Laravel Sail：如何让oci8扩展对非root（sail）用户生效？

问题背景 #

在基于Ubuntu的Docker镜像中安装PHP的oci8扩展，编译完成后该扩展仅对root用户可用，切换到非root（sail）用户启动PHP时，扩展无法加载。

尝试过的安装步骤 #

初始安装步骤 #

...
RUN pecl channel-update pecl.php.net
RUN echo 'instantclient,/usr/local/instantclient_21_11' | pecl install oci8-2.2.0
RUN echo "extension=oci8.so" >> /etc/php/7.4/cli/conf.d/30-oci8.ini
...

修改后的配置步骤 #

RUN echo '; priority=30' >> /etc/php/7.4/mods-available/oci8.ini \
    && echo 'extension=oci8.so' >> /etc/php/7.4/mods-available/oci8.ini \
    && ln -s /etc/php/7.4/mods-available/oci8.ini /etc/php/7.4/cli/conf.d/30-oci8.ini

错误信息 #

非root用户启动PHP时触发以下错误：

PHP Startup: Unable to load dynamic library 'oci8.so' (tried: /usr/lib/php/20190902/oci8.so (libnnz21.so: cannot open shared object file: No such file or directory), /usr/lib/php/20190902/oci8.so.so (/usr/lib/php/20190902/oci8.so.so: cannot open shared object file: No such file or directory))

排查结果 #

执行ldd /usr/lib/php/20190902/oci8.so检查依赖，显示libnnz21.so存在于正确路径/usr/local/instantclient/libnnz21.so。

解决后的完整Dockerfile #

FROM ubuntu:20.04

# 安装基础依赖
RUN apt-get update && apt-get install -y \
    php7.4-cli \
    php7.4-dev \
    pecl \
    libaio1 \
    curl \
    unzip \
    && rm -rf /var/lib/apt/lists/*

# 安装Oracle Instant Client并配置动态链接
RUN mkdir -p /usr/local/instantclient \
    && curl -o instantclient.zip https://download.oracle.com/otn_software/linux/instantclient/instantclient-basic-linux.x64-21.11.0.0.0dbru.zip \
    && unzip instantclient.zip -d /usr/local \
    && mv /usr/local/instantclient_21_11/* /usr/local/instantclient/ \
    && rm -rf instantclient.zip /usr/local/instantclient_21_11 \
    # 关键：将Instant Client路径添加到系统动态链接库配置
    && echo "/usr/local/instantclient" >> /etc/ld.so.conf.d/oracle-instantclient.conf \
    && ldconfig \
    # 确保非root用户可读
    && chmod -R 755 /usr/local/instantclient

# 安装并配置oci8扩展
RUN pecl channel-update pecl.php.net \
    && echo 'instantclient,/usr/local/instantclient' | pecl install oci8-2.2.0 \
    && echo 'extension=oci8.so' >> /etc/php/7.4/cli/conf.d/30-oci8.ini

# 创建sail用户并切换
RUN useradd -ms /bin/bash sail
USER sail

# 验证扩展加载
CMD ["php", "-m"]

关键修改说明 #

• 将Oracle Instant Client路径添加到系统动态链接库配置文件/etc/ld.so.conf.d/oracle-instantclient.conf，并执行ldconfig生效，确保所有用户进程都能找到依赖库。
• 添加chmod -R 755 /usr/local/instantclient，明确保证非root用户对Instant Client目录及文件有读取权限。

内容的提问来源于stack exchange，提问作者IGP