dbpolito · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026
diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
@@ -2,11 +2,18 @@ name: CI/CD
 
 on:
   push:
+    branches: [main]
   workflow_dispatch:
+  pull_request:
+  repository_dispatch:
+    types: [docker-php-updated]
+
+permissions:
+  contents: read
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.runner }}
 
     services:
       registry:
@@ -16,30 +23,28 @@ jobs:
 
     strategy:
       matrix:
-        version: ['8.1-swoole', '8.2-swoole', '8.3-swoole', '8.4-swoole']
+        version: ['8.2-swoole', '8.3-swoole', '8.4-swoole', '8.5-swoole', '8.4-debian-swoole', '8.5-debian-swoole']
         type: ['', '-prod']
+        runner: [ubuntu-latest, ubuntu-24.04-arm]
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4.1.2
-
-      - name: Setup QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: actions/checkout@v4
 
       - name: Setup Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
           driver-opts: network=host # needed to push to local registry
 
       - name: Build and export to Docker
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: ${{ matrix.version }}${{ matrix.type }}
           push: true
           tags: localhost:5000/kooldev/php:${{ matrix.version }}${{ matrix.type }}
 
       - name: Build and export to Docker (nginx)
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: ${{ matrix.version }}-nginx${{ matrix.type }}
           push: true
@@ -49,37 +54,62 @@ jobs:
 
       - name: Tests
         run: |
-          docker run localhost:5000/kooldev/php:${{ matrix.version }}${{ matrix.type }} php -r "extension_loaded('swoole') or die(1);"
-          docker run localhost:5000/kooldev/php:${{ matrix.version }}-nginx${{ matrix.type }} nginx -v
-          docker run localhost:5000/kooldev/php:${{ matrix.version }}-nginx${{ matrix.type }} nginx -t
+          docker run --rm localhost:5000/kooldev/php:${{ matrix.version }}${{ matrix.type }} php -r "exit(extension_loaded('swoole') ? 0 : 1);"
+          docker run --rm localhost:5000/kooldev/php:${{ matrix.version }}-nginx${{ matrix.type }} nginx -v
+          docker run --rm localhost:5000/kooldev/php:${{ matrix.version }}-nginx${{ matrix.type }} nginx -t
+          docker run --rm localhost:5000/kooldev/php:${{ matrix.version }}-nginx${{ matrix.type }} supervisord --version
+          docker run --rm localhost:5000/kooldev/php:${{ matrix.version }}${{ matrix.type }} dockerize --version
+          docker run --rm localhost:5000/kooldev/php:${{ matrix.version }}-nginx${{ matrix.type }} dockerize --version
+          docker run --rm localhost:5000/kooldev/php:${{ matrix.version }}${{ matrix.type }} sh -c 'echo "{{ .Env.TEST_VAR }}" > /tmp/test.tmpl && TEST_VAR=hello dockerize -template /tmp/test.tmpl:/tmp/test.out && test "$(cat /tmp/test.out)" = hello'
+          docker run --rm -e ASUSER=1000 localhost:5000/kooldev/php:${{ matrix.version }}-nginx${{ matrix.type }} php -r "exit(posix_getuid() === 1000 ? 0 : 1);"
+
+      - name: Test Supervisor lifecycle
+        run: bash tasks/test-supervisor.sh localhost:5000/kooldev/php:${{ matrix.version }}-nginx${{ matrix.type }}
 
       - name: Tests (dev)
         if: matrix.type == ''
         run: |
-          docker run localhost:5000/kooldev/php:${{ matrix.version }}${{ matrix.type }} node -v
-          docker run localhost:5000/kooldev/php:${{ matrix.version }}${{ matrix.type }} yarn -v
-          docker run localhost:5000/kooldev/php:${{ matrix.version }}-nginx${{ matrix.type }} node -v
-          docker run localhost:5000/kooldev/php:${{ matrix.version }}-nginx${{ matrix.type }} yarn -v
+          docker run --rm localhost:5000/kooldev/php:${{ matrix.version }}${{ matrix.type }} node -v
+          docker run --rm localhost:5000/kooldev/php:${{ matrix.version }}${{ matrix.type }} yarn -v
+          docker run --rm localhost:5000/kooldev/php:${{ matrix.version }}-nginx${{ matrix.type }} node -v
+          docker run --rm localhost:5000/kooldev/php:${{ matrix.version }}-nginx${{ matrix.type }} yarn -v
+
+  publish:
+    needs: build
+    if: github.ref == 'refs/heads/main' && github.repository == 'kool-dev/docker-php-swoole'
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        version: ['8.2-swoole', '8.3-swoole', '8.4-swoole', '8.5-swoole', '8.4-debian-swoole', '8.5-debian-swoole']
+        type: ['', '-prod']
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to DockerHub
         uses: docker/login-action@v3
-        if: github.ref == 'refs/heads/main' && github.repository == 'kool-dev/docker-php-swoole'
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Build and push
-        uses: docker/build-push-action@v5
-        if: github.ref == 'refs/heads/main' && github.repository == 'kool-dev/docker-php-swoole'
+        uses: docker/build-push-action@v6
         with:
           context: ${{ matrix.version }}${{ matrix.type }}
           platforms: linux/amd64,linux/arm64
           push: true
           tags: kooldev/php:${{ matrix.version }}${{ matrix.type }}
 
       - name: Build and push (nginx)
-        uses: docker/build-push-action@v5
-        if: github.ref == 'refs/heads/main' && github.repository == 'kool-dev/docker-php-swoole'
+        uses: docker/build-push-action@v6
         with:
           context: ${{ matrix.version }}-nginx${{ matrix.type }}
           platforms: linux/amd64,linux/arm64

diff --git a/8.2-swoole-nginx-prod/Dockerfile b/8.2-swoole-nginx-prod/Dockerfile
@@ -29,9 +29,7 @@ ENV PHP_FPM_LISTEN=/run/php-fpm.sock \
     NGINX_FASTCGI_BUFFER_SIZE='16k' \
     NGINX_ENTRYPOINT_WORKER_PROCESSES_AUTOTUNE=true
 
-RUN curl -L https://github.com/ochinchina/supervisord/releases/download/v0.6.3/supervisord_static_0.6.3_linux_amd64 -o /usr/local/bin/supervisord \
-    && chmod +x /usr/local/bin/supervisord \
-    && apk add --no-cache nginx \
+RUN apk add --no-cache nginx supervisor \
     && chown -R kool:kool /var/lib/nginx \
     && chmod 770 /var/lib/nginx/tmp \
     && ln -sf /dev/stdout /var/log/nginx/access.log \
@@ -48,7 +46,7 @@ RUN curl -L https://github.com/ochinchina/supervisord/releases/download/v0.6.3/s
     && sed -i "s|^user .*|user\ kool kool;|g" /etc/nginx/nginx.conf \
     && mv server-configs-nginx-*/mime.types /etc/nginx/mime.types \
     && rm -rf server-configs-nginx-* \
-    && curl -L https://raw.githubusercontent.com/nginxinc/docker-nginx/master/entrypoint/30-tune-worker-processes.sh -o /kool/30-tune-worker-processes.sh \
+    && curl -fSL https://raw.githubusercontent.com/nginxinc/docker-nginx/master/entrypoint/30-tune-worker-processes.sh -o /kool/30-tune-worker-processes.sh \
     && chmod +x /kool/30-tune-worker-processes.sh
 
 COPY supervisor.conf /kool/supervisor.conf

diff --git a/8.2-swoole-nginx-prod/default.tmpl b/8.2-swoole-nginx-prod/default.tmpl
@@ -10,7 +10,7 @@ server {
     listen {{ .Env.NGINX_LISTEN_HTTPS }} ssl http2;
     ssl_certificate     {{ .Env.NGINX_HTTPS_CERT }};
     ssl_certificate_key {{ .Env.NGINX_HTTPS_CERT_KEY }};
-    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
+    ssl_protocols       TLSv1.2 TLSv1.3;
     ssl_ciphers         HIGH:!aNULL:!MD5;
 {{ end }}
     root {{ .Env.NGINX_ROOT }};
@@ -67,5 +67,5 @@ server {
 
     # performance enhancements (mostly for caching static data)
     include h5bp/web_performance/cache-file-descriptors.conf;
-    include h5bp/web_performance/pre-compressed_content_gzip.conf;
+    include h5bp/web_performance/compression.conf;
 }
diff --git a/8.2-swoole-nginx-prod/entrypoint b/8.2-swoole-nginx-prod/entrypoint
@@ -5,17 +5,17 @@ set -e
 # Run as current user
 CURRENT_USER=${ASUSER:-${UID:-0}}
 
-if [ ! -z "$CURRENT_USER" ] && [ "$CURRENT_USER" != "0" ]; then
-    usermod -u $CURRENT_USER kool
+if [ -n "$CURRENT_USER" ] && [ "$CURRENT_USER" != "0" ]; then
+    usermod -u "$CURRENT_USER" kool
 fi
 
 dockerize -template /kool/kool.tmpl:/usr/local/etc/php/conf.d/kool.ini -template /kool/zz-docker.tmpl:/usr/local/etc/php-fpm.d/zz-docker.conf -template /kool/default.tmpl:/etc/nginx/conf.d/default.conf
 
 /kool/30-tune-worker-processes.sh
 
 # Run entrypoint if provided
-if [ ! -z "$ENTRYPOINT" ] && [ -f "$ENTRYPOINT" ]; then
-    bash $ENTRYPOINT
+if [ -n "$ENTRYPOINT" ] && [ -f "$ENTRYPOINT" ]; then
+    bash "$ENTRYPOINT"
 fi
 
 if [ "$1" = "sh" ] || [ "$1" = "bash" ] || [ "$1" = "php-fpm" ] || [ "$1" = "nginx" ] || [ "$1" = "supervisord" ]; then

diff --git a/8.2-swoole-nginx-prod/supervisor.conf b/8.2-swoole-nginx-prod/supervisor.conf
@@ -1,14 +1,29 @@
+[supervisord]
+logfile=/dev/stdout
+logfile_maxbytes=0
+pidfile=/run/supervisord.pid
+nodaemon=true
+user=root
+
 [program:nginx]
-depends_on = octane
 command = nginx -g "daemon off;"
+priority = 20
 autorestart = true
 stopasgroup = true
+killasgroup = true
 stderr_logfile = /dev/stderr
 stdout_logfile = /dev/stdout
+stderr_logfile_maxbytes = 0
+stdout_logfile_maxbytes = 0
 
 [program:octane]
 command = su-exec kool php artisan octane:start
+directory = /app
+priority = 10
 autorestart = true
 stopasgroup = true
+killasgroup = true
 stderr_logfile = /dev/stderr
 stdout_logfile = /dev/stdout
+stderr_logfile_maxbytes = 0
+stdout_logfile_maxbytes = 0
diff --git a/8.2-swoole-nginx/Dockerfile b/8.2-swoole-nginx/Dockerfile
@@ -29,9 +29,7 @@ ENV PHP_FPM_LISTEN=/run/php-fpm.sock \
     NGINX_FASTCGI_BUFFER_SIZE='16k' \
     NGINX_ENTRYPOINT_WORKER_PROCESSES_AUTOTUNE=true
 
-RUN curl -L https://github.com/ochinchina/supervisord/releases/download/v0.6.3/supervisord_static_0.6.3_linux_amd64 -o /usr/local/bin/supervisord \
-    && chmod +x /usr/local/bin/supervisord \
-    && apk add --no-cache nginx \
+RUN apk add --no-cache nginx supervisor \
     && chown -R kool:kool /var/lib/nginx \
     && chmod 770 /var/lib/nginx/tmp \
     && ln -sf /dev/stdout /var/log/nginx/access.log \
@@ -48,7 +46,7 @@ RUN curl -L https://github.com/ochinchina/supervisord/releases/download/v0.6.3/s
     && sed -i "s|^user .*|user\ kool kool;|g" /etc/nginx/nginx.conf \
     && mv server-configs-nginx-*/mime.types /etc/nginx/mime.types \
     && rm -rf server-configs-nginx-* \
-    && curl -L https://raw.githubusercontent.com/nginxinc/docker-nginx/master/entrypoint/30-tune-worker-processes.sh -o /kool/30-tune-worker-processes.sh \
+    && curl -fSL https://raw.githubusercontent.com/nginxinc/docker-nginx/master/entrypoint/30-tune-worker-processes.sh -o /kool/30-tune-worker-processes.sh \
     && chmod +x /kool/30-tune-worker-processes.sh
 
 COPY supervisor.conf /kool/supervisor.conf

diff --git a/8.2-swoole-nginx/default.tmpl b/8.2-swoole-nginx/default.tmpl
@@ -10,7 +10,7 @@ server {
     listen {{ .Env.NGINX_LISTEN_HTTPS }} ssl http2;
     ssl_certificate     {{ .Env.NGINX_HTTPS_CERT }};
     ssl_certificate_key {{ .Env.NGINX_HTTPS_CERT_KEY }};
-    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
+    ssl_protocols       TLSv1.2 TLSv1.3;
     ssl_ciphers         HIGH:!aNULL:!MD5;
 {{ end }}
     root {{ .Env.NGINX_ROOT }};
@@ -67,5 +67,5 @@ server {
 
     # performance enhancements (mostly for caching static data)
     include h5bp/web_performance/cache-file-descriptors.conf;
-    include h5bp/web_performance/pre-compressed_content_gzip.conf;
+    include h5bp/web_performance/compression.conf;
 }
diff --git a/8.2-swoole-nginx/entrypoint b/8.2-swoole-nginx/entrypoint
@@ -1,10 +1,8 @@
 #!/bin/sh
 set -e
 
-if [ "$ENABLE_XDEBUG" == "true" ]; then
-    docker-php-ext-enable xdebug >> /dev/null 2>&1
-
-    if [ $? != "0" ]; then
+if [ "$ENABLE_XDEBUG" = "true" ]; then
+    if ! docker-php-ext-enable xdebug > /dev/null 2>&1; then
         echo "[ERROR] An error happened enabling xdebug"
 
         exit 1
@@ -14,17 +12,17 @@ fi
 # Run as current user
 CURRENT_USER=${ASUSER:-${UID:-0}}
 
-if [ ! -z "$CURRENT_USER" ] && [ "$CURRENT_USER" != "0" ]; then
-    usermod -u $CURRENT_USER kool
+if [ -n "$CURRENT_USER" ] && [ "$CURRENT_USER" != "0" ]; then
+    usermod -u "$CURRENT_USER" kool
 fi
 
 dockerize -template /kool/kool.tmpl:/usr/local/etc/php/conf.d/kool.ini -template /kool/zz-docker.tmpl:/usr/local/etc/php-fpm.d/zz-docker.conf -template /kool/default.tmpl:/etc/nginx/conf.d/default.conf
 
 /kool/30-tune-worker-processes.sh
 
 # Run entrypoint if provided
-if [ ! -z "$ENTRYPOINT" ] && [ -f "$ENTRYPOINT" ]; then
-    bash $ENTRYPOINT
+if [ -n "$ENTRYPOINT" ] && [ -f "$ENTRYPOINT" ]; then
+    bash "$ENTRYPOINT"
 fi
 
 if [ "$1" = "sh" ] || [ "$1" = "bash" ] || [ "$1" = "php-fpm" ] || [ "$1" = "nginx" ] || [ "$1" = "supervisord" ]; then

diff --git a/8.2-swoole-nginx/supervisor.conf b/8.2-swoole-nginx/supervisor.conf
@@ -1,14 +1,29 @@
+[supervisord]
+logfile=/dev/stdout
+logfile_maxbytes=0
+pidfile=/run/supervisord.pid
+nodaemon=true
+user=root
+
 [program:nginx]
-depends_on = octane
 command = nginx -g "daemon off;"
+priority = 20
 autorestart = true
 stopasgroup = true
+killasgroup = true
 stderr_logfile = /dev/stderr
 stdout_logfile = /dev/stdout
+stderr_logfile_maxbytes = 0
+stdout_logfile_maxbytes = 0
 
 [program:octane]
 command = su-exec kool php artisan octane:start --watch
+directory = /app
+priority = 10
 autorestart = true
 stopasgroup = true
+killasgroup = true
 stderr_logfile = /dev/stderr
 stdout_logfile = /dev/stdout
+stderr_logfile_maxbytes = 0
+stdout_logfile_maxbytes = 0
diff --git a/8.3-swoole-nginx-prod/Dockerfile b/8.3-swoole-nginx-prod/Dockerfile
@@ -29,9 +29,7 @@ ENV PHP_FPM_LISTEN=/run/php-fpm.sock \
     NGINX_FASTCGI_BUFFER_SIZE='16k' \
     NGINX_ENTRYPOINT_WORKER_PROCESSES_AUTOTUNE=true
 
-RUN curl -L https://github.com/ochinchina/supervisord/releases/download/v0.6.3/supervisord_static_0.6.3_linux_amd64 -o /usr/local/bin/supervisord \
-    && chmod +x /usr/local/bin/supervisord \
-    && apk add --no-cache nginx \
+RUN apk add --no-cache nginx supervisor \
     && chown -R kool:kool /var/lib/nginx \
     && chmod 770 /var/lib/nginx/tmp \
     && ln -sf /dev/stdout /var/log/nginx/access.log \
@@ -48,7 +46,7 @@ RUN curl -L https://github.com/ochinchina/supervisord/releases/download/v0.6.3/s
     && sed -i "s|^user .*|user\ kool kool;|g" /etc/nginx/nginx.conf \
     && mv server-configs-nginx-*/mime.types /etc/nginx/mime.types \
     && rm -rf server-configs-nginx-* \
-    && curl -L https://raw.githubusercontent.com/nginxinc/docker-nginx/master/entrypoint/30-tune-worker-processes.sh -o /kool/30-tune-worker-processes.sh \
+    && curl -fSL https://raw.githubusercontent.com/nginxinc/docker-nginx/master/entrypoint/30-tune-worker-processes.sh -o /kool/30-tune-worker-processes.sh \
     && chmod +x /kool/30-tune-worker-processes.sh
 
 COPY supervisor.conf /kool/supervisor.conf

diff --git a/8.3-swoole-nginx-prod/default.tmpl b/8.3-swoole-nginx-prod/default.tmpl
@@ -10,7 +10,7 @@ server {
     listen {{ .Env.NGINX_LISTEN_HTTPS }} ssl http2;
     ssl_certificate     {{ .Env.NGINX_HTTPS_CERT }};
     ssl_certificate_key {{ .Env.NGINX_HTTPS_CERT_KEY }};
-    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
+    ssl_protocols       TLSv1.2 TLSv1.3;
     ssl_ciphers         HIGH:!aNULL:!MD5;
 {{ end }}
     root {{ .Env.NGINX_ROOT }};
@@ -67,5 +67,5 @@ server {
 
     # performance enhancements (mostly for caching static data)
     include h5bp/web_performance/cache-file-descriptors.conf;
-    include h5bp/web_performance/pre-compressed_content_gzip.conf;
+    include h5bp/web_performance/compression.conf;
 }
diff --git a/8.3-swoole-nginx-prod/entrypoint b/8.3-swoole-nginx-prod/entrypoint
@@ -5,17 +5,17 @@ set -e
 # Run as current user
 CURRENT_USER=${ASUSER:-${UID:-0}}
 
-if [ ! -z "$CURRENT_USER" ] && [ "$CURRENT_USER" != "0" ]; then
-    usermod -u $CURRENT_USER kool
+if [ -n "$CURRENT_USER" ] && [ "$CURRENT_USER" != "0" ]; then
+    usermod -u "$CURRENT_USER" kool
 fi
 
 dockerize -template /kool/kool.tmpl:/usr/local/etc/php/conf.d/kool.ini -template /kool/zz-docker.tmpl:/usr/local/etc/php-fpm.d/zz-docker.conf -template /kool/default.tmpl:/etc/nginx/conf.d/default.conf
 
 /kool/30-tune-worker-processes.sh
 
 # Run entrypoint if provided
-if [ ! -z "$ENTRYPOINT" ] && [ -f "$ENTRYPOINT" ]; then
-    bash $ENTRYPOINT
+if [ -n "$ENTRYPOINT" ] && [ -f "$ENTRYPOINT" ]; then
+    bash "$ENTRYPOINT"
 fi
 
 if [ "$1" = "sh" ] || [ "$1" = "bash" ] || [ "$1" = "php-fpm" ] || [ "$1" = "nginx" ] || [ "$1" = "supervisord" ]; then