Contao: a Symfony-based open source CMS

What this project is

Contao describes itself as a powerful open source CMS for creating professional websites and scalable web applications. The repository topics list cms, contao, monorepo, php and symfony. In this guide Contao is a CMS product: a content platform you install, configure and extend. It is not a PHP runtime, not a web server, and not an async library. It runs on top of PHP and relies on Symfony, in the same way other CMS products run on a language runtime.

It helps to keep the layers separate. PHP core is the language and its engine. A framework component, such as a Symfony package, is a reusable library. A CMS product, such as Contao, is a complete application with an administration area and content features built from such parts. Contao should also not be confused with Drupal CMS or any other CMS, and nothing in the supplied source compares them.

Architecture

The source describes the GitHub repository as a monorepo used to develop the Contao bundles. It is automatically split into separate packages. The listed bundles are ApiBundle, CalendarBundle, CommentsBundle, CoreBundle, FaqBundle, ListingBundle, MakerBundle, ManagerBundle, McpBundle, NewsBundle, NewsletterBundle and OauthServerBundle. The folder listing also shows a loupe-bridge directory, a test-case directory, end-to-end tests, and files such as UPGRADE.md, DEPRECATED.md, LIMITATIONS.md and VERSIONING.md.

The important warning in the README is direct: do not use contao/contao in production, and use the split packages instead. The monorepo exists for pull requests and issue reports. The source does not explain what each bundle does internally, so this guide does not either.

Execution and content model

The source packet does not describe Contao's request handling, its content data model, its templating, or whether it supports long-running workers. Those details are unknown here. Because Contao is described as Symfony-based, a classic request lifetime is the conventional assumption for PHP web applications, but treat that as an assumption to verify in the official documentation.

A classic request lifetime means PHP starts fresh state for each request and discards it afterward. A persistent worker keeps the process and its memory alive across many requests. That is faster to boot but riskier, because state can leak: static properties, singletons, service instances, caches, open database connections, user or session data, and request-scoped objects may survive into the next request. A worker setup therefore needs explicit cleanup, such as resetting services between requests, clearing per-request data, and recycling the process after a set amount of work. The supplied source makes no claim that Contao supports persistent workers, so do not assume it does. Swoole and Open Swoole are separate projects, and neither is part of Contao.

Practical use cases

The source supports these uses:

• Building professional websites and scalable web applications on an open source CMS.
• Contributing fixes or features to Contao by testing changes inside a running application.
• Studying a Symfony-based CMS organized as a bundle monorepo.

It does not give benchmarks, hosting recommendations or feature comparisons, so none are made here.

Installation approach

The README documents a contributor workflow built on the Contao Managed Edition. You create a project with Composer using the no-install option, giving a target directory and a branch. Use dev-main for a new feature, or the LTS branch for a bug fix. The README says the LTS branch is currently 5.3.x-dev, which is a statement from the page as checked and may have changed since.

Next, you edit the require section of the generated composer.json so it asks for PHP ^8.4 and contao/contao at the same branch. Then you run composer update. Composer clones the Git repository into vendor/contao/contao, and you finish by running vendor/bin/contao-setup. Changes made in that folder are tracked by Git, so you can submit a pull request from your application.

The PHP ^8.4 constraint appears in the README's development instructions, which fits this learning track on PHP 8.4. The source gives no PHP 8.5 statement, so Contao's PHP 8.5 compatibility is unknown. The source also gives no standalone production install command. For production, consult the official Contao documentation, and use the split packages rather than the monorepo.

Testing and tooling

The README lists Composer scripts for rector, ecs, service-linter, unit tests, functional tests, e2e tests, phpstan and depcheck. Functional tests need a database named contao_test. Building assets needs Node.js 18.12 or newer. The end-to-end suite needs Docker for its default MariaDB database, Playwright browsers, and Node.js 20 or newer for browser tests.

Strengths

• Open source under LGPL-3.0, per the repository.
• Modular bundle structure, with separate packages for areas such as news, calendar, FAQ, comments and newsletters.
• A documented contributor path, including a Managed Edition workflow and an isolated end-to-end test suite.
• A documented security policy, contributing guide and versioning file in the repository.

Limitations and unknowns

• The repository itself is not for production use.
• Lifecycle and support windows are not stated in the packet, so the lifecycle is recorded as unknown. Check VERSIONING.md and the official site.
• Unknown from the source: web server configuration, minimum production PHP version, supported databases for production, hosting requirements, performance, and the persistent worker story.
• Runtime-style PHP examples need Composer and network access and are not browser exercises.

Deployment

The source gives no deployment procedure. At a minimum, plan on the split packages, a database, and a web server whose configuration comes from the official Contao documentation. Never expose development services publicly. If you add FastCGI or any other backend service, keep it on a private interface, and bind any development port to 127.0.0.1.

Links

The only official source supplied is the Contao GitHub repository. Use it for the README, issues, security policy, LIMITATIONS.md, UPGRADE.md, DEPRECATED.md and VERSIONING.md.

{
  "require": {
    "php": "^8.4",
    "contao/contao": "dev-main"
  }
}

Merge the require section from composer-require-fragment.json into the composer.json generated by create-project.
Do not replace the whole generated composer.json with the fragment.
Use dev-main for new features. For bug fixes, the README says to use the LTS branch (stated as 5.3.x-dev at the time of checking) in both the create-project command and the require entry.
The contao/contao monorepo is for development only. Do not use it in production.
Web server and database configuration are not covered by the supplied source: unknown.

composer create-project --no-install contao/managed-edition contao-dev dev-main
cd contao-dev
composer update
vendor/bin/contao-setup