \
+ rm -rf /var/lib/apt/lists/*
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS CBAF69F173A0FEA4B537F470D66C9593118BCCB6 F38252826ACD957EF380D39F2F7956BC5DA04B5D
+
+ENV PHP_VERSION 7.3.33
+ENV PHP_URL="https://www.php.net/distributions/php-7.3.33.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.3.33.tar.xz.asc"
+ENV PHP_SHA256="166eaccde933381da9516a2b70ad0f447d7cec4b603d07b9a916032b215b90cc"
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends gnupg dirmngr; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apt-mark auto '.*' > /dev/null; \
+ apt-mark manual $savedAptMark > /dev/null; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.3,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ libargon2-dev \
+ libcurl4-openssl-dev \
+ libreadline-dev \
+ libsodium-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-iconv \
+ --with-openssl \
+ --with-readline \
+ --with-zlib \
+ \
+# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.")
+ --disable-phpdbg \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/bullseye/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+ --disable-cgi \
+ \
+ --enable-fpm \
+ --with-fpm-user=www-data \
+ --with-fpm-group=www-data \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find \
+ /usr/local \
+ -type f \
+ -perm '/0111' \
+ -exec sh -euxc ' \
+ strip --strip-all "$@" || : \
+ ' -- '{}' + \
+ ; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { print $(NF-1) }' \
+ | sort -u \
+ | xargs -r dpkg-query --search \
+ | cut -d: -f1 \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.3 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.3 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/fpm /usr/local/bin/docker-php-entrypoint
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+# temporary "freetype-config" workaround for https://github.com/docker-library/php/issues/865 (https://bugs.php.net/bug.php?id=76324)
+RUN { echo '#!/bin/sh'; echo 'exec pkg-config "$@" freetype2'; } > /usr/local/bin/freetype-config && chmod +x /usr/local/bin/freetype-config
+
+ENTRYPOINT ["docker-php-entrypoint"]
+WORKDIR /var/www/html
+
+RUN set -eux; \
+ cd /usr/local/etc; \
+ if [ -d php-fpm.d ]; then \
+ # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf"
+ sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \
+ cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \
+ else \
+ # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency
+ mkdir php-fpm.d; \
+ cp php-fpm.conf.default php-fpm.d/www.conf; \
+ { \
+ echo '[global]'; \
+ echo 'include=etc/php-fpm.d/*.conf'; \
+ } | tee php-fpm.conf; \
+ fi; \
+ { \
+ echo '[global]'; \
+ echo 'error_log = /proc/self/fd/2'; \
+ echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \
+ echo; \
+ echo '[www]'; \
+ echo '; if we send this to /proc/self/fd/1, it never appears'; \
+ echo 'access.log = /proc/self/fd/2'; \
+ echo; \
+ echo 'clear_env = no'; \
+ echo; \
+ echo '; Ensure worker stdout and stderr are sent to the main error log.'; \
+ echo 'catch_workers_output = yes'; \
+ echo 'decorate_workers_output = no'; \
+ } | tee php-fpm.d/docker.conf; \
+ { \
+ echo '[global]'; \
+ echo 'daemonize = no'; \
+ echo; \
+ echo '[www]'; \
+ echo 'listen = 9000'; \
+ } | tee php-fpm.d/zz-docker.conf
+
+# Override stop signal to stop process gracefully
+# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163
+STOPSIGNAL SIGQUIT
+
+EXPOSE 9000
+CMD ["php-fpm"]
diff --git a/eol/7.4/alpine/Dockerfile b/eol/7.4/alpine/Dockerfile
new file mode 100644
index 0000000..b4d7c46
--- /dev/null
+++ b/eol/7.4/alpine/Dockerfile
@@ -0,0 +1,220 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/1361ba95d80570e3984f9de9f765948246191557/7.4/alpine3.16/cli),
+# with the changes marked "chialab:".
+#
+
+FROM alpine:3.16
+
+# dependencies required for running "phpize"
+# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev dpkg \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkgconf \
+ re2c
+
+# persistent / runtime deps
+RUN apk add --no-cache \
+ ca-certificates \
+ curl \
+ tar \
+ xz \
+# https://github.com/docker-library/php/issues/494
+ openssl
+
+# ensure www-data user exists
+RUN set -eux; \
+ adduser -u 82 -D -S -G www-data www-data
+# 82 is the standard uid/gid for "www-data" in Alpine
+# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable
+# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable
+# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS 42670A7FE4D0441C8E4632349E4FDC074A4EF02D 5A52880781F755608BF815FC910DEB46F53EA312
+
+ENV PHP_VERSION 7.4.33
+ENV PHP_URL="https://www.php.net/distributions/php-7.4.33.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.4.33.tar.xz.asc"
+ENV PHP_SHA256="924846abf93bc613815c55dd3f5809377813ac62a9ec4eb3778675b82a27b927"
+
+RUN set -eux; \
+ \
+ apk add --no-cache --virtual .fetch-deps gnupg; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apk del --no-network .fetch-deps
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.4,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ apk add --no-cache --virtual .build-deps \
+ $PHPIZE_DEPS \
+ argon2-dev \
+ coreutils \
+ curl-dev \
+ gnu-libiconv-dev \
+ libsodium-dev \
+ libxml2-dev \
+ linux-headers \
+ oniguruma-dev \
+ openssl-dev \
+ readline-dev \
+ sqlite-dev \
+ ; \
+ \
+# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php)
+ rm -vf /usr/include/iconv.h; \
+# PHP < 8 doesn't know to look deeper for GNU libiconv: https://github.com/php/php-src/commit/b480e6841ecd5317faa136647a2b8253a4c2d0df
+ ln -sv /usr/include/gnu-libiconv/*.h /usr/include/; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-iconv=/usr \
+ --with-openssl \
+ --with-readline \
+ --with-zlib \
+ \
+# https://github.com/docker-library/php/pull/1259
+ --enable-phpdbg \
+ --enable-phpdbg-readline \
+ \
+# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear")
+ --with-pear \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/bullseye/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-musl' && echo '--without-pcre-jit') \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find \
+ /usr/local \
+ -type f \
+ -perm '/0111' \
+ -exec sh -euxc ' \
+ strip --strip-all "$@" || : \
+ ' -- '{}' + \
+ ; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+ runDeps="$( \
+ scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
+ | tr ',' '\n' \
+ | sort -u \
+ | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+ )"; \
+ apk add --no-cache $runDeps; \
+ \
+ apk del --no-network .build-deps; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.3 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.4 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/cli /usr/local/bin/docker-php-entrypoint
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+ENTRYPOINT ["docker-php-entrypoint"]
+CMD ["php", "-a"]
diff --git a/eol/7.4/apache/Dockerfile b/eol/7.4/apache/Dockerfile
new file mode 100644
index 0000000..a652345
--- /dev/null
+++ b/eol/7.4/apache/Dockerfile
@@ -0,0 +1,308 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/1361ba95d80570e3984f9de9f765948246191557/7.4/bullseye/apache),
+# with the changes marked "chialab:".
+#
+
+FROM debian:bullseye-slim
+
+# chialab: Debian bullseye has been moved to archive.debian.org.
+RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+ -e 's/security.debian.org/archive.debian.org/g' \
+ -e '/bullseye-updates/d' /etc/apt/sources.list
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ ; \
+ rm -rf /var/lib/apt/lists/*
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+ENV APACHE_CONFDIR /etc/apache2
+ENV APACHE_ENVVARS $APACHE_CONFDIR/envvars
+
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends apache2; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+# generically convert lines like
+# export APACHE_RUN_USER=www-data
+# into
+# : ${APACHE_RUN_USER:=www-data}
+# export APACHE_RUN_USER
+# so that they can be overridden at runtime ("-e APACHE_RUN_USER=...")
+ sed -ri 's/^export ([^=]+)=(.*)$/: ${\1:=\2}\nexport \1/' "$APACHE_ENVVARS"; \
+ \
+# setup directories and permissions
+ . "$APACHE_ENVVARS"; \
+ for dir in \
+ "$APACHE_LOCK_DIR" \
+ "$APACHE_RUN_DIR" \
+ "$APACHE_LOG_DIR" \
+ ; do \
+ rm -rvf "$dir"; \
+ mkdir -p "$dir"; \
+ chown "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$dir"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ chmod 777 "$dir"; \
+ done; \
+ \
+# delete the "index.html" that installing Apache drops in here
+ rm -rvf /var/www/html/*; \
+ \
+# logs should go to stdout / stderr
+ ln -sfT /dev/stderr "$APACHE_LOG_DIR/error.log"; \
+ ln -sfT /dev/stdout "$APACHE_LOG_DIR/access.log"; \
+ ln -sfT /dev/stdout "$APACHE_LOG_DIR/other_vhosts_access.log"; \
+ chown -R --no-dereference "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$APACHE_LOG_DIR"
+
+# Apache + PHP requires preforking Apache for best results
+RUN a2dismod mpm_event && a2enmod mpm_prefork
+
+# PHP files should be handled by PHP, and should be preferred over any other file type
+RUN { \
+ echo ''; \
+ echo '\tSetHandler application/x-httpd-php'; \
+ echo ''; \
+ echo; \
+ echo 'DirectoryIndex disabled'; \
+ echo 'DirectoryIndex index.php index.html'; \
+ echo; \
+ echo ''; \
+ echo '\tOptions -Indexes'; \
+ echo '\tAllowOverride All'; \
+ echo ''; \
+ } | tee "$APACHE_CONFDIR/conf-available/docker-php.conf" \
+ && a2enconf docker-php
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS 42670A7FE4D0441C8E4632349E4FDC074A4EF02D 5A52880781F755608BF815FC910DEB46F53EA312
+
+ENV PHP_VERSION 7.4.33
+ENV PHP_URL="https://www.php.net/distributions/php-7.4.33.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.4.33.tar.xz.asc"
+ENV PHP_SHA256="924846abf93bc613815c55dd3f5809377813ac62a9ec4eb3778675b82a27b927"
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends gnupg dirmngr; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apt-mark auto '.*' > /dev/null; \
+ apt-mark manual $savedAptMark > /dev/null; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.4,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ apache2-dev \
+ libargon2-dev \
+ libcurl4-openssl-dev \
+ libonig-dev \
+ libreadline-dev \
+ libsodium-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-iconv \
+ --with-openssl \
+ --with-readline \
+ --with-zlib \
+ \
+# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.")
+ --disable-phpdbg \
+ \
+# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear")
+ --with-pear \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/bullseye/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+ --disable-cgi \
+ \
+ --with-apxs2 \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find \
+ /usr/local \
+ -type f \
+ -perm '/0111' \
+ -exec sh -euxc ' \
+ strip --strip-all "$@" || : \
+ ' -- '{}' + \
+ ; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { print $(NF-1) }' \
+ | sort -u \
+ | xargs -r dpkg-query --search \
+ | cut -d: -f1 \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.3 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.4 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/apache /usr/local/bin/docker-php-entrypoint
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+ENTRYPOINT ["docker-php-entrypoint"]
+# https://httpd.apache.org/docs/2.4/stopping.html#gracefulstop
+STOPSIGNAL SIGWINCH
+
+# chialab: from eol/scripts.
+COPY --from=scripts apache2-foreground /usr/local/bin/
+WORKDIR /var/www/html
+
+EXPOSE 80
+CMD ["apache2-foreground"]
diff --git a/eol/7.4/cli/Dockerfile b/eol/7.4/cli/Dockerfile
new file mode 100644
index 0000000..fd3ff1f
--- /dev/null
+++ b/eol/7.4/cli/Dockerfile
@@ -0,0 +1,241 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/1361ba95d80570e3984f9de9f765948246191557/7.4/bullseye/cli),
+# with the changes marked "chialab:".
+#
+
+FROM debian:bullseye-slim
+
+# chialab: Debian bullseye has been moved to archive.debian.org.
+RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+ -e 's/security.debian.org/archive.debian.org/g' \
+ -e '/bullseye-updates/d' /etc/apt/sources.list
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ ; \
+ rm -rf /var/lib/apt/lists/*
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS 42670A7FE4D0441C8E4632349E4FDC074A4EF02D 5A52880781F755608BF815FC910DEB46F53EA312
+
+ENV PHP_VERSION 7.4.33
+ENV PHP_URL="https://www.php.net/distributions/php-7.4.33.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.4.33.tar.xz.asc"
+ENV PHP_SHA256="924846abf93bc613815c55dd3f5809377813ac62a9ec4eb3778675b82a27b927"
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends gnupg dirmngr; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apt-mark auto '.*' > /dev/null; \
+ apt-mark manual $savedAptMark > /dev/null; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.4,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ libargon2-dev \
+ libcurl4-openssl-dev \
+ libonig-dev \
+ libreadline-dev \
+ libsodium-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-iconv \
+ --with-openssl \
+ --with-readline \
+ --with-zlib \
+ \
+# https://github.com/docker-library/php/pull/1259
+ --enable-phpdbg \
+ --enable-phpdbg-readline \
+ \
+# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear")
+ --with-pear \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/bullseye/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+# https://github.com/docker-library/php/pull/939#issuecomment-730501748
+ --enable-embed \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find \
+ /usr/local \
+ -type f \
+ -perm '/0111' \
+ -exec sh -euxc ' \
+ strip --strip-all "$@" || : \
+ ' -- '{}' + \
+ ; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { print $(NF-1) }' \
+ | sort -u \
+ | xargs -r dpkg-query --search \
+ | cut -d: -f1 \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.3 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.4 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/cli /usr/local/bin/docker-php-entrypoint
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+ENTRYPOINT ["docker-php-entrypoint"]
+CMD ["php", "-a"]
diff --git a/eol/7.4/fpm-alpine/Dockerfile b/eol/7.4/fpm-alpine/Dockerfile
new file mode 100644
index 0000000..a0933a4
--- /dev/null
+++ b/eol/7.4/fpm-alpine/Dockerfile
@@ -0,0 +1,270 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/1361ba95d80570e3984f9de9f765948246191557/7.4/alpine3.16/fpm),
+# with the changes marked "chialab:".
+#
+
+FROM alpine:3.16
+
+# dependencies required for running "phpize"
+# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev dpkg \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkgconf \
+ re2c
+
+# persistent / runtime deps
+RUN apk add --no-cache \
+ ca-certificates \
+ curl \
+ tar \
+ xz \
+# https://github.com/docker-library/php/issues/494
+ openssl
+
+# ensure www-data user exists
+RUN set -eux; \
+ adduser -u 82 -D -S -G www-data www-data
+# 82 is the standard uid/gid for "www-data" in Alpine
+# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable
+# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable
+# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS 42670A7FE4D0441C8E4632349E4FDC074A4EF02D 5A52880781F755608BF815FC910DEB46F53EA312
+
+ENV PHP_VERSION 7.4.33
+ENV PHP_URL="https://www.php.net/distributions/php-7.4.33.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.4.33.tar.xz.asc"
+ENV PHP_SHA256="924846abf93bc613815c55dd3f5809377813ac62a9ec4eb3778675b82a27b927"
+
+RUN set -eux; \
+ \
+ apk add --no-cache --virtual .fetch-deps gnupg; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apk del --no-network .fetch-deps
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.4,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ apk add --no-cache --virtual .build-deps \
+ $PHPIZE_DEPS \
+ argon2-dev \
+ coreutils \
+ curl-dev \
+ gnu-libiconv-dev \
+ libsodium-dev \
+ libxml2-dev \
+ linux-headers \
+ oniguruma-dev \
+ openssl-dev \
+ readline-dev \
+ sqlite-dev \
+ ; \
+ \
+# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php)
+ rm -vf /usr/include/iconv.h; \
+# PHP < 8 doesn't know to look deeper for GNU libiconv: https://github.com/php/php-src/commit/b480e6841ecd5317faa136647a2b8253a4c2d0df
+ ln -sv /usr/include/gnu-libiconv/*.h /usr/include/; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-iconv=/usr \
+ --with-openssl \
+ --with-readline \
+ --with-zlib \
+ \
+# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.")
+ --disable-phpdbg \
+ \
+# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear")
+ --with-pear \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/bullseye/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-musl' && echo '--without-pcre-jit') \
+ \
+ --disable-cgi \
+ \
+ --enable-fpm \
+ --with-fpm-user=www-data \
+ --with-fpm-group=www-data \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find \
+ /usr/local \
+ -type f \
+ -perm '/0111' \
+ -exec sh -euxc ' \
+ strip --strip-all "$@" || : \
+ ' -- '{}' + \
+ ; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+ runDeps="$( \
+ scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
+ | tr ',' '\n' \
+ | sort -u \
+ | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+ )"; \
+ apk add --no-cache $runDeps; \
+ \
+ apk del --no-network .build-deps; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.3 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.4 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/fpm /usr/local/bin/docker-php-entrypoint
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+ENTRYPOINT ["docker-php-entrypoint"]
+WORKDIR /var/www/html
+
+RUN set -eux; \
+ cd /usr/local/etc; \
+ if [ -d php-fpm.d ]; then \
+ # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf"
+ sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \
+ cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \
+ else \
+ # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency
+ mkdir php-fpm.d; \
+ cp php-fpm.conf.default php-fpm.d/www.conf; \
+ { \
+ echo '[global]'; \
+ echo 'include=etc/php-fpm.d/*.conf'; \
+ } | tee php-fpm.conf; \
+ fi; \
+ { \
+ echo '[global]'; \
+ echo 'error_log = /proc/self/fd/2'; \
+ echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \
+ echo; \
+ echo '[www]'; \
+ echo '; if we send this to /proc/self/fd/1, it never appears'; \
+ echo 'access.log = /proc/self/fd/2'; \
+ echo; \
+ echo 'clear_env = no'; \
+ echo; \
+ echo '; Ensure worker stdout and stderr are sent to the main error log.'; \
+ echo 'catch_workers_output = yes'; \
+ echo 'decorate_workers_output = no'; \
+ } | tee php-fpm.d/docker.conf; \
+ { \
+ echo '[global]'; \
+ echo 'daemonize = no'; \
+ echo; \
+ echo '[www]'; \
+ echo 'listen = 9000'; \
+ } | tee php-fpm.d/zz-docker.conf
+
+# Override stop signal to stop process gracefully
+# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163
+STOPSIGNAL SIGQUIT
+
+EXPOSE 9000
+CMD ["php-fpm"]
diff --git a/eol/7.4/fpm/Dockerfile b/eol/7.4/fpm/Dockerfile
new file mode 100644
index 0000000..2ba20b7
--- /dev/null
+++ b/eol/7.4/fpm/Dockerfile
@@ -0,0 +1,288 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/1361ba95d80570e3984f9de9f765948246191557/7.4/bullseye/fpm),
+# with the changes marked "chialab:".
+#
+
+FROM debian:bullseye-slim
+
+# chialab: Debian bullseye has been moved to archive.debian.org.
+RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+ -e 's/security.debian.org/archive.debian.org/g' \
+ -e '/bullseye-updates/d' /etc/apt/sources.list
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ ; \
+ rm -rf /var/lib/apt/lists/*
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 777 /var/www/html
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS 42670A7FE4D0441C8E4632349E4FDC074A4EF02D 5A52880781F755608BF815FC910DEB46F53EA312
+
+ENV PHP_VERSION 7.4.33
+ENV PHP_URL="https://www.php.net/distributions/php-7.4.33.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.4.33.tar.xz.asc"
+ENV PHP_SHA256="924846abf93bc613815c55dd3f5809377813ac62a9ec4eb3778675b82a27b927"
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends gnupg dirmngr; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apt-mark auto '.*' > /dev/null; \
+ apt-mark manual $savedAptMark > /dev/null; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=7.4,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ libargon2-dev \
+ libcurl4-openssl-dev \
+ libonig-dev \
+ libreadline-dev \
+ libsodium-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-iconv \
+ --with-openssl \
+ --with-readline \
+ --with-zlib \
+ \
+# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.")
+ --disable-phpdbg \
+ \
+# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear")
+ --with-pear \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/bullseye/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+ --disable-cgi \
+ \
+ --enable-fpm \
+ --with-fpm-user=www-data \
+ --with-fpm-group=www-data \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find \
+ /usr/local \
+ -type f \
+ -perm '/0111' \
+ -exec sh -euxc ' \
+ strip --strip-all "$@" || : \
+ ' -- '{}' + \
+ ; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { print $(NF-1) }' \
+ | sort -u \
+ | xargs -r dpkg-query --search \
+ | cut -d: -f1 \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.3 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.4 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/fpm /usr/local/bin/docker-php-entrypoint
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+ENTRYPOINT ["docker-php-entrypoint"]
+WORKDIR /var/www/html
+
+RUN set -eux; \
+ cd /usr/local/etc; \
+ if [ -d php-fpm.d ]; then \
+ # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf"
+ sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \
+ cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \
+ else \
+ # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency
+ mkdir php-fpm.d; \
+ cp php-fpm.conf.default php-fpm.d/www.conf; \
+ { \
+ echo '[global]'; \
+ echo 'include=etc/php-fpm.d/*.conf'; \
+ } | tee php-fpm.conf; \
+ fi; \
+ { \
+ echo '[global]'; \
+ echo 'error_log = /proc/self/fd/2'; \
+ echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \
+ echo; \
+ echo '[www]'; \
+ echo '; if we send this to /proc/self/fd/1, it never appears'; \
+ echo 'access.log = /proc/self/fd/2'; \
+ echo; \
+ echo 'clear_env = no'; \
+ echo; \
+ echo '; Ensure worker stdout and stderr are sent to the main error log.'; \
+ echo 'catch_workers_output = yes'; \
+ echo 'decorate_workers_output = no'; \
+ } | tee php-fpm.d/docker.conf; \
+ { \
+ echo '[global]'; \
+ echo 'daemonize = no'; \
+ echo; \
+ echo '[www]'; \
+ echo 'listen = 9000'; \
+ } | tee php-fpm.d/zz-docker.conf
+
+# Override stop signal to stop process gracefully
+# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163
+STOPSIGNAL SIGQUIT
+
+EXPOSE 9000
+CMD ["php-fpm"]
diff --git a/eol/8.0/alpine/Dockerfile b/eol/8.0/alpine/Dockerfile
new file mode 100644
index 0000000..2be2802
--- /dev/null
+++ b/eol/8.0/alpine/Dockerfile
@@ -0,0 +1,218 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/df4636cac888ec860ccbf0f200637b88a2fb22ab/8.0/alpine3.16/cli),
+# with the changes marked "chialab:".
+#
+
+FROM alpine:3.16
+
+# dependencies required for running "phpize"
+# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev dpkg \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkgconf \
+ re2c
+
+# persistent / runtime deps
+RUN apk add --no-cache \
+ ca-certificates \
+ curl \
+ tar \
+ xz \
+# https://github.com/docker-library/php/issues/494
+ openssl
+
+# ensure www-data user exists
+RUN set -eux; \
+ adduser -u 82 -D -S -G www-data www-data
+# 82 is the standard uid/gid for "www-data" in Alpine
+# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable
+# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable
+# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 1777 /var/www/html
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS 1729F83938DA44E27BA0F4D3DBDB397470D12172 BFDDD28642824F8118EF77909B67A5C12229118F 2C16C765DBE54A088130F1BC4B9B5F600B55F3B4 39B641343D8C104B2B146DC3F9C39DC0B9698544
+
+ENV PHP_VERSION 8.0.30
+ENV PHP_URL="https://www.php.net/distributions/php-8.0.30.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.0.30.tar.xz.asc"
+ENV PHP_SHA256="216ab305737a5d392107112d618a755dc5df42058226f1670e9db90e77d777d9"
+
+RUN set -eux; \
+ \
+ apk add --no-cache --virtual .fetch-deps gnupg; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apk del --no-network .fetch-deps
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=8.0,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ apk add --no-cache --virtual .build-deps \
+ $PHPIZE_DEPS \
+ argon2-dev \
+ coreutils \
+ curl-dev \
+ gnu-libiconv-dev \
+ libsodium-dev \
+ libxml2-dev \
+ linux-headers \
+ oniguruma-dev \
+ openssl-dev \
+ readline-dev \
+ sqlite-dev \
+ ; \
+ \
+# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php)
+ rm -vf /usr/include/iconv.h; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-iconv=/usr \
+ --with-openssl \
+ --with-readline \
+ --with-zlib \
+ \
+# https://github.com/docker-library/php/pull/1259
+ --enable-phpdbg \
+ --enable-phpdbg-readline \
+ \
+# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear")
+ --with-pear \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/bullseye/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-musl' && echo '--without-pcre-jit') \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find \
+ /usr/local \
+ -type f \
+ -perm '/0111' \
+ -exec sh -euxc ' \
+ strip --strip-all "$@" || : \
+ ' -- '{}' + \
+ ; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+ runDeps="$( \
+ scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
+ | tr ',' '\n' \
+ | sort -u \
+ | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+ )"; \
+ apk add --no-cache $runDeps; \
+ \
+ apk del --no-network .build-deps; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.3 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.4 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/cli /usr/local/bin/docker-php-entrypoint
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+ENTRYPOINT ["docker-php-entrypoint"]
+CMD ["php", "-a"]
diff --git a/eol/8.0/apache/Dockerfile b/eol/8.0/apache/Dockerfile
new file mode 100644
index 0000000..7f2531e
--- /dev/null
+++ b/eol/8.0/apache/Dockerfile
@@ -0,0 +1,308 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/df4636cac888ec860ccbf0f200637b88a2fb22ab/8.0/bullseye/apache),
+# with the changes marked "chialab:".
+#
+
+FROM debian:bullseye-slim
+
+# chialab: Debian bullseye has been moved to archive.debian.org.
+RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+ -e 's/security.debian.org/archive.debian.org/g' \
+ -e '/bullseye-updates/d' /etc/apt/sources.list
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ ; \
+ rm -rf /var/lib/apt/lists/*
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 1777 /var/www/html
+
+ENV APACHE_CONFDIR /etc/apache2
+ENV APACHE_ENVVARS $APACHE_CONFDIR/envvars
+
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends apache2; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+# generically convert lines like
+# export APACHE_RUN_USER=www-data
+# into
+# : ${APACHE_RUN_USER:=www-data}
+# export APACHE_RUN_USER
+# so that they can be overridden at runtime ("-e APACHE_RUN_USER=...")
+ sed -ri 's/^export ([^=]+)=(.*)$/: ${\1:=\2}\nexport \1/' "$APACHE_ENVVARS"; \
+ \
+# setup directories and permissions
+ . "$APACHE_ENVVARS"; \
+ for dir in \
+ "$APACHE_LOCK_DIR" \
+ "$APACHE_RUN_DIR" \
+ "$APACHE_LOG_DIR" \
+ ; do \
+ rm -rvf "$dir"; \
+ mkdir -p "$dir"; \
+ chown "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$dir"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ chmod 1777 "$dir"; \
+ done; \
+ \
+# delete the "index.html" that installing Apache drops in here
+ rm -rvf /var/www/html/*; \
+ \
+# logs should go to stdout / stderr
+ ln -sfT /dev/stderr "$APACHE_LOG_DIR/error.log"; \
+ ln -sfT /dev/stdout "$APACHE_LOG_DIR/access.log"; \
+ ln -sfT /dev/stdout "$APACHE_LOG_DIR/other_vhosts_access.log"; \
+ chown -R --no-dereference "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$APACHE_LOG_DIR"
+
+# Apache + PHP requires preforking Apache for best results
+RUN a2dismod mpm_event && a2enmod mpm_prefork
+
+# PHP files should be handled by PHP, and should be preferred over any other file type
+RUN { \
+ echo ''; \
+ echo '\tSetHandler application/x-httpd-php'; \
+ echo ''; \
+ echo; \
+ echo 'DirectoryIndex disabled'; \
+ echo 'DirectoryIndex index.php index.html'; \
+ echo; \
+ echo ''; \
+ echo '\tOptions -Indexes'; \
+ echo '\tAllowOverride All'; \
+ echo ''; \
+ } | tee "$APACHE_CONFDIR/conf-available/docker-php.conf" \
+ && a2enconf docker-php
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS 1729F83938DA44E27BA0F4D3DBDB397470D12172 BFDDD28642824F8118EF77909B67A5C12229118F 2C16C765DBE54A088130F1BC4B9B5F600B55F3B4 39B641343D8C104B2B146DC3F9C39DC0B9698544
+
+ENV PHP_VERSION 8.0.30
+ENV PHP_URL="https://www.php.net/distributions/php-8.0.30.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.0.30.tar.xz.asc"
+ENV PHP_SHA256="216ab305737a5d392107112d618a755dc5df42058226f1670e9db90e77d777d9"
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends gnupg; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apt-mark auto '.*' > /dev/null; \
+ apt-mark manual $savedAptMark > /dev/null; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=8.0,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ apache2-dev \
+ libargon2-dev \
+ libcurl4-openssl-dev \
+ libonig-dev \
+ libreadline-dev \
+ libsodium-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-iconv \
+ --with-openssl \
+ --with-readline \
+ --with-zlib \
+ \
+# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.")
+ --disable-phpdbg \
+ \
+# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear")
+ --with-pear \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/bullseye/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+ --disable-cgi \
+ \
+ --with-apxs2 \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find \
+ /usr/local \
+ -type f \
+ -perm '/0111' \
+ -exec sh -euxc ' \
+ strip --strip-all "$@" || : \
+ ' -- '{}' + \
+ ; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { so = $(NF-1); if (index(so, "/usr/local/") == 1) { next }; gsub("^/(usr/)?", "", so); print so }' \
+ | sort -u \
+ | xargs -r dpkg-query --search \
+ | cut -d: -f1 \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.3 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.4 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/apache /usr/local/bin/docker-php-entrypoint
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+ENTRYPOINT ["docker-php-entrypoint"]
+# https://httpd.apache.org/docs/2.4/stopping.html#gracefulstop
+STOPSIGNAL SIGWINCH
+
+# chialab: from eol/scripts.
+COPY --from=scripts apache2-foreground /usr/local/bin/
+WORKDIR /var/www/html
+
+EXPOSE 80
+CMD ["apache2-foreground"]
diff --git a/eol/8.0/cli/Dockerfile b/eol/8.0/cli/Dockerfile
new file mode 100644
index 0000000..d237b26
--- /dev/null
+++ b/eol/8.0/cli/Dockerfile
@@ -0,0 +1,241 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/df4636cac888ec860ccbf0f200637b88a2fb22ab/8.0/bullseye/cli),
+# with the changes marked "chialab:".
+#
+
+FROM debian:bullseye-slim
+
+# chialab: Debian bullseye has been moved to archive.debian.org.
+RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+ -e 's/security.debian.org/archive.debian.org/g' \
+ -e '/bullseye-updates/d' /etc/apt/sources.list
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ ; \
+ rm -rf /var/lib/apt/lists/*
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 1777 /var/www/html
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS 1729F83938DA44E27BA0F4D3DBDB397470D12172 BFDDD28642824F8118EF77909B67A5C12229118F 2C16C765DBE54A088130F1BC4B9B5F600B55F3B4 39B641343D8C104B2B146DC3F9C39DC0B9698544
+
+ENV PHP_VERSION 8.0.30
+ENV PHP_URL="https://www.php.net/distributions/php-8.0.30.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.0.30.tar.xz.asc"
+ENV PHP_SHA256="216ab305737a5d392107112d618a755dc5df42058226f1670e9db90e77d777d9"
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends gnupg; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apt-mark auto '.*' > /dev/null; \
+ apt-mark manual $savedAptMark > /dev/null; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=8.0,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ libargon2-dev \
+ libcurl4-openssl-dev \
+ libonig-dev \
+ libreadline-dev \
+ libsodium-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-iconv \
+ --with-openssl \
+ --with-readline \
+ --with-zlib \
+ \
+# https://github.com/docker-library/php/pull/1259
+ --enable-phpdbg \
+ --enable-phpdbg-readline \
+ \
+# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear")
+ --with-pear \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/bullseye/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+# https://github.com/docker-library/php/pull/939#issuecomment-730501748
+ --enable-embed \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find \
+ /usr/local \
+ -type f \
+ -perm '/0111' \
+ -exec sh -euxc ' \
+ strip --strip-all "$@" || : \
+ ' -- '{}' + \
+ ; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { so = $(NF-1); if (index(so, "/usr/local/") == 1) { next }; gsub("^/(usr/)?", "", so); print so }' \
+ | sort -u \
+ | xargs -r dpkg-query --search \
+ | cut -d: -f1 \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.3 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.4 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/cli /usr/local/bin/docker-php-entrypoint
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+ENTRYPOINT ["docker-php-entrypoint"]
+CMD ["php", "-a"]
diff --git a/eol/8.0/fpm-alpine/Dockerfile b/eol/8.0/fpm-alpine/Dockerfile
new file mode 100644
index 0000000..f2ed862
--- /dev/null
+++ b/eol/8.0/fpm-alpine/Dockerfile
@@ -0,0 +1,274 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/df4636cac888ec860ccbf0f200637b88a2fb22ab/8.0/alpine3.16/fpm),
+# with the changes marked "chialab:".
+#
+
+FROM alpine:3.16
+
+# dependencies required for running "phpize"
+# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev dpkg \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkgconf \
+ re2c
+
+# persistent / runtime deps
+RUN apk add --no-cache \
+ ca-certificates \
+ curl \
+ tar \
+ xz \
+# https://github.com/docker-library/php/issues/494
+ openssl
+
+# ensure www-data user exists
+RUN set -eux; \
+ adduser -u 82 -D -S -G www-data www-data
+# 82 is the standard uid/gid for "www-data" in Alpine
+# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable
+# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable
+# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 1777 /var/www/html
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS 1729F83938DA44E27BA0F4D3DBDB397470D12172 BFDDD28642824F8118EF77909B67A5C12229118F 2C16C765DBE54A088130F1BC4B9B5F600B55F3B4 39B641343D8C104B2B146DC3F9C39DC0B9698544
+
+ENV PHP_VERSION 8.0.30
+ENV PHP_URL="https://www.php.net/distributions/php-8.0.30.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.0.30.tar.xz.asc"
+ENV PHP_SHA256="216ab305737a5d392107112d618a755dc5df42058226f1670e9db90e77d777d9"
+
+RUN set -eux; \
+ \
+ apk add --no-cache --virtual .fetch-deps gnupg; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apk del --no-network .fetch-deps
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=8.0,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ apk add --no-cache --virtual .build-deps \
+ $PHPIZE_DEPS \
+ argon2-dev \
+ coreutils \
+ curl-dev \
+ gnu-libiconv-dev \
+ libsodium-dev \
+ libxml2-dev \
+ linux-headers \
+ oniguruma-dev \
+ openssl-dev \
+ readline-dev \
+ sqlite-dev \
+ ; \
+ \
+# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php)
+ rm -vf /usr/include/iconv.h; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-iconv=/usr \
+ --with-openssl \
+ --with-readline \
+ --with-zlib \
+ \
+# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.")
+ --disable-phpdbg \
+ \
+# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear")
+ --with-pear \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/bullseye/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-musl' && echo '--without-pcre-jit') \
+ \
+ --disable-cgi \
+ \
+ --enable-fpm \
+ --with-fpm-user=www-data \
+ --with-fpm-group=www-data \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find \
+ /usr/local \
+ -type f \
+ -perm '/0111' \
+ -exec sh -euxc ' \
+ strip --strip-all "$@" || : \
+ ' -- '{}' + \
+ ; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+ runDeps="$( \
+ scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
+ | tr ',' '\n' \
+ | sort -u \
+ | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+ )"; \
+ apk add --no-cache $runDeps; \
+ \
+ apk del --no-network .build-deps; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.3 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.4 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/fpm /usr/local/bin/docker-php-entrypoint
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+ENTRYPOINT ["docker-php-entrypoint"]
+WORKDIR /var/www/html
+
+RUN set -eux; \
+ cd /usr/local/etc; \
+ if [ -d php-fpm.d ]; then \
+ # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf"
+ sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \
+ cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \
+ else \
+ # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency
+ mkdir php-fpm.d; \
+ cp php-fpm.conf.default php-fpm.d/www.conf; \
+ { \
+ echo '[global]'; \
+ echo 'include=etc/php-fpm.d/*.conf'; \
+ } | tee php-fpm.conf; \
+ fi; \
+ { \
+ echo '[global]'; \
+ echo 'error_log = /proc/self/fd/2'; \
+ echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \
+ echo; \
+ echo '[www]'; \
+ echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \
+ echo '; https://bugs.php.net/bug.php?id=73886'; \
+ echo 'access.log = /proc/self/fd/2'; \
+ echo; \
+ echo 'clear_env = no'; \
+ echo; \
+ echo '; Ensure worker stdout and stderr are sent to the main error log.'; \
+ echo 'catch_workers_output = yes'; \
+ echo 'decorate_workers_output = no'; \
+ } | tee php-fpm.d/docker.conf; \
+ { \
+ echo '[global]'; \
+ echo 'daemonize = no'; \
+ echo; \
+ echo '[www]'; \
+ echo 'listen = 9000'; \
+ } | tee php-fpm.d/zz-docker.conf; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+ { \
+ echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \
+ echo 'fastcgi.logging = Off'; \
+ } > "$PHP_INI_DIR/conf.d/docker-fpm.ini"
+
+# Override stop signal to stop process gracefully
+# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163
+STOPSIGNAL SIGQUIT
+
+EXPOSE 9000
+CMD ["php-fpm"]
diff --git a/eol/8.0/fpm/Dockerfile b/eol/8.0/fpm/Dockerfile
new file mode 100644
index 0000000..a7a1ad1
--- /dev/null
+++ b/eol/8.0/fpm/Dockerfile
@@ -0,0 +1,294 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/df4636cac888ec860ccbf0f200637b88a2fb22ab/8.0/bullseye/fpm),
+# with the changes marked "chialab:".
+#
+
+FROM debian:bullseye-slim
+
+# chialab: Debian bullseye has been moved to archive.debian.org.
+RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+ -e 's/security.debian.org/archive.debian.org/g' \
+ -e '/bullseye-updates/d' /etc/apt/sources.list
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ ; \
+ rm -rf /var/lib/apt/lists/*
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 1777 /var/www/html
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS 1729F83938DA44E27BA0F4D3DBDB397470D12172 BFDDD28642824F8118EF77909B67A5C12229118F 2C16C765DBE54A088130F1BC4B9B5F600B55F3B4 39B641343D8C104B2B146DC3F9C39DC0B9698544
+
+ENV PHP_VERSION 8.0.30
+ENV PHP_URL="https://www.php.net/distributions/php-8.0.30.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.0.30.tar.xz.asc"
+ENV PHP_SHA256="216ab305737a5d392107112d618a755dc5df42058226f1670e9db90e77d777d9"
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends gnupg; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ if [ -n "$PHP_ASC_URL" ]; then \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ fi; \
+ \
+ apt-mark auto '.*' > /dev/null; \
+ apt-mark manual $savedAptMark > /dev/null; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=8.0,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ libargon2-dev \
+ libcurl4-openssl-dev \
+ libonig-dev \
+ libreadline-dev \
+ libsodium-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-iconv \
+ --with-openssl \
+ --with-readline \
+ --with-zlib \
+ \
+# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.")
+ --disable-phpdbg \
+ \
+# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear")
+ --with-pear \
+ \
+# bundled pcre does not support JIT on s390x
+# https://manpages.debian.org/bullseye/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
+ $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+ --disable-cgi \
+ \
+ --enable-fpm \
+ --with-fpm-user=www-data \
+ --with-fpm-group=www-data \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find \
+ /usr/local \
+ -type f \
+ -perm '/0111' \
+ -exec sh -euxc ' \
+ strip --strip-all "$@" || : \
+ ' -- '{}' + \
+ ; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { so = $(NF-1); if (index(so, "/usr/local/") == 1) { next }; gsub("^/(usr/)?", "", so); print so }' \
+ | sort -u \
+ | xargs -r dpkg-query --search \
+ | cut -d: -f1 \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ rm -rf /var/lib/apt/lists/*; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.3 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/7.4 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/fpm /usr/local/bin/docker-php-entrypoint
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+ENTRYPOINT ["docker-php-entrypoint"]
+WORKDIR /var/www/html
+
+RUN set -eux; \
+ cd /usr/local/etc; \
+ if [ -d php-fpm.d ]; then \
+ # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf"
+ sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \
+ cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \
+ else \
+ # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency
+ mkdir php-fpm.d; \
+ cp php-fpm.conf.default php-fpm.d/www.conf; \
+ { \
+ echo '[global]'; \
+ echo 'include=etc/php-fpm.d/*.conf'; \
+ } | tee php-fpm.conf; \
+ fi; \
+ { \
+ echo '[global]'; \
+ echo 'error_log = /proc/self/fd/2'; \
+ echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \
+ echo; \
+ echo '[www]'; \
+ echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \
+ echo '; https://bugs.php.net/bug.php?id=73886'; \
+ echo 'access.log = /proc/self/fd/2'; \
+ echo; \
+ echo 'clear_env = no'; \
+ echo; \
+ echo '; Ensure worker stdout and stderr are sent to the main error log.'; \
+ echo 'catch_workers_output = yes'; \
+ echo 'decorate_workers_output = no'; \
+ } | tee php-fpm.d/docker.conf; \
+ { \
+ echo '[global]'; \
+ echo 'daemonize = no'; \
+ echo; \
+ echo '[www]'; \
+ echo 'listen = 9000'; \
+ } | tee php-fpm.d/zz-docker.conf; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+ { \
+ echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \
+ echo 'fastcgi.logging = Off'; \
+ } > "$PHP_INI_DIR/conf.d/docker-fpm.ini"
+
+# Override stop signal to stop process gracefully
+# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163
+STOPSIGNAL SIGQUIT
+
+EXPOSE 9000
+CMD ["php-fpm"]
diff --git a/eol/8.1/alpine/Dockerfile b/eol/8.1/alpine/Dockerfile
new file mode 100644
index 0000000..b05de84
--- /dev/null
+++ b/eol/8.1/alpine/Dockerfile
@@ -0,0 +1,242 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/5c037abaf9dc0095e29807c048d9d1b97e6a9716/8.1/alpine3.21/cli),
+# with the changes marked "chialab:".
+#
+
+FROM alpine:3.21
+
+# dependencies required for running "phpize"
+# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev dpkg \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkgconf \
+ re2c
+
+# persistent / runtime deps
+RUN apk add --no-cache \
+ ca-certificates \
+ curl \
+ openssl \
+ tar \
+ xz
+
+# ensure www-data user exists
+RUN set -eux; \
+ adduser -u 82 -D -S -G www-data www-data
+# 82 is the standard uid/gid for "www-data" in Alpine
+# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable
+# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable
+# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 1777 /var/www/html
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS 528995BFEDFBA7191D46839EF9BA0ADA31CBD89E 39B641343D8C104B2B146DC3F9C39DC0B9698544 F1F692238FBC1666E5A5CCD4199F9DFEF6FFBAFD
+
+ENV PHP_VERSION 8.1.34
+ENV PHP_URL="https://www.php.net/distributions/php-8.1.34.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.1.34.tar.xz.asc"
+ENV PHP_SHA256="ffa9e0982e82eeaea848f57687b425ed173aa278fe563001310ae2638db5c251"
+
+RUN set -eux; \
+ \
+ apk add --no-cache --virtual .fetch-deps gnupg; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ \
+ apk del --no-network .fetch-deps
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=8.1,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ apk add --no-cache --virtual .build-deps \
+ $PHPIZE_DEPS \
+ argon2-dev \
+ coreutils \
+ curl-dev \
+ gnu-libiconv-dev \
+ libsodium-dev \
+ libxml2-dev \
+ linux-headers \
+ oniguruma-dev \
+ openssl-dev \
+ patch \
+ patchutils \
+ readline-dev \
+ sqlite-dev \
+ ; \
+ \
+# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php)
+ rm -vf /usr/include/iconv.h; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511
+ PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \
+ PHP_UNAME='Linux - Docker' \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+# Apply patches; see https://github.com/docker-library/php/pull/1552
+ # https://github.com/php/php-src/issues/11678
+ curl -fL 'https://github.com/php/php-src/commit/577b8ae4226368e66fee7a9b5c58f9e2428372fc.patch?full_index=1' -o 11678.patch; \
+ echo '6edc20c3bb3e7cc13515abce7f2fffa8ebea6cf7469abfbc78fcdc120350b239 *11678.patch' | sha256sum -c -; \
+ patch -p1 < 11678.patch; \
+ rm 11678.patch; \
+ # https://github.com/php/php-src/pull/19131
+ # this backported commit broke our ability to apply 14834, which is the fix we need, so this is applied as a reverse patch to undo it
+ # 19131 was for FreeBSD, so doesn't apply to this alpine build
+ curl -fL 'https://github.com/php/php-src/commit/a5df26691d1b1f71b964b869510473a5d5413999.patch?full_index=1' -o 19131.patch; \
+ echo 'c98c01c74d3a6da197116f8511b16fed361ca6bbb6a8af8df629a933f541c213 *19131.patch' | sha256sum -c -; \
+ patch --reverse -p1 < 19131.patch; \
+ rm 19131.patch; \
+ # https://github.com/php/php-src/issues/14834
+ curl -fL 'https://github.com/php/php-src/commit/67259e451d5d58b4842776c5696a66d74e157609.patch?full_index=1' -o 14834.patch; \
+ echo 'ed10a1b254091ad676ed204e55628ecbd6c8962004d6185a1821cedecd526c0f *14834.patch' | sha256sum -c -; \
+ filterdiff -x '*/NEWS' 14834.patch | patch -p1; \
+ rm 14834.patch; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here for compatibility with existing versions. ftp_ssl_connect() needed ftp to be compiled statically before PHP 7.0 (see https://github.com/docker-library/php/issues/236).
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-iconv=/usr \
+ --with-openssl \
+ --with-readline \
+ --with-zlib \
+ \
+# https://github.com/docker-library/php/pull/1259
+ --enable-phpdbg \
+ --enable-phpdbg-readline \
+ \
+# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear")
+ --with-pear \
+ \
+# bundled pcre does not support JIT on riscv64 until 10.41 (php 8.3+)
+# https://github.com/PCRE2Project/pcre2/commits/pcre2-10.41/src/sljit/sljitNativeRISCV_64.c
+# https://github.com/php/php-src/tree/php-8.3.0/ext/pcre/pcre2lib
+ $(test "$gnuArch" = 'riscv64-linux-musl' && echo '--without-pcre-jit') \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find \
+ /usr/local \
+ -type f \
+ -perm '/0111' \
+ -exec sh -euxc ' \
+ strip --strip-all "$@" || : \
+ ' -- '{}' + \
+ ; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+ runDeps="$( \
+ scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
+ | tr ',' '\n' \
+ | sort -u \
+ | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+ )"; \
+ apk add --no-cache $runDeps; \
+ \
+ apk del --no-network .build-deps; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.3 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/8.1 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/cli /usr/local/bin/docker-php-entrypoint
+
+# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required)
+RUN docker-php-ext-enable opcache
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+ENTRYPOINT ["docker-php-entrypoint"]
+CMD ["php", "-a"]
diff --git a/eol/8.1/apache/Dockerfile b/eol/8.1/apache/Dockerfile
new file mode 100644
index 0000000..4c312ca
--- /dev/null
+++ b/eol/8.1/apache/Dockerfile
@@ -0,0 +1,311 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/5c037abaf9dc0095e29807c048d9d1b97e6a9716/8.1/trixie/apache),
+# with the changes marked "chialab:".
+#
+
+FROM debian:trixie-slim
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ ; \
+ apt-get dist-clean
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 1777 /var/www/html
+
+ENV APACHE_CONFDIR /etc/apache2
+ENV APACHE_ENVVARS $APACHE_CONFDIR/envvars
+
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends apache2; \
+ apt-get dist-clean; \
+ \
+# generically convert lines like
+# export APACHE_RUN_USER=www-data
+# into
+# : ${APACHE_RUN_USER:=www-data}
+# export APACHE_RUN_USER
+# so that they can be overridden at runtime ("-e APACHE_RUN_USER=...")
+ sed -ri 's/^export ([^=]+)=(.*)$/: ${\1:=\2}\nexport \1/' "$APACHE_ENVVARS"; \
+ \
+# setup directories and permissions
+ . "$APACHE_ENVVARS"; \
+ for dir in \
+ "$APACHE_LOCK_DIR" \
+ "$APACHE_RUN_DIR" \
+ "$APACHE_LOG_DIR" \
+# https://salsa.debian.org/apache-team/apache2/-/commit/b97ca8714890ead1ba6c095699dde752e8433205
+ "$APACHE_RUN_DIR/socks" \
+ ; do \
+ rm -rvf "$dir"; \
+ mkdir -p "$dir"; \
+ chown "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$dir"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ chmod 1777 "$dir"; \
+ done; \
+ \
+# delete the "index.html" that installing Apache drops in here
+ rm -rvf /var/www/html/*; \
+ \
+# logs should go to stdout / stderr
+ ln -sfT /dev/stderr "$APACHE_LOG_DIR/error.log"; \
+ ln -sfT /dev/stdout "$APACHE_LOG_DIR/access.log"; \
+ ln -sfT /dev/stdout "$APACHE_LOG_DIR/other_vhosts_access.log"; \
+ chown -R --no-dereference "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$APACHE_LOG_DIR"
+
+# Apache + PHP requires preforking Apache for best results
+RUN a2dismod mpm_event && a2enmod mpm_prefork
+
+# PHP files should be handled by PHP, and should be preferred over any other file type
+RUN { \
+ echo ''; \
+ echo '\tSetHandler application/x-httpd-php'; \
+ echo ''; \
+ echo; \
+ echo 'DirectoryIndex disabled'; \
+ echo 'DirectoryIndex index.php index.html'; \
+ echo; \
+ echo ''; \
+ echo '\tOptions -Indexes'; \
+ echo '\tAllowOverride All'; \
+ echo ''; \
+ } | tee "$APACHE_CONFDIR/conf-available/docker-php.conf" \
+ && a2enconf docker-php
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS 528995BFEDFBA7191D46839EF9BA0ADA31CBD89E 39B641343D8C104B2B146DC3F9C39DC0B9698544 F1F692238FBC1666E5A5CCD4199F9DFEF6FFBAFD
+
+ENV PHP_VERSION 8.1.34
+ENV PHP_URL="https://www.php.net/distributions/php-8.1.34.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.1.34.tar.xz.asc"
+ENV PHP_SHA256="ffa9e0982e82eeaea848f57687b425ed173aa278fe563001310ae2638db5c251"
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends gnupg; \
+ apt-get dist-clean; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ \
+ apt-mark auto '.*' > /dev/null; \
+ apt-mark manual $savedAptMark > /dev/null; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=8.1,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ apache2-dev \
+ libargon2-dev \
+ libcurl4-openssl-dev \
+ libonig-dev \
+ libreadline-dev \
+ libsodium-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511
+ PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \
+ PHP_UNAME='Linux - Docker' \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here for compatibility with existing versions. ftp_ssl_connect() needed ftp to be compiled statically before PHP 7.0 (see https://github.com/docker-library/php/issues/236).
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-iconv \
+ --with-openssl \
+ --with-readline \
+ --with-zlib \
+ \
+# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.")
+ --disable-phpdbg \
+ \
+# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear")
+ --with-pear \
+ \
+# bundled pcre does not support JIT on riscv64 until 10.41 (php 8.3+)
+# https://github.com/PCRE2Project/pcre2/commits/pcre2-10.41/src/sljit/sljitNativeRISCV_64.c
+# https://github.com/php/php-src/tree/php-8.3.0/ext/pcre/pcre2lib
+ $(test "$gnuArch" = 'riscv64-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+ --disable-cgi \
+ \
+ --with-apxs2 \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find \
+ /usr/local \
+ -type f \
+ -perm '/0111' \
+ -exec sh -euxc ' \
+ strip --strip-all "$@" || : \
+ ' -- '{}' + \
+ ; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { so = $(NF-1); if (index(so, "/usr/local/") == 1) { next }; gsub("^/(usr/)?", "", so); printf "*%s\n", so }' \
+ | sort -u \
+ | xargs -rt dpkg-query --search \
+# https://manpages.debian.org/trixie/dpkg/dpkg-query.1.en.html#S (we ignore diversions and it'll be really unusual for more than one package to provide any given .so file)
+ | awk 'sub(":$", "", $1) { print $1 }' \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ apt-get dist-clean; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.3 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/8.1 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/apache /usr/local/bin/docker-php-entrypoint
+
+# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required)
+RUN docker-php-ext-enable opcache
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+ENTRYPOINT ["docker-php-entrypoint"]
+# https://httpd.apache.org/docs/2.4/stopping.html#gracefulstop
+STOPSIGNAL SIGWINCH
+
+# chialab: from eol/scripts.
+COPY --from=scripts apache2-foreground /usr/local/bin/
+WORKDIR /var/www/html
+
+EXPOSE 80
+CMD ["apache2-foreground"]
diff --git a/eol/8.1/cli/Dockerfile b/eol/8.1/cli/Dockerfile
new file mode 100644
index 0000000..0ac5fd7
--- /dev/null
+++ b/eol/8.1/cli/Dockerfile
@@ -0,0 +1,242 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/5c037abaf9dc0095e29807c048d9d1b97e6a9716/8.1/trixie/cli),
+# with the changes marked "chialab:".
+#
+
+FROM debian:trixie-slim
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ ; \
+ apt-get dist-clean
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 1777 /var/www/html
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS 528995BFEDFBA7191D46839EF9BA0ADA31CBD89E 39B641343D8C104B2B146DC3F9C39DC0B9698544 F1F692238FBC1666E5A5CCD4199F9DFEF6FFBAFD
+
+ENV PHP_VERSION 8.1.34
+ENV PHP_URL="https://www.php.net/distributions/php-8.1.34.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.1.34.tar.xz.asc"
+ENV PHP_SHA256="ffa9e0982e82eeaea848f57687b425ed173aa278fe563001310ae2638db5c251"
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends gnupg; \
+ apt-get dist-clean; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ \
+ apt-mark auto '.*' > /dev/null; \
+ apt-mark manual $savedAptMark > /dev/null; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=8.1,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ libargon2-dev \
+ libcurl4-openssl-dev \
+ libonig-dev \
+ libreadline-dev \
+ libsodium-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511
+ PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \
+ PHP_UNAME='Linux - Docker' \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here for compatibility with existing versions. ftp_ssl_connect() needed ftp to be compiled statically before PHP 7.0 (see https://github.com/docker-library/php/issues/236).
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-iconv \
+ --with-openssl \
+ --with-readline \
+ --with-zlib \
+ \
+# https://github.com/docker-library/php/pull/1259
+ --enable-phpdbg \
+ --enable-phpdbg-readline \
+ \
+# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear")
+ --with-pear \
+ \
+# bundled pcre does not support JIT on riscv64 until 10.41 (php 8.3+)
+# https://github.com/PCRE2Project/pcre2/commits/pcre2-10.41/src/sljit/sljitNativeRISCV_64.c
+# https://github.com/php/php-src/tree/php-8.3.0/ext/pcre/pcre2lib
+ $(test "$gnuArch" = 'riscv64-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+# https://github.com/docker-library/php/pull/939#issuecomment-730501748
+ --enable-embed \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find \
+ /usr/local \
+ -type f \
+ -perm '/0111' \
+ -exec sh -euxc ' \
+ strip --strip-all "$@" || : \
+ ' -- '{}' + \
+ ; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { so = $(NF-1); if (index(so, "/usr/local/") == 1) { next }; gsub("^/(usr/)?", "", so); printf "*%s\n", so }' \
+ | sort -u \
+ | xargs -rt dpkg-query --search \
+# https://manpages.debian.org/trixie/dpkg/dpkg-query.1.en.html#S (we ignore diversions and it'll be really unusual for more than one package to provide any given .so file)
+ | awk 'sub(":$", "", $1) { print $1 }' \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ apt-get dist-clean; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.3 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/8.1 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/cli /usr/local/bin/docker-php-entrypoint
+
+# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required)
+RUN docker-php-ext-enable opcache
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+ENTRYPOINT ["docker-php-entrypoint"]
+CMD ["php", "-a"]
diff --git a/eol/8.1/fpm-alpine/Dockerfile b/eol/8.1/fpm-alpine/Dockerfile
new file mode 100644
index 0000000..830519f
--- /dev/null
+++ b/eol/8.1/fpm-alpine/Dockerfile
@@ -0,0 +1,298 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/5c037abaf9dc0095e29807c048d9d1b97e6a9716/8.1/alpine3.21/fpm),
+# with the changes marked "chialab:".
+#
+
+FROM alpine:3.21
+
+# dependencies required for running "phpize"
+# these get automatically installed and removed by "docker-php-ext-*" (unless they're already installed)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev dpkg \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkgconf \
+ re2c
+
+# persistent / runtime deps
+RUN apk add --no-cache \
+ ca-certificates \
+ curl \
+ openssl \
+ tar \
+ xz
+
+# ensure www-data user exists
+RUN set -eux; \
+ adduser -u 82 -D -S -G www-data www-data
+# 82 is the standard uid/gid for "www-data" in Alpine
+# https://git.alpinelinux.org/aports/tree/main/apache2/apache2.pre-install?h=3.14-stable
+# https://git.alpinelinux.org/aports/tree/main/lighttpd/lighttpd.pre-install?h=3.14-stable
+# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install?h=3.14-stable
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 1777 /var/www/html
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS 528995BFEDFBA7191D46839EF9BA0ADA31CBD89E 39B641343D8C104B2B146DC3F9C39DC0B9698544 F1F692238FBC1666E5A5CCD4199F9DFEF6FFBAFD
+
+ENV PHP_VERSION 8.1.34
+ENV PHP_URL="https://www.php.net/distributions/php-8.1.34.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.1.34.tar.xz.asc"
+ENV PHP_SHA256="ffa9e0982e82eeaea848f57687b425ed173aa278fe563001310ae2638db5c251"
+
+RUN set -eux; \
+ \
+ apk add --no-cache --virtual .fetch-deps gnupg; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ \
+ apk del --no-network .fetch-deps
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=8.1,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ apk add --no-cache --virtual .build-deps \
+ $PHPIZE_DEPS \
+ argon2-dev \
+ coreutils \
+ curl-dev \
+ gnu-libiconv-dev \
+ libsodium-dev \
+ libxml2-dev \
+ linux-headers \
+ oniguruma-dev \
+ openssl-dev \
+ patch \
+ patchutils \
+ readline-dev \
+ sqlite-dev \
+ ; \
+ \
+# make sure musl's iconv doesn't get used (https://www.php.net/manual/en/intro.iconv.php)
+ rm -vf /usr/include/iconv.h; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511
+ PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \
+ PHP_UNAME='Linux - Docker' \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+# Apply patches; see https://github.com/docker-library/php/pull/1552
+ # https://github.com/php/php-src/issues/11678
+ curl -fL 'https://github.com/php/php-src/commit/577b8ae4226368e66fee7a9b5c58f9e2428372fc.patch?full_index=1' -o 11678.patch; \
+ echo '6edc20c3bb3e7cc13515abce7f2fffa8ebea6cf7469abfbc78fcdc120350b239 *11678.patch' | sha256sum -c -; \
+ patch -p1 < 11678.patch; \
+ rm 11678.patch; \
+ # https://github.com/php/php-src/pull/19131
+ # this backported commit broke our ability to apply 14834, which is the fix we need, so this is applied as a reverse patch to undo it
+ # 19131 was for FreeBSD, so doesn't apply to this alpine build
+ curl -fL 'https://github.com/php/php-src/commit/a5df26691d1b1f71b964b869510473a5d5413999.patch?full_index=1' -o 19131.patch; \
+ echo 'c98c01c74d3a6da197116f8511b16fed361ca6bbb6a8af8df629a933f541c213 *19131.patch' | sha256sum -c -; \
+ patch --reverse -p1 < 19131.patch; \
+ rm 19131.patch; \
+ # https://github.com/php/php-src/issues/14834
+ curl -fL 'https://github.com/php/php-src/commit/67259e451d5d58b4842776c5696a66d74e157609.patch?full_index=1' -o 14834.patch; \
+ echo 'ed10a1b254091ad676ed204e55628ecbd6c8962004d6185a1821cedecd526c0f *14834.patch' | sha256sum -c -; \
+ filterdiff -x '*/NEWS' 14834.patch | patch -p1; \
+ rm 14834.patch; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here for compatibility with existing versions. ftp_ssl_connect() needed ftp to be compiled statically before PHP 7.0 (see https://github.com/docker-library/php/issues/236).
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-iconv=/usr \
+ --with-openssl \
+ --with-readline \
+ --with-zlib \
+ \
+# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.")
+ --disable-phpdbg \
+ \
+# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear")
+ --with-pear \
+ \
+# bundled pcre does not support JIT on riscv64 until 10.41 (php 8.3+)
+# https://github.com/PCRE2Project/pcre2/commits/pcre2-10.41/src/sljit/sljitNativeRISCV_64.c
+# https://github.com/php/php-src/tree/php-8.3.0/ext/pcre/pcre2lib
+ $(test "$gnuArch" = 'riscv64-linux-musl' && echo '--without-pcre-jit') \
+ \
+ --disable-cgi \
+ \
+ --enable-fpm \
+ --with-fpm-user=www-data \
+ --with-fpm-group=www-data \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find \
+ /usr/local \
+ -type f \
+ -perm '/0111' \
+ -exec sh -euxc ' \
+ strip --strip-all "$@" || : \
+ ' -- '{}' + \
+ ; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+ runDeps="$( \
+ scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
+ | tr ',' '\n' \
+ | sort -u \
+ | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+ )"; \
+ apk add --no-cache $runDeps; \
+ \
+ apk del --no-network .build-deps; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.3 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/8.1 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/fpm /usr/local/bin/docker-php-entrypoint
+
+# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required)
+RUN docker-php-ext-enable opcache
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+ENTRYPOINT ["docker-php-entrypoint"]
+WORKDIR /var/www/html
+
+RUN set -eux; \
+ cd /usr/local/etc; \
+ if [ -d php-fpm.d ]; then \
+ # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf"
+ sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \
+ cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \
+ else \
+ # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency
+ mkdir php-fpm.d; \
+ cp php-fpm.conf.default php-fpm.d/www.conf; \
+ { \
+ echo '[global]'; \
+ echo 'include=etc/php-fpm.d/*.conf'; \
+ } | tee php-fpm.conf; \
+ fi; \
+ { \
+ echo '[global]'; \
+ echo 'error_log = /proc/self/fd/2'; \
+ echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \
+ echo; \
+ echo '[www]'; \
+ echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \
+ echo '; https://bugs.php.net/bug.php?id=73886'; \
+ echo 'access.log = /proc/self/fd/2'; \
+ echo; \
+ echo 'clear_env = no'; \
+ echo; \
+ echo '; Ensure worker stdout and stderr are sent to the main error log.'; \
+ echo 'catch_workers_output = yes'; \
+ echo 'decorate_workers_output = no'; \
+ } | tee php-fpm.d/docker.conf; \
+ { \
+ echo '[global]'; \
+ echo 'daemonize = no'; \
+ echo; \
+ echo '[www]'; \
+ echo 'listen = 9000'; \
+ } | tee php-fpm.d/zz-docker.conf; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+ { \
+ echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \
+ echo 'fastcgi.logging = Off'; \
+ } > "$PHP_INI_DIR/conf.d/docker-fpm.ini"
+
+# Override stop signal to stop process gracefully
+# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163
+STOPSIGNAL SIGQUIT
+
+EXPOSE 9000
+CMD ["php-fpm"]
diff --git a/eol/8.1/fpm/Dockerfile b/eol/8.1/fpm/Dockerfile
new file mode 100644
index 0000000..96c920c
--- /dev/null
+++ b/eol/8.1/fpm/Dockerfile
@@ -0,0 +1,295 @@
+#
+# Taken from the official PHP image's Dockerfile
+# (https://github.com/docker-library/php/tree/5c037abaf9dc0095e29807c048d9d1b97e6a9716/8.1/trixie/fpm),
+# with the changes marked "chialab:".
+#
+
+FROM debian:trixie-slim
+
+# prevent Debian's PHP packages from being installed
+# https://github.com/docker-library/php/pull/542
+RUN set -eux; \
+ { \
+ echo 'Package: php*'; \
+ echo 'Pin: release *'; \
+ echo 'Pin-Priority: -1'; \
+ } > /etc/apt/preferences.d/no-debian-php
+
+# dependencies required for running "phpize"
+# (see persistent deps below)
+ENV PHPIZE_DEPS \
+ autoconf \
+ dpkg-dev \
+ file \
+ g++ \
+ gcc \
+ libc-dev \
+ make \
+ pkg-config \
+ re2c
+
+# persistent / runtime deps
+RUN set -eux; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ $PHPIZE_DEPS \
+ ca-certificates \
+ curl \
+ xz-utils \
+ ; \
+ apt-get dist-clean
+
+ENV PHP_INI_DIR /usr/local/etc/php
+RUN set -eux; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
+ [ ! -d /var/www/html ]; \
+ mkdir -p /var/www/html; \
+ chown www-data:www-data /var/www/html; \
+ chmod 1777 /var/www/html
+
+# Apply stack smash protection to functions using local buffers and alloca()
+# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
+# Enable optimization (-O2)
+# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
+# https://github.com/docker-library/php/issues/272
+# -D_LARGEFILE_SOURCE and -D_FILE_OFFSET_BITS=64 (https://www.php.net/manual/en/intro.filesystem.php)
+ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ENV PHP_CPPFLAGS="$PHP_CFLAGS"
+ENV PHP_LDFLAGS="-Wl,-O1 -pie"
+
+ENV GPG_KEYS 528995BFEDFBA7191D46839EF9BA0ADA31CBD89E 39B641343D8C104B2B146DC3F9C39DC0B9698544 F1F692238FBC1666E5A5CCD4199F9DFEF6FFBAFD
+
+ENV PHP_VERSION 8.1.34
+ENV PHP_URL="https://www.php.net/distributions/php-8.1.34.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-8.1.34.tar.xz.asc"
+ENV PHP_SHA256="ffa9e0982e82eeaea848f57687b425ed173aa278fe563001310ae2638db5c251"
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends gnupg; \
+ apt-get dist-clean; \
+ \
+ mkdir -p /usr/src; \
+ cd /usr/src; \
+ \
+ curl -fsSL -o php.tar.xz "$PHP_URL"; \
+ \
+ if [ -n "$PHP_SHA256" ]; then \
+ echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
+ fi; \
+ \
+ curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; \
+ export GNUPGHOME="$(mktemp -d)"; \
+ for key in $GPG_KEYS; do \
+ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
+ done; \
+ gpg --batch --verify php.tar.xz.asc php.tar.xz; \
+ gpgconf --kill all; \
+ rm -rf "$GNUPGHOME"; \
+ \
+ apt-mark auto '.*' > /dev/null; \
+ apt-mark manual $savedAptMark > /dev/null; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+
+# chialab: helper scripts are shared by all eol/ images, see eol/scripts.
+COPY --from=scripts docker-php-source /usr/local/bin/
+
+# chialab: security backports for this EOL version (see eol/patches).
+ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
+LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
+RUN --mount=type=bind,from=patches,source=8.1,target=/usr/src/php-patches \
+ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
+ docker-php-source-patch /usr/src/php-patches
+
+RUN set -eux; \
+ \
+ savedAptMark="$(apt-mark showmanual)"; \
+ apt-get update; \
+ apt-get install -y --no-install-recommends \
+ libargon2-dev \
+ libcurl4-openssl-dev \
+ libonig-dev \
+ libreadline-dev \
+ libsodium-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libxml2-dev \
+ zlib1g-dev \
+ ; \
+ \
+ export \
+ CFLAGS="$PHP_CFLAGS" \
+ CPPFLAGS="$PHP_CPPFLAGS" \
+ LDFLAGS="$PHP_LDFLAGS" \
+# https://github.com/php/php-src/blob/d6299206dd828382753453befd1b915491b741c6/configure.ac#L1496-L1511
+ PHP_BUILD_PROVIDER='https://github.com/docker-library/php' \
+ PHP_UNAME='Linux - Docker' \
+ ; \
+ docker-php-source extract; \
+ cd /usr/src/php; \
+ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+ debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+# https://bugs.php.net/bug.php?id=74125
+ if [ ! -d /usr/include/curl ]; then \
+ ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
+ fi; \
+ ./configure \
+ --build="$gnuArch" \
+ --with-config-file-path="$PHP_INI_DIR" \
+ --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
+ \
+# make sure invalid --configure-flags are fatal errors instead of just warnings
+ --enable-option-checking=fatal \
+ \
+# https://github.com/docker-library/php/issues/439
+ --with-mhash \
+ \
+# https://github.com/docker-library/php/issues/822
+ --with-pic \
+ \
+# --enable-ftp is included here for compatibility with existing versions. ftp_ssl_connect() needed ftp to be compiled statically before PHP 7.0 (see https://github.com/docker-library/php/issues/236).
+ --enable-ftp \
+# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
+ --enable-mbstring \
+# --enable-mysqlnd is included here because it's harder to compile after the fact than extensions are (since it's a plugin for several extensions, not an extension in itself)
+ --enable-mysqlnd \
+# https://wiki.php.net/rfc/argon2_password_hash
+ --with-password-argon2 \
+# https://wiki.php.net/rfc/libsodium
+ --with-sodium=shared \
+# always build against system sqlite3 (https://github.com/php/php-src/commit/6083a387a81dbbd66d6316a3a12a63f06d5f7109)
+ --with-pdo-sqlite=/usr \
+ --with-sqlite3=/usr \
+ \
+ --with-curl \
+ --with-iconv \
+ --with-openssl \
+ --with-readline \
+ --with-zlib \
+ \
+# https://github.com/bwoebi/phpdbg-docs/issues/1#issuecomment-163872806 ("phpdbg is primarily a CLI debugger, and is not suitable for debugging an fpm stack.")
+ --disable-phpdbg \
+ \
+# in PHP 7.4+, the pecl/pear installers are officially deprecated (requiring an explicit "--with-pear")
+ --with-pear \
+ \
+# bundled pcre does not support JIT on riscv64 until 10.41 (php 8.3+)
+# https://github.com/PCRE2Project/pcre2/commits/pcre2-10.41/src/sljit/sljitNativeRISCV_64.c
+# https://github.com/php/php-src/tree/php-8.3.0/ext/pcre/pcre2lib
+ $(test "$gnuArch" = 'riscv64-linux-gnu' && echo '--without-pcre-jit') \
+ --with-libdir="lib/$debMultiarch" \
+ \
+ --disable-cgi \
+ \
+ --enable-fpm \
+ --with-fpm-user=www-data \
+ --with-fpm-group=www-data \
+ ; \
+ make -j "$(nproc)"; \
+ find -type f -name '*.a' -delete; \
+ make install; \
+ find \
+ /usr/local \
+ -type f \
+ -perm '/0111' \
+ -exec sh -euxc ' \
+ strip --strip-all "$@" || : \
+ ' -- '{}' + \
+ ; \
+ make clean; \
+ \
+# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
+ cp -v php.ini-* "$PHP_INI_DIR/"; \
+ \
+ cd /; \
+ docker-php-source delete; \
+ \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+ apt-mark auto '.*' > /dev/null; \
+ [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
+ find /usr/local -type f -executable -exec ldd '{}' ';' \
+ | awk '/=>/ { so = $(NF-1); if (index(so, "/usr/local/") == 1) { next }; gsub("^/(usr/)?", "", so); printf "*%s\n", so }' \
+ | sort -u \
+ | xargs -rt dpkg-query --search \
+# https://manpages.debian.org/trixie/dpkg/dpkg-query.1.en.html#S (we ignore diversions and it'll be really unusual for more than one package to provide any given .so file)
+ | awk 'sub(":$", "", $1) { print $1 }' \
+ | sort -u \
+ | xargs -r apt-mark manual \
+ ; \
+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+ apt-get dist-clean; \
+ \
+# update pecl channel definitions https://github.com/docker-library/php/issues/443
+ pecl update-channels; \
+ rm -rf /tmp/pear ~/.pearrc; \
+ \
+# smoke test
+ php --version
+
+# chialab: from eol/scripts.
+COPY --from=scripts docker-php-ext-configure/7.2 /usr/local/bin/docker-php-ext-configure
+COPY --from=scripts docker-php-ext-enable/7.3 /usr/local/bin/docker-php-ext-enable
+COPY --from=scripts docker-php-ext-install/8.1 /usr/local/bin/docker-php-ext-install
+COPY --from=scripts docker-php-entrypoint/fpm /usr/local/bin/docker-php-entrypoint
+
+# enable OPcache by default (https://wiki.php.net/rfc/make_opcache_required)
+RUN docker-php-ext-enable opcache
+
+# sodium was built as a shared module (so that it can be replaced later if so desired), so let's enable it too (https://github.com/docker-library/php/issues/598)
+RUN docker-php-ext-enable sodium
+
+ENTRYPOINT ["docker-php-entrypoint"]
+WORKDIR /var/www/html
+
+RUN set -eux; \
+ cd /usr/local/etc; \
+ if [ -d php-fpm.d ]; then \
+ # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf"
+ sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \
+ cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \
+ else \
+ # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency
+ mkdir php-fpm.d; \
+ cp php-fpm.conf.default php-fpm.d/www.conf; \
+ { \
+ echo '[global]'; \
+ echo 'include=etc/php-fpm.d/*.conf'; \
+ } | tee php-fpm.conf; \
+ fi; \
+ { \
+ echo '[global]'; \
+ echo 'error_log = /proc/self/fd/2'; \
+ echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; \
+ echo; \
+ echo '[www]'; \
+ echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/fd/1 does not work.'; \
+ echo '; https://bugs.php.net/bug.php?id=73886'; \
+ echo 'access.log = /proc/self/fd/2'; \
+ echo; \
+ echo 'clear_env = no'; \
+ echo; \
+ echo '; Ensure worker stdout and stderr are sent to the main error log.'; \
+ echo 'catch_workers_output = yes'; \
+ echo 'decorate_workers_output = no'; \
+ } | tee php-fpm.d/docker.conf; \
+ { \
+ echo '[global]'; \
+ echo 'daemonize = no'; \
+ echo; \
+ echo '[www]'; \
+ echo 'listen = 9000'; \
+ } | tee php-fpm.d/zz-docker.conf; \
+ mkdir -p "$PHP_INI_DIR/conf.d"; \
+ { \
+ echo '; https://github.com/docker-library/php/issues/878#issuecomment-938595965'; \
+ echo 'fastcgi.logging = Off'; \
+ } > "$PHP_INI_DIR/conf.d/docker-fpm.ini"
+
+# Override stop signal to stop process gracefully
+# https://github.com/php/php-src/blob/17baa87faddc2550def3ae7314236826bc1b1398/sapi/fpm/php-fpm.8.in#L163
+STOPSIGNAL SIGQUIT
+
+EXPOSE 9000
+CMD ["php-fpm"]
diff --git a/eol/README.md b/eol/README.md
new file mode 100644
index 0000000..bb243b8
--- /dev/null
+++ b/eol/README.md
@@ -0,0 +1,57 @@
+# EOL PHP versions
+
+The official images stop receiving updates once a PHP version reaches end of life. For those
+versions we build PHP ourselves from the official images' Dockerfiles, with security patches
+applied to the sources, and use the result as the base image instead of `php:`.
+
+- `//Dockerfile`: the official Dockerfiles, one per tag suffix (`cli`, `apache`,
+ `fpm`, `alpine`, `fpm-alpine`).
+- `scripts/`: the helper scripts copied into the images (`docker-php-*`, `apache2-foreground`),
+ passed to the build as the `scripts` named context.
+- `patches/`: `docker-php-source-patch` and one `/series` of patches per version, passed to
+ the build as the `patches` named context.
+
+The build picks a directory up on its own: if `eol//` exists, the Makefile and
+`build-images.yml` build it as the base image. No workflow lists EOL versions.
+
+## Adding a version
+
+Add it once there is a security patch to apply: `make test` fails an EOL image whose
+`PHP_PATCHES` is empty. Until then, keep building on the official image.
+
+1. **Find the source.** Take the last [docker-library/php](https://github.com/docker-library/php)
+ commit that still has the `/` directory. For each flavor, pick the variant the plain
+ official tag pointed to: `//{cli,apache,fpm}` and
+ `/alpine/{cli,fpm}` for `alpine` and `fpm-alpine`.
+2. **Copy the Dockerfiles** to `eol///Dockerfile`, with the header used by the
+ other versions linking the exact source path at that commit. Copy only the Dockerfile, not
+ the scripts next to it.
+3. **Mark every change** with a `# chialab:` comment:
+ - replace the `COPY docker-php-*` and `COPY apache2-foreground` lines with
+ `COPY --from=scripts …` (see [Scripts](#scripts));
+ - add the patch step right after `docker-php-source` is copied, as in the other versions:
+ `ENV PHP_PATCHES`, `LABEL it.chialab.php.patches` and the `RUN` that bind-mounts
+ `patches/` and runs `docker-php-source-patch`;
+ - once the OS release is archived, or a download host or keyserver disappears, fix it the
+ same way the older versions do.
+4. **Add the patches** to `patches//` and list them in its `series`, with a comment
+ linking where each one comes from.
+5. **Update the range** of EOL versions in the main [README](../README.md).
+
+## Scripts
+
+Each script in `scripts/` covers a range of PHP versions. Versioned scripts are named after the
+first version that uses them, and serve every later version until the next file: for example,
+`docker-php-ext-install/7.4` is used by both 7.4 and 8.0, and 8.1 has its own file.
+Entrypoints vary by flavor rather than version, so they're named `cli` (also for `alpine`),
+`fpm` (also for `fpm-alpine`) and `apache`.
+
+When adding a version, compare each script from the docker-library directory with the newest
+file in `scripts/`:
+
+- if it's identical, point the new Dockerfile at that file;
+- if it differs, add it as `scripts/