lotuswebagency/php
PHP 7.0 to 8.5 compiled from source on Wolfi, for amd64 and arm64, signed and shipped with an SBOM.
Open source
PHP, Node.js and other Docker images we run in production
We publish the Docker base images our client stacks run on: PHP, Node.js, Angie, nginx, Percona MySQL and Adminer. They are MIT-licensed, scanned with Trivy, signed with Cosign and shipped with an SBOM. Each has its source on GitHub and its builds on Docker Hub, where you can pull it.
How often are our images pulled, and how are they licensed and signed?
102K+
Docker Hub pulls, as of October 2026
7
Docker images
MIT
licensed
Signed
with Cosign, SBOM included
Which Docker images do we publish?
Each image has its source on GitHub and its builds on Docker Hub.
lotuswebagency/nginx-nodejs
A rootless Node.js runtime behind nginx with Brotli and gzip, supervised by s6, for amd64.
dementev/php-fpm-with-ext
PHP-FPM and CLI Docker images for PHP 7.0 to 8.5 with the common extensions preinstalled and a PrestaShop compatibility shim. Superseded by lotuswebagency/php.
Source on GitHub: php-fpm-with-ext Docker Hub: php-fpm-with-ext
dementev/angie
A Debian-slim Angie reverse proxy with brotli, zstd and cache purge, tuned for low latency.
dementev/nginx
Alpine nginx for static sites and SPAs behind a reverse proxy, with brotli, zstd and Prometheus status.
dementev/mysql-percona
Percona Server for MySQL 8.4 LTS on Debian slim, with XtraBackup built in, automatic TLS and no root.
dementev/adminer
Adminer with every database driver it supports, plus native parallel dumps and fast restore.
How do we ship them?
- Every build is scanned with Trivy, and a vulnerability finding fails the build
- Images are signed with Cosign keyless signing, so you can verify they came from our CI
- Each image ships with an SBOM and build provenance
- Most images are rebuilt weekly to pick up base-image security fixes, and most are built for both amd64 and arm64
- Third-party GitHub Actions in the pipelines are pinned to full commit SHAs
The build pipeline itself is open too: docker-workflows, the reusable GitHub Actions workflows behind most of our images.
What else have we built?
FARS
On-demand HTTP image resizing with libvips: JPEG, PNG, WebP and AVIF variants with a self-invalidating cache. Built by our team for a client store.
Docker Hub
XML Sitemap Inspector
A Chrome extension that finds, shows and validates every XML sitemap on the current site, entirely in your browser.
Learn more
Hushscript is our own product for transcribing tab and microphone audio.
Common Questions
How are your images built and signed?
Each build is scanned for vulnerabilities and fails if one is found, then signed with Cosign so you can check it came from our CI. An SBOM and build provenance ship with every image, and the reusable GitHub Actions workflows behind most of them are open source in docker-workflows.
Which versions are maintained?
The php image covers PHP 7.0 to 8.5 for amd64 and arm64. End-of-life PHP versions stay published and are rebuilt weekly for base-image updates, but PHP itself gets no upstream security fixes for them. The Node.js runtime image follows Node.js releases, Percona Server for MySQL is on the 8.4 LTS line, and dementev/php-fpm-with-ext is superseded by lotuswebagency/php.
How do I pull them?
Run docker pull with the image name from Docker Hub, for example docker pull lotuswebagency/php:8.5-fpm. Tags follow the PHP or Node.js version, and you can pin an image digest for reproducible builds.
Want infrastructure like this?
We run these images in production for our clients. If you want the same setup behind your site or store, let's talk.