Build php:8.5 from Alpine 3.24 (opcache/composer OOM fix) #48

Merged

geusebio merged 3 commits from fix/php85-bump-alpine-324 into main 2026-08-22 21:00:18 +00:00

Conversation 2 Commits 3 Files changed 6 +38 -9

geusebio commented 2026-08-22 19:59:41 +00:00

Owner

Copy link

Why

git.grey.ooo/Grey.ooo/Someones.Computer#990 root-caused an intermittent CI
composer OOM to an opcache miscompilation in PHP 8.5.6 (Alpine), tripped by
this image's non-default opcache.enable_cli=On. #1024 there measured 8.5.9
clean (0/15 failures) against 4-10/15 on 8.5.6, and asks for either the PHP
bump or turning off opcache.enable_cli.

This takes the PHP-bump path: Alpine 3.24's php85 package is already at
8.5.9-r0 (3.23 is still 8.5.6-r0), so php-85-base now builds from a new
alpine-24-base stage instead of alpine-23-base. Nothing else in the
family (Node, FrankenPHP, .Net, Java) changes base.

What changed

• Alpine.Dockerfile: added alpine-24-base / builder-24-base stages,
  mirroring the existing alpine-23-base block exactly (Alpine 3.24 is
  already the current stable release).
• PHP.Dockerfile: php-85-base now FROM ./Alpine.Dockerfile#alpine-24-base
  instead of alpine-23-base. NGINX_VERSION bumped 1.28 → 1.30 to match
  what Alpine 3.24's nginx package actually ships (it's a validation label,
  not a pin — see fs/php-nginx/etc/validate.d/nginx.sh).
• test-versions-assertions.yml / test.yml: added base-alpine-24-assertions
  alongside the existing per-version assertions.
• README.md: updated the PHP 8.5 / PHP+Node 8.5 / Magento 8.5 table rows and
  the image family tree diagram.

Deliberately not touched: docker-bake.hcl's base-alpine target and
mirror-baseimages.yml. Alpine 3.24 isn't in the mirror workflow's image
matrix yet, so publishing a matthewbaggett/base:24 / builder:24 through
the mirrored contexts map would fail until that's added separately — a
reasonable follow-up, but a different change. alpine-24-base is deliberately
internal-only for now, consumed solely by php-85-base, which already pulls
Alpine directly rather than through the mirror context.

Verified locally

docker build --target php-85-base -f PHP.Dockerfile . and the same for
php-85-node-base: both build clean and /usr/local/bin/validate passes
every check, reporting PHP 8.5.9 (cli) ... with Zend OPcache v8.5.9.

Follow-up (not automatic — sequencing for whoever picks this up)

Docker image FROM references are baked in at build time, not re-resolved on
pull, so this alone does not fix anyone downstream:

1. This merges and publishes matthewbaggett/php:8.5 built from Alpine 3.24.
2. actions/Github-Actions-Runner (no scheduled rebuild — push or
   workflow_dispatch only) needs its own build run after step 1, so
   ghcr.io/matthewbaggett/act-runner:php8.5 actually rebuilds FROM the new
   base rather than reusing its already-built layers.
3. Only then is someone.computer's git.grey.ooo/Grey.ooo/Someones.Computer#1024/#990
   ci.yml revert (COMPOSER_NO_BLOCKING) safe to land — otherwise CI would
   still be running the old, buggy 8.5.6 image under the hood.

## Why git.grey.ooo/Grey.ooo/Someones.Computer#990 root-caused an intermittent CI composer OOM to an opcache miscompilation in PHP 8.5.6 (Alpine), tripped by this image's non-default `opcache.enable_cli=On`. #1024 there measured 8.5.9 clean (0/15 failures) against 4-10/15 on 8.5.6, and asks for either the PHP bump or turning off `opcache.enable_cli`. This takes the PHP-bump path: Alpine 3.24's `php85` package is already at 8.5.9-r0 (3.23 is still 8.5.6-r0), so `php-85-base` now builds from a new `alpine-24-base` stage instead of `alpine-23-base`. Nothing else in the family (Node, FrankenPHP, .Net, Java) changes base. ## What changed - `Alpine.Dockerfile`: added `alpine-24-base` / `builder-24-base` stages, mirroring the existing `alpine-23-base` block exactly (Alpine 3.24 is already the current stable release). - `PHP.Dockerfile`: `php-85-base` now `FROM ./Alpine.Dockerfile#alpine-24-base` instead of `alpine-23-base`. `NGINX_VERSION` bumped 1.28 → 1.30 to match what Alpine 3.24's `nginx` package actually ships (it's a validation label, not a pin — see `fs/php-nginx/etc/validate.d/nginx.sh`). - `test-versions-assertions.yml` / `test.yml`: added `base-alpine-24-assertions` alongside the existing per-version assertions. - `README.md`: updated the PHP 8.5 / PHP+Node 8.5 / Magento 8.5 table rows and the image family tree diagram. **Deliberately not touched:** `docker-bake.hcl`'s `base-alpine` target and `mirror-baseimages.yml`. Alpine 3.24 isn't in the mirror workflow's image matrix yet, so publishing a `matthewbaggett/base:24` / `builder:24` through the mirrored `contexts` map would fail until that's added separately — a reasonable follow-up, but a different change. `alpine-24-base` is deliberately internal-only for now, consumed solely by `php-85-base`, which already pulls Alpine directly rather than through the mirror context. ## Verified locally `docker build --target php-85-base -f PHP.Dockerfile .` and the same for `php-85-node-base`: both build clean and `/usr/local/bin/validate` passes every check, reporting `PHP 8.5.9 (cli) ... with Zend OPcache v8.5.9`. ## Follow-up (not automatic — sequencing for whoever picks this up) Docker image FROM references are baked in at build time, not re-resolved on pull, so this alone does not fix anyone downstream: 1. This merges and publishes `matthewbaggett/php:8.5` built from Alpine 3.24. 2. `actions/Github-Actions-Runner` (no scheduled rebuild — push or `workflow_dispatch` only) needs its own build run *after* step 1, so `ghcr.io/matthewbaggett/act-runner:php8.5` actually rebuilds FROM the new base rather than reusing its already-built layers. 3. Only then is someone.computer's git.grey.ooo/Grey.ooo/Someones.Computer#1024/#990 `ci.yml` revert (`COMPOSER_NO_BLOCKING`) safe to land — otherwise CI would still be running the old, buggy 8.5.6 image under the hood.

geusebio added 1 commit 2026-08-22 19:59:41 +00:00

Build php:8.5 (and php-node/magento 8.5) from Alpine 3.24 ... 7d4fe741df

Alpine 3.23's php85 package is pinned at 8.5.6, which has a confirmed opcache
miscompilation that sends composer's RuleSetGenerator into a runaway
allocation loop under this image's non-default opcache.enable_cli=On
(git.grey.ooo/Grey.ooo/Someones.Computer#990, #1024). 3.24 already ships
8.5.9, which the upstream investigation measured clean at 0/15 against
4-10/15 failures on 8.5.6, so this repoints php-85-base's FROM instead of
touching opcache config that every other Alpine-family image still relies on.

Adds an alpine-24-base stage (paired builder-24-base for consistency, unused
today) rather than bumping the shared base-alpine bake matrix: 3.24 isn't in
mirror-baseimages.yml's mirror list yet, so publishing matthewbaggett/base:24
via the mirrored context would fail until that's added separately. php-85-base
already pulls Alpine directly (no mirror context), so this is a self-contained
change.

Alpine 3.24 also bumped its nginx package from 1.28 to 1.30; NGINX_VERSION is
only a validation label, not a pin, so it moves to match.

geusebio added 1 commit 2026-08-22 20:13:24 +00:00

ci: bump Tomcat 9 pin to 9.0.121, dlcdn dropped 9.0.117 ... 64b52a6e85

Unrelated to the php85/Alpine bump on this branch, but blocking its CI run:
dlcdn.apache.org only serves the current Tomcat release, and 9.0.117 was
superseded (recurring pattern here per c59ba11/f86420a/cfef6af). Only the
active java-tomcat-{21,17,11} pins move; java-tomcat-8's 9.0.111 (also 404,
but that target is deprecated and unwired from test.yml's aggregator) and
java-tomcat-7's 8.5.83 (served from archive.apache.org, still resolves) are
untouched.

geusebio commented 2026-08-22 20:13:34 +00:00

Author

Owner

Copy link

Run 339 (job 69841) failed on java-11-tomcat-assertions with wget exit 8 — dlcdn.apache.org 404s on TOMCAT_VERSION=9.0.117 (superseded by 9.0.121, same recurring pattern as c59ba11/f86420a/cfef6af). Unrelated to this PR's php85/Alpine change, but it's the shared 'Run container tests' job so it blocked mine too. Bumped the three active java-tomcat-9 pins (21/17/11) to 9.0.121 in 64b52a6; left java-tomcat-8's 9.0.111 alone since that target is deprecated and already unwired from test.yml's aggregator, and java-tomcat-7's 8.5.83 still resolves via archive.apache.org.

Run 339 (job 69841) failed on java-11-tomcat-assertions with wget exit 8 — dlcdn.apache.org 404s on TOMCAT_VERSION=9.0.117 (superseded by 9.0.121, same recurring pattern as c59ba11/f86420a/cfef6af). Unrelated to this PR's php85/Alpine change, but it's the shared 'Run container tests' job so it blocked mine too. Bumped the three active java-tomcat-9 pins (21/17/11) to 9.0.121 in 64b52a6; left java-tomcat-8's 9.0.111 alone since that target is deprecated and already unwired from test.yml's aggregator, and java-tomcat-7's 8.5.83 still resolves via archive.apache.org.

geusebio added 1 commit 2026-08-22 20:25:25 +00:00

ci: retrigger CI ... fabf1618b5

Run 340 failed with "failed to set up container networking: no available
IPv4 addresses on this network's address pools" -- Docker network pool
exhaustion on the shared runner daemon, unrelated to this branch's php85/
Alpine change or the Tomcat pin bump. This Forgejo has no rerun API, so an
empty commit is the retrigger, same as d32d42d/469cf02.

geusebio commented 2026-08-22 20:59:51 +00:00

Author

Owner

Copy link

Green: https://git.grey.ooo/Grey.ooo/docker/actions/runs/341 (Run container tests + Build both succeeded, full multi-arch matrix). Merging.

Green: https://git.grey.ooo/Grey.ooo/docker/actions/runs/341 (Run container tests + Build both succeeded, full multi-arch matrix). Merging.

geusebio changed title from WIP: Build php:8.5 from Alpine 3.24 (opcache/composer OOM fix) to Build php:8.5 from Alpine 3.24 (opcache/composer OOM fix) 2026-08-22 21:00:07 +00:00

geusebio merged commit d70f9feb86 into main 2026-08-22 21:00:18 +00:00

geusebio referenced this pull request from a commit 2026-08-22 21:00:20 +00:00

Merge pull request 'Build php:8.5 from Alpine 3.24 (opcache/composer OOM fix)' (#48) from fix/php85-bump-alpine-324 into main

geusebio referenced this pull request from a commit 2026-08-23 00:43:09 +00:00

Drop the ci.yml half — superseded by the image fix #1041 proves

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Grey.ooo/docker!48

No description provided.