|
| 1 | +# Base Image to use for build. |
| 2 | +ARG BASE_IMAGE=base |
| 3 | +# CPU Architecture. Can be "x86_64" or "arm64" |
| 4 | +ARG CPU_ARCHITECTURE |
| 5 | +# Platform used to build the image. Can be "linux/amd64" or "linux/arm64". |
| 6 | +ARG DOCKER_PLATFORM |
| 7 | + |
| 8 | +FROM --platform=${DOCKER_PLATFORM} ymirapp/${BASE_IMAGE}:${CPU_ARCHITECTURE} as php-build |
| 9 | + |
| 10 | +############################################################################### |
| 11 | +# Oniguruma |
| 12 | +# This library is not packaged in PHP since PHP 7.4. |
| 13 | +# See https://github.com/php/php-src/blob/43dc7da8e3719d3e89bd8ec15ebb13f997bbbaa9/UPGRADING#L578-L581 |
| 14 | +# We do not install the system version because I didn't manage to make it work... |
| 15 | +# Ideally we shouldn't compile it ourselves. |
| 16 | +# https://github.com/kkos/oniguruma/releases |
| 17 | +# Needed by: |
| 18 | +# - php mbstring |
| 19 | +ENV VERSION_ONIG=6.9.9 |
| 20 | +ENV ONIG_BUILD_DIR=${BUILD_DIR}/oniguruma |
| 21 | +RUN set -xe; \ |
| 22 | + mkdir -p ${ONIG_BUILD_DIR}; \ |
| 23 | + curl -Ls https://github.com/kkos/oniguruma/releases/download/v${VERSION_ONIG}/onig-${VERSION_ONIG}.tar.gz \ |
| 24 | + | tar xzC ${ONIG_BUILD_DIR} --strip-components=1 |
| 25 | +WORKDIR ${ONIG_BUILD_DIR}/ |
| 26 | +RUN set -xe; \ |
| 27 | + ./configure --prefix=${INSTALL_DIR}; \ |
| 28 | + make -j $(nproc); \ |
| 29 | + make install |
| 30 | + |
| 31 | + |
| 32 | +ENV VERSION_PHP=8.4.1 |
| 33 | + |
| 34 | + |
| 35 | +ENV PHP_BUILD_DIR=${BUILD_DIR}/php |
| 36 | +RUN set -xe; \ |
| 37 | + mkdir -p ${PHP_BUILD_DIR}; \ |
| 38 | + # Download and upack the source code |
| 39 | + # --location will follow redirects |
| 40 | + # --silent will hide the progress, but also the errors: we restore error messages with --show-error |
| 41 | + # --fail makes sure that curl returns an error instead of fetching the 404 page |
| 42 | + curl --location --silent --show-error --fail https://www.php.net/get/php-${VERSION_PHP}.tar.gz/from/this/mirror \ |
| 43 | + | tar xzC ${PHP_BUILD_DIR} --strip-components=1 |
| 44 | +# Move into the unpackaged code directory |
| 45 | +WORKDIR ${PHP_BUILD_DIR}/ |
| 46 | + |
| 47 | +# Configure the build |
| 48 | +# -fstack-protector-strong : Be paranoid about stack overflows |
| 49 | +# -fpic : Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) |
| 50 | +# -fpie : Support Address Space Layout Randomization (see -fpic) |
| 51 | +# -O3 : Optimize for fastest binaries possible. |
| 52 | +# -I : Add the path to the list of directories to be searched for header files during preprocessing. |
| 53 | +# --enable-option-checking=fatal: make sure invalid --configure-flags are fatal errors instead of just warnings |
| 54 | +# --enable-ftp: because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236) |
| 55 | +# --enable-mbstring: because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) |
| 56 | +# --with-zlib and --with-zlib-dir: See https://stackoverflow.com/a/42978649/245552 |
| 57 | +# --with-pear: necessary for `pecl` to work (to install PHP extensions) |
| 58 | +# |
| 59 | +RUN set -xe \ |
| 60 | + && ./buildconf --force \ |
| 61 | + && CFLAGS="-fstack-protector-strong -fpic -fpie -O3 -I${INSTALL_DIR}/include -I/usr/include -ffunction-sections -fdata-sections" \ |
| 62 | + CPPFLAGS="-fstack-protector-strong -fpic -fpie -O3 -I${INSTALL_DIR}/include -I/usr/include -ffunction-sections -fdata-sections" \ |
| 63 | + LDFLAGS="-L${INSTALL_DIR}/lib64 -L${INSTALL_DIR}/lib -Wl,-O1 -Wl,--strip-all -Wl,--hash-style=both -pie" \ |
| 64 | + ./configure \ |
| 65 | + --prefix=${INSTALL_DIR} \ |
| 66 | + --enable-option-checking=fatal \ |
| 67 | + --enable-sockets \ |
| 68 | + --with-config-file-path=${INSTALL_DIR}/etc/php \ |
| 69 | + --with-config-file-scan-dir=${INSTALL_DIR}/etc/php/conf.d:/var/task/php/conf.d \ |
| 70 | + --enable-fpm \ |
| 71 | + --disable-cgi \ |
| 72 | + --enable-cli \ |
| 73 | + --disable-phpdbg \ |
| 74 | + --with-sodium \ |
| 75 | + --with-readline \ |
| 76 | + --with-openssl \ |
| 77 | + --with-zlib=${INSTALL_DIR} \ |
| 78 | + --with-curl \ |
| 79 | + --enable-exif \ |
| 80 | + --enable-ftp \ |
| 81 | + --with-gettext \ |
| 82 | + --enable-mbstring \ |
| 83 | + --with-pdo-mysql=shared,mysqlnd \ |
| 84 | + --with-mysqli \ |
| 85 | + --enable-pcntl \ |
| 86 | + --with-zip \ |
| 87 | + --enable-bcmath \ |
| 88 | + --enable-intl=shared \ |
| 89 | + --enable-soap \ |
| 90 | + --with-xsl=${INSTALL_DIR} \ |
| 91 | + --with-pear |
| 92 | +RUN make -j $(nproc) |
| 93 | +# Run `make install` and override PEAR's PHAR URL because pear.php.net is down |
| 94 | +RUN set -xe; \ |
| 95 | + make install PEAR_INSTALLER_URL='https://github.com/pear/pearweb_phars/raw/master/install-pear-nozlib.phar'; \ |
| 96 | + { find ${INSTALL_DIR}/bin ${INSTALL_DIR}/sbin -type f -perm +0111 -exec strip --strip-all '{}' + || true; }; \ |
| 97 | + make clean; \ |
| 98 | + cp php.ini-production ${INSTALL_DIR}/etc/php/php.ini |
| 99 | + |
| 100 | +# Install extensions using pecl |
| 101 | +RUN pecl install APCu |
| 102 | +RUN pecl install igbinary |
| 103 | +RUN pecl install msgpack |
| 104 | +RUN pecl install zstd |
| 105 | + |
| 106 | +# Build extensions |
| 107 | +WORKDIR ${IMAGICK_BUILD_DIR} |
| 108 | +RUN set -xe; \ |
| 109 | + pecl download imagick-${VERSION_IMAGICK_EXTENSION}; \ |
| 110 | + tar xzf imagick-${VERSION_IMAGICK_EXTENSION}.tgz |
| 111 | +WORKDIR ${IMAGICK_BUILD_DIR}/imagick-${VERSION_IMAGICK_EXTENSION} |
| 112 | +RUN set -xe; \ |
| 113 | + phpize; \ |
| 114 | + ./configure --with-imagick=${INSTALL_DIR}; \ |
| 115 | + make -j $(nproc); \ |
| 116 | + make install; |
| 117 | + |
| 118 | +RUN set -xe; \ |
| 119 | + mkdir -p ${RELAY_BUILD_DIR}; \ |
| 120 | + RELAY_CPU_ARCHITECTURE=$(arch | sed -e 's/arm64/aarch64/;s/amd64\|x86_64/x86-64/') && \ |
| 121 | + curl -L "https://builds.r2.relay.so/v${VERSION_RELAY_EXTENSION}/relay-v${VERSION_RELAY_EXTENSION}-php8.4-centos7-${RELAY_CPU_ARCHITECTURE}.tar.gz" \ |
| 122 | + | tar xzC ${RELAY_BUILD_DIR} --strip-components=1 |
| 123 | +WORKDIR ${RELAY_BUILD_DIR}/ |
| 124 | +RUN cp relay.ini ${INSTALL_DIR}/etc/php/conf.d/50-relay.ini; \ |
| 125 | + cp relay-pkg.so ${INSTALL_DIR}/lib/php/extensions/no-debug-non-zts-20230831/relay.so; \ |
| 126 | + sed -i "s/00000000-0000-0000-0000-000000000000/$(cat /proc/sys/kernel/random/uuid)/" ${INSTALL_DIR}/lib/php/extensions/no-debug-non-zts-20230831/relay.so; |
| 127 | + |
| 128 | +# Install Composer |
| 129 | +RUN curl -sS https://getcomposer.org/installer | ${INSTALL_DIR}/bin/php -- --install-dir=${INSTALL_DIR}/bin/ --filename=composer |
| 130 | + |
| 131 | +# Symlink all our binaries into /opt/bin so that Lambda sees them in the path. |
| 132 | +RUN mkdir -p /opt/bin \ |
| 133 | + && cd /opt/bin \ |
| 134 | + && ln -s ../ymir/bin/* . \ |
| 135 | + && ln -s ../ymir/sbin/* . |
| 136 | + |
| 137 | +# Remove extra files to make the layers as slim as possible |
| 138 | +COPY clean.sh /tmp |
| 139 | +RUN /tmp/clean.sh && rm /tmp/clean.sh |
| 140 | + |
| 141 | +# Copy config files |
| 142 | +COPY php.ini ${INSTALL_DIR}/etc/php/conf.d |
| 143 | +COPY php-fpm.conf ${INSTALL_DIR}/etc/php-fpm.d |
| 144 | + |
| 145 | +# Build PHP runtime |
| 146 | +RUN git clone https://github.com/ymirapp/php-runtime.git /tmp/runtime-build \ |
| 147 | + && cd /tmp/runtime-build \ |
| 148 | + && git checkout tags/v1.12.4 \ |
| 149 | + && cd /opt \ |
| 150 | + && cp -R /tmp/runtime-build/composer.json /tmp/runtime-build/composer.lock /tmp/runtime-build/runtime/bootstrap /tmp/runtime-build/runtime/runtime.php /tmp/runtime-build/src /tmp/runtime-build/templates ./ \ |
| 151 | + && chmod 0555 /opt/bootstrap /opt/runtime.php \ |
| 152 | + && composer install --no-dev |
| 153 | + |
| 154 | +# Now we start back from a clean image. |
| 155 | +# We get rid of everything that is unnecessary (build tools, source code, and anything else |
| 156 | +# that might have created intermediate layers for docker) by copying online the /opt directory. |
| 157 | +FROM --platform=${DOCKER_PLATFORM} public.ecr.aws/lambda/provided:al2-${CPU_ARCHITECTURE} |
| 158 | +ENV PATH="/opt/bin:${PATH}" \ |
| 159 | + LD_LIBRARY_PATH="/opt/ymir/lib64:/opt/ymir/lib" |
| 160 | + |
| 161 | +# Copy everything we built above into the same dir on the base AmazonLinux container. |
| 162 | +COPY --from=php-build /opt /opt |
| 163 | + |
| 164 | +# Needed for building the layer |
| 165 | +COPY --from=php-build /usr/lib64 /usr/lib64 |
0 commit comments