Couple of questions about static-php and your public repo

[iamdadmin]

Firstly sorry for posting this as an issue, I wasn't sure the best way to get in touch. And secondly, thanks for publishing the php-zts and frankenphp builds on your repos, it's appreciated!

I am creating this to check, that if once installed, are these fully static? i.e. no need for gcc-14-base / libc6 / libstdc++6 in the base? No need for dependencies like lizbip, libicu for locales etc? I'm working on a distroless, rootless image and looking to understand what I can remove and what can be kept.

I'm new to static builds, so just wanted to ask directly instead of making assumptions. Thanks in advance for any time you can spare to reply.

[henderkes]

They are "mostly" static, as in, they are as static as it gets when linked against system libc.

❯❯ ~  14:33 ldd /usr/bin/php-zts
        linux-vdso.so.1 (0x00007ffeb8124000)
        libm.so.6 => /lib64/libm.so.6 (0x00007fdbdd988000)
        libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fdbdd983000)
        libc.so.6 => /lib64/libc.so.6 (0x00007fdbdae27000)
        libdl.so.2 => /lib64/libdl.so.2 (0x00007fdbdd97e000)
        librt.so.1 => /lib64/librt.so.1 (0x00007fdbdd977000)
        /lib64/ld-linux-x86-64.so.2 (0x00007fdbdda3e000)
        libutil.so.1 => /lib64/libutil.so.1 (0x00007fdbdd972000)
        libresolv.so.2 => /lib64/libresolv.so.2 (0x00007fdbdd960000)

All these are fulfilled by the respective libc version of the package (glibc 2.31+ for debian packages, 2.28 for rhel 8, 2.36 rhel 9, 2.39 rhel 10, musl 1.2X for alpine).

As long as you don't remove libc itself from your system, they will work.

[henderkes]

If you want to make sure you don't remove anything too much, we have an example on how to build distroless images at https://frankenphp.dev/docs/docker/#hardening-images. You could apply the same approach with my packages (install everything you need, then run the part:

    EXT_DIR="$(php-zts -r 'echo ini_get("extension_dir");')" && \
    FRANKENPHP_BIN="$(which frankenphp)"; \
    LIBS_TMP_DIR="/tmp/libs"; \
    mkdir -p "$LIBS_TMP_DIR"; \
    for target in "$FRANKENPHP_BIN" $(find "$EXT_DIR" -maxdepth 2 -type f -name "*.so"); do \
        libtree -pv "$target" | sed 's/.*── \(.*\) \[.*/\1/' | grep -v "^$target" | while IFS= read -r lib; do \
            [ -z "$lib" ] && continue; \
            base=$(basename "$lib"); \
            destfile="$LIBS_TMP_DIR/$base"; \
            if [ ! -f "$destfile" ]; then \
                cp "$lib" "$destfile"; \
            fi; \
        done; \
    done

[iamdadmin]

Thank you, that is supremely helpful! I did start with the FrankenPHP hardening example, and I managed to get down to a ~220Mb distroless image, but using ldd / lddtree from pax-utils (instead of libtree). It was still quite complicated and fragile, and needed manually included transitive dependencies.

So my next step was to utilise your php-zts statically compiled packages, and insert that into distroless.

I'm working on a first-party frankenphp docker image for TempestPHP Framework over here tempestphp/tempest-framework#2004 if you're interested to see what I'm working on. The draft pull was the testing ~220Mb image, but working on this more-refined version now. Thanks again for the pointers!

[iamdadmin]

I thought I’d let you know how it went, and say thanks again for the help!

For comparison, the FrankenPHP official images at time of writing come in at 182MB for Alpine and 613MB for Debian, but neither of these have any of the extensions I’ve added to my image.

The distroless image I created comes in at 263MB, and I think about half the delta against the Alpine image is the extensions themselves. There’s also static curl and static busybox, but neither are huge of course.

I’m making a case for not having an Alpine image at all due to the musl limitations with zts. It’s been a fun project and I’ve learned plenty.

[henderkes]

If you'd like to save a bit more space, in a minimal image you could actually delete /usr/bin/php-zts (~40mb?) after installing frankenphp. Won't be able to use php-cli anymore, but I guess for scripts there's frankenphp php-cli script.php.

Sadly FrankenPHP itself is quite large (~50mb). Go is not very good at dead code elimination.

[iamdadmin]

That's very tempting! But I'm not sure if at the moment there's a strong use-case for php-cli remaining or not. In the distroless image there's no shell, so I can't do a simple /bin/sh alias script for it either, although a micro-size compiled program might do it. In the debug image the alias script would be fine.