Build PHP from Source

[tomschlick]

As part of today's PHP2Shell craziness, I think we all were a bit astounded how long it actually takes the dockerhub PHP images to get built (~3 hours from 8.5.12 release time). This is likely due to multiple factors like dockerhub staff approval times, multiple build steps on their end, and the back and forth with their jenkins server for builds.

My thought is that we could start building from source images here. Yes that means taking on more of the build time in this project, but it seems given the build time contribution from depot.dev to this project that might be doable without extra cost.

I currently have agents running a POC locally, and will post an accompanying PR when I can, but I wanted to start the conversation.

One major question I would ask is do we build this as single images or basically copy what the dockerhub/php image does and make a php-base image for each variant that the SSU php image uses as a base.

I would lean towards the latter so that the SSU specific code doesn't have to build from scratch each time. The question would be if we keep that in this same repo or have a php-base repo as well?

[jaydrogers]

Thanks for this! I took some time to reflect here:

• Improving future security releases and reducing dependencies on upstream builds (Post-mortem: PHP2Shell security release) #727

If you can chime in on there, that would be great!