NES for PHP 7 Container Images

The NES for PHP 7 images are drop-in replacements for the official php images for PHP 7.4 (the cli, fpm and apache variants), with release v7.4.33-nes-7.4.3: the same entrypoints, commands, ports, PHP_INI_DIR, docker-php-ext-* helpers and www-data user. In a Dockerfile, change the FROM line and nothing else in the PHP setup.

Images and tags

Every image is in registry.nes.herodevs.com/nes/php-nes. Each image's version is its release without the v, 7.4.33-nes-7.4.3, and its tag is that version, the variant and the base: 7.4.33-nes-7.4.3-<variant>-<base>. A tag names one release of one image and never moves.

The registry serves each image under its release tag only: the official images' moving tags, such as 7.4-fpm, have no NES counterpart. To update to a new NES for PHP release, change the tag to the new release's.

Access

The images are in the NES registry at registry.nes.herodevs.com, which requires a HeroDevs access token. If you do not have an access token, contact support@herodevs.com. For more information see Access Tokens.

Pull an image

Log in with your contact e-mail and your access token as the password:

docker login registry.nes.herodevs.com -u <your-contact-email>

then pull the images you use:

docker pull registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.3-cli-bookworm
docker pull registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.3-fpm-bookworm
docker pull registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.3-apache-bookworm

docker pull registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.3-cli-ubi8
docker pull registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.3-fpm-ubi8
docker pull registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.3-apache-ubi8

docker pull registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.3-cli-ubi9
docker pull registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.3-fpm-ubi9
docker pull registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.3-apache-ubi9

docker pull registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.3-cli-alpine3.22
docker pull registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.3-fpm-alpine3.22

docker pull registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.3-cli-alpine3.24
docker pull registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.3-fpm-alpine3.24

In a Dockerfile, replace the official image with the NES image of the same variant, for example php:7.4-fpm with:

FROM registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.3-fpm-bookworm

or, for the official Alpine image, php:7.4-fpm-alpine, the NES image on the newest Alpine release:

FROM registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.3-fpm-alpine3.24

In Kubernetes, give the pods a pull secret:

kubectl create secret docker-registry herodevs-registry \
  --docker-server=registry.nes.herodevs.com \
  --docker-username=<your-contact-email> \
  --docker-password=<your-nes-access-token>

and name it in the pod spec's imagePullSecrets.

Check the image

php -v shows PHP 7.4.33-nes, and the image's org.opencontainers.image.version label is the image version, 7.4.33-nes-7.4.3:

docker run --rm registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.3-fpm-bookworm php -v
docker image inspect registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.3-fpm-bookworm | grep org.opencontainers.image.version

Load from a tar

A host that cannot reach the registry can take an image as a file. On a host that can, pull the image and save it with its checksum:

docker pull registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.3-fpm-bookworm
docker save -o nes-php-7.4.33-nes-7.4.3-fpm-bookworm.tar registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.3-fpm-bookworm
sha256sum nes-php-7.4.33-nes-7.4.3-fpm-bookworm.tar > nes-php-7.4.33-nes-7.4.3-fpm-bookworm.tar.sha256

Copy both files to the other host, then check and load the image:

sha256sum -c nes-php-7.4.33-nes-7.4.3-fpm-bookworm.tar.sha256
docker load -i nes-php-7.4.33-nes-7.4.3-fpm-bookworm.tar

An image tar from HeroDevs, php-nes-<base>-<variant>-<image version>-<architecture>.tar with its .sha256 file, is checked and loaded the same way. It holds one image, tagged php-nes:<image version>-<variant>-<base>; tag it as your deployments name it, for example:

docker tag php-nes:7.4.33-nes-7.4.3-fpm-bookworm registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.3-fpm-bookworm

The UBI images

The UBI images give the official images' interface on Red Hat's base, with these differences:

• They use microdnf, not apt-get, so a Dockerfile's package installation lines change. The apache variant runs Red Hat's httpd (/etc/httpd), with APACHE_RUN_USER and the other official variables.
• The core extensions (ctype, curl, dom, json, mbstring, mysqlnd, pdo, xml and the rest of the official set) load from ini files in conf.d, where the official images build them in. Mounting a directory over conf.d, a PHP_INI_SCAN_DIR that replaces the scan directory, or php -n leaves them out: mount single files into conf.d, or add to the scan directory (:/extra).
• pcntl is built into the CLI only: php-fpm and Apache do not load it.
• PEAR's system configuration is /etc/pear.conf.

The Alpine images

The Alpine images are the official Alpine images' build, on a supported Alpine release, with these points to know:

• They use musl, not glibc, and apk, not apt-get, so a Dockerfile's package installation lines are the ones it uses with the official Alpine image.
• www-data is Alpine's user and group 82, as in the official Alpine images.
• iconv is GNU libiconv, as in the official Alpine images (musl's own iconv cannot transliterate).
• docker-php-ext-configure, docker-php-ext-install and docker-php-ext-enable install the build tools they need from Alpine's repositories and remove them after, so a build that uses them needs Alpine's repositories. Before pecl install or phpize, add the tools yourself: apk add --no-cache --virtual .phpize-deps $PHPIZE_DEPS.
• musl behaves as in the official Alpine images: there is no GLOB_BRACE for glob() and no IDN flags (AI_IDN and the rest) for socket_addrinfo_lookup(); setlocale() accepts any locale but locales other than C and UTF-8 change nothing (number, money and character-class formatting stay C's); strftime() leaves %Z empty for a time zone PHP set; crypt() returns * for a rejected salt, where glibc returns *0; and imap_utf8_to_mutf7() and imap_mutf7_to_utf8() are not available when ext/imap is built against Alpine's c-client.
• There is no apache variant on Alpine, as there was none in the official images.