composer.json: the PHP packages

{
    "name": "local/typo3-appliance",
    "description": "TYPO3 Docker Appliance",
    "type": "project",
    "license": "GPL-2.0-or-later",
    …
}

Composer is the package manager for PHP. composer.json defines which packages are installed within which version ranges. This is the recommended way to install TYPO3: the core, system extensions and third-party extensions are ordinary Composer packages.

The type project marks an application that is not itself included as a library. The license GPL-2.0-or-later matches TYPO3’s.

"repositories": [
    {
        "type": "path",
        "url": "packages/*"
    }
],

Besides the public directory Packagist, Composer also looks for packages in packages/. Every subfolder with its own composer.json becomes a package, here local/oidc-backend and local/site-package.

Composer installs path packages as symbolic links: vendor/local/site-package points to packages/site_package. To add a new extension of your own, create its folder and require it:

docker compose run --rm --no-deps --entrypoint "" -v "$PWD:/app" -w /app php \
    composer require local/my-extension:@dev --no-install
docker compose up -d --build

"require": {
    "php": "^8.4",
    "causal/oidc": "^6.0",
    "local/oidc-backend": "@dev",
    "local/site-package": "@dev",
    "typo3/cms-backend": "^14.3",
    "typo3/cms-core": "^14.3",
    …
},

The version constraints follow semantic versioning:

• ^14.3 allows all versions from 14.3.0 below 15.0.0, that is bug fix and feature updates of TYPO3 14, but no jump to a new major version.
• "php": "^8.4" is not a package but a condition: Composer refuses to install on an older PHP version.
• @dev allows any development state of the local package. Path packages have no published versions.

The packages in detail:

System extensions you do not need can be removed here. A rebuild then removes them.

"config": {
    "allow-plugins": {
        "typo3/class-alias-loader": true,
        "typo3/cms-composer-installers": true
    },
    "sort-packages": true
},
"extra": {
    "typo3/cms": {
        "web-dir": "public"
    }
},
"minimum-stability": "stable",
"prefer-stable": true

• allow-plugins: Composer only runs plugins that are explicitly allowed. typo3/cms-composer-installers creates the web root public/ with index.php and links the extensions’ public files into public/_assets. typo3/class-alias-loader provides old class names as aliases so that older extensions keep working.
• sort-packages: composer require keeps the list under require sorted alphabetically.
• web-dir: the public folder that nginx serves as its document root. Everything outside it, such as vendor/, config/ and var/, is not reachable from the web.
• minimum-stability and prefer-stable: stable versions only, no betas or development states. Exceptions such as @dev for the local packages only apply where they are stated explicitly.

# verfügbare Updates anzeigen
docker compose run --rm --no-deps --entrypoint "" -v "$PWD:/app" -w /app php \
    composer outdated "typo3/*"

# TYPO3 innerhalb von ^14.3 aktualisieren, nur composer.lock neu schreiben
docker compose run --rm --no-deps --entrypoint "" -v "$PWD:/app" -w /app php \
    composer update "typo3/*" --with-all-dependencies --no-install

# Images mit den neuen Versionen bauen und starten
docker compose up -d --build

composer.json names the allowed version ranges, and composer.lock the exact installed versions including checksums. The build always installs exactly the state of the lock file. That is why it belongs in the repository, and why every machine and every restore sees identical versions.

An update first changes only the lock file. --no-install prevents Composer from creating a local vendor/ in the project folder, which plays no role in the image anyway. Only the rebuild brings the new versions into the images. On start, the entrypoint adjusts the database schema.