Docker Hardened Images

[matthieu-delisle]

Describe your feature request

Is it in the plans to create a frankenPHP image based on the Docker Hardened Images that are newly made available to public?

[henderkes]

Forgive me if I'm missing something, but that seems majorly pointless to me. I know a grand total of zero php projects that don't require a few extensions, the docker-php-ext-installer wouldn't work on dhi images given that they don't have a shell or a package manager.

So if you want to use the hardened images, you'll need to do a multi-stage build yourself anyhow, where you can copy /usr/local/bin/frankenphp and /usr/local/lib/libphp.so and /usr/lib/.so from the frankenphp images.

[AlliBalliBaba]

I agree, a hardened image probably most of the time needs a multi-stage build. It would be nice to have a template on how to do this in the docs though.

[henderkes]

The build would be the same as for distroless images, which docker hardened images essentially are, with a preconfigured software stack and a slow 7 day CVE SLA slapped on it.

For distroless images we have an open PR for docs: https://github.com/php/frankenphp/pull/1900/changes

Since the preconfigured software stack is useless for php (and especially frankenphp, they don't maintain zts images or extensions), you may as well use distroless images.

[henderkes]

❯❯ ~  13:26 docker run dhi.io/php:8.5 -v
PHP 8.5.0 (cli) (built: Jan 17 2026 01:22:17) (NTS)
Copyright (c) The PHP Group
Built by https://github.com/docker-hardened-images/definitions
Zend Engine v4.5.0, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.0, Copyright (c), by Zend Technologies
❯❯ ~  13:26 docker run dhi.io/php:8.5.1 -v
Unable to find image 'dhi.io/php:8.5.1' locally
docker: Error response from daemon: failed to resolve reference "dhi.io/php:8.5.1": dhi.io/php:8.5.1: not found

Run 'docker run --help' for more information

Okay, perhaps not the greatest idea to run dhi images anyway.