How to Dockerize a Laravel App with PHP-FPM and Nginx

# ── Stage 1: Composer dependencies ──────────────────────────────
FROM composer:2 AS builder
WORKDIR /app
COPY composer.json composer.lock ./
RUN composer install \
      --no-dev \
      --no-scripts \
      --optimize-autoloader \
      --no-interaction \
      --prefer-dist

COPY . .
RUN composer run-script post-autoload-dump

# ── Stage 2: PHP-FPM runtime ──────────────────────────────────
FROM php:8.3-fpm-alpine AS runtime

# Install system deps + PHP extensions
RUN apk add --no-cache \
      libpng-dev libjpeg-turbo-dev libwebp-dev \
      libzip-dev oniguruma-dev icu-dev && \
    docker-php-ext-install \
      pdo_mysql mbstring zip bcmath intl gd opcache

WORKDIR /var/www

# Copy app + vendor from builder
COPY --from=builder /app .

# Non-root user
RUN addgroup -g 1000 laravel && \
    adduser -u 1000 -G laravel -s /bin/sh -D laravel && \
    chown -R laravel:laravel /var/www

USER laravel

EXPOSE 9000
CMD ["php-fpm"]

# docker/nginx/default.conf
server {
    listen 80;
    root /var/www/public;
    index index.php;

    # Serve static files directly
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # Forward PHP requests to php-fpm
    location ~ \.php$ {
        fastcgi_pass   php:9000;
        fastcgi_index  index.php;
        include        fastcgi_params;
        fastcgi_param  SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        fastcgi_param  DOCUMENT_ROOT   $realpath_root;
    }

    location ~ /\.ht {
        deny all;
    }
}

services:
  php:
    build:
      context: .
      target: runtime
    volumes:
      - ./storage:/var/www/storage
    env_file: .env
    networks:
      - laravel

  nginx:
    image: nginx:1.27-alpine
    ports:
      - "80:80"
    volumes:
      - ./public:/var/www/public:ro
      - ./docker/nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
    depends_on:
      - php
    networks:
      - laravel

  mysql:
    image: mysql:8.4
    environment:
      MYSQL_ROOT_PASSWORD: "${DB_PASSWORD}"
      MYSQL_DATABASE: "${DB_DATABASE}"
    volumes:
      - mysql_data:/var/lib/mysql
    networks:
      - laravel

  redis:
    image: redis:7.4-alpine
    networks:
      - laravel

volumes:
  mysql_data:

networks:
  laravel:

vendor/
node_modules/
.git/
.env
.env.*
storage/logs/*
storage/framework/cache/*
storage/framework/sessions/*
storage/framework/views/*
tests/
docker/
*.md

#!/bin/sh
# docker/php/entrypoint.sh

set -e

echo "Waiting for MySQL..."
until php -r "new PDO('mysql:host=\${DB_HOST};dbname=\${DB_DATABASE}', '\${DB_USERNAME}', '\${DB_PASSWORD}');" 2>/dev/null; do
  sleep 1
done

php artisan migrate --force
php artisan optimize
php artisan storage:link --force

exec "\$@"

# Add to the runtime stage in your Dockerfile (as root, before USER laravel)
COPY docker/php/entrypoint.sh /usr/local/bin/entrypoint.sh
RUN chmod +x /usr/local/bin/entrypoint.sh

USER laravel
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
CMD ["php-fpm"]

APP_ENV=production
APP_KEY=base64:your_key_here
APP_DEBUG=false
APP_URL=https://example.com

DB_CONNECTION=mysql
DB_HOST=mysql
DB_PORT=3306
DB_DATABASE=laravel
DB_USERNAME=root
DB_PASSWORD=secret

REDIS_HOST=redis
REDIS_PORT=6379

CACHE_STORE=redis
SESSION_DRIVER=redis
QUEUE_CONNECTION=redis

# Build and start (detached)
docker compose up -d --build

# Watch all logs
docker compose logs -f

# Confirm all containers are running
docker compose ps

# Run artisan commands inside the container
docker compose exec php php artisan tinker

# Stop everything (keeps volumes)
docker compose down

# Stop and wipe database (DANGER: deletes data)
docker compose down -v

# Add health check to mysql service in docker-compose.yml
healthcheck:
  test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
  interval: 10s
  timeout: 5s
  retries: 5

# Scan for vulnerabilities
docker scout cves local://your-image:latest