Composer, PHP's dependency manager, is used via your SSH access. The only thing to know: you must call it with the PHP binary of the desired version, and not with the default php command.
Prerequisites: SSH access must be enabled for your hosting. See Connect to your account via SSH.
The PHP binary path
Our servers run on CloudLinux, where each PHP version has its own executable:
/opt/alt/php<version>/usr/bin/php
The version number is written without a dot. For PHP 8.5:
/opt/alt/php85/usr/bin/php --version
Preferably use the same version as the one selected for your site in Hosting management → Web technologies → PHP configuration: this will prevent a dependency installed via the command line from being incompatible with the PHP that actually executes the site.
Install Composer
Go to the directory of the relevant site, then download the installer:
cd ~/exemple.ch
wget https://getcomposer.org/installer -O composer-setup.php
/opt/alt/php85/usr/bin/php -d allow_url_fopen=On composer-setup.php
rm composer-setup.php
The -d allow_url_fopen=On option is required: the installer downloads composer.phar and this directive is disabled by default on our servers.
You get a composer.phar file in the current directory.
Use Composer
/opt/alt/php85/usr/bin/php -d allow_url_fopen=On composer.phar install
/opt/alt/php85/usr/bin/php -d allow_url_fopen=On composer.phar require monvendor/monpaquet
/opt/alt/php85/usr/bin/php -d allow_url_fopen=On composer.phar update
Shorten the command
To avoid retyping the full path, define an alias in your session:
alias composer='/opt/alt/php85/usr/bin/php -d allow_url_fopen=On ~/exemple.ch/composer.phar'
The alias disappears upon disconnection. To keep it, add the same line to the end of your ~/.bashrc file.
Common issues
| Message |
Cause |
Solution |
allow_url_fopen must be enabled |
The -d allow_url_fopen=On option was forgotten |
Add it to the command |
requires php ^8.x but your php version is ... |
Composer was launched with a different PHP version than the one expected by the project |
Call the binary of the correct version, using the path above |
Allowed memory size exhausted |
A large dependency resolution |
Prefix the command with COMPOSER_MEMORY_LIMIT=-1, or use the Boost memory button in the PHP Configuration |
Do not leave composer.phar, composer.json and the vendor/ folder accessible from the web. If your site root is the domain directory itself, protect them — or better, point the site root to the public subdirectory of your application, via Website → Apache Configuration → Domain base directory.