Docker Laravel v3.0.1

Security fixes

• Upgraded NGINX from 1.31.2 to 1.31.3.
• Fixed CVE-2026-42533, a heap buffer overflow involving the map directive and regular-expression captures that could lead to denial of service or, under specific conditions, remote code execution.
• Also includes fixes for CVE-2026-60005 in ngx_http_slice_module and CVE-2026-56434 in ngx_http_ssi_module.

Runtime updates

• Updated and pinned the base image to Alpine Linux 3.24.
• Updated PHP packages to 8.5.8.
• Kept Node.js on the 24 LTS release line (24.17.0) and updated npm to 11.12.1.
• Prevented packages from different Alpine releases from being mixed.

Validation

• Base-image, entrypoint, PHP-FPM, NGINX, healthcheck, header, and service tests passed.
• Derived production build against the Prowect Laravel application passed.
• Trivy reported no high or critical vulnerabilities.
• Added regression checks for NGINX, Alpine, Node.js, and package repository versions.

Full details are available in the changelog.

Docker Laravel v3.0.0

Breaking changes

• PHP 8.5: Applications must update Composer dependencies whose PHP constraints exclude PHP 8.5.
• Fail-fast entrypoint: Composer, npm, Artisan, migration, synchronous seeding, and other setup failures now stop the build or container immediately.
• Deterministic production builds: Build mode uses composer install --no-dev --optimize-autoloader and npm ci. Compatible Composer and npm lock files are required.
• Seeder behavior: ONSTART_SEEDER_WAIT now defaults to true, so seeder failures stop startup by default.
• Custom entrypoints: /entrypoint.sh now receives the container command and all arguments through "$@".
• Healthcheck: The internal NGINX health endpoint has moved to http://127.0.0.1:8081/healthz.

See the v2 to v3 upgrade guide before updating an existing application.

Runtime updates

• Alpine Linux 3.23
• NGINX 1.31
• PHP and PHP-FPM 8.5
• Composer 2.10.2
• Node.js 24.15
• npm 11

Improvements

• Added safe build-only Laravel defaults for cache, sessions, queues, and database connections.
• Composer dependencies are installed deterministically during every derived-image build.
• Custom entrypoint commands and arguments are forwarded correctly.
• Queue workers no longer start without an asynchronous queue connection.
• Inertia SSR retains Node.js runtime dependencies only when explicitly enabled.
• Added local base-image and derived-Laravel regression tests, including repeatable parallel builds.
• Added a Trivy scan for high and critical vulnerabilities to GitHub Actions.

Security

• NGINX version tokens are disabled globally.
• PHP version exposure and the X-Powered-By response header are disabled globally.
• cgi.fix_pathinfo is disabled.
• The healthcheck is isolated from replaceable application NGINX configurations.
• The release image passes the configured Trivy scan with no high or critical findings.

Full details are available in the changelog.

v2.0.0

• Updated the base image to nginx:1.31.2-alpine.
• Updated Alpine package repositories to v3.23.
• Updated PHP from 8.3 to 8.5.
• Updated PHP-FPM from 8.3 to 8.5.
• Updated Node.js to 24.15.
• Adjusted PHP package names for Alpine PHP 8.5 compatibility.
• Disabled NGINX server_tokens by default
• Disabled PHP version exposure via expose_php = Off
• Hid the X-Powered-By FascCGI response header

v1.3.0

Added INERTIA_SSR_ENABLED environment variable to run SSR in background.

v1.2.0

• Added ONSTART_SEEDER_WAIT environment variable to run seeds in foreground (instead of background)
• Added imagick
• Executing vite & queue-worker/horizon as nginx user (instead of root)
• Restructured build process using MODE=build (f.e. vite build / npm run build)

v1.1.0

Updated dependencies to support Laravel 12 & some improvements

v1.0.3

Added PHP Xdebug support

v1.0.2

Some fixes

v1.0.1

Change permissions in background, for faster start up

v1.0.0

First release: based on Alpine v3.17 using PHP 8.1