php-fpm: improve dockerfile, switch to per-lane www.conf

Shared www.conf isn't viable due to differing supported options between
PHP-FPM versions. Additionally, the Dockerfile multi-stage build wasn't
useful as it copied build artifacts. Switched to single-stage with build
artifact pruning.

php-fpm/7.4/Dockerfile

@@ -1,7 +1,9 @@
-# Multi-stage Alpine-based PHP 7.4 FPM image optimized for WordPress
-ARG BASE_TAG=7.4-fpm-alpine3.16
-FROM php:${BASE_TAG} AS build
+# Alpine-based PHP 7.4 FPM image optimized for WordPress
+ARG BASE_VERSION=7.4
+ARG BASE_TAG=${BASE_VERSION}-fpm-alpine3.16
+FROM php:${BASE_TAG}
 
+# Install build dependencies, PHP extensions, and runtime dependencies in a single layer
 RUN set -eux; \
 	apk add --no-cache --virtual .build-deps \
 	$PHPIZE_DEPS \
@@ -10,7 +12,6 @@ RUN set -eux; \
 	g++ \
 	make \
 	pkgconfig \
-	bash \
 	freetype-dev \
 	libjpeg-turbo-dev \
 	libpng-dev \
@@ -21,6 +22,25 @@ RUN set -eux; \
 	oniguruma-dev \
 	mariadb-dev \
 	; \
+	\
+	# Install runtime dependencies
+	apk add --no-cache \
+	bash \
+	freetype \
+	libjpeg-turbo \
+	libpng \
+	libxml2 \
+	zlib \
+	icu-libs \
+	libzip \
+	mariadb-client \
+	openssl \
+	ca-certificates \
+	tzdata \
+	; \
+	update-ca-certificates; \
+	\
+	# Configure and install extensions
 	docker-php-ext-configure gd --with-freetype --with-jpeg; \
 	docker-php-ext-install -j"$(nproc)" \
 	gd \
@@ -38,40 +58,24 @@ RUN set -eux; \
 	soap \
 	pcntl \
 	; \
+	\
+	# Install PECL extensions
 	pecl channel-update pecl.php.net; \
 	pecl install redis && docker-php-ext-enable redis; \
+	\
+	# Use production php.ini
 	cp "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"; \
+	\
+	# Clean up build dependencies
 	apk del .build-deps; \
 	rm -rf /var/cache/apk/* /tmp/*
 
-FROM php:${BASE_TAG} AS runtime
-
-RUN set -eux; \
-	apk add --no-cache \
-	freetype \
-	libjpeg-turbo \
-	libpng \
-	libxml2 \
-	zlib \
-	icu-libs \
-	libzip \
-	mariadb-client \
-	openssl \
-	ca-certificates \
-	tzdata \
-	; \
-	update-ca-certificates || true
-
-# Copy built PHP and extensions from the build stage
-COPY --from=build /usr/local/lib/php /usr/local/lib/php
-COPY --from=build /usr/local/etc/php /usr/local/etc/php
-
 # Create a non-root application user and prepare webroot directory
-RUN addgroup -g 1000 app || true; \
-	adduser -D -u 1000 -G app app || true; \
-	mkdir -p /var/www/html; \
-	chown -R app:app /var/www/html; \
-	mkdir -p /var/run/php /run/php /var/log/php; \
+RUN addgroup -g 1000 app && \
+	adduser -D -u 1000 -G app app && \
+	mkdir -p /var/www/html && \
+	chown -R app:app /var/www/html && \
+	mkdir -p /var/run/php /run/php /var/log/php && \
 	chown -R app:app /var/run/php /run/php /var/log/php
 
 # Minimal security / production tuning for opcache and PHP
@@ -92,19 +96,16 @@ RUN set -eux; \
 	echo 'error_log = /proc/self/fd/2'; \
 	} > /usr/local/etc/php/conf.d/zz-hardening.ini
 
-EXPOSE 9000
-
-HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 CMD pgrep -f "php-fpm" || exit 1
-
-WORKDIR /var/www/html
-
 # Copy pool configuration and entrypoint from shared path in repo root
-COPY --chown=root:root shared/php-fpm/www.conf /usr/local/etc/php-fpm.d/www.conf
+COPY --chown=app:app php-fpm/${BASE_VERSION}/www.conf /usr/local/etc/php-fpm.d/www.conf
 COPY --chown=root:root shared/php-fpm/entrypoint.sh /usr/local/bin/entrypoint.sh
 RUN chmod 755 /usr/local/bin/entrypoint.sh
 
+WORKDIR /var/www/html
+USER app
+
 ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
-
-USER root
-
 CMD ["php-fpm"]
+
+EXPOSE 9000
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 CMD pgrep -f "php-fpm" > /dev/null || exit 1