Wissensdatenbank

Composer is PHP's standard dependency manager, used by virtually every modern PHP framework (Laravel, Symfony) to install and manage third-party libraries.

Prerequisites

• PHP installed (see How to Install PHP on Ubuntu & Debian)
• PHP CLI and the php-cli extension

Step 1 — Download the Composer Installer

php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"

Step 2 — Verify the Installer's Integrity

Check the current expected hash from Composer's official download page, then verify:

HASH=$(curl -sS https://composer.github.io/installer.sig)
php -r "if (hash_file('sha384', 'composer-setup.php') === '$HASH') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"

Step 3 — Install Composer Globally

sudo php composer-setup.php --install-dir=/usr/local/bin --filename=composer

Step 4 — Clean Up

php -r "unlink('composer-setup.php');"

Step 5 — Verify Installation

composer --version

Using Composer in a Project

Initialize a new project:

composer init

Install a package:

composer require guzzlehttp/guzzle

Install all dependencies listed in an existing composer.json (e.g. after cloning a project):

composer install

Updating Dependencies

composer update

Installing for Production (Optimized, No Dev Dependencies)

composer install --no-dev --optimize-autoloader

--optimize-autoloader generates a more efficient class map, improving application performance in production.

Understanding composer.json and composer.lock

• composer.json — declares your project's dependencies and version constraints
• composer.lock — records the exact resolved versions installed; commit this to version control for reproducible installs across environments

Common Errors

"composer: command not found" — verify it was installed to a directory in your PATH (/usr/local/bin is standard and typically already included).

Memory limit errors during install:

COMPOSER_MEMORY_LIMIT=-1 composer install

"Your requirements could not be resolved" — a version conflict between required packages; review the specific conflicting constraints Composer reports.

Best Practices

• Always commit composer.lock to version control for consistent deployments
• Use --no-dev when installing on production servers
• Keep Composer itself updated: composer self-update

Related Articles

• How to Install PHP on Ubuntu & Debian
• How to Deploy a Laravel Application on a VPS
• How to Transfer Files To and From a VPS (SCP, SFTP & rsync)