alvar0rm/laravel repository overview

⁠¿Qué es esta imagen?

Imagen Docker preconfigurada para el ecosistema Laravel (versiones 5.0 a 13), con compatibilidad estricta entre PHP, Composer y Node.js LTS de cada era.

⁠Advertencias de Seguridad

Todas las imágenes usan Ubuntu 24.04 LTS. Estas versiones de PHP están EOL: solo para desarrollo local, nunca exponer a internet.

⁠Parche de PHP2Shell (CVE-2026-109618 y CVE-2026-109619)

Las imágenes publicadas desde octubre de 2026 incluyen la corrección: PHP 5.6–8.1 con backport del PPA, 8.2 con 8.2.35, 8.3 con el paquete nativo de Ubuntu (8.3.6, parchado por Canonical), 8.4 con 8.4.27 y 8.5 con 8.5.12. Cada Dockerfile verifica el parche al compilar y falla si el changelog de PHP no menciona CVE-2026-109618.

php -v no indica si hay parche (el número de versión no cambia en backports). Para comprobarlo:

docker run --rm --entrypoint sh alvar0rm/laravel:7-php7.4 \
  -c 'zcat /usr/share/doc/php7.4-common/changelog.Debian.gz | grep CVE-2026-109618'

⁠Cómo usar esta imagen

⁠Docker Compose (Recomendado)

services:
  app:
    image: alvar0rm/laravel:13-php8.4
    restart: unless-stopped
    volumes:
      - ./app:/var/www/app
    ports:
      - "80:80"
      - "5173:5173"

⁠Consola

docker run -d -p 80:80 \
  -v $(pwd)/app:/var/www/app \
  alvar0rm/laravel:13-php8.4-supervisor

⁠Como imagen base

FROM alvar0rm/laravel:13-php8.4
RUN apt-get update && apt-get install -y cron && rm -rf /var/lib/apt/lists/*

⁠Variables de Entorno

Si GIT_CLONE_URL está definido y la carpeta está vacía, clona el repo automáticamente.

environment:
  TZ: "America/Mexico_City"
  GIT_USER_NAME: "Docker user"
  GIT_DEFAULT_BRANCH: "main"
  GIT_CLONE_URL: "https://github.com/usuario/proyecto.git"

⁠Matriz de Compatibilidad

Nomenclatura: {laravel}-php{version}[-supervisor] · Base: Ubuntu 24.04 LTS

⁠Arquitecturas

⁠Composer (por versión de PHP)

⁠Node.js

⁠Supervisor

⁠Extensiones de PHP

Conexión a SQL Server: PHP 5.6 usa pdo_dblib (FreeTDS). PHP 7.0–7.3 usa pdo_sqlsrv con ODBC Driver 17 (pdo_sqlsrv 5.3.0 en 7.0–7.2 y 5.9.0 en 7.3). PHP 7.4–8.5 usa pdo_sqlsrv con ODBC Driver 18 (5.10.1 en 7.4, 5.11.1 en 8.0–8.2, 5.12.0 en 8.3 y 5.13.3 en 8.4–8.5). Microsoft solo soporta ODBC 18 con pdo_sqlsrv 5.10 o superior. En PHP 8.5, OPcache viene integrado en el núcleo.

⁠Configuración de Apache

• DocumentRoot: /var/www/app/public
• Config: /etc/apache2/apache2.conf
• VirtualHost HTTP: /etc/apache2/sites-available/000-default.conf
• VirtualHost HTTPS: /etc/apache2/sites-available/default-ssl.conf

⁠Configuración de PHP (php.ini)

⁠Supervisor y Colas

Las imágenes con -supervisor incluyen Supervisor preconfigurado con un worker de ejemplo.

Directorios de configuración:

• /etc/supervisor/conf.d/
• /var/www/app/storage/supervisor/

[program:queue-default]
command=php /var/www/app/artisan queue:listen --timeout=3600 --tries=1
autostart=true
autorestart=true
numprocs=1
user=www-data
stdout_logfile=/var/www/app/storage/logs/default.log

⁠SSL

El entrypoint habilita HTTPS automáticamente si detecta certificados en:

• /etc/ssl/certs/localhost.crt
• /etc/ssl/private/localhost.key

volumes:
  - ./certs/localhost.crt:/etc/ssl/certs/localhost.crt:ro
  - ./certs/localhost.key:/etc/ssl/private/localhost.key:ro

⁠Configuración SSH para Git

services:
  app:
    image: alvar0rm/laravel:13-php8.4
    environment:
      GIT_CLONE_URL: "[email protected]:usuario/repositorio.git"
      SSH_AUTH_SOCK: "/tmp/ssh-agent.sock"
    volumes:
      - ~/.ssh/id_rsa:/root/.ssh/id_rsa:ro             # Clonado inicial
      - ${SSH_AUTH_SOCK}:/tmp/ssh-agent.sock:ro          # Push/pull posteriores
      - ~/.ssh/known_hosts:/root/.ssh/known_hosts:ro     # Verificación de host

Llave sin passphrase (alternativa):

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_docker -N "" -C "docker-dev"

Problemas comunes:

Compatibilidad accept-new: todas las imágenes (PHP 5.6–8.5) usan Ubuntu 24.04 con OpenSSH 9.6, que soporta accept-new.

⁠What is this image?

Pre-configured Docker image for the Laravel ecosystem (versions 5.0 to 13), with strict compatibility between PHP, Composer, and the LTS Node.js of each era.

⁠Security Warnings

All images use Ubuntu 24.04 LTS. These PHP versions are EOL: local development only — never expose to the internet.

⁠PHP2Shell patch (CVE-2026-109618 and CVE-2026-109619)

Images published from October 2026 include the fix: PHP 5.6–8.1 with a PPA backport, 8.2 with 8.2.35, 8.3 with the native Ubuntu package (8.3.6, patched by Canonical), 8.4 with 8.4.27 and 8.5 with 8.5.12. Every Dockerfile verifies the patch at build time and fails if the PHP changelog does not mention CVE-2026-109618.

php -v does not tell you whether the patch is present (backports keep the version number). To check:

docker run --rm --entrypoint sh alvar0rm/laravel:7-php7.4 \
  -c 'zcat /usr/share/doc/php7.4-common/changelog.Debian.gz | grep CVE-2026-109618'

⁠How to use this image

⁠Docker Compose (Recommended)

services:
  app:
    image: alvar0rm/laravel:13-php8.4
    restart: unless-stopped
    volumes:
      - ./app:/var/www/app
    ports:
      - "80:80"
      - "5173:5173"

⁠Console

docker run -d -p 80:80 \
  -v $(pwd)/app:/var/www/app \
  alvar0rm/laravel:13-php8.4-supervisor

⁠As base image

FROM alvar0rm/laravel:13-php8.4
RUN apt-get update && apt-get install -y cron && rm -rf /var/lib/apt/lists/*

⁠Environment Variables

If GIT_CLONE_URL is set and the folder is empty, the repo is cloned automatically.

environment:
  TZ: "America/New_York"
  GIT_USER_NAME: "Docker user"
  GIT_DEFAULT_BRANCH: "main"
  GIT_CLONE_URL: "https://github.com/user/project.git"

⁠Compatibility Matrix

Naming convention: {laravel}-php{version}[-supervisor] · Base: Ubuntu 24.04 LTS

⁠Architectures

⁠Composer (by PHP version)

⁠Node.js

⁠Supervisor

⁠PHP Extensions

SQL Server connectivity: PHP 5.6 uses pdo_dblib (FreeTDS). PHP 7.0–7.3 uses pdo_sqlsrv with ODBC Driver 17 (pdo_sqlsrv 5.3.0 on 7.0–7.2 and 5.9.0 on 7.3). PHP 7.4–8.5 uses pdo_sqlsrv with ODBC Driver 18 (5.10.1 on 7.4, 5.11.1 on 8.0–8.2, 5.12.0 on 8.3 and 5.13.3 on 8.4–8.5). Microsoft only supports ODBC 18 with pdo_sqlsrv 5.10 or later. In PHP 8.5, OPcache is built into the core.

⁠Apache Configuration

• DocumentRoot: /var/www/app/public
• Config: /etc/apache2/apache2.conf
• HTTP VirtualHost: /etc/apache2/sites-available/000-default.conf
• HTTPS VirtualHost: /etc/apache2/sites-available/default-ssl.conf

⁠PHP Configuration (php.ini)

⁠Supervisor and Queues

Images with -supervisor include Supervisor pre-configured with an example queue worker.

Configuration directories:

• /etc/supervisor/conf.d/
• /var/www/app/storage/supervisor/

[program:queue-default]
command=php /var/www/app/artisan queue:listen --timeout=3600 --tries=1
autostart=true
autorestart=true
numprocs=1
user=www-data
stdout_logfile=/var/www/app/storage/logs/default.log

⁠SSL

The entrypoint auto-enables HTTPS if it detects certificates at:

• /etc/ssl/certs/localhost.crt
• /etc/ssl/private/localhost.key

volumes:
  - ./certs/localhost.crt:/etc/ssl/certs/localhost.crt:ro
  - ./certs/localhost.key:/etc/ssl/private/localhost.key:ro

⁠SSH Configuration for Git

services:
  app:
    image: alvar0rm/laravel:13-php8.4
    environment:
      GIT_CLONE_URL: "[email protected]:user/repository.git"
      SSH_AUTH_SOCK: "/tmp/ssh-agent.sock"
    volumes:
      - ~/.ssh/id_rsa:/root/.ssh/id_rsa:ro             # Initial clone
      - ${SSH_AUTH_SOCK}:/tmp/ssh-agent.sock:ro          # Subsequent push/pull
      - ~/.ssh/known_hosts:/root/.ssh/known_hosts:ro     # Host verification

Key without passphrase (alternative):

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_docker -N "" -C "docker-dev"

Common issues:

accept-new compatibility: all images (PHP 5.6–8.5) use Ubuntu 24.04 with OpenSSH 9.6, which supports accept-new.