phpm: A Rust-powered 'pnpm' Layer Revolutionizing Composer Dependency Management

Host: Alex Chan Guest: Elena Rodriguez, Senior Systems Architect and Open Source Contributor Host: Hey everyone, welcome back to Allur. I’m your host, Alex Chan. If you’ve been in the PHP ecosystem for more than, I don’t know, five minutes, you’ve probably spent a significant chunk of your life staring at a terminal window waiting for `composer install` to finish. We love Composer—it basically saved PHP—but let’s be real: as our projects get bigger, and especially as we move toward monorepo structures, that `vendor` folder starts to feel a bit like a black hole for your disk space. I mean, how many copies of `monolog` or `symfony/console` do you actually need on one laptop? Host: Joining me today is someone who lives and breathes high-performance tooling. Elena Rodriguez is a Senior Systems Architect who has been bridging the gap between high-level application code and low-level systems programming for years. Elena, I am so glad you’re here. Welcome to Allur! Guest: Thanks so much for having me, Alex! It’s a pleasure to be here. I’ve been a listener for a while, so it’s fun to be on the other side of the mic. Host: Oh, that’s awesome to hear! So, Elena, let’s jump right in. I think every PHP dev has had that "aha" moment—or maybe a "yikes" moment—where they realize their `projects` folder is taking up 50 gigabytes, and 40 of those are just duplicate `vendor` files. Is that the itch that `phpm` is trying to scratch? Guest: (Laughs) Oh, absolutely. It’s that exact "yikes" moment. I actually call it "vendor bloat fatigue." Historically, Composer is very literal. If you have ten projects that all use the same version of a package, Composer downloads it ten times and saves it ten times in ten different folders. It’s simple, but it’s incredibly inefficient. Host: Okay, so for the non-systems-engineers out there, a symlink is basically like a shortcut or a pointer, right? Like, the project *thinks* the files are there, but they’re actually living in a central library somewhere else? Guest: Exactly! It’s like having a giant library in your house. Instead of buying a new copy of *The Great Gatsby* for every room you want to read it in, you just keep one copy on the shelf and put a little note in every room saying, "Hey, the book is over there on shelf three." Your project sees the files, PHP can execute them, but your SSD only has to hold the actual bits once. Host: That makes so much sense. Now, the big headline here is that `phpm` is built with Rust. We’re seeing Rust pop up everywhere lately—in JavaScript tooling, in the Linux kernel... why was Rust the move for a Composer wrapper? Why not just write this in PHP? Guest: That’s a great question. And look, I love PHP, but when you’re doing heavy-duty file system orchestration—scanning thousands of files, calculating hashes to see if they’ve changed, and managing symbolic links across a huge monorepo—you need raw speed and safety. Host: I imagine! Speaking of monorepos... I’ve worked on a few Laravel monorepos where we have maybe five or six different internal packages. Every time I run a build, I can go grab a coffee. How does `phpm` specifically help that struggle? Guest: Oh, monorepos are where `phpm` really flexes its muscles. In a traditional monorepo, you might have multiple sub-projects with overlapping dependencies. Composer can get really bogged down trying to resolve all that and copying files back and forth. Host: I love that. "Flow state" is the dream! But I have to ask—because I’m sure listeners are thinking this—is this a replacement for Composer? Do I have to delete my `composer.json` and learn a whole new syntax? Because that sounds... honestly, a little scary. Guest: (Laughs) No, no! Not at all. That’s the best part. It’s an *orchestrator*. You keep your `composer.json`, you keep your `composer.lock`. Those are the gold standards. `phpm` is just a wrapper. You literally just type `phpm install` instead of `composer install`. Host: So it’s like a turbocharger for the engine you already have. Guest: That is a perfect analogy. Actually, I’m going to steal that! Host: (Laughs) Please do! So, let’s talk real talk for a second. Nothing is perfect. What are the "gotchas"? I mean, I’ve had issues with symlinks before, especially in Docker environments or certain Windows setups. Have you run into those struggles with `phpm`? Guest: Oh, definitely. Symlinks are powerful, but they can be finicky. If you’re developing inside a Docker container but your code is on a Windows host, sometimes the file permissions or the way the symlinks are interpreted can get a bit... weird. Host: I can imagine. It’s like the first time you use a cloud drive—you’re like, "Where are my files?" then you realize it doesn't matter as long as they open. Guest: It’s actually super simple if you have Rust’s toolchain. You just run `cargo install phpm`. That’s it. If you don’t have Cargo, you can usually grab a binary from their GitHub releases. Once it’s in your path, you just navigate to your PHP project and run `phpm install`. Host: I’m definitely doing that this afternoon. My MacBook’s 256GB drive is screaming for help. Guest: Exactly! It’s an exciting time. We’re not throwing away the wisdom of the last 15 years of PHP; we’re just using modern tools like Rust to make it feel fresh and fast again. Host: Well, before we wrap up—any final thoughts or a place where people can follow your work or the `phpm` project? Guest: Definitely check out the `phpm` repository on GitHub. It’s open source, and the contributors are really active. And if you’re a PHP dev who’s been curious about Rust, looking at the source code for `phpm` is actually a great way to see how the two worlds can play together. You can find me on X and GitHub at @ERodriguezSystems. Host: Amazing. Elena, thank you so much for joining us and breaking this down. Guest: Thanks for having me, Alex! This was fun. Host: And thank you all for tuning into Allur. To recap: `phpm` is that Rust-powered layer that brings `pnpm`-style efficiency to your Composer workflow. If you’re tired of the "vendor" bloat and want to speed up your CI/CD or local environment, give it a look. We’ll have all the links in the show notes at allur-podcast.tech.