Composer is the de facto dependency manager for PHP, handling package installation, autoloading, and version constraints for modern PHP projects. In this tutorial, we will install Composer globally on a LAMP server, verify the installation, and walk through common workflows: starting a new project, installing dependencies, and updating packages. By the end, you will have Composer running and understand the core commands you will use daily.
Prerequisites
- A LAMP server running Ubuntu 20.04 or later, Debian, or CentOS
- PHP 7.2 or later installed
- Root or sudo access
- An active internet connection on the server
Step 1 — Update System Packages
Before installing Composer, refresh your package index to ensure you are pulling the latest versions. On Ubuntu or Debian, run:
sudo apt update
On CentOS or RHEL, use:
sudo yum update
This ensures any dependencies Composer needs are current.
Step 2 — Install Required PHP Extensions
Composer requires a few PHP extensions to function correctly. Install them now. On Ubuntu or Debian:
sudo apt install php-cli php-mbstring php-xml php-curl unzip -y
On CentOS or RHEL:
sudo yum install php-cli php-mbstring php-xml php-curl unzip -y
These packages provide the command-line PHP interpreter, multibyte string support, XML parsing, cURL for HTTPS downloads, and unzip for extracting archives. Verify PHP is installed and note the version:
php -v
You should see output showing PHP 7.2 or later.
Step 3 — Download the Composer Installer
Composer provides an official installer script. Download it to your home directory using PHP itself:
cd ~ php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
This one-liner fetches the installer and saves it as composer-setup.php. Next, verify the installer integrity by comparing its SHA-384 hash against the official signature. Retrieve the expected hash:
HASH="$(wget -q -O - https://composer.github.io/installer.sig)"
Now check the downloaded installer against that hash:
php -r "if (hash_file('sha384', 'composer-setup.php') === '$HASH') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
If you see Installer verified, proceed. If you see Installer corrupt, the download failed or was tampered with; do not continue until you get a verified installer.
Step 4 — Install Composer Globally
Run the installer to generate the Composer executable:
php composer-setup.php
This creates a file named composer.phar in your current directory. Move it to /usr/local/bin so it is available system-wide and rename it to composer:
sudo mv composer.phar /usr/local/bin/composer
Make it executable:
sudo chmod +x /usr/local/bin/composer
Clean up the installer script:
rm composer-setup.php
Composer is now installed globally. Any user can invoke it by typing composer.
Step 5 — Verify the Installation
Test that Composer is accessible and working. Run:
composer --version
You should see output like Composer version 2.6.5, confirming the installation. To see a list of available commands, type:
composer
This prints the help screen with all commands Composer supports. You are ready to manage PHP dependencies.
Step 6 — Create a New Project with Composer
Composer can scaffold a new project from a package template. For example, to create a new Laravel project, navigate to your web root and run:
cd /var/www/html composer create-project --prefer-dist laravel/laravel myapp
Composer will download Laravel and all its dependencies into a directory named myapp. The --prefer-dist flag tells Composer to download stable release archives rather than cloning git repositories, which is faster. This command initializes a complete Laravel application with a vendor directory, autoload files, and a composer.json manifest.
Step 7 — Install Dependencies for an Existing Project
If you clone an existing PHP project from a repository, it will contain a composer.json file listing required packages but not the vendor directory. Install all dependencies by navigating to the project root and running:
cd /var/www/html/myproject composer install
Composer reads composer.json and composer.lock (if present), then downloads every package and its dependencies into the vendor directory. The composer.lock file pins exact versions, ensuring consistent installs across environments. Always commit composer.lock to version control so your team and production servers use identical package versions.
Step 8 — Add, Update, and Remove Packages
To add a new package to your project, use the require command. For example, to install the Monolog logging library:
composer require monolog/monolog
Composer adds the package to composer.json, updates composer.lock, and downloads it to vendor. To update all packages to their latest allowed versions (respecting version constraints in composer.json), run:
composer update
To update a single package:
composer update monolog/monolog
To remove a package:
composer remove monolog/monolog
This uninstalls the package, removes it from composer.json, and updates composer.lock. Always run composer install in production and composer update only in development, so production stays locked to tested versions.
Step 9 — Use Autoloading
Composer generates a PSR-4 autoloader, so you never need to manually require class files. At the top of your PHP entry point (e.g., index.php), include the autoloader:
require __DIR__ . '/vendor/autoload.php';
Now any class from installed packages or your own src directory (if configured in composer.json) loads automatically when referenced. This is one of the biggest productivity wins Composer provides.
Wrap-up
You have installed Composer globally on your LAMP server, verified the installation, and practiced the core workflow: creating projects, installing dependencies, updating packages, and leveraging autoloading. Composer is now the foundation for managing PHP libraries in any project you build or maintain. Keep Composer itself up to date by running sudo composer self-update periodically, and always commit composer.lock to ensure reproducible builds across your team and servers.
