Apache 2.4 and PHP 8.1

[richardsyeo]

I am using Apache 2.4.52 and PHP 8.1.2. on Ubuntu 22.04.1 LTS.
Do you have any recommendations on how to setup Apache config and php.ini for use with VIPS 8.12.1 on a heavily used website?

[jcupitt]

Hi @richardsyeo,

It should be pretty straightforward -- just enable ffi in php.ini.

You should do some input sanitisation. I'd make some effort to only allow known good formats (perhaps png, jpg, gif), and use eg. jpegload to load the image. newFromFile() will search for and use any loader that has been compiled into the libvips binary, and ubuntu's libvips has several dubious loaders in it.

You could consider making your own libvips binary and only include the code you need, though that would make deployment harder. libvips 8.13 has a new feature that will block untested loaders, which could be useful.

Some formats can be used to make denial of service decompression bombs. You can make a 100mb GIF, for example, that will need 20gb of server memory to process. I'd open files, check dimensions, and refuse to handle images over maybe 100mpx.

Install libvips with apt install libvips42 --no-install-recommends. The ubuntu package will install 800mb (!!!) of useless recommended stuff if you miss this flag.

You might need to limit the number of pipelines you run at once, it depends what you're using libvips for, your expected server load and how much ram your server has.

[richardsyeo]

Thanks

Which is best to use PHP CGI or FPM?

Best methods to use when loading images from s3, transforming and returning?

Should this be used at end of each script?
Vips\Config::shutDown();

[jcupitt]

I´d use FPM. You don´t need to call shutDown.