php:8.4-fpm-alpine image size, layers and vulnerabilities (2026-11-01)

docker pull php:8.4-fpm-alpinephp@sha256:93aa3f61216b73cc6f878235c9772849449f4efc18dfe3d6678eed645076c00d

Size per platform

Compressed download size on Docker Hub for each architecture.

ppc64le37 MB
i38637 MB
amd6437 MB
arm6437 MB
s390x37 MB
riscv6436 MB
arm/v635 MB
arm/v734 MB

Where the bytes go

Unpacked bytes by directory in the final amd64 filesystem.

/usr/local/bin22 MB
/usr/local/sbin22 MB
/usr/lib17 MB
/usr/src14 MB
/usr/local/include5.6 MB
/usr/local/lib4.6 MB
/usr/bin1.4 MB
/bin1.2 MB
/lib670 kB
/etc/ssl204 kB

Layers

The 12 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.

1. Base filesystem (alpine-minirootfs-3.3.9 MB
2. RUN … apk add3.5 MB
3. RUN set -eux; adduser -u 82 -D -S -G 930 B
4. RUN … create directories217 B
5. RUN … apk add14 MB
6. COPY docker-php-source → /usr/local/b490 B
7. RUN … apk add15 MB
8. COPY docker-php-ext-* → docker-php-en2 kB
9. RUN docker-php-ext-enable opcache22 kB
10. RUN docker-php-ext-enable sodium22 kB
11. WORKDIR /var/www/html32 B
12. RUN set -eux; cd "${PHP_INI_DIR%/php9 kB

Full build steps

3.9 MBADD alpine-minirootfs-3.24.3-x86_64.tar.gz / # buildkit
3.5 MBRUN /bin/sh -c apk add --no-cache ca-certificates curl openssl tar xz # buildkit
930 BRUN /bin/sh -c set -eux; adduser -u 82 -D -S -G www-data www-data # buildkit
217 BRUN /bin/sh -c set -eux; mkdir -p "$PHP_INI_DIR/conf.d"; [ ! -d /var/www/html ]; mkdir -p /var/www/html; chown www-data:www-data /var/www/html; chmod 1777 /var/www/html # buildkit
14 MBRUN /bin/sh -c set -eux; apk add --no-cache --virtual .fetch-deps gnupg; mkdir -p /usr/src; cd /usr/src; curl -fsSL -o php.tar.xz "$PHP_URL"; if [ -n "$PHP_SHA256" ]; then echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; fi; curl -fsSL -o php.tar.xz.asc "$PHP_ASC_URL"; export GNUPGHOME="$(mktemp -d)"; for key in $GPG_KEYS; do gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; done; gpg --batch --verify php.tar.xz.asc php.tar.xz; gpgconf --kill all; rm -rf "$GNUPGHOME"; apk del --no-network .fetch-deps # buildkit
490 BCOPY docker-php-source /usr/local/bin/ # buildkit
15 MBRUN /bin/sh -c set -eux; apk add --no-cache --virtual .build-deps $PHPIZE_DEPS argon2-dev coreutils curl-dev gnu-libiconv-dev libsodium-dev libxml2-dev linux-headers oniguruma-dev openssl-dev readline-dev sqlite-dev ; rm -vf /usr/include/iconv.h; export CFLAGS="$PHP_CFLAGS" CPPFLAGS="$PHP_CPPFLAGS" LDFLAGS="$PHP_LDFLAGS" PHP_BUILD_PROVIDER='https://github.com/docker-library/php' PHP_UNAME='Linux - Docker' ; docker-php-source extract; cd /usr/src/php; gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; case "$gnuArch" in 'i686-linux-'*) e
2 kBCOPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/ # buildkit
22 kBRUN /bin/sh -c docker-php-ext-enable opcache # buildkit
22 kBRUN /bin/sh -c docker-php-ext-enable sodium # buildkit
32 BWORKDIR /var/www/html
9 kBRUN /bin/sh -c set -eux; cd "${PHP_INI_DIR%/php}"; cp -v php-fpm.conf.default php-fpm.conf; cp -v php-fpm.d/www.conf.default php-fpm.d/www.conf; grep -E '^listen = 127.0.0.1:9000' php-fpm.d/www.conf; sed -ri 's/^(listen = 127.0.0.1:9000)/;\1/' php-fpm.d/www.conf; grep -E '^;listen = 127.0.0.1:9000' php-fpm.d/www.conf; { echo '[global]'; echo 'error_log = /proc/self/fd/2'; echo; echo '; https://github.com/docker-library/php/pull/725#issuecomment-443540114'; echo 'log_limit = 8192'; echo; echo '[www]'; echo '; php-fpm closes STDOUT on startup, so sending logs to /proc/self/

Known vulnerabilities

1Critical1 with a fix

2High2 with a fix

2Medium2 with a fix

44Low44 with a fix

0Unknown0 with a fix

49 findings across 41 packages; 49 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.

Severity	Vulnerability	Affected packages	Fixed in
Critical	CVE-2026-111497brotli: Out-of-Bounds Write in Google Brotli Decoder	brotli-libsinstalled 1.2.0-r1	1.2.1-r0
High	CVE-2026-92392curl: curl: HTTP/2 upload Use-After-Free	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Medium	CVE-2026-92388curl: curl: FTP wildcard write callback mixup	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-107928curl: curl: info leak uploading over WebSockets with GnuTLS	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-107929curl: curl: local interface connection reuse mixup	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-86409curl: curl: stale SigV4 headers sent unintended	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-86410curl: curl: redirect to SFTP or SCP bypasses host verification	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-86411curl: curl: FTP connection reuse inherits client-certificate	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-86412curl: curl: server-set cookie erases cookie jar	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-86413curl: curl: Negotiate credentials sent to redirected origin	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-86414curl: curl: leaking host credentials to HTTP proxy	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-86415curl: curl: auto client cert connection reuse mixup	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-87861curl: curl: cross-origin reuse of a Negotiate connection	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-87862curl: curl: HSTS cache import drops longer-lived child	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-87863curl: curl: Hsts Response Erases Persisted Entries	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-87864curl: IMAP APPEND plus CRLF conversion command injection	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-87865curl: curl: knownhost callback mismatches key as missing	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-87866curl: curl: wolfSSL public-key pinning bypass	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-92386curl: curl: server-set cookie aborts cookie jar load	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-92387curl: curl: never-ending loop via server response omission	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-92389curl: curl: TFTP direction confusion	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-92390curl: curl: -J no-clobber guarantee bypassed with 103 early hints	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-92391curl: curl: curl_mime_free stack overflow by recursion	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-94265curl: curl: Authorization: Negotiate sent to foreign origin	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-94266curl: curl: password leak in CURLINFO_EFFECTIVE_URL	curl, libcurlinstalled 8.22.0-r0	8.23.0-r0

Packages

Alpine packages: 41

Image configuration

Base OS: Alpine Linux 3.24.3
Default user: root (no USER set; the entrypoint may still drop privileges)
Entrypoint: docker-php-entrypoint
Command: php-fpm
Exposed ports: 9000/tcp
Image created: 2026-10-21
amd64 digest: sha256:a58708a9676c18f3f3dab3b9b49e39044d7d2b239543122094314dffb0ae05a7

Other PHP tags

php:8.4-cli549 MB unpacked · 186 MB downloadC 2H 121M 818L 936? 4 php:8.4-apache519 MB unpacked · 180 MB downloadC 2H 122M 820L 969? 7

php:8.4-apache vs php:8.4-fpm-alpine

Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-26 from digest sha256:a58708a9676c. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.