Configuration

Environment variables

The complete reference for every variable, grouped by image and area.

All runtime configuration is done through environment variables, rendered into configuration files at container start. Variables set on a parent image are inherited by its children, so the php variables work on php-nginx and php-nginx-dev too.

Beyond the named variables below, any php.ini or PHP-FPM setting can be set with the php.<setting>, fpm.pool.<setting> and fpm.global.<setting> prefixes. See PHP settings.

All images (from base)

Variable	Default	Description
`LOG_MODE`	`stdout`	`stdout` streams everything to the container, tagged per service. `file` writes one file per service under `/var/log`.
`LOG_FORMAT`	`text`	`text` for `[service]`-prefixed lines, `json` for one JSON object per line.
`LOG_TAG`	`true`	`false` removes the `[service]` prefixes in text mode.
`TZ`	`UTC`	Container timezone.
`LANG`	`C.UTF-8`	Locale.

php

General

Variable	Default	php.ini directive
`PHP_MEMORY_LIMIT`	`128M`	`memory_limit`
`PHP_UPLOAD_MAX_FILESIZE`	`2M`	`upload_max_filesize`
`PHP_POST_MAX_SIZE`	`2M`	`post_max_size`
`PHP_MAX_EXECUTION_TIME`	`30`	`max_execution_time`
`PHP_MAX_INPUT_TIME`	`60`	`max_input_time`
`PHP_MAX_INPUT_VARS`	`1000`	`max_input_vars`
`PHP_DISPLAY_ERRORS`	`Off`	`display_errors`
`PHP_ERROR_REPORTING`	`E_ALL & ~E_DEPRECATED & ~E_STRICT`	`error_reporting`
`PHP_DATE_TIMEZONE`	`UTC`	`date.timezone`
`PHP_SENDMAIL_PATH`	(PHP default)	`sendmail_path`, for example `/usr/bin/msmtp -t`

Security

Variable	Default	php.ini directive
`PHP_EXPOSE_PHP`	`Off`	`expose_php` (controls the `X-Powered-By` header)
`PHP_DISABLE_FUNCTIONS`	(empty)	`disable_functions`
`PHP_ALLOW_URL_FOPEN`	`On`	`allow_url_fopen`
`PHP_ALLOW_URL_INCLUDE`	`Off`	`allow_url_include`
`PHP_OPEN_BASEDIR`	(empty)	`open_basedir`, for example `/var/www/html:/tmp`
`PHP_SESSION_COOKIE_HTTPONLY`	`On`	`session.cookie_httponly`
`PHP_SESSION_COOKIE_SECURE`	(auto)	`session.cookie_secure`. Resolves to `On` when `NGINX_SSL_ENABLED=true`, otherwise `Off`.
`PHP_SESSION_COOKIE_SAMESITE`	`Lax`	`session.cookie_samesite`
`PHP_SESSION_USE_STRICT_MODE`	`On`	`session.use_strict_mode`
`PHP_CGI_FIX_PATHINFO`	`0`	`cgi.fix_pathinfo`

OPcache

Variable	Default	php.ini directive
`OPCACHE_ENABLE`	`0`	`opcache.enable`
`OPCACHE_ENABLE_CLI`	`0`	`opcache.enable_cli`
`OPCACHE_MEMORY_CONSUMPTION`	`128`	`opcache.memory_consumption`
`OPCACHE_INTERNED_STRINGS_BUFFER`	`8`	`opcache.interned_strings_buffer`
`OPCACHE_MAX_ACCELERATED_FILES`	`10000`	`opcache.max_accelerated_files`
`OPCACHE_VALIDATE_TIMESTAMPS`	`1`	`opcache.validate_timestamps`
`OPCACHE_REVALIDATE_FREQ`	`2`	`opcache.revalidate_freq`
`OPCACHE_MAX_WASTED_PERCENTAGE`	`5`	`opcache.max_wasted_percentage`
`OPCACHE_LOG_VERBOSITY_LEVEL`	`1`	`opcache.log_verbosity_level`
`OPCACHE_ERROR_LOG`	`/var/log/php-opcache.log`	`opcache.error_log`

OPcache is off by default so the image behaves predictably for CLI work and bind-mounted development. Turn it on in production with OPCACHE_ENABLE=1 and, for immutable deployments, OPCACHE_VALIDATE_TIMESTAMPS=0.

Build-time and internals

Variable	Description
`PHP_VERSION`	Minor without the dot, for example `84`. Set at build time; used in package and path names.
`PHP_PATCH_VERSION`	Exact pinned release, for example `8.4.26`. Set at build time.
`PHPRC`	`/run/php`, where the rendered php.ini lives.

php-nginx

Nginx

Variable	Default	Description
`NGINX_PORT`	`80`	HTTP listen port. Use 8080 or higher when running as non-root.
`NGINX_LISTEN_IPV6`	`true`	Also listen on `[::]`. Set `false` on hosts with IPv6 disabled in the kernel.
`NGINX_SERVER_NAME`	`_`	`server_name`. Also fixes the HTTPS redirect target.
`NGINX_DOCUMENT_ROOT`	`/var/www/html`	Web root.
`NGINX_FASTCGI_PASS`	`127.0.0.1:9000`	Upstream for PHP requests.
`NGINX_ACCESS_LOG`	(by `LOG_MODE`)	Access log destination. `off` disables it.
`NGINX_ERROR_LOG`	(by `LOG_MODE`)	Error log destination for the `http` block and the app server.

PHP-FPM

Variable	Default	Description
`PHP_FPM_LISTEN`	`127.0.0.1:9000`	Pool listen address.
`PHP_FPM_MAX_CHILDREN`	`30`	`pm.max_children`
`PHP_FPM_START_SERVERS`	`5`	`pm.start_servers`
`PHP_FPM_MIN_SPARE_SERVERS`	`3`	`pm.min_spare_servers`
`PHP_FPM_MAX_SPARE_SERVERS`	`10`	`pm.max_spare_servers`
`PHP_FPM_MAX_REQUESTS`	`1000`	`pm.max_requests`
`PHP_FPM_REQUEST_TERMINATE_TIMEOUT`	`0`	`request_terminate_timeout`
`PHP_FPM_ERROR_LOG`	(by `LOG_MODE`)	FPM master and pool error log.
`PHP_FPM_SLOWLOG`	(by `LOG_MODE`)	Slow request log (requests over 5 seconds).

SSL and HTTPS

Variable	Default	Description
`NGINX_SSL_ENABLED`	`false`	Master switch.
`NGINX_SSL_PORT`	`443`	HTTPS listen port. Use 8443 when running as non-root.
`NGINX_SSL_CERTIFICATE`	`/etc/nginx/ssl/cert.pem`	Certificate path.
`NGINX_SSL_CERTIFICATE_KEY`	`/etc/nginx/ssl/key.pem`	Private key path.
`NGINX_SSL_PROTOCOLS`	`TLSv1.2 TLSv1.3`	Allowed TLS versions.
`NGINX_SSL_CIPHERS`	Mozilla intermediate list	`ssl_ciphers`.
`NGINX_SSL_PREFER_SERVER_CIPHERS`	`off`	`ssl_prefer_server_ciphers`.
`NGINX_SSL_SESSION_CACHE`	`shared:SSL:10m`	`ssl_session_cache`.
`NGINX_SSL_SESSION_TIMEOUT`	`1d`	`ssl_session_timeout`.
`NGINX_SSL_REDIRECT`	`true`	Serve an HTTP listener that redirects to HTTPS.
`NGINX_SSL_REDIRECT_PORT`	(inherits `NGINX_PORT`)	Port for the redirect listener.
`NGINX_SSL_REDIRECT_HOST`	(first `NGINX_SERVER_NAME`)	Host used in the redirect `Location`.
`NGINX_SSL_SELF_SIGNED`	`false`	Generate a self-signed certificate at startup if none exists.
`NGINX_SSL_SELF_SIGNED_CN`	`localhost`	CN and SAN for the generated certificate.
`NGINX_SSL_SELF_SIGNED_DAYS`	`365`	Validity of the generated certificate.
`NGINX_SSL_HSTS`	`true`	Send `Strict-Transport-Security`.
`NGINX_SSL_HSTS_MAX_AGE`	`63072000`	HSTS max-age in seconds (two years).

php-nginx-dev

Variable	Default	Description
`PHP_DEBUGGER`	`xdebug`	`xdebug` or `none`.
`XDEBUG_MODE`	`develop,debug`	Xdebug modes.
`XDEBUG_START_WITH_REQUEST`	`trigger`	`yes`, `no` or `trigger`.
`XDEBUG_CLIENT_HOST`	`host.docker.internal`	IDE host.
`XDEBUG_CLIENT_PORT`	`9003`	IDE port.
`XDEBUG_DISCOVER_CLIENT_HOST`	`false`	Derive the IDE host from the request.
`XDEBUG_IDEKEY`	`PHPSTORM`	IDE key.
`XDEBUG_OUTPUT_DIR`	`/tmp/xdebug`	Profiles and traces.
`XDEBUG_LOG_LEVEL`	`3`	Xdebug log level.
`NGINX_NO_CACHE_PATTERN`	asset regex	Paths served with `no-store`. Empty disables.
`PHP_INI_SCAN_DIR`	`:/run/php/conf.d`	Adds the rendered Xdebug ini to PHP's scan path.

The dev image also overrides PHP_DISPLAY_ERRORS=On and PHP_ERROR_REPORTING=E_ALL.

php-nginx-dev

The web stack with Xdebug, errors on screen and uncached assets, for local development only.

PHP settings

Named variables for the common php.ini and PHP-FPM settings, and generic overrides for everything else.