webmasterfcn's picture

Hello,

can any admin answer me what is the best way to switch on the newest turnkey lamp from php 5 to the php 7 environment.

 

Any suggestions would be nice

Forum: 
Jeremy Davis's picture

[sorry for such an essay-like answer to what is on face value a pretty straight forward question. It felt important to give you all the info so I can be usre that you're making an informed decision.]

IMO there are no really rock solid and reliable way to install PHP7 on TurnKey v14.x. At least not to match the way that PHP5.6 is currently installed. So if this is for production, I'd personally be thinking long and hard about whether this is a need or just a desire.

OTOH, if this is just for a local development system that will not be publicly accessible, then that's a whole other story. Please skip the next bit; down to the last paragraph.

Perhaps to explain my position I should give you a bit of background. As you may or may not be aware, TurnKey leverages Debian and it's package management system. It's how we can provide automatically installed nightly security updates without being too concerned about something breaking.

So that's one of the big pluses of basing on Debian. However, one of the downsides is that often (especially towards the end of it's life), the software in a Debian release gets a little dated and stale.

So while a Debian release is considered "stable", none of the software is refreshed with newer versions. Security concerns (and some bugs) are mitigated via backported patches. On TurnKey, we configure an auto update job to run every night and install only those well tested security updates.

It's designed that way to ensure ongoing stability. So rather than provide newer versions, the version is frozen at OS release time and security related updates are backported to that particular version.

So the thing to consider here is that a Debian OS is something of an ecosystem. With all the moving parts designed to work together and explicitly configured not to conflict or cause issues with any other software.

Whilst you can install a newer version if you desire, unless you really need to, I would avoid it. In a couple of weeks Debian should release their next version Stretch (aka Debian 9.0). This will include PHP7 by default. Ideally we'd be releasing an v15.0 soon after, but unfortunately we're pretty snowed under and will probably be a few months away yet.

But if you can't wait until we release v15.0, but you can wait a few weeks, then I would recommend that you wait for Debian Stretch to drop. Once that's happened, you can then do an in-place upgrade from Debian Jessie (what v14.x is based on) to Stretch. You won't find much about it online just yet, but I'm sure when it gets close to release, blog posts will spring up all over the place...

If you need something right now, then I'm not aware of anything that is guaranteed not to break stuff or cause you headaches down the track. Although I know that "dotdeb" are fairly well regarded for providing newer version of PHP, Apache and other popular server side software, into Debian.

My guess is that if you do that, initially everything should all be pretty sweet. The thing that most don't consider though, is that now you are no longer getting automated PHP security updates. You could configure the security updates to also pull from dotdeb, however they do not supply backported security patches like Debian. Depending on the software you use, it means that there is a risk in the future, that you may find yourself in a position where the current version you have of PHP has a security vulnerability; but your code won't run properly on the new version. You would then be stuck with an insecure version until you have time to resolve the incompatibilities.

OTOH, if you're a Windows user, you're possibly used to that sort of issue occurring already. In my experience it can be quite common that you need to keep an insecure library or framework installed as you have some software that depends on it.

So maybe it doesn't seem like that big a deal to you? And perhaps you'll be lucky and it won't cause you any issues. However, I think it's importnat that you understand potential implications of your choices.

So to actually answer your question; probably the best way to go is to install it from dotdeb. I just did a quick google and this looks good (I haven't tested it though). Although there are probably plenty of other options if you have a search. Just keep in mind that TurnKey v14.x is Debian Jessie (aka 8) under the hood.

Add new comment