Reference

Environment variable specification

Every setting in these images is an environment variable, so you can change PHP, the web server, and the Laravel automations without mounting config files.

Set them in your compose.yml:

compose.yml
services:
  php:
    image: serversideup/php:8.5-fpm-nginx
    environment:
      PHP_MEMORY_LIMIT: "512M"
      PHP_OPCACHE_ENABLE: "1"

Search by name or setting, or pick a variation to see only the variables it reads, with its defaults. Select a variable for its accepted values, the official docs, and a line to copy into compose.yml. An empty default ("") leaves the setting off.

135 variables

  • fpm-apache/var/www/html/publicDirectory Apache serves files from. Set /var/www/html for apps without a public/ folder.
  • fpm-apache8080Port Apache listens on for HTTP inside the container.
  • fpm-apache8443Port Apache listens on for HTTPS inside the container.
  • fpm-apache0Connections an Apache process handles before it restarts. 0 never restarts.
  • fpm-apache150Most requests Apache serves at once.
  • fpm-apache75Most idle threads Apache keeps.
  • fpm-apache10Fewest idle threads Apache keeps.
  • fpm-apachewww-dataThe group Apache runs as when started as root. Same build-time limit as APACHE_RUN_USER.
  • fpm-apachewww-dataThe user Apache runs as when started as root. Written into /etc/apache2/envvars at build time, so changing it at runtime has no effect.
  • fpm-apache2Apache processes started at launch.
  • fpm-apache64Upper limit for APACHE_THREADS_PER_CHILD.
  • fpm-apache25Threads each Apache process runs.
  • All variations/var/www/htmlWhere your app lives in the container. If you change it, also change NGINX_WEBROOT, APACHE_DOCUMENT_ROOT, or CADDY_SERVER_ROOT.
  • All variations Requires AUTORUN_ENABLEDfalsePrint each automation step and the AUTORUN_* values it read, plus the database errors while it waits for the database. LOG_OUTPUT_LEVEL=debug prints the steps but not the database errors.
  • All variationsfalseRun the Laravel automations (storage link, migrations, and caches) each time the container starts. They run whatever the container's command is, so turn them on for one service only, not your workers. DISABLE_DEFAULT_CONFIG=true also turns them off.
  • All variations Requires AUTORUN_ENABLEDtrueRun php artisan config:cache so Laravel loads its config from one cached file. Once config is cached, Laravel stops reading .env, so env() outside your config files only sees the container's environment variables.
  • All variations Requires AUTORUN_ENABLEDtrueRun php artisan event:cache so Laravel reads its event listeners from a cache instead of scanning your Listeners directory on every request.
  • All variations Requires AUTORUN_ENABLEDtrueRun php artisan migrate at start-up, after clearing the config cache and waiting for the database. AUTORUN_LARAVEL_MIGRATION_MODE picks the command, and the variables below add flags.
  • All variations Requires AUTORUN_ENABLED""Connections to migrate, comma-separated, such as mysql,pgsql. Empty uses the default connection.
  • All variations Requires AUTORUN_ENABLEDtrueAdd --force so migrations run without the confirmation prompt Laravel shows when APP_ENV=production. A container can't answer it, so with false in production Laravel cancels the migration and the container stops.
  • All variations Requires AUTORUN_ENABLEDfalseAdd --isolated so only one container migrates at a time. Needs a default cache store that supports atomic locks, shared by every host that runs migrations, and default mode; any other mode stops the container. Laravel older than 9.38.0 migrates without it, and the first deploy skips it until the migrations table exists.
  • All variations Requires AUTORUN_ENABLEDdefaultPick the migrate command: default (migrate), fresh (migrate:fresh), or refresh (migrate:refresh). fresh and refresh drop every table, so use them only in development.
  • All variations Requires AUTORUN_ENABLEDfalseAdd --seed to run your database seeders after migrating. They run on every start, so make them safe to repeat.
  • All variations Requires AUTORUN_ENABLEDfalseMigrate right away instead of first waiting for the database to accept connections.
  • All variations Requires AUTORUN_ENABLED30Seconds to wait for the database to accept connections before migrating, trying once a second. A host that never answers holds each try for the driver's connect timeout, so the wait can run much longer. If the database isn't ready in time, the container stops.
  • All variations Requires AUTORUN_ENABLEDtrueRun php artisan optimize, which caches config, events, routes, and views in one command on Laravel 11 and newer. Turn one cache off with its variable below and the image leaves it out with --except (Laravel 11.38.0+) or runs the other *:cache commands one by one. With false, only the cache variables set to true run.
  • All variations Requires AUTORUN_ENABLEDtrueRun php artisan route:cache so Laravel registers your routes from one cached file instead of loading every route file on each request.
  • All variations Requires AUTORUN_ENABLEDfalseSkip without failing when there's no Laravel in APP_BASE_DIR, such as before the first composer install. Laravel counts as found when artisan and vendor/ both exist.
  • All variations Requires AUTORUN_ENABLEDtrueRun php artisan storage:link so files in storage/app/public are served from public/storage. Skipped when public/storage already exists.
  • All variations Requires AUTORUN_ENABLEDtrueRun php artisan view:cache to compile every Blade template at start-up, so no visitor waits for a page to compile.
  • frankenphpoffLet's Encrypt certificate profile. shortlived issues certificates that last about six days and renew every few days; it's also needed for IP-address certificates. Any profile other than off drops Caddy's ZeroSSL fallback, so the container needs reliable outbound access to Let's Encrypt.
  • frankenphpoffCaddy's admin API, which can reconfigure the server. Ignored under Laravel Octane, which turns it on for itself on localhost.
  • frankenphpoffWhether Caddy gets certificates and redirects HTTP to HTTPS on its own.
  • frankenphp""Extra Caddy global options. Ignored under Laravel Octane, which overwrites it; use a file in /etc/frankenphp/caddyfile-global.d/ instead.
  • frankenphp8080Port Caddy listens on for HTTP inside the container.
  • frankenphphttp://Site address Caddy answers on for HTTP. The default http:// answers any hostname.
  • frankenphp8443Port Caddy listens on for HTTPS inside the container.
  • frankenphphttps://Site address Caddy answers on for HTTPS. Set your domain here, such as https://example.com.
  • frankenphpautoFormat of Caddy's logs. auto writes JSON in a container and readable lines in a terminal. Every format redacts the authorization query parameter. Leave auto under Laravel Octane, which only parses JSON.
  • frankenphpstderrWhere Caddy writes its access and runtime logs. Leave stderr under Laravel Octane, which only relays stderr.
  • frankenphp""Extra directives inside the php_server block.
  • frankenphplocalhostSet by Laravel Octane, so you don't set it. Host of the Caddy admin API that octane:status, octane:reload, and octane:stop call.
  • frankenphp2019Set by Laravel Octane, so you don't set it. Port of the Caddy admin API, from Octane's --admin-port or derived from --port: --port=8080 gives 2099.
  • frankenphp""Extra Caddyfile directives for your site. Laravel Octane overwrites it, so prefer a file in /etc/frankenphp/caddyfile-server.d/. See adding your own Caddyfile rules.
  • frankenphpUnsetCaddy's log level. When unset, it follows LOG_OUTPUT_LEVEL. Under Laravel Octane, use octane:start --log-level instead.
  • frankenphp/var/www/html/publicDirectory Caddy serves files from. Set /var/www/html for apps without a public/ folder.
  • frankenphp""Set by Laravel Octane, so you don't set it. Holds the watch directives from --watch and the watch paths in config/octane.php.
  • frankenphp""Set by Laravel Octane, so you don't set it. Holds the worker settings from --workers for the worker block that loads frankenphp-worker.php.
  • All variations1Hide Composer's warning about running as root.
  • All variations/composerComposer's global directory, shared by every project. It holds global config, auth.json, and globally required packages.
  • All variations24Parallel Composer downloads, 1 to 50. Composer's own default is 12, and raising it further rarely helps. Lower it if your proxy struggles.
  • All variationsfalsetrue skips the image's start-up scripts and automations, so you configure everything yourself. That includes the web server configuration, so fpm-nginx and fpm-apache need your own. Your own scripts in /etc/entrypoint.d/ still run.
  • frankenphp""Directives inside the global frankenphp block, such as num_threads.
  • frankenphpcgocheck=0Go runtime settings for FrankenPHP. cgocheck=0 skips Go's pointer checks on every call into PHP, like the official FrankenPHP images.
  • fpm-nginx · fpm-apache · frankenphp/healthcheckPath the container health check requests, left out of access logs. The image answers /healthcheck itself; set an app route such as /up to check your app instead.
  • frankenphp/etc/ssl/healthcheck/localhost.crtSelf-signed certificate for the health check on localhost when SSL_MODE=full. The image generates it at start-up whenever SSL_MODE isn't off.
  • frankenphp/etc/ssl/healthcheck/localhost.keyPrivate key for the health check certificate.
  • frankenphp0Set by Laravel Octane, so you don't set it. Octane passes 1, which runs frankenphp-worker.php as a worker and turns on the admin API. If you set it yourself, only 1 and 0 work; anything else, such as true or an empty string, stops FrankenPHP with a "File to import not found" error. See Laravel Octane.
  • All variationswarnHow much PHP, PHP-FPM, and the web server log. debug also shows every PHP error and traces the entrypoint. FrankenPHP defaults to info because Caddy logs requests at that level.
  • frankenphpfalseRun the Mercure hub at /.well-known/mercure. Needs both JWT keys.
  • frankenphp""Extra hub directives, one per line, such as anonymous or cors_origins.
  • frankenphpHS256Algorithm for publisher tokens. A PEM key needs an asymmetric one, such as RS256.
  • frankenphpUnsetShared secret or PEM public key that verifies publisher tokens.
  • frankenphpHS256Algorithm for subscriber tokens.
  • frankenphpUnsetShared secret or PEM public key that verifies subscriber tokens.
  • frankenphphttps://localhostThe iss claim tokens must carry, usually your app's URL. Tokens are verified only with the keys of the issuer they claim.
  • fpm-nginx/dev/stdoutWhere NGINX writes access logs. The default sends them to the container log.
  • fpm-nginx100MLargest request body NGINX accepts. Keep it in line with PHP_POST_MAX_SIZE.
  • fpm-nginx/dev/stderrWhere NGINX writes errors. The default sends them to the container log.
  • fpm-nginx8kBuffer for the first part of a PHP-FPM response, which holds the headers. Raise it if large headers cause 502 errors.
  • fpm-nginx8 8kNumber and size of the buffers NGINX uses to read a response from PHP-FPM. Raise it if large responses get written to disk.
  • fpm-nginx8080Port NGINX listens on for HTTP inside the container.
  • fpm-nginx8443Port NGINX listens on for HTTPS inside the container.
  • fpm-nginxallWhich IP versions NGINX listens on. Use ipv4 on hosts without IPv6.
  • fpm-nginxoffShow the NGINX version in the Server header and on error pages.
  • fpm-nginx/var/www/html/publicDirectory NGINX serves files from. Set /var/www/html for apps without a public/ folder.
  • All variationsUTCDefault timezone for PHP date and time functions.
  • All variations""PHP functions to turn off, comma-separated, such as exec,shell_exec. Empty by default because Laravel, Composer, and Symfony Process need proc_open.
  • All variationsOffShow PHP errors in the response. Keep it Off in production; errors still go to the log.
  • All variationsOffShow errors that happen while PHP starts, before your code runs.
  • All variations/dev/stderrWhere PHP writes errors. The default sends them to the container log.
  • All variations22527Which errors PHP reports, as a number. 22527 is E_ALL & ~E_DEPRECATED & ~E_STRICT: everything except deprecation and strict notices. This calculator works out other values.
  • All variationsOnAllow file uploads in HTTP requests.
  • fpm · fpm-nginx · fpm-apachewww-dataGroup PHP-FPM workers run as. Only used when the container runs as root.
  • fpm · fpm-nginx · fpm-apachewww-dataUser PHP-FPM workers run as. Only used when the container runs as root.
  • fpm · fpm-nginx · fpm-apachedynamicHow PHP-FPM manages workers. static keeps a fixed number running, dynamic keeps a few spare, and ondemand starts them as requests arrive.
  • fpm · fpm-nginx · fpm-apache20Most PHP-FPM workers at once, which caps how many requests run in parallel. With static, it's the exact number of workers. See PHP-FPM workers.
  • fpm · fpm-nginx · fpm-apache0Requests a worker handles before it restarts, which limits memory leaks. 0 never restarts.
  • fpm · fpm-nginx · fpm-apache3Most idle workers to keep. Only used with dynamic.
  • fpm · fpm-nginx · fpm-apache1Fewest idle workers to keep. Only used with dynamic.
  • fpm · fpm-nginx · fpm-apache2Workers started with PHP-FPM. Only used with dynamic.
  • fpm · fpm-nginx · fpm-apache/statusURL path for the PHP-FPM status page. The fpm variation's health check reads /status, so changing it there fails the health check.
  • fpm · fpm-nginx · fpm-apachewwwName of the PHP-FPM pool, shown in logs and on the status page.
  • fpm · fpm-nginx · fpm-apache10sHow long workers get to react to a stop or reload signal from PHP-FPM before they are killed.
  • All variationsOnFormat displayed errors as HTML. Only affects errors shown on screen; PHP always turns it off for the CLI.
  • All variations99Seconds a script may run before PHP stops it. On Linux, time spent waiting on the database, network, or other system calls doesn't count.
  • All variations20Most files one request can upload.
  • All variations-1Seconds PHP may spend reading request input, such as POST data and uploads. -1 uses PHP_MAX_EXECUTION_TIME and 0 removes the limit. The CLI always uses -1.
  • All variations1000Most input variables PHP accepts per request, counted separately for query strings, POST data, and cookies. Raise it for very large forms.
  • All variations256MMost memory one script may use, such as 512M. -1 removes the limit.
  • All variations0Keep compiled PHP in memory so requests skip parsing and compiling. Set 1 in production. See production performance tuning.
  • All variations1Use OPcache for php commands too. Only matters when OPcache is on. 0 keeps it to the web server, so a preload script doesn't run on every php command.
  • All variations0Answer file_exists(), is_file(), and is_readable() from the cache for files that are already cached. With PHP_OPCACHE_VALIDATE_TIMESTAMPS off, a file deleted after it was cached still looks present.
  • All variations180Seconds to wait for a pending cache reset before OPcache kills the processes still holding the old cache.
  • All variations32Memory, in MB, for storing repeated strings once. It comes out of PHP_OPCACHE_MEMORY_CONSUMPTION.
  • All variationsoffPHP's just-in-time compiler. To use it, set tracing and a non-zero PHP_OPCACHE_JIT_BUFFER_SIZE.
  • All variations0Memory for JIT-compiled code, such as 64M. 0 leaves the JIT off. Added on top of PHP_OPCACHE_MEMORY_CONSUMPTION.
  • All variations32531Most scripts OPcache can hold. PHP rounds up to a prime, and 32531 is one.
  • All variations256Shared memory for the cache, in MB. It fills only as files are cached.
  • All variations""Path to a script that loads classes into memory when PHP starts. Empty turns preloading off. It also runs on every php command unless PHP_OPCACHE_ENABLE_CLI=0. See preloading.
  • All variations""User the preload script runs as. Required to preload when the container runs as root.
  • All variations2Seconds between checks for changed files. Only used when PHP_OPCACHE_VALIDATE_TIMESTAMPS=1.
  • All variations1Keep doc comments in the cache. 0 breaks code that reads PHPDoc annotations, such as Doctrine and PHPUnit.
  • All variations0Check cached files for changes. With 0, code changes need a container restart. Set 1 if you mount your code and keep OPcache on.
  • All variations""Limit the files PHP can open to these directories, separated by :. It's a safety net, not a security boundary. Setting it turns off the realpath cache.
  • All variations100MLargest request body PHP accepts. Keep it at least as large as PHP_UPLOAD_MAX_FILE_SIZE.
  • All variations4096KMemory PHP uses to remember resolved file paths, which saves file system lookups on every request. Raise it for apps with a large vendor/ directory. See realpath cache.
  • All variations600Seconds PHP keeps a resolved file path in the cache. 600 follows Symfony's recommendation.
  • All variationsOnHide the session cookie from JavaScript. Applies to native PHP sessions only; Laravel sets its own cookie flags.
  • All variationsfalseSend the session cookie over HTTPS only. Off by default so local development over HTTP works; set true when you serve over HTTPS. Applies to native PHP sessions only; Laravel sets its own cookie flags.
  • All variations0Track upload progress in the session. Off because of PHP's October 23, 2026 advisory. Only set 1 if your app reads upload progress and never changes session.serialize_handler at runtime.
  • All variations100MLargest single file PHP accepts in an upload.
  • All variations""Check scripts for a byte order mark to detect their encoding. Only used when PHP_ZEND_MULTIBYTE is on.
  • All variationsOffParse scripts written in multibyte encodings such as Shift JIS. Most apps leave it off.
  • fpm-nginx · fpm-apache2Stop the container if a start-up service fails.
  • fpm-nginx · fpm-apache0Milliseconds to wait for services to start before giving up. 0 waits forever.
  • fpm-nginx · fpm-apache1Pass the container's environment to every service.
  • fpm-nginx · fpm-apache1How much S6 Overlay logs, from 0 to 5. 1 prints warnings and errors. Raise it first when a service won't start.
  • All variationstruePrint the container information banner at start-up.
  • fpm-nginx · fpm-apache · frankenphp/etc/ssl/private/self-signed-web.crtPath to the TLS certificate. When SSL_MODE isn't off and neither this file nor the private key exists, the image generates a self-signed pair; if only one exists, the container stops. FrankenPHP ignores it when CADDY_AUTO_HTTPS=on.
  • fpm-nginx · fpm-apache · frankenphpoffWhether the web server serves HTTP, HTTPS, or both. mixed serves both, and full redirects HTTP to HTTPS. With native PHP sessions over HTTPS, also set PHP_SESSION_COOKIE_SECURE=true.
  • fpm-nginx · fpm-apache · frankenphp/etc/ssl/private/self-signed-web.keyPath to the TLS private key.
  • fpm-nginx · fpm-apache · frankenphpcloudflareWhich proxies may pass the visitor's real IP address to your app.
  • frankenphp/configWhere Caddy saves its autosaved config.
  • frankenphp/dataWhere Caddy stores certificates. Mount a volume here if Caddy issues certificates, so they survive restarts.

Vulnerability scanning

How every published serversideup/php image is scanned for known vulnerabilities, and where to see the results.

Command reference

The helper commands in /usr/local/bin of the serversideup/php images, which variations ship them, and how to use them.