Weave Code
Workerman Bundle Laravel Package
crazy-goat/workerman-bundle
Run Symfony on Workerman: a pure-PHP event loop HTTP server, scheduler, and supervisor replacing php-fpm, nginx, cron, and supervisord. The kernel and DI container persist between requests for speed, with a composable middleware pipeline, console commands, and no external binaries.
Workerman runtime for Symfony turns your Symfony application into a high-performance, event-driven HTTP server, scheduler, and supervisor — all in pure PHP. It replaces the classic php-fpm + nginx + cron + supervisord stack, keeping the Symfony kernel and DI container alive between requests for faster responses with little or no code change.
- Middleware pipeline — composable request/response handling with
StaticFilesMiddleware(ETag, 304, path traversal and dot-file protection, LRU cache) built once and reused. - Console commands — full server lifecycle management via
Server*commands. - Event loop runtime — persistent kernel and container across requests.
- Lean dependencies — no PSR-7 bridge required; PHP
^8.2, Symfony^6.4 | ^7.0 | ^8.0.
Frequently asked questions about Workerman Bundle
- Is crazy-goat/workerman-bundle a Laravel package, or can I use it in a Laravel app?
- No. It is a Symfony bundle (CrazyGoat\WorkermanBundle) that registers in config/bundles.php and depends on Symfony's kernel lifecycle, services_resetter, console commands and DI configuration tree. Laravel has no bundle registration, no kernel terminate event and no services_resetter, so there is no supported integration path without a rewrite. If you are on Laravel, evaluate Laravel Octane with RoadRunner, Swoole or FrankenPHP instead, and treat this repo as a reference architecture for consolidating php-fpm, nginx, cron and supervisord into one pure-PHP process tree.
- How do I install crazy-goat/workerman-bundle?
- Install it with Composer, for example composer require crazy-goat/workerman-bundle, and register the bundle in config/bundles.php if Symfony Flex does not do it for you. Your runtime must be PHP 8.2 or newer with the pcntl and posix extensions available, which means Unix-like hosts only. After that you start the server using the bundle's workerman:server commands rather than your usual web server.
- Which PHP and Symfony versions does it support?
- The bundle requires PHP ^8.2 and supports Symfony ^6.4, ^7.0 and ^8.0. It is intentionally lean and does not require a PSR-7 bridge, unlike the upstream luzrain/workerman-bundle which pulls in psr/http-factory, psr/http-message and symfony/psr-http-message-bridge. The CI matrix covers PHP 8.2 through 8.5 against Symfony 6.4 through 8.1.
- Can this bundle really replace php-fpm, nginx, cron and supervisord?
- That is its core design goal: one Workerman process tree provides an event-driven HTTP server, a SchedulerWorker for cron-like jobs and a SupervisorWorker for process supervision, all in pure PHP with no Go binaries or external daemons. It is a genuine four-component consolidation rather than a thin wrapper, but you should confirm TLS termination, log shipping and restart semantics before removing nginx and supervisord from your stack. TLS is configured via local_cert and local_pk, and binding ports below 1024 requires root or CAP_NET_BIND_SERVICE.
- How do I start, stop and inspect the Workerman server from the console?
- The bundle ships full lifecycle console commands under the workerman:server namespace, including start, stop, restart, reload, status and connections. These let you run and diagnose the server without writing your own process management scripts. Confirm the exact command names in the README for your version, since the fork rewrote several areas relative to upstream.
- Does request state leak between requests since the kernel stays alive?
- Correctness depends on Symfony's services_resetter firing when the kernel terminates, because the container and kernel persist across requests in the event loop. Any service that holds request-scoped state, such as identity data, entity managers, output buffers or static caches, will leak into subsequent requests unless it is covered by the resetter. This is the same class of failure seen with Laravel Octane, and the bundle delegates it to Symfony rather than solving it outright, so audit your services before production.
- Why does HTTPS or WSS fail in Kubernetes with this bundle?
- The bundle rejects symlinked certificate paths, and Kubernetes secret mounts are symlinks, so in-cluster TLS termination with local_cert and local_pk will fail. The practical answer is to terminate TLS at the ingress or load balancer and run Workerman over plain HTTP inside the cluster. Also note the runtime needs pcntl and posix, which rules out Windows and many restricted PaaS environments.
- Why is static_files.allowed_extensions ignored by StaticFilesMiddleware?
- When StaticFilesMiddleware is registered as a service, which is the recommended setup, the static_files.allowed_extensions option is silently ignored. That makes it a security-relevant config no-op that reviewers should verify against actual behaviour rather than trusting the configuration tree. The middleware itself does implement ETag, Last-Modified and 304 handling, dot-file blocking, path traversal protection, symlink control and an LRU realpath cache with TTL.
- Is it safe to make blocking database or HTTP calls inside a Workerman worker?
- No. A single synchronous database query, blocking HTTP client call or sleep() serializes the entire worker, so one slow dependency stalls every request that worker is handling. The bundle does not ship documented tooling for auditing blocking I/O, so you need to review your code paths yourself before migrating. This is the standard trade-off of any event-loop server, including Swoole and RoadRunner.
- Is crazy-goat/workerman-bundle production ready and actively maintained?
- Engineering quality signals are strong for its size: PHPStan level 8, Rector, PHP-CS-Fixer, an 80 percent coverage floor, unit, integration and e2e tests, and a 21-class exception hierarchy. Adoption evidence is weak, with very few stars and dependents and a single fork lineage off luzrain/workerman-bundle, so there are no production references or commercial support. The fork removed the PSR-7 pipeline and rewrote config loading, exceptions and process supervision, meaning upstream security fixes will not arrive automatically and someone must own merge triage.
Weaver
How can I help you explore Laravel packages today?