Available Images

Complete reference of all available Cbox base image tags and variants.

Image Registry

All images are published to GitHub Container Registry:

ghcr.io/cboxdk/php-baseimages/{image-type}:{tag}

Image Tiers

All images come in four tiers to match your needs:

Multi-Service Images (PHP-FPM + Nginx)

Single container with both PHP-FPM and Nginx - perfect for simple deployments.

Standard Tier (Default)

Slim Tier

Optimized for APIs and microservices with minimal footprint:

Chromium Tier

Includes Chromium for Browsershot, Dusk, and PDF generation:

Rootless Variants

All tiers support rootless execution (runs as www-data user). Available for all PHP versions:

Where {version} is 8.2, 8.3, 8.4, or 8.5.

Tag Format

{type}:{php_version}-{os}[-tier][-rootless][-vN]

Examples:
php-fpm-nginx:8.5-bookworm-v1           # Standard tier, release channel (RECOMMENDED)
php-fpm-nginx:8.5-bookworm-slim-v1      # Slim tier, release channel
php-fpm-nginx:8.5-bookworm-chromium-v1  # Chromium tier, release channel
php-fpm-nginx:8.5-bookworm-rootless-v1  # Standard + rootless, release channel
php-fpm-nginx:8.5-bookworm              # Standard tier, rolling (follows latest release)
php-fpm-nginx:8.5-bookworm-slim-rootless  # Slim + rootless, rolling

Every tag in the matrices above also exists with the -v1 release-channel suffix — that is the variant to pin in production.

Release Channel Tags (Recommended for Production)

Channel tags are rebuilt weekly with OS security patches but never cross a tooling major — your runtime contract stays put, the machine underneath stays patched:

# Behavior pinned to major v1, security patches keep flowing
image: ghcr.io/cboxdk/php-baseimages/php-fpm-nginx:8.5-bookworm-v1

Rolling Tags

Rolling tags also receive weekly security updates, but follow the newest tooling release — including future majors:

# Follows the latest release, rebuilt every Monday
image: ghcr.io/cboxdk/php-baseimages/php-fpm-nginx:8.5-bookworm

Immutable Digests

For byte-exact reproduction, pin the digest (ages by design — it contains the CVEs of its build day):

# Locked to a specific build
image: ghcr.io/cboxdk/php-baseimages/php-fpm-nginx:8.5-bookworm-v1@sha256:abc123...

See Tagging Strategy for the full policy.

Architecture Support

All images are built for multiple architectures:

Docker automatically pulls the correct architecture:

# Works on both AMD64 and ARM64
docker pull ghcr.io/cboxdk/php-baseimages/php-fpm-nginx:8.5-bookworm-v1

OS Information

Cbox PHP Base Images use Debian 12 (Bookworm) as the base operating system.

Tier Comparison

Version Support

Dates from php.net/supported-versions; the authoritative copy lives in versions.json. Security-only is a normal, supported state — images keep rebuilding weekly until six months after security support ends.

Recommendation: PHP 8.5 for new projects and production.

Usage Examples

Docker CLI

# Pull standard tier (most Laravel/PHP apps)
docker pull ghcr.io/cboxdk/php-baseimages/php-fpm-nginx:8.5-bookworm-v1

# Pull slim tier (APIs, microservices)
docker pull ghcr.io/cboxdk/php-baseimages/php-fpm-nginx:8.5-bookworm-slim-v1

# Pull chromium tier (Browsershot, Dusk)
docker pull ghcr.io/cboxdk/php-baseimages/php-fpm-nginx:8.5-bookworm-chromium-v1

# Run with volume mount
docker run -p 8000:80 -v $(pwd):/var/www/html \
  ghcr.io/cboxdk/php-baseimages/php-fpm-nginx:8.5-bookworm-v1

Docker Compose

services:
  # Standard tier - most Laravel apps
  app:
    image: ghcr.io/cboxdk/php-baseimages/php-fpm-nginx:8.5-bookworm-v1
    ports:
      - "8000:80"
    volumes:
      - ./:/var/www/html

  # Slim tier - API service
  api:
    image: ghcr.io/cboxdk/php-baseimages/php-fpm-nginx:8.5-bookworm-slim-v1
    ports:
      - "8001:80"

  # Chromium tier - PDF generation service
  pdf:
    image: ghcr.io/cboxdk/php-baseimages/php-fpm-nginx:8.5-bookworm-chromium-v1
    environment:
      PHP_MEMORY_LIMIT: "1G"

Dockerfile

# Standard tier for most apps
FROM ghcr.io/cboxdk/php-baseimages/php-fpm-nginx:8.5-bookworm-v1

COPY --chown=www-data:www-data . /var/www/html

RUN composer install --no-dev --optimize-autoloader

# Chromium tier for Browsershot
FROM ghcr.io/cboxdk/php-baseimages/php-fpm-nginx:8.5-bookworm-chromium-v1

COPY --chown=www-data:www-data . /var/www/html

RUN composer install --no-dev --optimize-autoloader

Weekly Security Rebuilds

All images are automatically rebuilt every Monday at 03:00 UTC:

• Latest upstream PHP patches
• Latest OS security updates
• CVE scanning with Trivy
• Multi-architecture builds

Stay secure: Pull images regularly to get security patches.

# Pull latest security patches
docker pull ghcr.io/cboxdk/php-baseimages/php-fpm-nginx:8.5-bookworm-v1
docker-compose up -d --pull always

Need help choosing? See Choosing Your Image