Dockerfile.base

# =============================================================================
# TYPO3 Official Base Image
# Debian Trixie + PHP (Sury) — Production-ready, Composer-based
#
# This image does NOT contain TYPO3 itself. It provides the runtime environment.
# Build your project image on top of this:
#
#   FROM ghcr.io/typo3incubator/typo3-base:8.3-nginx
#   COPY --from=build /app /var/www/html
#
# Variants available (--target):
#   fpm        → PHP-FPM only (for Kubernetes, bring your own web server)
#   nginx      → PHP-FPM + Nginx + Supervisor (all-in-one)
#   fpm-slim   → PHP-FPM only, no GraphicsMagick (use with external imgproxy)
#   nginx-slim → PHP-FPM + Nginx, no GraphicsMagick (use with external imgproxy)
#
# =============================================================================

ARG PHP_VERSION=8.3

# -----------------------------------------------------------------------------
# Stage 1: Shared PHP base with all TYPO3-required extensions
# -----------------------------------------------------------------------------
FROM debian:trixie-slim AS php-base

ARG PHP_VERSION=8.3

LABEL maintainer="TYPO3 Association <info@typo3.org>"
LABEL org.opencontainers.image.title="TYPO3 Base Image"
LABEL org.opencontainers.image.description="Production-ready base image for Composer-based TYPO3 projects"
LABEL org.opencontainers.image.vendor="TYPO3 Association"
LABEL org.opencontainers.image.source="https://github.com/typo3/docker"
LABEL org.opencontainers.image.licenses="GPL-3.0-or-later"

ENV DEBIAN_FRONTEND=noninteractive

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

# Composer from official multi-stage image (pinned version)
COPY --from=composer:2.9 /usr/bin/composer /usr/local/bin/composer

# Install Sury PHP repository and all packages
# hadolint ignore=DL3008
RUN set -eux; \
    apt-get update; \
    apt-get install -y --no-install-recommends \
        apt-transport-https \
        ca-certificates \
        curl \
        gnupg \
    ; \
    curl -sSL https://packages.sury.org/php/apt.gpg \
        | gpg --dearmor > /usr/share/keyrings/debsuryorg-archive-keyring.gpg; \
    echo "deb [signed-by=/usr/share/keyrings/debsuryorg-archive-keyring.gpg] https://packages.sury.org/php/ trixie main" \
        > /etc/apt/sources.list.d/php-sury.list; \
    apt-get update; \
    apt-get install -y --no-install-recommends \
        php${PHP_VERSION}-cli \
        php${PHP_VERSION}-common \
        php${PHP_VERSION}-curl \
        php${PHP_VERSION}-fpm \
        php${PHP_VERSION}-gd \
        php${PHP_VERSION}-intl \
        php${PHP_VERSION}-mbstring \
        php${PHP_VERSION}-mysql \
        php${PHP_VERSION}-pgsql \
        php${PHP_VERSION}-xml \
        php${PHP_VERSION}-zip \
        php${PHP_VERSION}-opcache \
        php${PHP_VERSION}-apcu \
        php${PHP_VERSION}-redis \
        # Utilities for Composer and runtime
        git \
        unzip \
    ; \
    # Create application user
    useradd -m -u 1000 -s /bin/bash typo3; \
    # Create directory structure
    mkdir -p \
        /var/www/html/public \
        /var/www/html/var \
        /var/www/html/config \
        /run/php \
    ; \
    chown -R typo3:typo3 /var/www/html /run/php; \
    # Create version-agnostic symlink for php-fpm binary
    ln -sf /usr/sbin/php-fpm${PHP_VERSION} /usr/local/bin/php-fpm; \
    # Cleanup
    apt-get clean; \
    rm -rf /var/lib/apt/lists/*

# -----------------------------------------------------------------------------
# PHP Configuration
# COPY to staging dir, then move to versioned paths (COPY can't use build args)
# -----------------------------------------------------------------------------
COPY base/config/php/typo3.ini /tmp/php-config/typo3.ini
COPY base/config/php/opcache.ini /tmp/php-config/opcache.ini
COPY base/config/php/php-fpm.conf /tmp/php-config/php-fpm.conf

RUN set -eux; \
    # FPM config
    cp /tmp/php-config/typo3.ini "/etc/php/${PHP_VERSION}/fpm/conf.d/99-typo3.ini"; \
    cp /tmp/php-config/opcache.ini "/etc/php/${PHP_VERSION}/fpm/conf.d/99-opcache.ini"; \
    cp /tmp/php-config/php-fpm.conf "/etc/php/${PHP_VERSION}/fpm/pool.d/zz-typo3.conf"; \
    # CLI config (same ini settings)
    cp /tmp/php-config/typo3.ini "/etc/php/${PHP_VERSION}/cli/conf.d/99-typo3.ini"; \
    cp /tmp/php-config/opcache.ini "/etc/php/${PHP_VERSION}/cli/conf.d/99-opcache.ini"; \
    # Remove default www pool to avoid conflict
    rm -f "/etc/php/${PHP_VERSION}/fpm/pool.d/www.conf"; \
    # Cleanup staging
    rm -rf /tmp/php-config; \
    # Verify extensions
    php -m | grep -i gd; \
    php -m | grep -i intl; \
    php -m | grep -i curl; \
    php -m | grep -i opcache

# TYPO3 environment-based configuration (loaded at runtime via getenv)
COPY base/config/typo3/additional.php /usr/local/share/typo3/additional.php

# Environment variables for runtime configuration
ENV TYPO3_CONTEXT=Production \
    PHP_MEMORY_LIMIT=512M \
    PHP_MAX_EXECUTION_TIME=240 \
    PHP_UPLOAD_MAX_FILESIZE=32M \
    PHP_POST_MAX_SIZE=32M \
    PHP_MAX_INPUT_VARS=1500 \
    PHP_VERSION=${PHP_VERSION}

WORKDIR /var/www/html

# -----------------------------------------------------------------------------
# Stage 1b: Full base with GraphicsMagick (default)
# Slim variants (fpm-slim, nginx-slim) skip this stage and use php-base directly
# -----------------------------------------------------------------------------
FROM php-base AS php-base-full

# hadolint ignore=DL3008
RUN set -eux; \
    apt-get update; \
    apt-get install -y --no-install-recommends graphicsmagick; \
    apt-get clean; \
    rm -rf /var/lib/apt/lists/*

# -----------------------------------------------------------------------------
# Stage 2: FPM-only variant (lean, no web server)
# -----------------------------------------------------------------------------
FROM php-base-full AS fpm

COPY base/docker-entrypoint.sh /docker-entrypoint.sh
RUN chmod +x /docker-entrypoint.sh

EXPOSE 9000

HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
    CMD pgrep -f "php-fpm: master" > /dev/null || exit 1

ENTRYPOINT ["/docker-entrypoint.sh"]
CMD ["php-fpm", "--nodaemonize"]

# -----------------------------------------------------------------------------
# Stage 3: Nginx variant (bundled web server + supervisor)
# -----------------------------------------------------------------------------
FROM php-base-full AS nginx

# hadolint ignore=DL3008
RUN set -eux; \
    apt-get update; \
    apt-get install -y --no-install-recommends \
        nginx \
        supervisor \
    ; \
    mkdir -p /run/nginx; \
    chown -R typo3:typo3 /var/log/nginx /run/nginx; \
    apt-get clean; \
    rm -rf /var/lib/apt/lists/*

# Nginx Configuration
COPY base/config/nginx/nginx.conf /etc/nginx/nginx.conf
COPY base/config/nginx/typo3.conf /etc/nginx/conf.d/default.conf

# Supervisor Configuration
COPY base/config/supervisor/supervisord.conf /etc/supervisord.conf

COPY base/docker-entrypoint.sh /docker-entrypoint.sh
RUN chmod +x /docker-entrypoint.sh

EXPOSE 80

HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
    CMD curl -sf http://localhost/healthz || exit 1

ENTRYPOINT ["/docker-entrypoint.sh"]
CMD ["supervisord", "-c", "/etc/supervisord.conf"]

# =============================================================================
# Slim variants — no GraphicsMagick (use with external imgproxy service)
# =============================================================================

# -----------------------------------------------------------------------------
# Stage 4: FPM-only slim variant
# -----------------------------------------------------------------------------
FROM php-base AS fpm-slim

COPY base/docker-entrypoint.sh /docker-entrypoint.sh
RUN chmod +x /docker-entrypoint.sh

EXPOSE 9000

HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
    CMD pgrep -f "php-fpm: master" > /dev/null || exit 1

ENTRYPOINT ["/docker-entrypoint.sh"]
CMD ["php-fpm", "--nodaemonize"]

# -----------------------------------------------------------------------------
# Stage 5: Nginx slim variant
# -----------------------------------------------------------------------------
FROM php-base AS nginx-slim

# hadolint ignore=DL3008
RUN set -eux; \
    apt-get update; \
    apt-get install -y --no-install-recommends \
        nginx \
        supervisor \
    ; \
    mkdir -p /run/nginx; \
    chown -R typo3:typo3 /var/log/nginx /run/nginx; \
    apt-get clean; \
    rm -rf /var/lib/apt/lists/*

# Nginx Configuration
COPY base/config/nginx/nginx.conf /etc/nginx/nginx.conf
COPY base/config/nginx/typo3.conf /etc/nginx/conf.d/default.conf

# Supervisor Configuration
COPY base/config/supervisor/supervisord.conf /etc/supervisord.conf

COPY base/docker-entrypoint.sh /docker-entrypoint.sh
RUN chmod +x /docker-entrypoint.sh

EXPOSE 80

HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
    CMD curl -sf http://localhost/healthz || exit 1

ENTRYPOINT ["/docker-entrypoint.sh"]
CMD ["supervisord", "-c", "/etc/supervisord.conf"]