From 78e712a1f44d13d3245c383fd419a6698b87bbf0 Mon Sep 17 00:00:00 2001
From: LRVT <21357789+l4rm4nd@users.noreply.github.com>
Date: Wed, 21 Oct 2026 13:53:34 +0200
Subject: [PATCH] Enhance PHP service configuration in docker-compose

Added user, security options, and resource limits to PHP service.
---
 examples/nginx-php/docker-compose.yml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/examples/nginx-php/docker-compose.yml b/examples/nginx-php/docker-compose.yml
index c9a15f6..278d1e1 100644
--- a/examples/nginx-php/docker-compose.yml
+++ b/examples/nginx-php/docker-compose.yml
@@ -26,13 +26,24 @@ services:
   
   php:
     image: php:8-fpm-alpine
+    user: 82:82
     container_name: php    
     hostname: php
     volumes:
+      - php_tmp:/tmp
+      - php_run:/run
       - ${DOCKER_VOLUME_STORAGE:-/mnt/docker-volumes}/nginx/www-data:/var/www # must be same path to www-data as above
       #- ${DOCKER_VOLUME_STORAGE:-/mnt/docker-volumes}/php/custom-php.ini:/usr/local/etc/php/conf.d/php.ini:ro
     restart: unless-stopped
     working_dir: /var/www
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    read_only: true
+    pids_limit: 100
+    mem_limit: 512m
+    cpus: 1.0
     expose:
       - 9000
     #networks:
@@ -41,3 +52,7 @@ services:
 #networks:
 #  proxy:
 #    external: true
+
+volumes:
+  php_tmp:
+  php_run: