How would you prefer it to work?

If I understand the top-poster's issue correctly:

https://frankenphp.dev/docs/

docker run -v $PWD:/app/public \ -p 80:80 -p 443:443 -p 443:443/udp \ dunglas/frankenphp

This mounts the current working directory into "public". Meaning, all .git, .env etc. will be publicly accessible.

Better form would be to mount a $PWD/src directory instead. The documentation needs to be updated better for newbies. Generally ill-advised. Documentation just needs better updating or warnings. Very dangerous to inexperienced devs.

In comparison the Laravel integration, it instructs the following:

https://frankenphp.dev/docs/laravel/

docker run -p 80:80 -p 443:443 -p 443:443/udp -v $PWD:/app dunglas/frankenphp

While all the sensitive files are mounted in, they have to be to function properly. In this case, they're mounted to a more secure context.

It literally says “copy your PHP files” note the PHP part. It doesn’t say copy all your secrets and git history too.

If you run the above docker command, which is directly from the docs, it copies everything inside of your current working directory. Not just PHP files.

That docker command isn't "copying" anything; it's mounting, and I really hope people aren't doing that in production. There's a separate section on running in production.

Production deployment guide also suggests copying everything (`COPY . /app/public`).

https://frankenphp.dev/docs/production/

Your .dockerignore is supposed to filter out for you. In the Symfony default implementation, you have this file you can use:

https://github.com/dunglas/symfony-docker/blob/main/.dockeri...

My primary concern is actually that you have to store code in a directory that is publicly served by default. I haven't looked into the PHP world lately, but I have assumed that by now most PHP frameworks would store code (and associated configs etc) outside the document root, like the Laravel approach you mentioned.

I see what you mean. I interpreted the getting started one-liner differently. I took it to mean that the docker container is serving from `/app/public` and the user needs to mount their files accordingly.

Yeah, most modern PHP frameworks use a public/ directory which has the index.php entrypoint in it, and any static assets are served from in there (JS/CSS/images) if necessary.