Real apps, verified end-to-end

ENTRY_FILE=index.php selects framework mode: public/ becomes the document root, so .env, app/ and vendor/ are never reachable over HTTP.

Container environment overrides .env — Laravel's dotenv loader never overrides real environment variables, so DB_HOST and APP_ENV set in Compose win.

The dev image revalidates OPcache on every request; edits on the bind-mounted src/ apply instantly.

The skeleton runs on core extensions alone (ctype, iconv, xml); native intl and mbstring are added because real apps use them and they beat the polyfill.

APP_ENV comes from the container environment — Symfony reads real env vars over .env.

Static assets resolve to real files in public/ and are served from disk, falling through to index.php only on a miss.

No database, no extra services — the smallest possible OxPHP deployment: one image, one process.

yiisoft/assets publishes static files into public/assets/<hash>/ — real files on disk, no URL-rewrite gymnastics.

Traditional mode is mandatory: wp-admin/, wp-login.php and wp-cron.php must execute as physical files — ENTRY_FILE stays unset.

PHP_DENY_PATHS blocks .php execution under wp-content/uploads/ — a shell uploaded via a vulnerable plugin never runs; matched before disk I/O, no existence oracle.

CLI work goes through a WP-CLI sidecar sharing the same volume and database; wp-config.php reads credentials via getenv().

Drupal's RewriteCond !-f + RewriteRule ^ index.php is exactly framework mode: serve existing files, dispatch the rest to web/index.php.

Aggregated CSS/JS under web/sites/default/files/ are served from disk as static files.

The cold first request warms Twig and caches (~15 s); after that responses are single-digit milliseconds — Drupal warmup, not OxPHP overhead.

Control-panel resources (web/cpresources/<hash>/) are real files on disk, served by framework mode.

Use MySQL 8.4 LTS, not 9 — Craft is verified against 8.x.

Database settings come from the container environment (CRAFT_DB_*), so they live in Compose.

october:mirror public reproduces October's nginx asset whitelist: public/ holds only index.php and */assets symlinks; themes, config/, .env and vendor/ stay outside the webroot.

SYMLINK_ALLOW_PATHS=/var/www/html is required — the mirror's symlinks point back into the project tree, which OxPHP blocks by default.

Don't forget tailor:migrate: the demo theme's Tailor blueprints get their tables separately from october:migrate.

Versioned static URLs (/static/version<N>/…) need one self-referential symlink inside pub/static — nginx strips that segment with a rewrite rule, OxPHP doesn't rewrite.

Run production mode: developer mode generates DI classes at request time, risking races across the multi-threaded worker pool.

MySQL needs --log_bin_trust_function_creators=1; composer install runs through the built PHP 8.4 image, not stock composer:2.

Two physical front controllers — index.php and admin/index.php — so traditional mode; framework mode would funnel the admin into the storefront controller.

The webroot is the project root, so PHP_DENY_PATHS=/system/**,/install/** blocks direct execution of internals; dotfiles already answer 404 by default.

Default query routing (index.php?route=…) works with zero rewrite rules.