Docker Base

Appwrite base docker image with applications and extensions built and installed.

Getting Started

This project contains Appwrite's PHP base container image.

NOTE

• For example usage latest is stated in the commands. The Appwrite team recommends using pinned version releases outside of development.
• We use Docker but you may use any compatible container runtime in its place.

Prerequisites

In order to run this container you'll need the Docker runtime installed.

Docker

• Linux

• OS X

• Windows

• Docker buildx

Optional

• GoogleContainerTools/container-structure-test for testing
• Trivy for CVE scanning

Build

--target is required. The XDebug variant derives from final, so it has to be declared after it, which makes it the last stage — and Docker defaults to the last stage. Omitting --target therefore builds XDebug, not production.

# Default (production) image
docker build --no-cache --target final --tag appwrite/base:latest .

# XDebug variant
docker build --no-cache --target xdebug --tag appwrite/base:latest-xdebug .
# exit code 0

Scan

trivy image --format json --pkg-types  os,library --severity  CRITICAL,HIGH --output trivy-image-results.json appwrite/base:latest
# success is a zero exit code

Test

# Production image
container-structure-test test --config tests.yaml --image appwrite/base:latest
# PASS

# XDebug variant
container-structure-test test --config tests-xdebug.yaml --image appwrite/base:latest-xdebug
# PASS
CI=true dive --config .dive-ci.yml appwrite/base:latest
# Results:
#   PASS: highestUserWastedPercent
#   PASS: highestWastedBytes
#   PASS: lowestEfficiency
# Result:PASS [Total:3] [Passed:3] [Failed:0] [Warn:0] [Skipped:0]

Run

docker run appwrite/base:latest php -m
# ...
# yaml
# Zend OPcache
# zlib
# zstd
# 
# [Zend Modules]
# Zend OPcache

Push

Pushing a built image to a repository should be handle by automation.

docker push appwrite/base:latest | tee "push-$(date +%s).log"

Automation

Dependency updates and releases are automated. .github/workflows/dependencies.yml runs every Monday (and on manual dispatch): it resolves the newest stable same-major release for the PHP base digest and each pinned extension, rewrites the pins in Dockerfile, opens a pull request, waits for that exact head's CI, merges it, then tags, builds, and publishes the release. A run that dies between merge and publish is resumed on the next run rather than duplicated.

The logic lives in .github/scripts as PHP and is exercised by its own suite.

composer install
composer verify
# pint, phpstan, phpunit, parity

composer verify also runs on every push via .github/workflows/verify.yml, and gates the Monday job before it touches any dependency.

Find Us

• GitHub
• Discord
• Twitter

Copyright and license

The MIT License (MIT) http://www.opensource.org/licenses/mit-license.php