I'm wondering if it's not just better to use plain Debian base images.

  FROM debian:... 
  RUN apt install php ...

This will take longer on a cold build cache, and pins the PHP version to the current Debian version. But Debian once again proved very reliable to patch in time.