From 95ff0d37584bbf70c7b855639617f6ae4d2cb8a1 Mon Sep 17 00:00:00 2001
From: Michael Contento <mail@michaelcontento.de>
Date: Wed, 26 Apr 2017 17:16:56 +0200
Subject: [PATCH] Add xdebug support and improve php configuration

---
 Dockerfile                                    | 20 +++++++++++---
 usr/bin/docker-start                          | 12 +++++++++
 .../etc/php/conf.d/00-best-practices.ini      |  8 ++++++
 usr/local/etc/php/conf.d/00-performance.ini   | 26 +++++++++++++++++++
 usr/local/etc/php/conf.d/00-security.ini      | 20 ++++++++++++++
 usr/local/etc/php/conf.d/10-xdebug.ini        |  4 +++
 6 files changed, 87 insertions(+), 3 deletions(-)
 create mode 100644 usr/local/etc/php/conf.d/00-best-practices.ini
 create mode 100644 usr/local/etc/php/conf.d/00-performance.ini
 create mode 100644 usr/local/etc/php/conf.d/00-security.ini
 create mode 100644 usr/local/etc/php/conf.d/10-xdebug.ini

diff --git a/Dockerfile b/Dockerfile
index d40cad2..919cfa8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,12 +1,18 @@
-FROM php:7.1-fpm-alpine
+FROM php:fpm-alpine
 
 MAINTAINER Michael Contento <mail@michaelcontento.de>
 
 RUN \
 # Install dependencies
     apk add --no-cache nginx supervisor \
-# Install PHP extension
+# Install PHP extension: opcache
     && docker-php-ext-install opcache \
+    && rm -f /usr/local/etc/php/conf.d/docker-php-ext-opcache.ini \
+# Install PHP extension: xdebug
+    && apk add --no-cache g++ make autoconf \
+    && pecl install xdebug \
+    && apk del g++ make autoconf \
+    && rm -rf /tmp/pear \
 # Remove (some of the) default nginx config
     && rm -f /etc/nginx.conf \
     && rm -rf /etc/nginx/sites-* \
@@ -22,7 +28,8 @@ RUN \
     && rm -rf /var/www \
 # ... but ensure it exists with the right owner
     && mkdir -p /var/www \
-    && chown www-data.www-data /var/www
+    && echo "<?php phpinfo();" > /var/www/index.php \
+    && chown -R www-data.www-data /var/www
 
 WORKDIR /var/www
 
@@ -40,6 +47,13 @@ ENV REDIRECT_CODE=302
 # "http", "https" or "auto" (which will trust X-Forwarded-Proto)
 ENV REDIRECT_PROTO="auto"
 
+# Change this to true/1 to enable the xdebug extension for php. You need to change
+# some xdebug settings? E.g. xdebug.idekey? Just set a environment variable with the dot
+# replaced with an underscore (xdebug.idekey => XDEBUG_IDEKEY) and they xdebug config will
+# be changed on container start. This is a fast and simple alternative to adding a custom
+# config ini in /usr/local/etc/php/conf.d/
+ENV XDEBUG=false
+
 ADD etc/ /etc/
 ADD usr/ /usr/
 
diff --git a/usr/bin/docker-start b/usr/bin/docker-start
index afc8aac..a270543 100755
--- a/usr/bin/docker-start
+++ b/usr/bin/docker-start
@@ -28,4 +28,16 @@ if [[ -f "/etc/nginx/sites-available/redirect-${REDIRECT_MODE}.conf" ]]; then
         "/etc/nginx/sites-enabled/redirect-${REDIRECT_MODE}.conf"
 fi
 
+# Configure or disable XDebug as requested
+XDEBUG_INI="/usr/local/etc/php/conf.d/10-xdebug.ini"
+if [ ${XDEBUG} = true ] || [ "${XDEBUG}" == "1" ]; then
+    env \
+        | egrep '^XDEBUG_' \
+        | sed -e 's/XDEBUG_/xdebug./' \
+        | tr 'A-Z' 'a-z' \
+        >> "${XDEBUG_INI}"
+else
+    rm -f "${XDEBUG_INI}"
+fi
+
 exec /usr/bin/supervisord -c /etc/supervisord.conf
diff --git a/usr/local/etc/php/conf.d/00-best-practices.ini b/usr/local/etc/php/conf.d/00-best-practices.ini
new file mode 100644
index 0000000..a872af6
--- /dev/null
+++ b/usr/local/etc/php/conf.d/00-best-practices.ini
@@ -0,0 +1,8 @@
+; Disable deprecated short open tags ("<?")
+short_open_tag=Off
+
+; Do not expose php version header
+expose_php=Off
+
+; -1 can be used (like E_ALL) to report all errors - including those coming in new php versions
+error_reporting=-1
diff --git a/usr/local/etc/php/conf.d/00-performance.ini b/usr/local/etc/php/conf.d/00-performance.ini
new file mode 100644
index 0000000..340ee03
--- /dev/null
+++ b/usr/local/etc/php/conf.d/00-performance.ini
@@ -0,0 +1,26 @@
+zend_extension=opcache.so
+
+; we want fast cli scripts too
+opcache.enable_cli=On
+
+; fast shutdown because we skip free() calls
+opcache.fast_shutdown=On
+
+; The amount of memory used to store interned strings, in megabytes
+opcache.interned_strings_buffer=8
+
+; The maximum number of keys (and therefore scripts) in the OPcache hash table
+opcache.max_accelerated_files=20000
+
+; The size of the shared memory storage used by OPcache, in megabytes
+opcache.memory_consumption=128
+
+; If enabled, OPcache will check for updated scripts every opcache.revalidate_freq seconds. When
+; this directive is disabled, you must reset OPcache manually via opcache_reset(),
+; opcache_invalidate() or by restarting the Web server for changes to the filesystem to take effect.
+opcache.validate_timestamps=Off
+
+; Determines the size of the realpath cache to be used by PHP. This value
+; should be increased on systems where PHP opens many files, to reflect the
+; quantity of the file operations performed.
+realpath_cache_size=4096K
diff --git a/usr/local/etc/php/conf.d/00-security.ini b/usr/local/etc/php/conf.d/00-security.ini
new file mode 100644
index 0000000..9b7f3be
--- /dev/null
+++ b/usr/local/etc/php/conf.d/00-security.ini
@@ -0,0 +1,20 @@
+; Disable file uploads by default for security reasons. Your service needs file uploads? Please
+; add a overwriting php.ini in your custom Dockerfile!
+file_uploads=Off
+
+; session.use_strict_mode specifies whether the module will use strict session id mode. If this
+; mode is enabled, the module does not accept uninitialized session ID. If uninitialized session ID
+; is sent from browser, new session ID is sent to browser. Applications are protected from session
+; fixation via session adoption with strict mode. Defaults to 0 (disabled).
+session.use_strict_mode=On
+
+; Enable assert() evaluation.
+assert.active=Off
+
+; This determines whether errors should be printed to the screen as part of the output or if they
+; should be hidden from the user. Value "stderr" sends the errors to stderr instead of stdout.
+display_errors=Off
+
+; Tells whether script error messages should be logged to the server's error log or error_log.
+; You're strongly advised to use error logging in place of error displaying on production web sites.
+log_errors=On
diff --git a/usr/local/etc/php/conf.d/10-xdebug.ini b/usr/local/etc/php/conf.d/10-xdebug.ini
new file mode 100644
index 0000000..09dfa99
--- /dev/null
+++ b/usr/local/etc/php/conf.d/10-xdebug.ini
@@ -0,0 +1,4 @@
+zend_extension=xdebug.so
+xdebug.remote_autostart=On
+xdebug.remote_enable=On
+xdebug.remote_connect_back=On