自定义nginx-php74的基础镜像

这个版本有必要的包，主要是配置文件和依赖。

cat Dockerfile 
FROM docker.1ms.run/debian:11

ENV DEBIAN_FRONTEND=noninteractive

RUN echo "deb http://archive.debian.org/debian bullseye main contrib non-free" > /etc/apt/sources.list \
    && echo "deb http://archive.debian.org/debian bullseye-updates main contrib non-free" >> /etc/apt/sources.list \
    && echo "deb http://archive.debian.org/debian-security bullseye-security main contrib non-free" >> /etc/apt/sources.list \
    && apt-get update -o Acquire::Check-Valid-Until=false

# 安装依赖
RUN apt-get update && apt-get install -y --no-install-recommends \
    git \
    build-essential \
    autoconf \
    automake \
    libtool \
    bison \
    re2c \
    pkg-config \
    libssl-dev \
    libxml2-dev \
    libcurl4-openssl-dev \
    libonig-dev \
    libsodium-dev \
    libsqlite3-dev \
    zlib1g-dev \
    libreadline-dev \
    libargon2-dev \
    nginx \
    supervisor \
    ca-certificates \
    procps curl libpng-dev libjpeg-dev libfreetype6-dev \
    && rm -rf /var/lib/apt/lists/*

# 创建应用用户 application uid/gid 1000
RUN groupadd -g 1000 application \
    && useradd -m -u 1000 -g 1000 -s /usr/sbin/nologin application

# 这里的源码是cve2026 7.4的补丁包源码直接在github下载就好
COPY php-src /usr/src/php-src

# 编译 PHP 7.4 补丁版本
RUN cd /usr/src/php-src \
    && ./buildconf --force \
    && ./configure \
    '--build=x86_64-linux-gnu' \
    '--with-config-file-path=/usr/local/etc/php' \
    '--with-config-file-scan-dir=/usr/local/etc/php/conf.d' \
    '--enable-option-checking=fatal' \
    '--with-mhash' \
    '--with-pic' \
    '--enable-ftp' \
    '--enable-mbstring' \
    '--enable-mysqlnd' \
    '--with-password-argon2' \
    '--with-sodium=shared' \
    '--with-pdo-sqlite=/usr' \
    '--with-sqlite3=/usr' \
    '--with-curl' \
    '--with-iconv' \
    '--with-openssl' \
    '--with-readline' \
    '--with-zlib' \
    '--disable-phpdbg' \
    '--with-pear' \
    '--with-libdir=lib/x86_64-linux-gnu' \
    '--disable-cgi' \
    '--enable-fpm' \
    '--with-fpm-user=application' \
    '--with-fpm-group=application' \
    '--with-pdo-mysql=mysqlnd' \
    '--with-mysqli=mysqlnd' \
    '--enable-gd' \
    '--with-jpeg' \
    '--with-freetype' \
    'build_alias=x86_64-linux-gnu' \
    && make -j$(nproc) \
    && make install \
    && rm -rf /usr/src/php-src \
    && echo 'include=/usr/local/etc/php-fpm.d/*.conf' >> /usr/local/etc/php-fpm.conf

# 创建 php 配置目录
RUN mkdir -p /usr/local/etc/php /usr/local/etc/php/conf.d && \
    printf "no\nno\nno\nno\nno\nyes\n" | pecl install redis

COPY php.ini /usr/local/etc/php/php.ini

# php-fpm pool 配置
COPY php-fpm.conf /usr/local/etc/php-fpm.d/www.conf

# nginx 主配置
COPY nginx.conf /etc/nginx/nginx.conf

# supervisor 配置
COPY supervisor.conf /etc/supervisor/conf.d/supervisor.conf

# 网站目录权限
RUN  mkdir -p /app && chown -R application:application /app

# 暴露端口
EXPOSE 80

WORKDIR /app

# supervisor 入口
CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/supervisord.conf"]

需要的配置文件

cat nginx.conf 
user application;
worker_processes auto;
error_log /dev/stdout;
pid /run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /dev/stdout main;

    sendfile        on;
    tcp_nopush     on;
    tcp_nodelay    on;
    keepalive_timeout  65;
    # 上传限制 500M
    client_max_body_size 500M;

    server {
        listen 80;
        server_name _;
        root /app;
        index index.php index.html;

        location / {
            try_files $uri $uri/ /index.php$is_args$args;
        }

        location ~ \.php$ {
            fastcgi_pass 127.0.0.1:9000;
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param SERVER_NAME $host;
        }

        # 禁止访问 php-fpm 日志、ini 等敏感文件
        location ~ /\. {
            deny all;
        }
    }
    include /etc/nginx/conf.d/*.conf;
}



---

cat php-fpm.conf 
[global]
daemonize = no
error_log = /dev/stderr
log_buffering = yes
log_level = notice

[www]
user = application
group = application
listen = 127.0.0.1:9000
listen.owner = application
listen.group = application
pm = dynamic
pm.max_children = 20
pm.start_servers = 5
pm.min_spare_servers =  2
pm.max_spare_servers = 8

; 日志输出到 stdout
access.format = %R - %u %t "%m %r%Q%q" %s %{HTTP_HOST}e%{REQUEST_URI}e %{seconds}d %{kilo}M %C%% %{HTTP_REFERER}e
access.log = /dev/stdout


---

cat php.ini 
upload_max_filesize = 500M
post_max_size = 510M
memory_limit = 512M
max_execution_time = 300
max_input_time = 300

date.timezone = Asia/Shanghai
opcache.enable=1
opcache.enable_cli=0
opcache.memory_consumption=128
opcache.interned_strings_buffer=8
opcache.max_accelerated_files= 10000
opcache.revalidate_freq=60
opcache.validate_timestamps=1
extension=redis.so

---

cat php.ini 
upload_max_filesize = 500M
post_max_size = 510M
memory_limit = 512M
max_execution_time = 300
max_input_time = 300

date.timezone = Asia/Shanghai
opcache.enable=1
opcache.enable_cli=0
opcache.memory_consumption=128
opcache.interned_strings_buffer=8
opcache.max_accelerated_files= 10000
opcache.revalidate_freq=60
opcache.validate_timestamps=1
extension=redis.so

这个版本的文档验证了，依赖和控制了nginx和php的权限。后续要修改需要自定义下nginx.conf和子配置文件目录下的配置文件就行了。