[DOCKER] Run PHP-FPM with OPcache enabled in a Read Only container

environment

Premise

• OPcache --Cache activation --file_cache_only is invalid --lockfile_path is / tmp
• PHP-FPM --No file path to pid
• Docker
  • Read Only mode

Method

Mount volume on / tmp where the opcache lock file is created.

docker run -d -p 9000:9000 --read-only -v $(pwd)/tmp:/tmp php:7.3-fpm-alpine3.12

Commentary

I will explain why volume is mounted on / tmp. opcache requires a lock file to cache in shared memory. Within the zend_shared_alloc_create_lock function, call mkstemp to create a lock file in / tmp. If the creation fails, the error message Unable to create lock file is output and then the process terminates abnormally.

Lock file creation function

void zend_shared_alloc_create_lock(char *lockfile_path)
{
	int val;

#ifdef ZTS
    zts_lock = tsrm_mutex_alloc();
#endif

	snprintf(lockfile_name, sizeof(lockfile_name), "%s/%sXXXXXX", lockfile_path, SEM_FILENAME_PREFIX);
	lock_file = mkstemp(lockfile_name);
	fchmod(lock_file, 0666);

	if (lock_file == -1) {
		zend_accel_error(ACCEL_LOG_FATAL, "Unable to create lock file: %s (%d)", strerror(errno), errno);
	}
	val = fcntl(lock_file, F_GETFD, 0);
	val |= FD_CLOEXEC;
	fcntl(lock_file, F_SETFD, val);

	unlink(lockfile_name);
}

zend_shared_alloc_create_lock is called from zend_shared_alloc_startup and passes the runtime setting lockfile_path as an argument.

zend_shared_alloc_create_Caller of lock

int zend_shared_alloc_startup(size_t requested_size)
{
/*abridgement*/

#ifndef ZEND_WIN32
	zend_shared_alloc_create_lock(ZCG(accel_directives).lockfile_path);
#else
	zend_shared_alloc_create_lock();
#endif

Reference

• https://www.php.net/manual/ja/opcache.configuration.php
• https://www.php.net/manual/ja/install.fpm.configuration.php
• https://github.com/php/php-src/blob/PHP-7.3/ext/opcache/zend_shared_alloc.c