docker pull php:8.4-apachephp@sha256:4af38a0245996e700e20ec211b9f1c44fb789ad8cc7d24c7ea81ff382b641052Size per platform
Compressed download size on Docker Hub for each architecture.
Where the bytes go
Unpacked bytes by directory in the final amd64 filesystem.
Layers
The 15 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.
Full build steps
- 30 MB
# debian.sh --arch 'amd64' out/ 'trixie' '@1793059200' - 226 B
RUN /bin/sh -c set -eux; { echo 'Package: php*'; echo 'Pin: release *'; echo 'Pin-Priority: -1'; } > /etc/apt/preferences.d/no-debian-php # buildkit - 118 MB
RUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends $PHPIZE_DEPS ca-certificates curl xz-utils ; apt-get dist-clean # buildkit - 227 B
RUN /bin/sh -c set -eux; mkdir -p "$PHP_INI_DIR/conf.d"; [ ! -d /var/www/html ]; mkdir -p /var/www/html; chown www-data:www-data /var/www/html; chmod 1777 /var/www/html # buildkit - 4.2 MB
RUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends apache2; apt-get dist-clean; sed -ri 's/^export ([^=]+)=(.*)$/: ${\1:=\2}\nexport \1/' "$APACHE_ENVVARS"; . "$APACHE_ENVVARS"; for dir in "$APACHE_LOCK_DIR" "$APACHE_RUN_DIR" "$APACHE_LOG_DIR" "$APACHE_RUN_DIR/socks" ; do rm -rvf "$dir"; mkdir -p "$dir"; chown "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$dir"; chmod 1777 "$dir"; done; rm -rvf /var/www/html/*; ln -sfT /dev/stderr "$APACHE_LOG_DIR/error.log"; ln -sfT /dev/stdout "$APACHE_LOG_DIR/access.log"; ln -sfT /dev/stdout "$APACHE_ - 430 B
RUN /bin/sh -c a2dismod mpm_event && a2enmod mpm_prefork # buildkit - 483 B
RUN /bin/sh -c { echo '<FilesMatch \.php$>'; echo '\tSetHandler application/x-httpd-php'; echo '</FilesMatch>'; echo; echo 'DirectoryIndex disabled'; echo 'DirectoryIndex index.php index.html'; echo; echo '<Directory /var/www/>'; echo '\tOptions -Indexes'; echo '\tAllowOverride All'; echo '</Directory>'; } | tee "$APACHE_CONFDIR/conf-available/docker-php.conf" && a2enconf docker-php # buildkit - 14 MB
RUN /bin/sh -c set -eux; savedAptMark="$(apt-mark showmanual)"; apt-get update; apt-get install -y --no-install-recommends gnupg; apt-get dist-clean; mkdir -p /usr/src; cd /usr/src; curl -fsSL -o php.tar.xz "$PHP_URL"; if [ -n "$PHP_SHA256" ]; then echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; fi; curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; export GNUPGHOME="$(mktemp -d)"; for key in $GPG_KEYS; do gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; done; gpg --batch --verify php.tar.xz.asc php.tar.xz; gpgconf --kill all; rm -rf "$GNUPGHOME"; apt-mark - 489 B
COPY docker-php-source /usr/local/bin/ # buildkit - 14 MB
RUN /bin/sh -c set -eux; savedAptMark="$(apt-mark showmanual)"; apt-get update; apt-get install -y --no-install-recommends apache2-dev libargon2-dev libcurl4-openssl-dev libonig-dev libreadline-dev libsodium-dev libsqlite3-dev libssl-dev libxml2-dev zlib1g-dev ; export CFLAGS="$PHP_CFLAGS" CPPFLAGS="$PHP_CPPFLAGS" LDFLAGS="$PHP_LDFLAGS" PHP_BUILD_PROVIDER='https://github.com/docker-library/php' PHP_UNAME='Linux - Docker' ; docker-php-source extract; cd /usr/src/php; gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; debMultiarch="$(dpkg-archite - 2 kB
COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ # buildkit - 251 B
RUN /bin/sh -c docker-php-ext-enable opcache # buildkit - 246 B
RUN /bin/sh -c docker-php-ext-enable sodium # buildkit - 893 B
COPY apache2-foreground /usr/local/bin/ # buildkit - 32 B
WORKDIR /var/www/html
Known vulnerabilities
2Critical0 with a fix
122High0 with a fix
820Medium0 with a fix
969Low0 with a fix
7Unknown0 with a fix
1920 findings across 186 packages; 0 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.
| Severity | Vulnerability | Affected packages | Fixed in |
|---|---|---|---|
| Critical | CVE-2026-6653libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free | libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | no fix yet |
| Critical | CVE-2026-99083kernel: ksmbd: fix heap out-of-bounds write in krb5_authenticate() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2013-7445kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2019-19449kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2019-19814kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2021-3847kernel: low-privileged user privileges escalation | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2021-3864kernel: descendant's dumpable setting with certain SUID binaries | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2024-21803kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2024-58015kernel: wifi: ath12k: Fix for out-of bound access error | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-38137kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-38187kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-38421kernel: platform/x86/amd: pmf: Use device managed allocations | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-38636kernel: rv: Use strings in da monitors tracepoints | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-39859kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-39862kernel: wifi: mt76: mt7915: fix list corruption after hardware restart | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-39958kernel: iommu/s390: Make attach succeed when the device was surprise removed | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-40025kernel: f2fs: fix to do sanity check on node footer for non inode dnode | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-68174kernel: Linux kernel AMD KFD: Race condition causes system crash | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-68735kernel: Kernel: Privilege escalation via use-after-free in drm/panthor | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-69720ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution. | libncursesw6, libtinfo6, ncurses-base, ncurses-bininstalled 6.5+20250216-2 | no fix yet |
| High | CVE-2026-100072kernel: ACPI: platform: Use acpi_bus_get_primary_device() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-12064curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP | curl, libcurl4t64installed 8.14.1-2+deb13u7 | no fix yet |
| High | CVE-2026-16742systemd: systemd-homed: Local privilege escalation via missing home-record signature verification | libsystemd0, libudev1installed 257.13-1~deb13u1 | no fix yet |
| High | CVE-2026-23102kernel: Linux kernel: Denial of Service due to incorrect SVE context restoration | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-23208kernel: ALSA: usb-audio: Prevent excessive number of frames | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-23327kernel: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-31493kernel: RDMA/efa: Fix use of completion ctx after free | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-31568kernel: s390/mm: Add missing secure storage access fixups for donated memory | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-43185kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-46130kernel: dm-verity-fec: fix reading parity bytes split across blocks (take 3) | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-46181kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-46279kernel: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-52991kernel: sched/psi: fix race between file release and pressure write | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-53000kernel: netfilter: nat: use kfree_rcu to release ops | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-53091kernel: net: pull headers in qdisc_pkt_len_segs_init() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-53109kernel: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-53118kernel: vdpa: use generic driver_override infrastructure | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-53277kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-53330kernel: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-54369acl: Symlink traversal privilege escalation via libacl functions | libacl1installed 2.3.2-2+b1 | no fix yet |
Showing the 40 most severe of 1,168 distinct vulnerabilities (1920 findings, one per affected package).
Packages
- Debian packages
- 186
Image configuration
- Base OS
- Debian 13.7 (trixie)
- Default user
- root (no USER set; the entrypoint may still drop privileges)
- Entrypoint
- docker-php-entrypoint
- Command
- apache2-foreground
- Exposed ports
- 80/tcp
- Image created
- 2026-10-28
- amd64 digest
- sha256:f285280aa665ef0fe6f9645ed5e6aa94df2c4595b62c07d4c90c79dcc0ddc8a4
Other PHP tags
php:8.4-cli549 MB unpacked · 186 MB downloadC 2H 121M 818L 936? 4
php:8.4-fpm-alpine91 MB unpacked · 37 MB downloadC 1H 2M 2L 44
Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-31 from digest sha256:f285280aa665. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.