Document how to build static SAPI binaries?

[1ma]

Apparently it is not as easy as adding the -static flag to the LDFLAGS environment variable before building, even though libtool sees and uses it.

[nikic]

Isn't everything (apart from always shared extensions like opcache) built statically by default?

[1ma]

Most extensions can be built statically (their code is embedded in the binary, as opposed to an ext.so file in the EXTENSION_DIR), but their dependencies are not, hence the resulting binary is not fully static.

A concrete example, this Dockerfile builds PHP 7.2.8 with just the OpenSSL extension:

FROM alpine:3.8

RUN apk add --no-cache \
    alpine-sdk \
    autoconf \
    automake \
    file \
    flex \
    libressl-dev \
    libtool \
    re2c

ENV PHP_VERSION=7.2.8

RUN cd /tmp \
 && curl -OsS http://php.net/distributions/php-${PHP_VERSION}.tar.gz \
 && tar zxof php-${PHP_VERSION}.tar.gz

ENV CFLAGS="-O3 -march=x86-64"
ENV LDFLAGS="-s -static"

RUN cd /tmp/php-${PHP_VERSION} \
 && ./configure \
    EXTENSION_DIR="/usr/lib/php" \

    --prefix=/usr \
    --sysconfdir=/etc/php/cli \
    --with-config-file-path=/etc/php/cli \
    --with-config-file-scan-dir=/etc/php/cli/conf.d \

    --enable-static=yes \
    --enable-shared=no \
    --disable-all \
    --with-openssl \

    --enable-cli \
    --disable-fpm \
    --disable-cgi \
    --disable-phpdbg \
 && make -j$(grep "cpu cores" /proc/cpuinfo | wc -l) \
 && make install

$ docker build -t php72 -f Dockerfile .
...
/bin/bash /tmp/php-7.2.8/libtool --silent --preserve-dup-deps --mode=link cc -export-dynamic -O3 -march=x86-64 -fvisibility=hidden -DZEND_SIGNALS    -s -static  ext/date/php_date.lo ext/... -o sapi/cli/php
...
Successfully built 802fd4c8ff0a
Successfully tagged php72:latest

$ docker run --rm -it php72 sh -l

# php -v
PHP 7.2.8 (cli) (built: Jul 23 2018 09:38:08) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies

# php -m
[PHP Modules]
Core
date
openssl
pcre
Reflection
SPL
standard

[Zend Modules]

# ldd /usr/bin/php
	/lib/ld-musl-x86_64.so.1 (0x7fcfc36e5000)
	libssl.so.45 => /lib/libssl.so.45 (0x7fcfc2cd4000)
	libcrypto.so.43 => /lib/libcrypto.so.43 (0x7fcfc2929000)
	libc.musl-x86_64.so.1 => /lib/ld-musl-x86_64.so.1 (0x7fcfc36e5000)

but the desired outcome would be:

# ldd /usr/bin/php
	not a dynamic executable

[nikic]

Ah okay, I see what you mean now. Unfortunately I have no idea idea how this can be achieved.

[jpauli]

This cant be done using our build stack. PHP has a lot of dependencies over the system, through its extensions and core.

It is usually better for memory footprint and security, to build things dynamically however.