Entry-Point Runtime — PHP-FPM

Heuristics the Stella Ops scanner uses to classify a container entry point as a PHP-FPM FastCGI process manager, plus the evidence it attaches and the edge cases it guards against. For the shared detector contracts, scoring, and calibration, see the Runtime Detector Overview. PHP-FPM frequently runs behind a web server, so a container that also starts Nginx or Apache is classified as a Supervisor with PHP-FPM as a child service.

Signals to gather

• argv0 equals php-fpm or php-fpm8* variants; master process often invoked with -F or --nodaemonize.
• Configuration files: /usr/local/etc/php-fpm.conf, www.conf, pool definitions under php-fpm.d.
• PHP runtime artefacts: composer.json, public/index.php, artisan, wp-config.php.
• Environment variables such as PHP_FPM_CONFIG, PHP_INI_DIR, APP_ENV.
• Socket or port exposure (listen = 9000, /run/php-fpm.sock).

Implementation notes

• Verify master process vs worker processes (master stays PID 1, workers forked).
• Inspect pool configuration to extract listening endpoint and process manager mode.
• If docker-php-entrypoint is involved, ShellFlow must expand to php-fpm.
• Distinguish FPM from CLI invocations (php script.php) to avoid misclassification.

Evidence & scoring

• Reward confirmed config files and listening sockets.
• Add evidence for application artefacts (Composer lockfile, framework directories).
• Penalise when only the binary is present without config (could be CLI usage).

Edge cases

• Images bundling Apache/Nginx front-ends should end up as Supervisor with PHP-FPM as a child service.
• Some Alpine packages use versioned naming (e.g., php-fpm7, php-fpm8) — include these aliases in the detector.
• When php-fpm is launched via s6 or a supervisor, rely on child detection to avoid double counting.

Related

• Runtime Detector Overview — shared contracts, scoring, calibration.
• Supervisor detector — Nginx/Apache + PHP-FPM combos.
• Entry-Point Runtime — Nginx — the most common front-end for PHP-FPM.