waazaafr/webserver-apache-php8 repository overview

⁠webserver-apache-php8

Apache + PHP 8 Docker image with a persistent /var/www layout, optional reverse proxy support, and a wide set of PHP extensions and utilities.

⁠Available tags

All tags are multi-arch (linux/amd64 + linux/arm64); Docker picks the right architecture automatically.

• Branch tags (8.4) always point to the latest patched release of that branch: use them to receive security fixes automatically.
• Full version tags (8.4.27-apache-trixie) match the upstream php base image and never change.
• Only the latest patched version of each branch is kept. Older version tags, -arm64 and -previous tags have been removed.
• PHP 8.2 reaches end of life on 2026-12-31. Plan your migration to 8.3 or newer.

⁠Quick start

⁠Docker Compose

services:
  app:
    image: waazaafr/webserver-apache-php8:8.4
    container_name: webserver
    restart: unless-stopped
    ports:
      - "8787:80"
    volumes:
      - ./webserver:/var/www
    environment:
      TZ: Europe/Paris
      PUID: 99
      PGID: 100
      PUBLIC_FOLDER: "false"
      PROXY_LOCAL_IPS: 192.168.1.23
      PROXY_EXTERNAL_IPS: 192.168.1.23

⁠Docker run

docker run -d \
  --name webserver \
  --restart unless-stopped \
  -p 8787:80 \
  -v ./webserver:/var/www \
  -e TZ=Europe/Paris \
  -e PUID=99 \
  -e PGID=100 \
  -e PUBLIC_FOLDER=false \
  -e PROXY_LOCAL_IPS=192.168.1.23 \
  -e PROXY_EXTERNAL_IPS=192.168.1.23 \
  waazaafr/webserver-apache-php8:8.4

Then put your website in ./webserver/html/ and open http://<host>:8787.

⁠Configuration

⁠Environment variables

⁠Persistent layout

Everything persistent lives in /var/www: bind it to a folder on your host. Missing folders are created at startup.

⁠Helper commands

Two commands are available inside the container, useful in cron jobs (e.g. stop Apache while running mysqldump or pg_dump):

• apache-stop
• apache-start

⁠What's inside

PHP and its dependencies come from the packages.sury.org⁠ repository. Base OS: Debian 13 (trixie).

⁠Utilities

composer git curl nano tree zip unzip smbclient sqlite3 mariadb-client postgresql-client redis-tools locales-all

⁠PHP extensions

Databases & cache: mysqli mysqlnd pdo_mysql pgsql pdo_pgsql sqlite3 pdo_sqlite pdo_dblib dba mongodb redis memcached apcu Zend OPcache

Text, i18n & data: mbstring iconv intl gettext pspell json igbinary msgpack ds

XML & web: dom libxml SimpleXML xml xmlreader xmlwriter xsl soap tidy curl ftp imap ldap snmp sockets

Images & files: gd imagick exif fileinfo zip zlib bz2 Phar

Security & math: openssl sodium hash random bcmath gmp mcrypt

System & core: Core calendar ctype date filter pcntl pcre PDO posix readline Reflection session shmop SPL standard sysvmsg sysvsem sysvshm tokenizer

mcrypt is available on 8.2, 8.3 and 8.4 only.

⁠Apache modules

Main: mpm_prefork php rewrite remoteip deflate filter status

Others: access_compat alias auth_basic authn_core authn_file authz_core authz_host authz_user autoindex dir env mime negotiation reqtimeout setenvif

Static: core so watchdog http log_config logio version unixd

⁠Changelog

Full upstream PHP changelog: php.net/ChangeLog-8.php⁠

⁠2026-10-22

• 🔒 8.4.27⁠ and 8.5.12⁠ published, completing the security update below.
• 8.3.36 rebuilt with the redis PHP extension, which was missing from the 8.3 images.
• Old tags removed: only the latest patched multi-arch tag of each branch is kept (no more -arm64 or -previous tags).

⁠2026-10-21

• 🔒 Security: rebuilt on PHP 8.2.35⁠ and 8.3.36⁠, fixing the critical RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619. These releases also include the fixes from the 2026-09-24 PHP releases (OpenSSL, SOAP, Phar, FPM, mysqlnd).

⁠2026-08-23

• 🔒 Security: bumped to PHP 8.2.33⁠, 8.3.33⁠, 8.4.24⁠, 8.5.9⁠: CVE-2026-9672 (GD), CVE-2026-17543 (pgsql SQL injection), CVE-2026-7260 (Phar), CVE-2026-17544 (BCMath, 8.4/8.5 only).
• 8.2 and 8.3 are now explicitly based on Debian 13 (trixie), like 8.4 and 8.5.

⁠2026-05-01

• Added FORCE_CHOWN (disabled by default).

⁠2026-03-20

• Added locales-all.

⁠2026-03-15

• Removed the automatic creation of a default index.php.

⁠2026-02-15

• Added PUID and PGID to set the apache2 user IDs and the ownership of /var/www.

⁠2026-01-27

• Added the redis PHP extension.
• Fixed reverse proxy handling.

⁠Links

• 💬 Discord: discord.gg/p9xkjEw8ts⁠
• ☕ Buy me a coffee: buymeacoffee.com/waazaa⁠
• ☕ Ko-fi: ko-fi.com/waazaa⁠
• UnRAID license: unraid.net⁠
• VPS: rarecloud.io⁠