Repository navigation
fix: Apache logs, php.ini, HTTPS detection and CI health check - #58
Merged
Merged
Conversation
The php:*-apache base images link /var/log/apache2/{access,error}.log to
/dev/stdout and /dev/stderr. Cleaning /var/log/* after apt-get deleted those
links, so apache2-foreground recreated the directory and Apache wrote its
logs to files inside the container: invisible to `docker logs` and growing
without bound. Only the apt lists are removed now.
The Apache images shipped no php.ini, so PHP ran on its built-in defaults, which are development ones: zend.assertions=1 (assert() calls compiled and executed in production) and the PHP version in an X-Powered-By header. They now start from php.ini-production, as the FrankenPHP images already do, with conf.d/app.ini on top. app.ini also sets expose_php = Off, which php.ini-production leaves on.
SetEnvIf matched a header named X_FORWARDED_PROTO, which no proxy sends, so $_SERVER['HTTPS'] was never set behind a TLS-terminating proxy.
The CI images run no web server, so the curl health check always failed and every container using them was reported unhealthy.
The Apache images piped the getcomposer.org installer into php without checking its signature. They now use install-php-extensions @composer like 8.5-symfony, the CI and FrankenPHP images.
guillaume-sainthillier
enabled auto-merge
October 12, 2026 13:13
guillaume-sainthillier
added a commit
that referenced
this pull request
Oct 12, 2026
Same changes as #58 (Apache logs on stdout/stderr, php.ini-production, X-Forwarded-Proto, no health check in the CI image, Composer through install-php-extensions) and #59 (OPcache timestamps and sizing), so the 8.6 folders match 8.5 apart from the base image. conf/ is copied from _shared/ as it will be once both are merged; until then, running update.sh on this branch alone would revert it.
guillaume-sainthillier
added a commit
that referenced
this pull request
Oct 12, 2026
* feat: add PHP 8.6 release candidate images Add the 8.6, 8.6-ci and 8.6-symfony variants, copied from 8.5 and built from the upstream php:8.6-rc-apache / php:8.6-rc-alpine images (8.6.0RC3 today). They are published as silarhi/php-apache:8.6* and listed in the CI matrix and the Makefile; latest stays on 8.5 until 8.6.0 is released. FrankenPHP variants are not added yet: dunglas/frankenphp has no PHP 8.6 tag so far. * fix: apply the image and OPcache fixes to the PHP 8.6 images Same changes as #58 (Apache logs on stdout/stderr, php.ini-production, X-Forwarded-Proto, no health check in the CI image, Composer through install-php-extensions) and #59 (OPcache timestamps and sizing), so the 8.6 folders match 8.5 apart from the base image. conf/ is copied from _shared/ as it will be once both are merged; until then, running update.sh on this branch alone would revert it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes from an audit of the images, one commit per change. Each was checked on locally built
8.5,8.5-symfony,8.1-symfonyand8.5-ciimages (before → after):rm -rf /var/log/*deleted the base image's/var/log/apache2/*.log → /dev/stdout|stderrlinks, so Apache logged to files inside the container. Access lines indocker logsafter 3 requests: 0 → 3. Already the case in the published images.zend.assertionswas1and responses carriedX-Powered-By: PHP/x.y.z. Nowphp.ini-production+conf.d/app.ini(as the FrankenPHP images do),zend.assertions=-1, andexpose_php = Offinapp.ini(production ini leaves it on, so this also applies to FrankenPHP).SetEnvIf X_FORWARDED_PROTOnever matched the realX-Forwarded-Protoheader;$_SERVER['HTTPS']is nowonwithX-Forwarded-Proto: https. Like before the bug, the header is not limited to trusted proxies.unhealthy. Removed.phpunchecked; nowinstall-php-extensions @composer, like every other variant.apache.conf/php.inicome from_shared/and were synced withupdate.sh(legacy folders included, as usual), but only the 8.1–8.5 Dockerfiles changed: legacy images aren't rebuilt by CI.Behaviour changes for derived images:
php.ini-productionsetserror_reporting = E_ALL & ~E_DEPRECATED,variables_order = "GPCS"($_ENVis no longer filled;getenv()and$_SERVERare unaffected) andzend.assertions = -1. The Apache/Symfony images get the same PHP settings as the FrankenPHP ones.PHP 8.6 (#57) gets the same changes in its own PR.