Batteries included Docker image for PHP 8.3 + all extensions installed and enabled, Composer, Node.js, Yarn.
The 8.x, 8.x-apache, and 8.x-fpm images (including their -debug variants) are built from PHP 8.3.36, which fixes CVE-2026-109618 and CVE-2026-109619. See the Google Cloud advisory.
The updated 8.x images must first be built and published by the workflow. Then pull the updated images, rebuild downstream application images with --pull, and redeploy running containers. Existing images and containers are not patched automatically. PHP patch versions are pinned explicitly and must be updated for future security releases.
PHP 7.4 is end-of-life and no longer receives security updates. Consequently, phackage has deprecated all 7.x images, including Apache, FPM, and debug variants, and no longer builds or publishes them.
Existing published 7.x images remain available unchanged for backward compatibility, but receive no further rebuilds, maintenance, or security updates. They remain vulnerable to the CVEs above. Migrate to the maintained 8.x images.
To use this image, you must have Docker installed.
Inside your Dockerfile
# use 8.x, 8.x-apache or 8.x-fpm as the image tag
# can suffix tag with -debug for an image with xdebug e.g., 8.x-debug
FROM ghcr.io/qrstuff/phackage:8.x
# ...run, cmd & more# use 8.x, 8.x-apache or 8.x-fpm as the image tag
# again, can suffix tag with -debug for an image with xdebug e.g., 8.x-debug
$ docker run -it --rm -v .:/app -w /app ghcr.io/qrstuff/phackage:8.x composer install
$ docker run -it -p 8000:8000 --rm -v .:/app -w /app ghcr.io/qrstuff/phackage:8.x php artisan serveBuilding or modifying the container yourself from source is also quite easy. Just clone the repository and run below command:
# using the pinned, patched PHP 8.3.36 base image
$ docker build --pull -t phackage-local .
# using custom php image version/variant
$ docker build --pull --build-arg="baseImageTag=8.3.36-fpm" -t phackage-local .See the LICENSE file.