PressHost 🚀

Docker image for WordPress and ClassicPress hosting with NGINX and PHP 8.4.

• ⚡ Based on Debian + NGINX 1.26 + PHP 8.4 + s6-overlay v3
• 🌱 Everything is done via environment variables; PHP configurations, NGINX, and even WordPress constants are handled by environment variables. No need to edit wp-config.php.
• 🧠 Real caching support, works well with WP Super Cache, W3 Total Cache, WP Fastest Cache, and also with NGINX FastCGI Cache (via NGINX Helper).
• 🌐 CDN-ready without plugins!
• 🗄️ Optional local Redis/Valkey server
• 🔐 Docker secrets (*_FILE) supported everywhere, including PHP-FPM requests.
• 📦 Separate code, uploads, cache, and logs!
• 🔧 Interactive installer, start the container, run docker exec -it presshost ./presshost and perform the guided installation.

PressHost is already trusted by high-traffic websites, including:

• 🎫 Catraca Livre - cultural events and entertainment platform
• 📖 Manual do Usuario - technology and tutorials website

Together, these sites handle more than 20 million pageviews per month, proving PressHost's reliability and performance at scale.

wget https://raw.githubusercontent.com/butialabs/presshost/main/compose.yml
nano compose.yml
docker compose up -d

WP_SITEURL and WP_HOME fall back to SITEURL when not set. server_name is also derived from the host portion of SITEURL.

If it's a migration, you can skip the installation and just copy the files to the correct volumes.

Upon startup, an index.php file would be displayed automatically if none already exists.

If you are upgrading from a previous version, review these changes:

Salts are generated automatically at startup if they are not defined.

WP/CP cron events are driven by supercronic (DISABLE_WP_CRON defaults to true), running /usr/local/bin/press-cron.sh every minute

By default the events run through WP-CLI, on the PHP CLI binary. That is a different SAPI from the PHP-FPM workers serving the site: separate opcache, separate disable_functions, and a separate object-cache connection. When an object-cache.php drop-in is installed on ClassicPress, cache-flushing events executed on the CLI side never reach the cache the FPM workers are using, so the flush silently does nothing.

To avoid that, press-cron.sh detects a ClassicPress install and dispatches the run with curl to wp-cron.php over the loopback interface instead.

When baking WordPress/ClassicPress files into your own image, set the owner at build time for fastest startup:

FROM ghcr.io/butialabs/presshost:latest
COPY --chown=www-data:www-data ./wordpress/ /site/press/

If you forget --chown, the init fixes ownership automatically at container start (see FIX_OWNERSHIP).

*1 exec,passthru,shell_exec,system,proc_open,popen,curl_multi_exec,parse_ini_file,show_source,pcntl_exec

On the first start, if the files at SSL_CERT_PATH and SSL_PRIVATE_PATH do not exist, a self-signed certificate is generated automatically. Mount /site/ssl as a volume to persist it across container recreates and image updates. Existing files are never overwritten, so providing your own certificate (Let's Encrypt, internal CA, etc.) just works by mounting it at the configured paths.

• When NGINX_CACHE=false (default): no cache zone is configured and no cache files are created.

• When NGINX_CACHE=true:

  • The cache lives in /site/cache/nginx/
  • Cache files are generated during operation
  • The X-FastCGI-Cache header will be present in responses with values like HIT, MISS, or BYPASS

The cache can be purged using the NGINX Cache Purge module. We recommend using the NGINX Helper

Two empty configuration files are included and loaded at startup. Mount your own versions to extend NGINX without modifying the image.

Example: reverse proxy at /i/ on the same domain:

# compose.yml
services:
  presshost:
    volumes:
      - ./custom-presshost.conf:/etc/nginx/conf.d/custom-presshost.conf

# custom-presshost.conf
location /i/ {
    proxy_pass http://image-service:3000/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
}

All logs are written under /site/logs and rotated daily by logrotate: nginx-access.log, nginx-error.log, php-fpm.log, php-error.log, php-slow.log, cron-presshost.log, cron-nginx.log and wp-debug.log (when WP_DEBUG_LOG=true).

These variables are used during the interactive installation process via presshost command:

PressHost ships with built-in protections that keep PHP/NGINX healthy under load:

PHP-FPM runs with clear_env=yes. The init script forwards environment variables into the FPM pool using prefix rules:

Not forwarded (never visible to PHP / phpinfo()): NGINX_*, PHP_*, VALKEY_*, HOME, PATH, and any unrelated container env vars.

Inside wp-config.php, every forwarded WP_* and PRESS_* variable is automatically defined as a constant (PRESS_FOO -> FOO, WP_FOO -> WP_FOO) with boolean/int coercion. Explicit define()s always win.

Examples:

services:
  presshost:
    image: ghcr.io/butialabs/presshost:latest
    environment:
      # ...
      SSL_CERT_PATH: /site/ssl/live/your-domain.com/fullchain.pem
      SSL_PRIVATE_PATH: /site/ssl/live/your-domain.com/privkey.pem
      SSL_TRUSTED_CERT_PATH: /site/ssl/live/your-domain.com/chain.pem
      NGINX_SSL_STAPLING: "on"
      NGINX_SSL_STAPLING_VERIFY: "on"
    volumes:
      # ...
      - /etc/certbot:/site/ssl:ro

Note: The SSL_TRUSTED_CERT_PATH variable should point to the intermediate certificate chain (chain.pem) for OCSP stapling to work correctly. Without this, you may see warnings like "ssl_stapling ignored, no OCSP responder URL in the certificate".

Note: Nginx automatically reloads daily at 00:00 (container timezone) to pick up renewed certificates. This ensures seamless certificate rotation without manual intervention.

Nginx caches the rendered HTML of anonymous (non-logged-in) requests and serves it directly.

environment:
  NGINX_CACHE: "true"
  NGINX_CACHE_MAX_SIZE: "1g"   # total disk space for the cache
  NGINX_CACHE_INACTIVE: "60m"  # evict pages not hit in this window

Cache is automatically bypassed for logged-in users, WooCommerce cart/checkout, wp-admin, POST requests, and WordPress preview mode. For on-demand purge from the WordPress admin, install the NGINX Helper plugin and point it at the FastCGI cache.

PressHost can drive CDN caching straight from the origin, no WordPress plugin required. Three independent features:

environment:
  NGINX_CDN_CACHE: "true"

Anonymous HTML responses get:

Cache-Control: public, max-age=60 (browser TTL)
CDN-Cache-Control: public, max-age=3600, stale-while-revalidate=60, stale-if-error=86400

Logged-in users, wp-admin, cart/checkout, POST requests and authenticated REST calls (Authorization header/X-WP-Nonce) get no-cache, no-store and CDN-Cache-Control: no-store. Error responses (4xx/5xx) never receive cache headers, so the CDN never caches error pages.

On Cloudflare, create one Cache Rule: "Eligible for cache" and Respect origin cache control. Freshness is handled by TTL (stale-while-revalidate softens updates), no purge plugin needed.

At boot, the init fetches the current IP ranges from cloudflare.com/ips-v4 and ips-v6 and configures set_real_ip_from automatically (a bundled snapshot is used if the fetch fails). Without this, rate limits, logs and the IP seen by WordPress would all be the CDN's, all visitors would share one rate-limit bucket.

environment:
  NGINX_ORIGIN_AUTH_SECRET: "a-long-random-string"

When set, requests from public networks must carry the header X-Origin-Auth: <secret> or they get 403, preventing attackers from bypassing the CDN/WAF and hitting the origin directly. Configure the CDN to send the header (Cloudflare: Transform Rule -> Modify Request Header). Private networks (RFC1918, localhost) are always allowed so healthchecks keep working.

Stores WordPress object-cache data (database query results, transients) in Valkey so they survive across requests and processes.

environment:
  WP_CACHE: "true"
  VALKEY_ENABLED: "true"

With VALKEY_ENABLED=true, the init auto-wires WP_REDIS_HOST=127.0.0.1 and WP_REDIS_PORT (unless you set them yourself). Then install and activate the Redis Object Cache plugin inside WordPress the plugin is still required to create the object-cache.php drop-in.

Never set VALKEY_BIND to a non-localhost address without VALKEY_PASSWORD!

services:
  presshost:
    environment:
      WP_CACHE: "true"
      WP_REDIS_HOST: valkey
      WP_REDIS_PORT: 6379

  valkey:
    image: valkey/valkey:8-alpine
    container_name: valkey
    restart: unless-stopped
    command: valkey-server --maxmemory 256mb --maxmemory-policy allkeys-lru --save ""
    networks:
      - presshost

PHP 8.4 includes a JIT compiler that can improve throughput on CPU-bound workloads (WooCommerce, page builders, image processing). It is disabled by default because a small number of plugins with legacy code may behave incorrectly with JIT enabled.

environment:
  PHP_OPCACHE_JIT: "tracing" # recommended mode for WordPress
  PHP_OPCACHE_JIT_BUFFER_SIZE: "128M"

The container ships with the presshost CLI. Launch it with:

docker exec -it presshost presshost

When no WordPress/ClassicPress is installed yet, the menu lets you:

1. Install WordPress: downloads wordpress.org/latest.zip (or a specific version), unpacks it to /site/press, generates wp-config.php and wp-secrets.php (locally generated salts, no external API), runs wp core install, and resets ownership of the install directory to www-data:www-data.
2. Install ClassicPress: same flow, pulling from the official ClassicPress release archive.

When a site is already installed, the menu offers:

1. View installation info: shows detected type (WordPress/ClassicPress), version, site URL, title and the configured directories (/site/press, /site/uploads, /site/cache).
2. Exit.

You can also invoke the installer non-interactively:

# Same flows scripted via env vars (no TTY required)
docker exec -e PRESSHOST_DEFAULT_ACTION=wordpress \
            -e INSTALL_URL=https://example.com \
            -e [email protected] \
            -it presshost presshost

presshost fix-perms resets ownership to www-data:www-data and applies safe permissions (755 for directories, 644 for files, 640 for wp-config.php and wp-secrets.php) on /site/{press,uploads,cache,logs}. It must be invoked with the root account inside the container:

docker exec -u 0 presshost presshost fix-perms

safe-chown <path> [path...] fixes ownership to APP_USER:APP_GROUP efficiently: healthy trees are an instant no-op (top-level probe), and dirty trees are walked chowning only wrong-owned entries in batches.

It runs automatically at startup when FIX_OWNERSHIP=true, in the background (APP_PATH, CACHE_PATH, LOGS_PATH by default; add UPLOADS_PATH with FIX_UPLOADS_OWNERSHIP=true), and is also used by presshost fix-perms (which always covers all four paths, run synchronously on demand). Manual use:

docker exec presshost safe-chown /site/press /site/uploads

Made with ❤️ by Butiá Labs