henderkes · Oct 9, 2026
diff --git a/8.6-rc/alpine3.23/cli/Dockerfile b/8.6-rc/alpine3.23/cli/Dockerfile
diff --git a/8.6-rc/alpine3.23/fpm/Dockerfile b/8.6-rc/alpine3.23/fpm/Dockerfile
diff --git a/8.6-rc/alpine3.24/cli/Dockerfile b/8.6-rc/alpine3.24/cli/Dockerfile
diff --git a/8.6-rc/alpine3.24/fpm/Dockerfile b/8.6-rc/alpine3.24/fpm/Dockerfile
diff --git a/8.6-rc/bookworm/cli/Dockerfile b/8.6-rc/bookworm/cli/Dockerfile
diff --git a/8.6-rc/bookworm/fpm/Dockerfile b/8.6-rc/bookworm/fpm/Dockerfile
diff --git a/8.6-rc/trixie/cli/Dockerfile b/8.6-rc/trixie/cli/Dockerfile
diff --git a/8.6-rc/trixie/fpm/Dockerfile b/8.6-rc/trixie/fpm/Dockerfile
diff --git a/Dockerfile-linux.template b/Dockerfile-linux.template
@@ -374,11 +374,14 @@ RUN set -eux; \
 # https://github.com/docker-library/php/issues/822
 		--with-pic \
 		\
-{{ ) else ( -}}
+{{ ) elif env.variant == "apache" then ( -}}
 # https://github.com/docker-library/php/issues/822
 # https://github.com/php/php-src/pull/21067/changes#diff-4b9db5b77bcd56aa33b310dc44c8bc99c729c9abb195df2e98e6985b81289ae8R130
 		--enable-pic \
 		\
+{{ ) else ( -}}
+# Forcing PIC also removes -fpie from executable objects, preventing local-exec TLS.
+# So do not --enable-pic
 {{ ) end -}}
 {{ if install_pear_pecl then ( -}}
 # --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)