The base image already contains nginx; the Dockerfile replaces it anyway. It appends deb http://nginx.org/packages/debian/ stretch nginx (with the matching deb-src line) to /etc/apt/sources.list, curls nginx_signing.key to /tmp and apt-key adds that file — no keyserver round-trip.

The install runs with -o Dpkg::Options::="--force-confnew" and --force-overwrite, so the upstream package overwrites /etc/nginx/nginx.conf instead of leaving a nginx.conf.dpkg-dist beside it. Without that flag the container would start with Debian's config and silently ignore this repo's.

Two lines earlier, dirmngr is installed explicitly and disable-ipv6 is written to ~/.gnupg/dirmngr.conf — not for nginx, but because a later step imports the MySQL signing key with gpg --recv-keys and dirmngr hung on IPv6 during the build.

TYPO3-era extensions call apc_fetch(), apc_store(), apc_add(). PHP 7 removed APC in favour of APCu, and APCu deliberately does not provide those function names. The image installs apcu_bc, which ships an apc.so that reimplements the old API on top of APCu:

pecl -d preferred_state=beta install apcu_bc

The preferred_state=beta is not stylistic — there was no stable release then (commit 8be829f). Load order is the whole trick. extension=apc.so is written to /opt/docker/etc/php/apcu-bc.ini, which is symlinked to /usr/local/etc/php/conf.d/**apcubc**.ini. PHP reads conf.d in filename order, and apcubc.ini sorts after the base image's APCu entry, so apcu.so loads before apc.so. The two commits before it (169b120, bf53981) are failed attempts at exactly this ordering.

The Blackfire probe is a prebuilt .so per PHP version, so the Dockerfile derives the version rather than hard-coding it:

version=$(php -r "echo PHP_MAJOR_VERSION.PHP_MINOR_VERSION;")   # -> 72

It then downloads https://blackfire.io/api/v1/releases/probe/php/linux/amd64/$version, unpacks the tarball, moves blackfire-*.so into php -r "echo ini_get('extension_dir');" and chown root:roots it. The 97-blackfire.php.ini this enables does not carry a client key or server — only blackfire.agent_socket=tcp://blackfire.services.ruhmesmeile.local:8707, the agency's internal agent, not the public Blackfire service. The probe tarball is fetched without a checksum or signature check.

config/php/99-docker.php.ini is headed "PRODUCTION configuration" and mostly is: display_errors = 0, expose_php = Off, memory_limit = 384M, max_execution_time = 900, max_input_vars = 5000, post_max_size/upload_max_filesize at 50M, date.timezone = Europe/Berlin.

Two lines do not fit the label. opcache.validate_timestamps = 1 with opcache.revalidate_freq = 2 means opcache stat()s every script every two seconds and picks up edits within a couple of seconds — handy across a deploy, wasted syscalls in steady state. And opcache.enable_cli = 1 optimises CLI processes too, which only matters because the scheduler runs as one.

mysql.default_host and mysqli.default_host both point at mysql — the docker-compose service name, resolved by the container network's DNS, not a real hostname.