docker pull php:8.4-cliphp@sha256:7e7413ed31b8c42b31c939cc83b3758b1cd618f7bf3803f5a0c39f98d4adcbeeSize per platform
Compressed download size on Docker Hub for each architecture.
Where the bytes go
Unpacked bytes by directory in the final amd64 filesystem.
Layers
The 10 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.
Full build steps
- 30 MB
# debian.sh --arch 'amd64' out/ 'trixie' '@1793059200' - 226 B
RUN /bin/sh -c set -eux; { echo 'Package: php*'; echo 'Pin: release *'; echo 'Pin-Priority: -1'; } > /etc/apt/preferences.d/no-debian-php # buildkit - 118 MB
RUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends $PHPIZE_DEPS ca-certificates curl xz-utils ; apt-get dist-clean # buildkit - 227 B
RUN /bin/sh -c set -eux; mkdir -p "$PHP_INI_DIR/conf.d"; [ ! -d /var/www/html ]; mkdir -p /var/www/html; chown www-data:www-data /var/www/html; chmod 1777 /var/www/html # buildkit - 14 MB
RUN /bin/sh -c set -eux; savedAptMark="$(apt-mark showmanual)"; apt-get update; apt-get install -y --no-install-recommends gnupg; apt-get dist-clean; mkdir -p /usr/src; cd /usr/src; curl -fsSL -o php.tar.xz "$PHP_URL"; if [ -n "$PHP_SHA256" ]; then echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; fi; curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; export GNUPGHOME="$(mktemp -d)"; for key in $GPG_KEYS; do gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; done; gpg --batch --verify php.tar.xz.asc php.tar.xz; gpgconf --kill all; rm -rf "$GNUPGHOME"; apt-mark - 492 B
COPY docker-php-source /usr/local/bin/ # buildkit - 24 MB
RUN /bin/sh -c set -eux; savedAptMark="$(apt-mark showmanual)"; apt-get update; apt-get install -y --no-install-recommends libargon2-dev libcurl4-openssl-dev libonig-dev libreadline-dev libsodium-dev libsqlite3-dev libssl-dev libxml2-dev zlib1g-dev ; export CFLAGS="$PHP_CFLAGS" CPPFLAGS="$PHP_CPPFLAGS" LDFLAGS="$PHP_LDFLAGS" PHP_BUILD_PROVIDER='https://github.com/docker-library/php' PHP_UNAME='Linux - Docker' ; docker-php-source extract; cd /usr/src/php; gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; debMultiarch="$(dpkg-architecture --query - 2 kB
COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ # buildkit - 251 B
RUN /bin/sh -c docker-php-ext-enable opcache # buildkit - 247 B
RUN /bin/sh -c docker-php-ext-enable sodium # buildkit
Known vulnerabilities
2Critical0 with a fix
121High0 with a fix
818Medium0 with a fix
936Low0 with a fix
4Unknown0 with a fix
1881 findings across 172 packages; 0 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.
| Severity | Vulnerability | Affected packages | Fixed in |
|---|---|---|---|
| Critical | CVE-2026-6653libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free | libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | no fix yet |
| Critical | CVE-2026-99083kernel: ksmbd: fix heap out-of-bounds write in krb5_authenticate() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2013-7445kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2019-19449kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2019-19814kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2021-3847kernel: low-privileged user privileges escalation | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2021-3864kernel: descendant's dumpable setting with certain SUID binaries | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2024-21803kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2024-58015kernel: wifi: ath12k: Fix for out-of bound access error | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-38137kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-38187kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-38421kernel: platform/x86/amd: pmf: Use device managed allocations | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-38636kernel: rv: Use strings in da monitors tracepoints | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-39859kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-39862kernel: wifi: mt76: mt7915: fix list corruption after hardware restart | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-39958kernel: iommu/s390: Make attach succeed when the device was surprise removed | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-40025kernel: f2fs: fix to do sanity check on node footer for non inode dnode | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-68174kernel: Linux kernel AMD KFD: Race condition causes system crash | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-68735kernel: Kernel: Privilege escalation via use-after-free in drm/panthor | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-69720ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution. | libtinfo6, ncurses-base, ncurses-bininstalled 6.5+20250216-2 | no fix yet |
| High | CVE-2026-100072kernel: ACPI: platform: Use acpi_bus_get_primary_device() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-12064curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP | curl, libcurl4t64installed 8.14.1-2+deb13u7 | no fix yet |
| High | CVE-2026-16742systemd: systemd-homed: Local privilege escalation via missing home-record signature verification | libsystemd0, libudev1installed 257.13-1~deb13u1 | no fix yet |
| High | CVE-2026-23102kernel: Linux kernel: Denial of Service due to incorrect SVE context restoration | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-23208kernel: ALSA: usb-audio: Prevent excessive number of frames | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-23327kernel: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-31493kernel: RDMA/efa: Fix use of completion ctx after free | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-31568kernel: s390/mm: Add missing secure storage access fixups for donated memory | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-43185kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-46130kernel: dm-verity-fec: fix reading parity bytes split across blocks (take 3) | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-46181kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-46279kernel: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-52991kernel: sched/psi: fix race between file release and pressure write | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-53000kernel: netfilter: nat: use kfree_rcu to release ops | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-53091kernel: net: pull headers in qdisc_pkt_len_segs_init() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-53109kernel: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-53118kernel: vdpa: use generic driver_override infrastructure | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-53277kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-53330kernel: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-54369acl: Symlink traversal privilege escalation via libacl functions | libacl1installed 2.3.2-2+b1 | no fix yet |
Showing the 40 most severe of 1,155 distinct vulnerabilities (1881 findings, one per affected package).
Packages
- Debian packages
- 172
Image configuration
- Base OS
- Debian 13.7 (trixie)
- Default user
- root (no USER set; the entrypoint may still drop privileges)
- Entrypoint
- docker-php-entrypoint
- Command
- php -a
- Exposed ports
- none
- Image created
- 2026-10-28
- amd64 digest
- sha256:009c5c2b76578b8afb9b7946b95ae420a16c122e498774c86a3fe0175a1426de
Other PHP tags
php:8.4-apache519 MB unpacked · 180 MB downloadC 2H 122M 820L 969? 7
php:8.4-fpm-alpine91 MB unpacked · 37 MB downloadC 1H 2M 2L 44
Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-31 from digest sha256:009c5c2b7657. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.