Opened 3 years ago

Last modified 19 months ago

#11601 assigned Feature/Enhancement Request

Some ideas for installing Drupal 8

Reported by: Owned by: Jamie McClelland
Priority: Low Component: Tech
Keywords: web-app-security Cc:
Sensitive: no

Description (last modified by

I tested some ideas about installing Drupal 8 using Composer and allowing to share files between websites, like it is done for Drupal 7, because I suspect it may help save buffer memory.

Here are the main steps:

  1. Download and install the files with Composer
$ composer create-project "drupal-composer/drupal-project:8.x-dev" <directory>
  1. Prepearing for hard linking core directory
$ rm -r <directory>/web/core
  1. Hard linking
<directory>/web$ cp --link --recursive /usr/local/share/drupal-8/core .
  • At the moment this does not work because both ends are not on the same disk, but it can be "simulated" in another directory
  • For security updates, steps 2. and 3. have to be repeated on a regular basis, but it seems to be very fast.
  • Regular Composer update is also possible, but now it does not allow to make the links.
  1. Usual Drush install
drush site-install --db-url=mysql://...:...@localhost/...

Modification to servers which may help

  • Moving the /usr/local/share repository to the same disk.
  • Changing the naming scheme of the repository to follow more the way composer is working. Directories could be .../share/url/<URL>/<version>/<type> where <URL> would be determined by:
    .../share/url$ git clone --branch 8.0.5 ""

Here the URL is given by the git URL available on

  • .../share/url/<URL>/... could also be replaced by .../share/vendor/<vendor>/<package>/... it would be more Composer friendly, but I am not 100% sure <vendor>/<package> would always be unique.
  • This directory scheme would leave some space to put a composer.json file describing the directory (version and path) in .../share/url/
  • The <type> is the Composer type of the repository or dist. It can be one of path, vcs, git, svn, hg, zip, artifact, (composer does not work yet on local filesystems, but see Satis).

Documentation includes:

Other related tickets include:

Change History (9)

comment:1 Changed 3 years ago by JaimeV

Owner: set to Jamie McClelland
Status: newassigned

Interesting, thanks for sharing this. Let's get jamie's input here since he was worked on this is in the past.

comment:2 Changed 3 years ago by

Description: modified (diff)

comment:3 Changed 3 years ago by

Description: modified (diff)

comment:4 Changed 3 years ago by

Satis may help to maintain a local mirror of repositories, most of them can soft linked automatically by Composer. It is just packages with a special design (like drupal 8) which do not works with soft links.

comment:5 Changed 3 years ago by

Install php CLI utilities globally This could allow to install composer globally and could help to install Drupal with composer.

Last edited 3 years ago by (previous) (diff)

comment:6 Changed 3 years ago by

Local packages can be symlinked by Composer

comment:7 Changed 3 years ago by Jamie McClelland

Thanks for all of your thinking on this ticket. I've carefully reviewed it and I think they are solid ideas.

However, I'm starting to think that the centrally-linked approach in general is going to be harder and harder to maintain. Lots of members don't even realize that they can install Drupal in the control panel and will install it manually. Drupal itself will continue to change in ways that may break the assumptions we make with the central install.

All of this is leading me toward the approach of: download a separate and independent drupal install in each web directory and then resolve #11405 by auto-upgrading each site on a cron job.

Given the valid concerns raised in #11405 about auto-upgrades, I think we would have to use caution. With Drupal, I would default to auto updating core, and give users the option to also auto update third party modules and themes.

Even this approach has complications though. How do you upgrade a Drupal site? Can we safely run drush up or do we have to check for a composer.json file and upgrade via composer??

comment:8 Changed 3 years ago by


Even this approach has complications though. How do you upgrade a Drupal site? Can we safely run drush up or do we have to check for a composer.json file and upgrade via composer??

  • Using Composer in a Drupal project
  • I realize that Drupal composer install is going into core. So I will wait for it.
  • There is a security which disable Drush on composer install, but it needs a recent Drush. I use Drush from composer stable release and it works very well. Debian 8 Jessie drush is orphaned and to old for the security to work.
  • I realize that nowadays composer can run out of memory, apparently when used for a lot of modules (or conditions between them).
  • Even in my Drush managed Drupal install, I user composer, for dowloading Drush and a few other libraries.

comment:9 Changed 19 months ago by Jamie McClelland

Keywords: web-app-security added

Please login to add comments to this ticket.

Note: See TracTickets for help on using tickets.