# heleos php-fpm base image — runs as non-root (www-data, uid 82 on alpine).
# Build arg PHP_VERSION selects the runtime; tag the image to match.
ARG PHP_VERSION=8.3
FROM php:${PHP_VERSION}-fpm-alpine

# Build extensions with dev headers, then keep only the runtime shared libs.
RUN set -eux; \
    apk add --no-cache --virtual .build-deps \
        icu-dev libzip-dev libpng-dev libjpeg-turbo-dev freetype-dev oniguruma-dev; \
    docker-php-ext-configure gd --with-freetype --with-jpeg; \
    docker-php-ext-install -j"$(nproc)" \
        pdo_mysql mysqli gd intl zip opcache exif; \
    runDeps="$( \
        scanelf --needed --nobanner --format '%n#p' --recursive /usr/local/lib/php/extensions \
        | tr ',' '\n' | sort -u | awk 'system("[ -e /usr/local/lib/"$1" ]") == 0 { next } { print "so:" $1 }' \
    )"; \
    apk add --no-cache $runDeps icu-libs libzip libpng libjpeg-turbo freetype oniguruma; \
    apk del .build-deps

# Platform php + pool config.
COPY php.ini  /usr/local/etc/php/conf.d/zz-heleos.ini
COPY www.conf /usr/local/etc/php-fpm.d/zz-heleos.conf

# Drop privileges: the container runs entirely as www-data. php-fpm listens on
# TCP 9000 (unprivileged), so no root is needed.
USER www-data
EXPOSE 9000