14

I've dockerised a wordpress application, now I'm being a purist and don't want to include nginx in the docker container and don't want to share any state between the nginx container and php-fpm container.

I want to run php-fpm as a standalone webserver (like unicorn in ruby or gunicorn in python) serving all the content (html, css and images) for the wordpress site. And run a nginx reverse proxy in front off it (caching static content). That way I can keep the separation of concerns and I don't have nginx forwarding traffic to and nginx server.

The default configuration for php-fpm only allows php files to be processed. Can the php-fpm conf that be changed? How? Is it a good idea?

3 Answers 3

8

You could, but the performance would be terrible, since everything would go through the PHP interpreter. This would also introduce an obvious, massive security problem.

This is exactly the sort of scenario in which you should be using shared data volumes.

5
  • PHP should run coden only in <?php ?> and .php files, shouldn't? Or FPM will interpret everything including .jpg or .txt?
    – Bobík
    Apr 21, 2017 at 17:49
  • There is no reason why performance would be terrible. If you need to protect access to a file, it's normal to check access by PHP and if it's a public file then PHP application should set cache HTTP headers so any cache proxy could improve perfs. Sep 24, 2018 at 16:59
  • 1
    @Charles-ÉdouardCoste Even if you check access in PHP code, you generally would not have PHP serve the file itself. It's not very fast at that. You would pass that back to Apache or nginx. Sep 24, 2018 at 17:14
  • It is quite easy to add <?php install_rootkit(); ?> as a comment into GIF files. Then you simply let the website display the picture and you are in. Feb 28, 2021 at 11:02
  • This works with shared data volumes, but it feels odd the need of the same files in both containers. Ideally everything could be isolated in just 1 container and let nginx do its work without knowing what is in the wordpress directories.
    – WilliamX
    Apr 1 at 18:00
1

You can use a TCP socket connection between nginx and php-fpm, then you can run those in different containers. Just specify fastcgi_pass fastcgi://php-fpm-ip:port in your nginx configuration.

Then, using shared data volumes you can access the files from same place.

2
  • I'm trying to avoid shared data volumes
    – Martinffx
    Sep 26, 2016 at 12:30
  • Well, then you can have the static data in another container and PHP files in another one. Passing the requests for these files via PHP causes overhead and will make your website slower. Or you can run lsyncd or similar utility to sync the files between app container and nginx container. Anyway, this is a bad idea, since it introduces unnecessary complexity for no visible benefit. Sep 26, 2016 at 15:50
0

I was doing this question myself during this few weeks. My solution was this docker documentation in docs.docker.com which says:

If you mount an empty volume into a directory in the container in which files or directories exist, these files or directories are propagated (copied) into the volume. Similarly, if you start a container and specify a volume which does not already exist, an empty volume is created for you. This is a good way to pre-populate data that another container needs.

So I just mounted an empty volume like this in composer.yml:

services:
  nginx:
    image: nginx:1.25
    volumes:
      - my-volume:/var/www
  php:
    image: my-custom/image:latest
    volumes:
      - my-volume:/var/www
volumes:
  my-volume:

After this, the static files were perfectly served to nginx from the php-fpm container which in this case has all the code that needed to be shared with nginx.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .