Drop FROM php:8-alpine in favor of FROM alpine:3.23 (~55% smaller image)

[akirayamamoto]

Fixes #799.

Replace FROM php:8-alpine with FROM alpine:3.23 in Dockerfile.alpine and install PHP entirely via apk. See #799 for the full context. Short version: the FROM image's /usr/local/bin/php is never used by Apache (mod_php loads from the apk packages instead), and the FROM image also carries PHP source/build artifacts the runtime doesn't need.

Change

-FROM php:8-alpine
+FROM alpine:3.23
 RUN apk add --quiet --no-cache \
     bash \
     apache2 \
+    php \
     php-apache2 \
     php-ctype \
     ...

The dead docker-php-extension-installer comment block also goes; it never applied to the alpine variant.

Image size

libsp-old:alpine  227 MB  (master HEAD)
libsp-exp:alpine  102 MB  (this PR)

The savings come from dropping the unused /usr/local/bin/php binary plus the /usr/src/php headers and build artifacts that the docker-library php:8-alpine image carries. ~55% smaller.

Verification

Inside the new image:

$ ls /usr/local/bin/php /usr/bin/php* 2>/dev/null
lrwxrwxrwx ... /usr/bin/php -> php84
-rwxr-xr-x ... /usr/bin/php84
$ command -v php
/usr/bin/php
$ ls /usr/lib/apache2/mod_php*.so
/usr/lib/apache2/mod_php84.so

One PHP install, no FROM-image leftovers, and mod_php is still served by the same php-apache2 package — which on alpine:3.23 resolves to php84, same major as master's FROM php:8-alpine.

Full Playwright e2e suite passes against this image: 12/12, 22.4s. Specs: classic-standalone-regression, design-switch, modes, title-special-chars across standalone/backend/frontend/dual configs.

Note on PHP version

alpine:3.23's php-apache2 meta resolves to php84-apache2, matching the PHP major that master's FROM php:8-alpine lands on today. No version regression and no need to pin a versioned package. Earlier alpine releases (3.21, 3.22) defaulted to php83; if a future Alpine bump shifts the default again, pinning php84-* explicitly is the escape hatch.

Dependabot

.github/dependabot.yml's docker ecosystem at / auto-discovers FROM lines. After this PR, Dependabot drops php:8-alpine and picks up alpine:3.23. No config change needed. One subtle shift: Alpine bumps now carry the implicit risk of a PHP major bump when the apk meta shifts — see the PHP-version note above for the lock-down option.

[qodo-free-for-open-source-projects]

Review Summary by Qodo

Replace php:8-alpine with alpine:3.23 for smaller image

✨ Enhancement

Walkthroughs

Description

• Replace FROM php:8-alpine with FROM alpine:3.23 base image
• Install PHP via apk packages instead of inheriting unused binary
• Remove dead docker-php-extension-installer comment block
• Reduce image size by ~55% (227 MB to 102 MB)

Diagram

flowchart LR
  A["FROM php:8-alpine<br/>227 MB"] -->|Remove unused binary<br/>and build artifacts| B["FROM alpine:3.23<br/>102 MB"]
  B -->|Add php package| C["Single PHP install<br/>via apk"]
  C -->|mod_php loads from| D["php-apache2 package<br/>php84"]

Loading

File Changes

1. Dockerfile.alpine ✨ Enhancement +2/-7

Replace PHP base image with Alpine base

• Changed base image from php:8-alpine to alpine:3.23
• Added explicit php package to apk installation list
• Removed commented-out docker-php-extension-installer block (lines 13-17)
• Kept all other PHP extension packages unchanged

Dockerfile.alpine

---

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

1. Missing CA certificates ☑ 🐞 Bug ☼ Reliability

Description

Dockerfile.alpine installs PHP/Apache but not a CA bundle, so PHP HTTPS requests (e.g.,
backend/getIP.php calling ipinfo.io when IPINFO_APIKEY is configured) can fail TLS verification at
runtime and break ISP detection.

Code

Dockerfile.alpine[R1-8]

+FROM alpine:3.23
RUN apk add --quiet --no-cache \
   bash \
   apache2 \
+    php \
   php-apache2 \
   php-ctype \
   php-phar \

Evidence

The Alpine Dockerfile’s apk install list does not include ca-certificates, yet the application
performs HTTPS requests to ipinfo.io when IPINFO_APIKEY is provided via the container
environment/entrypoint. Without a CA trust store in the image, those HTTPS requests may fail during
TLS verification.

Dockerfile.alpine[1-17]
backend/getIP.php[53-66]
docker/entrypoint.sh[55-67]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`Dockerfile.alpine` is now based on `alpine:3.23` and installs PHP via `apk`, but it does not install `ca-certificates`. The app makes outbound HTTPS calls (ipinfo.io) when `IPINFO_APIKEY` is configured; without a CA bundle, these calls can fail due to TLS verification.
### Issue Context
- `backend/getIP.php` calls `file_get_contents('https://ipinfo.io/...')`.
- `docker/entrypoint.sh` wires the `IPINFO_APIKEY` env var into the backend config.
### Fix Focus Areas
- Dockerfile.alpine[1-17]
### Suggested fix
- Add `ca-certificates` to the `apk add --no-cache` list (and optionally run `update-ca-certificates` if you want to be explicit).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---