adamrollogi/base:latest is a small Alpine image with the tooling the PHP images share. You can use it directly for sidecars or cron containers, but most people will only ever see it as the parent of php.
What is inside
| Component | Notes |
|---|---|
| Alpine 3.24 | Digest-pinned base, upgraded with apk upgrade at build time so Alpine security fixes are always current. Supported by Alpine until June 2028. |
| tini | PID 1 for correct signal handling and zombie reaping. |
| Supervisor 4.3 | Process manager used in root mode. Runs crond and, in the web images, Nginx and PHP-FPM. |
| bash, curl, wget, git, nano, openssl | Everyday tooling. |
| gettext-envsubst | Renders the configuration templates from environment variables at startup. |
| gcompat | glibc compatibility shim for binaries that need it. |
| ca-certificates, tzdata | Up to date trust store and timezone data. TZ defaults to UTC. |
| Python 3.14 | Present only because Supervisor needs it. setuptools is upgraded past Alpine's package to clear a known CVE. |
The appuser account (UID 1000, GID 1000) is created here and is the default user for every image.
Process model
The entrypoint is tini -- bash, and the default command is bash, so docker run adamrollogi/base drops you into a shell. Run supervisord -c /etc/supervisord.conf as root to get the Supervisor and cron setup the web images use.
Supervisor itself logs to the container's stderr. Cron runs through run-service, which tags its output [cron].
Logging helpers
Two small scripts live in /usr/local/bin and are used by every descendant image.
| Script | Purpose |
|---|---|
run-service <name> <command> | Starts a process with its stdout and stderr tagged [name], or wrapped as JSON when LOG_FORMAT=json. Lines that are already JSON pass through untouched. |
container-logs [-f] [service|all] | In LOG_MODE=file, tails the per-service log files. In the default stdout mode, prints the docker logs filtering recipes. |
The shared shell helpers (log, json_escape, apply_ini_overrides) are in /usr/local/lib/entrypoint-lib.sh and are sourced by the PHP entrypoints. See Logging.
Environment variables
| Variable | Default | Description |
|---|---|---|
LOG_MODE | stdout | stdout streams everything to the container, tagged per service. file writes one file per service under /var/log. |
LOG_FORMAT | text | text for tagged lines, json for one JSON object per line. |
LOG_TAG | true | false removes the [service] prefixes in text mode. |
LANG | C.UTF-8 | Locale. |
TZ | UTC | Timezone, applied to /etc/localtime at build. |
Hardening
- No setuid or setgid binaries. The
busybox-suidpackage is not installed and the setuid bits thatshadowwould add are stripped. - Configuration under
/etcis root-owned. Runtime config in the PHP images is rendered into/run. - OCI labels (
title,description,source,licenses) are set on the image.
Layout
| Path | Purpose |
|---|---|
/etc/supervisord.conf | Supervisor main config. Includes /etc/supervisord.d/*.conf. |
/usr/local/bin/run-service | Per-service log tagging wrapper. |
/usr/local/bin/container-logs | Log tailing helper for file mode. |
/usr/local/lib/entrypoint-lib.sh | Shared shell functions for entrypoints. |
/app | Default working directory, owned by appuser. |