How to Install PHP Composer on Debian 11 (Step-by-Step)

Install PHP Composer on Debian 11 with a verified installer, then use it to add a PHP package and generate an autoloader. You can complete the setup and run the test project in about ten minutes on a fresh VPS.

Prerequisites

• A Debian GNU/Linux 11 (Bullseye) 64-bit VPS. Debian 11 is an older release, so use a supported Debian version for a new long-lived production server when possible.
• SSH access as root, or a normal account with sudo privileges and a writable home directory.
• At least 1 GB of RAM and 2 GB of free disk space for PHP, Composer’s cache, and the sample project.
• Outbound HTTPS access to getcomposer.org and Packagist. Composer does not require a domain or an inbound firewall port.
• A VPSLake Linux VPS if you need a Debian server with root access.

The commands below use sudo for a normal SSH account. If you are already root, remove sudo and run the commands from a non-production test directory where appropriate.

Step 1: Confirm Debian 11 and install PHP prerequisites

Check the release first so you do not mix Bullseye packages with repositories for a newer Debian version.

grep -E '^(PRETTY_NAME|VERSION_CODENAME)=' /etc/os-release
dpkg --print-architecture
sudo apt update
sudo apt install -y ca-certificates curl git php-cli php-curl php-zip unzip

php-cli provides the PHP command Composer runs, while php-curl, php-zip, and unzip let Composer download and extract packages efficiently. Debian 11 should report VERSION_CODENAME=bullseye; the usual VPS architectures are amd64 and arm64.

PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
VERSION_CODENAME=bullseye
amd64

Confirm the PHP version before continuing:

php --version

The Debian 11 repository normally provides PHP 7.4. Composer’s current stable line supports PHP 7.2.5 and newer, but a package you later choose can set a higher PHP requirement.

Step 2: Download and verify the Composer installer

The checksum comparison detects a changed or incomplete installer before PHP executes it.

Work in your home directory and fetch both the installer and its current SHA-384 signature from Composer’s official endpoints:

cd ~
curl -fsSLo composer-setup.php https://getcomposer.org/installer
EXPECTED_CHECKSUM="$(curl -fsSL https://composer.github.io/installer.sig)"
ACTUAL_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")"
if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then echo 'ERROR: Invalid Composer installer checksum'; rm -f composer-setup.php; exit 1; fi
echo 'Installer checksum verified'

You should see:

Installer checksum verified

If the check fails, do not run the installer. Remove the file, check DNS and HTTPS connectivity, and download it again.

Step 3: Install Composer globally

Place the Composer executable in /usr/local/bin so every user can call composer without changing their shell profile.

sudo php composer-setup.php --install-dir=/usr/local/bin --filename=composer
sudo chmod 0755 /usr/local/bin/composer
rm -f composer-setup.php

The installer prints a success message and the path it used. The exact Composer version changes over time, so do not hard-code the version from an example:

All settings correct for using Composer
Composer (version 2.x.y) successfully installed to: /usr/local/bin/composer

Composer’s official installation guide documents the installer and its PHP requirements. Verify the binary and run its diagnostics:

composer --version
composer diagnose

Expected output includes a Composer 2 version, your PHP version, and a final line similar to Everything is OK from the diagnostics. Warnings about optional tools are worth reviewing before a production deployment.

Step 4: Create a project as a non-root user

Composer can execute package-provided scripts, so keep project files owned by a normal deployment user instead of running dependency installation as root.

If your SSH session is currently root, switch to the account that will own the application before creating the project:

sudo -iu YOUR_DEPLOY_USER

Replace YOUR_DEPLOY_USER with an existing non-root account. Stay in that user’s shell for the remaining project commands.

Create a small project and require Monolog 2, which supports the PHP version normally shipped with Debian 11:

mkdir -p ~/composer-demo
cd ~/composer-demo
composer require monolog/monolog:^2.0

Composer creates composer.json, resolves compatible dependencies, writes the exact versions to composer.lock, and builds vendor/autoload.php. The output should finish with package installation and autoload generation messages.

Inspect the generated files:

find . -maxdepth 2 -type f -printf '%p\n' | sort

You should see at least these paths:

./composer.json
./composer.lock
./vendor/autoload.php

The composer.json file declares what the project needs; composer.lock records the resolved versions so another server can reproduce the same dependency set.

Step 5: Test Composer’s autoloader

Requiring vendor/autoload.php lets PHP find the Monolog classes without manually including files from each package.

Create a short script that writes one log entry to standard output:

cd ~/composer-demo
tee demo.php >/dev/null <<'PHP'
<?php

require __DIR__ . '/vendor/autoload.php';

use Monolog\Handler\StreamHandler;
use Monolog\Logger;

$log = new Logger('demo');
$log->pushHandler(new StreamHandler('php://stdout', Logger::INFO));
$log->info('Composer autoloading works on Debian 11.');
PHP
php demo.php

The timestamp will differ, but the message proves that PHP loaded the Composer-generated autoloader and the installed package:

[2026-10-08T12:00:00.000000+00:00] demo.INFO: Composer autoloading works on Debian 11. [] []

Verify Composer on Debian 11

Run these checks from the project directory to validate the executable, manifest, lock file, platform extensions, and PHP script:

cd ~/composer-demo
composer --version
composer validate --strict
composer check-platform-reqs
php demo.php

The validation command should report that composer.json is valid, platform checks should show successful requirements, and the last command should print the Monolog message. There is no web server or public port in this example, so no firewall rule is needed.

Troubleshooting

php: command not found or the installer rejects the PHP version

The PHP CLI package is missing, or the shell is using a different PHP binary than expected. Install Debian 11’s CLI package and check the active binary:

sudo apt update
sudo apt install -y php-cli
command -v php
php --version

Do not bypass Composer’s PHP requirement with --ignore-platform-reqs; install a supported PHP version or choose a package release compatible with Debian 11.

Invalid Composer installer checksum

The installer and signature did not come from the same download, or a proxy returned an altered response. Delete the file and retry after confirming that HTTPS and DNS work:

rm -f ~/composer-setup.php
curl -I https://getcomposer.org/installer
curl -I https://composer.github.io/installer.sig

If the endpoints are blocked, fix the VPS’s outbound network or proxy configuration rather than executing an unchecked installer.

Do not run Composer as root/super user

This is a safety warning because dependency scripts can run with the permissions of the account that launches Composer. Switch to the account that owns the application and run Composer there; use sudo only for system-wide installation in /usr/local/bin.

sudo -iu YOUR_DEPLOY_USER
cd /PATH/TO/YOUR_PROJECT
composer install

Replace the uppercase placeholders with an existing deployment account and project path. Avoid setting COMPOSER_ALLOW_SUPERUSER=1 unless you fully control every package and script being installed.

Your requirements could not be resolved or a missing ext-* extension

The selected package needs a PHP version or extension that is not available in the current environment. Read the first requirement named in the error, then check and install the matching Debian package:

php -m | sort
sudo apt install -y php-curl php-zip
composer check-platform-reqs

If the package itself requires PHP 8.x, do not force the install on Debian 11’s default PHP 7.4. Select an older compatible package constraint or plan an OS/PHP upgrade.

Hardening

• Keep composer.lock in application deployments so production receives the versions you reviewed, and run composer install rather than an unrestricted composer update there.
• Review dependency advisories with composer audit before releasing an application.
• Keep the Composer binary and PHP packages updated, but schedule the Debian 11 upgrade because the release is old for new production workloads.

FAQ

Does Composer work with PHP 7.4 on Debian 11?

Yes. Composer’s current stable requirements include PHP 7.2.5 and newer, so Debian 11’s usual PHP 7.4 package can run Composer. The individual library you install may still require PHP 8.x, so Composer will check each project’s platform requirements.

Should I use composer install or composer update?

Use composer update when you intentionally want Composer to resolve newer versions and rewrite composer.lock. Use composer install on a server or fresh checkout when you want the versions already recorded in the lock file.

Where does the global Composer command live?

This guide installs it at /usr/local/bin/composer, a standard system-wide executable path. Run command -v composer to confirm which copy your shell is using if another Composer installation is already present.

Do I need a domain or web server to use Composer?

No. Composer manages PHP project dependencies and only needs outbound HTTPS access to download packages. Add a domain, web server, and TLS later if the PHP application itself will serve public requests.