[{"data":1,"prerenderedAt":630},["ShallowReactive",2],{"navigation":3,"/docs/guide/verifying-images":237,"/docs/guide/verifying-images-surround":625},[4],{"title":5,"path":6,"stem":7,"children":8},"Docs","/docs","docs",[9,12,56,85,132,153,190,207,220],{"title":10,"path":6,"stem":11},"","docs/index",{"title":13,"path":14,"stem":15,"children":16,"icon":55},"Getting Started","/docs/getting-started","docs/1.getting-started/1.index",[17,19,23,27,31,35,39,43,47,51],{"title":18,"path":14,"stem":15},"Introduction",{"title":20,"path":21,"stem":22},"Container Basics","/docs/getting-started/container-basics","docs/1.getting-started/2.container-basics",{"title":24,"path":25,"stem":26},"Installation","/docs/getting-started/installation","docs/1.getting-started/3.installation",{"title":28,"path":29,"stem":30},"These Images vs Others","/docs/getting-started/these-images-vs-others","docs/1.getting-started/4.these-images-vs-others",{"title":32,"path":33,"stem":34},"Choosing an Image","/docs/getting-started/choosing-an-image","docs/1.getting-started/5.choosing-an-image",{"title":36,"path":37,"stem":38},"Default Configurations","/docs/getting-started/default-configurations","docs/1.getting-started/6.default-configurations",{"title":40,"path":41,"stem":42},"Upgrade Guide","/docs/getting-started/upgrade-guide","docs/1.getting-started/7.upgrade-guide",{"title":44,"path":45,"stem":46},"Changelog","/docs/getting-started/changelog","docs/1.getting-started/8.changelog",{"title":48,"path":49,"stem":50},"About","/docs/getting-started/about","docs/1.getting-started/9.about",{"title":52,"path":53,"stem":54},"Contributing","/docs/getting-started/contributing","docs/1.getting-started/99.contributing",false,{"title":57,"path":58,"stem":59,"children":60,"page":55},"Image Variations","/docs/image-variations","docs/2.image-variations",[61,65,69,73,77,81],{"title":62,"path":63,"stem":64},"CLI","/docs/image-variations/cli","docs/2.image-variations/cli",{"title":66,"path":67,"stem":68},"FPM","/docs/image-variations/fpm","docs/2.image-variations/fpm",{"title":70,"path":71,"stem":72},"FPM-Apache","/docs/image-variations/fpm-apache","docs/2.image-variations/fpm-apache",{"title":74,"path":75,"stem":76},"FPM-NGINX","/docs/image-variations/fpm-nginx","docs/2.image-variations/fpm-nginx",{"title":78,"path":79,"stem":80},"FrankenPHP","/docs/image-variations/frankenphp","docs/2.image-variations/frankenphp",{"title":82,"path":83,"stem":84},"Unit (Deprecated)","/docs/image-variations/unit","docs/2.image-variations/unit",{"title":86,"path":87,"stem":88,"children":89,"page":55},"Framework Guides","/docs/framework-guides","docs/3.framework-guides",[90,123],{"title":91,"icon":55,"defaultOpen":55,"path":92,"stem":93,"children":94,"page":55},"Laravel","/docs/framework-guides/laravel","docs/3.framework-guides/1.laravel",[95,99,103,107,111,115,119],{"title":96,"path":97,"stem":98},"Automations","/docs/framework-guides/laravel/automations","docs/3.framework-guides/1.laravel/1.automations",{"title":100,"path":101,"stem":102},"Task Scheduler","/docs/framework-guides/laravel/task-scheduler","docs/3.framework-guides/1.laravel/2.task-scheduler",{"title":104,"path":105,"stem":106},"Queue","/docs/framework-guides/laravel/queue","docs/3.framework-guides/1.laravel/3.queue",{"title":108,"path":109,"stem":110},"Horizon","/docs/framework-guides/laravel/horizon","docs/3.framework-guides/1.laravel/4.horizon",{"title":112,"path":113,"stem":114},"Reverb","/docs/framework-guides/laravel/reverb","docs/3.framework-guides/1.laravel/4.reverb",{"title":116,"path":117,"stem":118},"Nightwatch","/docs/framework-guides/laravel/nightwatch","docs/3.framework-guides/1.laravel/5.nightwatch",{"title":120,"path":121,"stem":122},"Octane","/docs/framework-guides/laravel/octane","docs/3.framework-guides/1.laravel/octane",{"title":124,"icon":55,"defaultOpen":55,"path":125,"stem":126,"children":127,"page":55},"WordPress","/docs/framework-guides/wordpress","docs/3.framework-guides/2.wordpress",[128],{"title":129,"path":130,"stem":131},"Using Docker with WordPress","/docs/framework-guides/wordpress/using-wordpress-with-docker","docs/3.framework-guides/2.wordpress/4.using-wordpress-with-docker",{"title":133,"path":134,"stem":135,"children":136,"page":55},"Deployment And Production","/docs/deployment-and-production","docs/4.deployment-and-production",[137,141,145,149],{"title":138,"path":139,"stem":140},"Development to Production","/docs/deployment-and-production/development-to-production","docs/4.deployment-and-production/2.development-to-production",{"title":142,"path":143,"stem":144},"Packaging Your App for Deployment","/docs/deployment-and-production/packaging-your-app-for-deployment","docs/4.deployment-and-production/3.packaging-your-app-for-deployment",{"title":146,"path":147,"stem":148},"Configuring SSL","/docs/deployment-and-production/configuring-ssl","docs/4.deployment-and-production/4.configuring-ssl",{"title":150,"path":151,"stem":152},"Choosing a Host","/docs/deployment-and-production/choosing-a-host","docs/4.deployment-and-production/5.choosing-a-host",{"title":154,"icon":55,"defaultOpen":55,"path":155,"stem":156,"children":157,"page":55},"Advanced Guides","/docs/guide","docs/5.guide",[158,162,166,170,174,178,182,186],{"title":159,"path":160,"stem":161},"Migrating from official PHP images","/docs/guide/migrating-from-official-php-images","docs/5.guide/1.migrating-from-official-php-images",{"title":163,"path":164,"stem":165},"Using Healthchecks With Laravel","/docs/guide/using-healthchecks-with-laravel","docs/5.guide/2.using-healthchecks-with-laravel",{"title":167,"path":168,"stem":169},"Using S6 Overlay","/docs/guide/using-s6-overlay","docs/5.guide/2.using-s6-overlay",{"title":171,"path":172,"stem":173},"Understanding File Permissions","/docs/guide/understanding-file-permissions","docs/5.guide/3.understanding-file-permissions",{"title":175,"path":176,"stem":177},"Configuring Trusted Proxies","/docs/guide/configuring-trusted-proxies","docs/5.guide/4.configuring-trusted-proxies",{"title":179,"path":180,"stem":181},"Major version migrations","/docs/guide/major-version-migrations","docs/5.guide/5.major-version-migrations",{"title":183,"path":184,"stem":185},"Production performance tuning","/docs/guide/production-performance-tuning","docs/5.guide/6.production-performance-tuning",{"title":187,"path":188,"stem":189},"Verifying images","/docs/guide/verifying-images","docs/5.guide/7.verifying-images",{"title":191,"icon":55,"defaultOpen":55,"path":192,"stem":193,"children":194,"page":55},"Customization","/docs/customizing-the-image","docs/6.customizing-the-image",[195,199,203],{"title":196,"path":197,"stem":198},"Changing php.ini settings","/docs/customizing-the-image/changing-common-php-settings","docs/6.customizing-the-image/1.changing-common-php-settings",{"title":200,"path":201,"stem":202},"Installing PHP extensions","/docs/customizing-the-image/installing-additional-php-extensions","docs/6.customizing-the-image/2.installing-additional-php-extensions",{"title":204,"path":205,"stem":206},"Adding Start Up Scripts","/docs/customizing-the-image/adding-your-own-start-up-scripts","docs/6.customizing-the-image/3.adding-your-own-start-up-scripts",{"title":208,"path":209,"stem":210,"children":211,"page":55},"Troubleshooting","/docs/troubleshooting","docs/7.troubleshooting",[212,216],{"title":213,"path":214,"stem":215},"Common Issues","/docs/troubleshooting/common-issues","docs/7.troubleshooting/1.common-issues",{"title":217,"path":218,"stem":219},"Getting Help","/docs/troubleshooting/getting-help","docs/7.troubleshooting/2.getting-help",{"title":221,"path":222,"stem":223,"children":224,"page":55},"Reference","/docs/reference","docs/8.reference",[225,229,233],{"title":226,"path":227,"stem":228},"Environment Variable Specification","/docs/reference/environment-variable-specification","docs/8.reference/1.environment-variable-specification",{"title":230,"path":231,"stem":232},"Command Reference","/docs/reference/command-reference","docs/8.reference/2.command-reference",{"title":234,"path":235,"stem":236},"Vulnerability scanning","/docs/reference/vulnerability-scanning","docs/8.reference/3.vulnerability-scanning",{"id":238,"title":187,"body":239,"description":616,"extension":617,"links":618,"meta":619,"navigation":622,"path":188,"redirect":618,"seo":623,"stem":189,"__hash__":624},"docs/docs/5.guide/7.verifying-images.md",{"type":240,"value":241,"toc":609},"minimark",[242,249,254,270,283,287,298,347,357,360,367,371,380,411,422,426,439,465,472,498,568,572,580,593,605],[243,244,245],"lead-p",{},[246,247,248],"p",{},"Every image we publish is signed and carries a software bill of materials (SBOM) and build provenance. Use them to confirm that the image you pulled came from our GitHub Actions workflows and to see exactly what went into it.",[250,251,253],"h2",{"id":252},"why-verify-an-image","Why verify an image",[246,255,256,257,261,262,265,266,269],{},"A tag is only a pointer. Whoever controls it can point ",[258,259,260],"code",{},"8.5-cli"," at a different image. A signature check proves the image was published by the ",[258,263,264],{},"serversideup/docker-php"," repository's own publish workflow, from ",[258,267,268],{},"main"," or a release tag. The SBOM and provenance tell you what is in the image and how it was built, which is what most supply-chain policies and audits ask for.",[271,272,273],"note",{},[246,274,275,276,279,280,282],{},"Images published before we started signing have provenance but no SBOM or signature. Version-pinned tags such as ",[258,277,278],{},"8.4-fpm-nginx-v4.3.5"," are never rebuilt. Older ones will always fail the signature check. Floating tags like ",[258,281,260],{}," are signed from their next rebuild on.",[250,284,286],{"id":285},"verify-the-signature","Verify the signature",[246,288,289,290,297],{},"Install cosign by following the ",[291,292,296],"a",{"href":293,"rel":294},"https://docs.sigstore.dev/cosign/system_config/installation/",[295],"nofollow","Sigstore installation guide",", then run:",[299,300,305],"pre",{"className":301,"code":302,"filename":303,"language":304,"meta":10,"style":10},"language-bash shiki shiki-themes github-dark","cosign verify serversideup/php:8.5-cli \\\n  --certificate-oidc-issuer https://token.actions.githubusercontent.com \\\n  --certificate-identity-regexp '^https://github\\.com/serversideup/docker-php/\\.github/workflows/service_publish-images\\.yml@refs/(heads/main|tags/v.+)$'\n","Terminal","bash",[258,306,307,327,338],{"__ignoreMap":10},[308,309,312,316,320,323],"span",{"class":310,"line":311},"line",1,[308,313,315],{"class":314},"svObZ","cosign",[308,317,319],{"class":318},"sU2Wk"," verify",[308,321,322],{"class":318}," serversideup/php:8.5-cli",[308,324,326],{"class":325},"sDLfK"," \\\n",[308,328,330,333,336],{"class":310,"line":329},2,[308,331,332],{"class":325},"  --certificate-oidc-issuer",[308,334,335],{"class":318}," https://token.actions.githubusercontent.com",[308,337,326],{"class":325},[308,339,341,344],{"class":310,"line":340},3,[308,342,343],{"class":325},"  --certificate-identity-regexp",[308,345,346],{"class":318}," '^https://github\\.com/serversideup/docker-php/\\.github/workflows/service_publish-images\\.yml@refs/(heads/main|tags/v.+)$'\n",[246,348,349,350,352,353,356],{},"The two flags say who you trust. The issuer is GitHub Actions. The identity is our publish workflow running from ",[258,351,268],{}," or a ",[258,354,355],{},"v"," release tag. cosign exits with an error if the image has no signature from that identity.",[246,358,359],{},"Signing is keyless: there is no public key to download. Each signature is tied to the workflow run that made it through GitHub's OIDC token and recorded in Sigstore's public transparency log.",[246,361,362,363,366],{},"Docker Hub and GitHub Packages each hold their own signature. The same command works for ",[258,364,365],{},"ghcr.io/serversideup/php:8.5-cli",". The signature covers the image index, which references the image for every platform along with its SBOM and provenance. One check covers all of them.",[250,368,370],{"id":369},"read-the-sbom","Read the SBOM",[246,372,373,374,379],{},"The SBOM is an ",[291,375,378],{"href":376,"rel":377},"https://spdx.dev/",[295],"SPDX"," document that lists the packages in the image. Read it for one platform with Docker Buildx:",[299,381,383],{"className":301,"code":382,"filename":303,"language":304,"meta":10,"style":10},"docker buildx imagetools inspect serversideup/php:8.5-cli \\\n  --format '{{ json (index .SBOM \"linux/amd64\").SPDX }}'\n",[258,384,385,403],{"__ignoreMap":10},[308,386,387,390,393,396,399,401],{"class":310,"line":311},[308,388,389],{"class":314},"docker",[308,391,392],{"class":318}," buildx",[308,394,395],{"class":318}," imagetools",[308,397,398],{"class":318}," inspect",[308,400,322],{"class":318},[308,402,326],{"class":325},[308,404,405,408],{"class":310,"line":329},[308,406,407],{"class":325},"  --format",[308,409,410],{"class":318}," '{{ json (index .SBOM \"linux/amd64\").SPDX }}'\n",[246,412,413,414,417,418,421],{},"Use ",[258,415,416],{},"linux/arm64"," for the arm64 image. On an image published before SBOMs were added, the command prints ",[258,419,420],{},"null",".",[250,423,425],{"id":424},"read-the-build-provenance","Read the build provenance",[246,427,428,429,434,435,438],{},"The provenance is a ",[291,430,433],{"href":431,"rel":432},"https://slsa.dev/",[295],"SLSA"," record of how the image was built: the source commit, the Dockerfile, the build arguments, and the base images. We publish it in full (",[258,436,437],{},"mode=max","):",[299,440,442],{"className":301,"code":441,"filename":303,"language":304,"meta":10,"style":10},"docker buildx imagetools inspect serversideup/php:8.5-cli \\\n  --format '{{ json (index .Provenance \"linux/amd64\").SLSA }}'\n",[258,443,444,458],{"__ignoreMap":10},[308,445,446,448,450,452,454,456],{"class":310,"line":311},[308,447,389],{"class":314},[308,449,392],{"class":318},[308,451,395],{"class":318},[308,453,398],{"class":318},[308,455,322],{"class":318},[308,457,326],{"class":325},[308,459,460,462],{"class":310,"line":329},[308,461,407],{"class":325},[308,463,464],{"class":318}," '{{ json (index .Provenance \"linux/amd64\").SLSA }}'\n",[246,466,467,468,471],{},"To see only the commit and Dockerfile an image was built from, read ",[258,469,470],{},"invocation.configSource",":",[299,473,475],{"className":301,"code":474,"filename":303,"language":304,"meta":10,"style":10},"docker buildx imagetools inspect serversideup/php:8.5-cli \\\n  --format '{{ json (index .Provenance \"linux/amd64\").SLSA.invocation.configSource }}'\n",[258,476,477,491],{"__ignoreMap":10},[308,478,479,481,483,485,487,489],{"class":310,"line":311},[308,480,389],{"class":314},[308,482,392],{"class":318},[308,484,395],{"class":318},[308,486,398],{"class":318},[308,488,322],{"class":318},[308,490,326],{"class":325},[308,492,493,495],{"class":310,"line":329},[308,494,407],{"class":325},[308,496,497],{"class":318}," '{{ json (index .Provenance \"linux/amd64\").SLSA.invocation.configSource }}'\n",[299,499,504],{"className":500,"code":501,"filename":502,"language":503,"meta":10,"style":10},"language-json shiki shiki-themes github-dark","{\n  \"digest\": {\n    \"sha1\": \"af1462e3abf8c67ff3fb78141255adc33de5bf2c\"\n  },\n  \"entryPoint\": \"src/variations/cli/Dockerfile\",\n  \"uri\": \"https://github.com/serversideup/docker-php.git#af1462e3abf8c67ff3fb78141255adc33de5bf2c\"\n}\n","Output","json",[258,505,506,512,520,531,537,551,562],{"__ignoreMap":10},[308,507,508],{"class":310,"line":311},[308,509,511],{"class":510},"s95oV","{\n",[308,513,514,517],{"class":310,"line":329},[308,515,516],{"class":325},"  \"digest\"",[308,518,519],{"class":510},": {\n",[308,521,522,525,528],{"class":310,"line":340},[308,523,524],{"class":325},"    \"sha1\"",[308,526,527],{"class":510},": ",[308,529,530],{"class":318},"\"af1462e3abf8c67ff3fb78141255adc33de5bf2c\"\n",[308,532,534],{"class":310,"line":533},4,[308,535,536],{"class":510},"  },\n",[308,538,540,543,545,548],{"class":310,"line":539},5,[308,541,542],{"class":325},"  \"entryPoint\"",[308,544,527],{"class":510},[308,546,547],{"class":318},"\"src/variations/cli/Dockerfile\"",[308,549,550],{"class":510},",\n",[308,552,554,557,559],{"class":310,"line":553},6,[308,555,556],{"class":325},"  \"uri\"",[308,558,527],{"class":510},[308,560,561],{"class":318},"\"https://github.com/serversideup/docker-php.git#af1462e3abf8c67ff3fb78141255adc33de5bf2c\"\n",[308,563,565],{"class":310,"line":564},7,[308,566,567],{"class":510},"}\n",[250,569,571],{"id":570},"scan-it-yourself","Scan it yourself",[246,573,574,575,471],{},"You don't have to trust our scan. The images are public and work with any scanner. For example, with ",[291,576,579],{"href":577,"rel":578},"https://github.com/anchore/grype",[295],"Grype",[299,581,583],{"className":301,"code":582,"filename":303,"language":304,"meta":10,"style":10},"grype serversideup/php:8.5-cli\n",[258,584,585],{"__ignoreMap":10},[308,586,587,590],{"class":310,"line":311},[308,588,589],{"class":314},"grype",[308,591,592],{"class":318}," serversideup/php:8.5-cli\n",[246,594,595,596,599,600,604],{},"Add ",[258,597,598],{},"--only-fixed"," to list only the findings that have a fix available. Those are the ones a rebuild or an upgrade can change. See ",[291,601,603],{"href":602},"/docs/reference/vulnerability-scanning#most-findings-have-no-fix-yet","fixable and unfixed findings"," for why the full list is usually much longer.",[606,607,608],"style",{},"html pre.shiki code .svObZ, html code.shiki .svObZ{--shiki-default:#B392F0}html pre.shiki code .sU2Wk, html code.shiki .sU2Wk{--shiki-default:#9ECBFF}html pre.shiki code .sDLfK, html code.shiki .sDLfK{--shiki-default:#79B8FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .s95oV, html code.shiki .s95oV{--shiki-default:#E1E4E8}",{"title":10,"searchDepth":329,"depth":329,"links":610},[611,612,613,614,615],{"id":252,"depth":329,"text":253},{"id":285,"depth":329,"text":286},{"id":369,"depth":329,"text":370},{"id":424,"depth":329,"text":425},{"id":570,"depth":329,"text":571},"Check that a serversideup/php image was built and published by our GitHub Actions workflows, and see what is inside it.","md",null,{"head":620,"layout":7},{"title":621},"Verifying Images - Docker PHP - Server Side Up",true,{"title":187,"description":616},"nLKAsA7QNgmdbF-dpqomZmsFXRgWaR1acsz6fIIYO5w",[626,628],{"title":183,"path":184,"stem":185,"description":627,"children":-1},"The settings that matter for PHP performance in production, where our defaults come from, and how to measure and tune them for your application.",{"title":196,"path":197,"stem":198,"description":629,"children":-1},"Learn how to change common PHP settings with environment variables or your own php.ini file.",1793396148163]