Build FrankenPHP on patched PHP 8.3.36 base

docker/prod/Dockerfile

@@ -1,12 +1,90 @@
-ARG PHP_VERSION=8.3
-ARG FRANKENPHP_VERSION=1.13
+# syntax=docker/dockerfile:1
+ARG PHP_VERSION=8.3.36
+ARG GO_VERSION=1.27
+# FrankenPHP v1.13.1
+ARG FRANKENPHP_REF=99d4e119ca2e5a90a69d8dbee5d5c9a8016416c5
+ARG WATCHER_VERSION=0.14.5
 ARG COMPOSER_VERSION=2.8
 ARG APP_ENV
 ARG DOCKER_FILES_BASE_PATH="docker/prod/"
 
 FROM composer:${COMPOSER_VERSION} AS vendor
 
-FROM dunglas/frankenphp:${FRANKENPHP_VERSION}-builder-php${PHP_VERSION} AS upstream
+FROM golang:${GO_VERSION}-trixie AS golang-base
+
+# Rebuild of the official dunglas/frankenphp images on a patched PHP base.
+# Mirrors the "common", "builder" and "runner" stages of https://github.com/php/frankenphp/blob/v1.13.1/Dockerfile
+FROM scratch AS frankenphp-src
+ARG FRANKENPHP_REF
+ADD https://github.com/php/frankenphp.git#${FRANKENPHP_REF} /
+
+FROM php:${PHP_VERSION}-zts-trixie AS frankenphp-common
+
+WORKDIR /app
+
+RUN apt-get update && \
+    apt-get -y --no-install-recommends install \
+        mailcap \
+        libcap2-bin \
+    && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN set -eux; \
+    mkdir -p \
+        /app/public \
+        /config/caddy \
+        /data/caddy \
+        /etc/caddy \
+        /etc/frankenphp; \
+    sed -i 's/php/frankenphp run/g' /usr/local/bin/docker-php-entrypoint
+
+COPY --link --from=frankenphp-src /caddy/frankenphp/Caddyfile /etc/caddy/Caddyfile
+COPY --link --from=frankenphp-src /package/content/index.php /app/public/index.php
+RUN ln /etc/caddy/Caddyfile /etc/frankenphp/Caddyfile && \
+    curl -sSLf \
+        -o /usr/local/bin/install-php-extensions \
+        https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions && \
+    chmod +x /usr/local/bin/install-php-extensions
+
+ENV XDG_CONFIG_HOME=/config
+ENV XDG_DATA_HOME=/data
+
+FROM frankenphp-common AS upstream
+
+ARG WATCHER_VERSION
+
+COPY --from=golang-base /usr/local/go /usr/local/go
+
+ENV PATH=/usr/local/go/bin:$PATH
+ENV GOTOOLCHAIN=local
+
+RUN apt-get update && \
+    apt-get -y --no-install-recommends install \
+    cmake \
+    git \
+    libargon2-dev \
+    libbrotli-dev \
+    libcurl4-openssl-dev \
+    libonig-dev \
+    libreadline-dev \
+    libsodium-dev \
+    libsqlite3-dev \
+    libssl-dev \
+    libxml2-dev \
+    zlib1g-dev \
+    && \
+    apt-get clean
+
+WORKDIR /usr/local/src/watcher
+RUN curl -fsSL "https://github.com/e-dant/watcher/archive/refs/tags/${WATCHER_VERSION}.tar.gz" | tar xz --strip-components 1 && \
+    cmake -S . -B build -DCMAKE_BUILD_TYPE=Release && \
+    cmake --build build && \
+    cmake --install build && \
+    ldconfig
+
+WORKDIR /go/src/app
+COPY --link --from=frankenphp-src / ./
 
 COPY --from=caddy:builder /usr/bin/xcaddy /usr/bin/xcaddy
 
@@ -21,7 +99,16 @@ RUN CGO_ENABLED=1 \
         --with github.com/dunglas/frankenphp/caddy=./caddy/ \
         --with github.com/dunglas/caddy-cbrotli
 
-FROM dunglas/frankenphp:${FRANKENPHP_VERSION}-php${PHP_VERSION}
+FROM frankenphp-common
+
+ENV GODEBUG=cgocheck=0
+
+COPY --from=upstream /usr/local/lib/libwatcher* /usr/local/lib/
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends libstdc++6 && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* && \
+    ldconfig
 
 COPY --from=upstream /usr/local/bin/frankenphp /usr/local/bin/frankenphp