The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Install Composer on a Linux VPS by giving the server a compatible PHP command-line runtime, verifying Composer’s official installer with its current SHA-384 signature, and placing the resulting composer.phar in a directory on your PATH. A system-wide installation normally ends at /usr/local/bin/composer; a rootless installation can use ~/.local/bin/composer.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
After installation, run composer --version to verify the command, then run composer install from the directory containing your application’s composer.json. Keep composer.lock in deployments so every server receives the exact dependency versions that were tested.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →What Composer does on a Linux VPS
Composer is PHP’s command-line dependency manager. It is distributed as a PHAR archive, a PHP executable archive that the PHP CLI runtime can run directly. Composer reads a project’s composer.json, resolves the packages and version constraints declared there, downloads the packages, and creates a vendor directory containing the application’s dependencies.
The VPS therefore needs two separate things: a working PHP command-line interpreter and the Composer PHAR. Composer is not the same as a PHP extension, a web-server module, or a control-panel feature. Installing PHP for Apache or PHP-FPM does not always install the php command used by Composer, so check the CLI binary explicitly.
#1 Best Overall
The current Composer requirement is PHP 7.2.5 or newer, according to the Composer project’s current documentation. Composer 2.2 LTS remains available for legacy environments that need PHP 5.3.2 or newer. The latest release number changes over time; the official download page listed Composer v2.10.3 when this guide was prepared in 2026, so check the live Composer release information rather than hard-coding that number in automation.
Check the VPS before downloading Composer
Connect over SSH and inspect PHP
Connect to the VPS as the account that will run deployments, or as an administrative account when you are preparing a system-wide installation:
ssh [email protected]Check the PHP CLI version and confirm that the command is available:
php -vThe output should show PHP 7.2.5 or later for the current Composer line. If php -v reports an older release, either install a supported PHP CLI package or choose Composer 2.2 LTS for a genuinely legacy application. Do not assume that the PHP version used by your web site is the same one selected for SSH commands; verify the CLI binary that Composer will actually invoke.
Install the practical helper binaries
Composer can use archive tools and version-control clients while fetching packages. The Composer documentation lists helpers including unzip or 7z, gzip, tar, unrar, xz, and clients for Git, Mercurial, Fossil, Perforce, and Subversion. In a typical PHP application, unzip (or 7z) and Git are the useful minimum.
Package names and repository versions vary by distribution and release. The following is an Ubuntu/Debian example, not a universal command:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minutesudo apt update
sudo apt install php-cli unzip gitOn another distribution, use that distribution’s package manager and package names. If you do not have sudo, ask the VPS administrator to install the packages or use a user-owned PHP and toolchain that meets the requirements.
Check where a global command can live
A system-wide Composer command is normally placed in /usr/local/bin, which is commonly on every user’s PATH. A rootless installation should use a directory owned by your account, such as ~/.local/bin. Inspect your current path before choosing a destination:
Rank #2
printf '%sn' "$PATH"
ls -ld /usr/local/bin "$HOME/.local/bin" 2>/dev/nullCreate the per-user directory if it does not exist:
mkdir -p "$HOME/.local/bin"If ~/.local/bin is not already in PATH, add it to the shell startup file used by your account, then start a new shell or reload that file. For a Bourne-compatible shell, the setting is:
export PATH="$HOME/.local/bin:$PATH"Persist that line in ~/.profile or the appropriate startup file for your shell. A file can be installed correctly and still produce “command not found” until the directory containing it is on PATH.
Download and verify the official installer
Run the installer from a temporary working directory rather than from an application directory. The installer is published by the Composer project at https://getcomposer.org/installer. The project publishes the current SHA-384 value at https://composer.github.io/installer.sig.
mkdir -p "$HOME/tmp/composer-install"
cd "$HOME/tmp/composer-install"Download the installer with PHP, calculate its SHA-384 hash, compare that hash with the current published signature, and stop if they differ:
EXPECTED_CHECKSUM="$(php -r 'copy("https://composer.github.io/installer.sig", "php://stdout");')"
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
ACTUAL_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")"
if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
echo 'ERROR: Invalid installer checksum' >&2
rm -f composer-setup.php
exit 1
fi
php composer-setup.php
rm -f composer-setup.phpThe checksum test must happen before the installer is executed. A mismatch can indicate a truncated download, a proxy or caching problem, or a changed installer. Do not bypass the check by running an installer whose hash does not match. Remove the downloaded installer after a successful run as well; the generated composer.phar is the file you need to keep.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThe installer checks several PHP settings and then downloads composer.phar into the current working directory. If you want to test its environment checks without performing a normal installation, Composer documents this diagnostic command:
curl -sS https://getcomposer.org/installer | php -- --checkUse the current signature endpoint in scripts instead of copying a checksum once and leaving it unchanged. Composer’s programmatic-install guidance notes that the checksum changes whenever installer code changes. A maintained script should fetch the signature, compare it to the downloaded file, delete the file on failure, and exit non-zero when the values differ.
Choose an installation location
There are two independent decisions: whether the command is available to every user or only one account, and whether the destination requires administrative permissions. The PHAR itself is the same kind of Composer executable in either case.
| Placement | Typical destination | Who can run it | Permission model |
|---|---|---|---|
| System-wide | /usr/local/bin/composer |
All users whose PATH includes the directory |
Usually requires sudo or root access |
| Per-user | ~/.local/bin/composer |
The owning user, and only other users granted access | No root access; the directory and file are user-owned |
| Project-local | A directory inside the application or a temporary tools directory | Only commands that reference that path | Isolates the project but requires an explicit path or wrapper |
Install Composer globally for all users
Install into a controlled directory
From the temporary directory containing the downloaded installer, you can tell the installer exactly where to write the executable:
mkdir -p /tmp/composer-bin
php composer-setup.php --install-dir=/tmp/composer-bin --filename=composerThis produces /tmp/composer-bin/composer. A controlled directory is useful when you want to inspect the file before moving it into a protected system path. If you already have appropriate permissions, you can instead pass a system destination directly:
sudo php composer-setup.php --install-dir=/usr/local/bin --filename=composerThe Composer installer may report that it created composer.phar; the filename option gives the command the shorter name composer. If you used the default installer destination in your temporary directory, move and rename the result yourself:
sudo mv composer.phar /usr/local/bin/composer
sudo chmod 0755 /usr/local/bin/composerWhen installing from /tmp/composer-bin, the equivalent move is:
sudo mv /tmp/composer-bin/composer /usr/local/bin/composer
sudo chmod 0755 /usr/local/bin/composerUse one method or the other, not both. The important properties are that the final file is executable and that its directory is on the users’ PATH.
Recommended Free Tools
Verify the system-wide command
command -v composer
composer --versioncommand -v should print /usr/local/bin/composer when that is the selected destination. composer --version should print the installed Composer version and the PHP runtime it detected. If the shell still cannot find the command, open a new SSH session or inspect PATH before reinstalling.
Install Composer without root access
A shared VPS, managed account, or locked-down production server may not permit writing to /usr/local/bin. Install the PHAR in a directory owned by your account instead:
Rank #4
mkdir -p "$HOME/.local/bin"
php composer-setup.php --install-dir="$HOME/.local/bin" --filename=composer
chmod 0755 "$HOME/.local/bin/composer"Ensure the directory is in your path for the current session:
export PATH="$HOME/.local/bin:$PATH"
composer --versionPersist the export in your shell profile so future SSH sessions use the same command. A rootless installation is usually preferable when one deployment account is the only account that needs Composer: it avoids changing system files and prevents permission conflicts with other users. The trade-off is that other accounts will not automatically see the command, and every account that needs it must configure its own path.
Run Composer in the PHP project
Install the declared dependencies
Change to the directory that contains the application’s composer.json:
cd /var/www/example-app
composer installComposer reads the project definition and installs packages into vendor. The command does not require a web request and should normally be run by the deployment account in the release directory, not by a browser-facing PHP process.
Understand the lock-file decision
If composer.lock is present in the current directory, composer install uses the exact versions recorded there instead of resolving a new set. This is the behavior that makes deployments reproducible. If no lock file exists, Composer resolves versions that satisfy composer.json and creates a new lock file.
Free tools Windows power users keep installed
One-click scans. No signup required.
For an application, commit composer.lock to version control and deploy it with composer.json. Do not delete the lock file merely to make an installation proceed, and do not casually regenerate it on a production server: doing so can introduce newer transitive dependencies than the ones tested by the team. Update dependencies deliberately in a controlled development environment, review the resulting lock-file changes, and then deploy the committed result.
Confirm the vendor tree
After a successful install, check that the dependency directory exists and that the application’s bootstrap code points to it. A common PHP bootstrap statement is:
require __DIR__ . '/vendor/autoload.php';The exact bootstrap path belongs to the application, but Composer’s generated autoloader is normally under vendor/autoload.php. If the command succeeds but the application reports missing classes, verify that the web process is using the same release directory and that the deployment did not omit vendor or the lock file.
Latest Composer or Composer 2.2 LTS?
Choose the Composer line according to the PHP CLI version that must run it, not according to the PHP version you hope to install later.
| Choice | PHP baseline | When it fits | Important qualification |
|---|---|---|---|
| Current Composer line | PHP 7.2.5 or newer | New applications and servers with a supported PHP CLI | The release number and installer checksum change; use the live official installer and signature |
| Composer 2.2 LTS | PHP 5.3.2 or newer | Legacy applications that cannot yet move to a modern PHP runtime | It is a compatibility option for older PHP environments, not a reason to leave a maintainable application on obsolete PHP indefinitely |
Check the project’s platform requirements as well. A Composer version can run successfully while one of the application’s packages requires a newer PHP release. Conversely, upgrading PHP on the VPS can expose extensions or configuration differences that are unrelated to Composer itself.
Troubleshoot common installation failures
php: command not found
The VPS has no PHP CLI binary in the current path. Install the distribution’s PHP CLI package, then start a new shell and rerun php -v. Installing only PHP-FPM or a web-server module does not guarantee that the CLI command exists.
PHP is below the required version
Current Composer requires PHP 7.2.5 or newer. Upgrade the CLI runtime through the VPS distribution’s supported repositories, making sure the command-line binary and the web runtime are not accidentally pointing at different major versions. If the application must remain on PHP 5.3.2 or another legacy release, use the Composer 2.2 LTS line and plan a separate PHP upgrade.
The installer checksum does not match
Stop immediately and remove the installer. Fetch both files again from the official endpoints, check for a proxy that is replacing downloads, and verify that the VPS clock and TLS setup are functioning. Never execute a mismatched installer just because the download otherwise looks complete. A long-lived automation script should retrieve the current signature each time rather than embedding a stale value.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Permission denied while writing the destination
/usr/local/bin is normally administrator-owned. Either rerun the installer or move operation with sudo, or switch to ~/.local/bin and keep the installation rootless. Do not make a protected system directory world-writable to avoid one failed command.
composer: command not found after installation
Check the actual file location with ls -l /usr/local/bin/composer or ls -l "$HOME/.local/bin/composer", confirm executable permissions, and print PATH. Reload the shell profile or reconnect over SSH. If another Composer binary appears first in PATH, use command -v composer to identify which one is being executed.
Archive or VCS errors during composer install
Install the missing helper rather than rerunning Composer indefinitely. unzip or 7z handles common package archives; Git and other VCS clients are needed when a dependency is fetched from its repository. The package manager and exact package names depend on the VPS distribution.
The lock file appears to be ignored
Run the command from the directory that actually contains both composer.json and composer.lock. A lock file in a parent directory does not substitute for the file in the project’s current directory. Confirm that the deployment copied the lock file and that the command is not being run from a different release or temporary directory.
Use a repeatable deployment sequence
A practical deployment routine separates one-time server preparation from every-release work:
- Install and verify the PHP CLI and required archive or VCS helpers on the VPS.
- Install Composer system-wide or in the deployment user’s
~/.local/bin. - Run
composer --versionas the same user that will deploy the application. - Check out the release containing both
composer.jsonand the committedcomposer.lock. - Run
composer installfrom that release directory so the exact locked versions populatevendor. - Point the web server or process manager at the completed release only after the dependency installation succeeds.
This arrangement keeps the server’s Composer executable independent from the application’s dependency versions. The executable can be maintained in the chosen PATH directory, while each release receives the versions pinned by its own lock file.
Quick Recap
Security and maintenance checklist
- Download the installer from the official Composer endpoint over HTTPS.
- Fetch the current SHA-384 signature from https://composer.github.io/installer.sig and compare it before execution.
- Delete
composer-setup.phpafter a successful install and on checksum failure. - Keep Composer and PHP maintained through the VPS distribution’s normal update process, while checking compatibility with the application.
- Keep
composer.lockunder version control for deployable applications. - Run Composer with the least privilege needed; a deployment user rarely needs root access to install packages in its own release directory.
- Do not copy a one-time installer checksum into an automation script without a strategy for refreshing it when the installer changes.
Quick command reference
# Inspect the CLI runtime
php -v
# Download, verify, run, and remove the installer
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
EXPECTED_CHECKSUM="$(php -r 'copy("https://composer.github.io/installer.sig", "php://stdout");')"
ACTUAL_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")"
if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then rm -f composer-setup.php; exit 1; fi
php composer-setup.php
rm -f composer-setup.php
# System-wide placement
sudo mv composer.phar /usr/local/bin/composer
sudo chmod 0755 /usr/local/bin/composer
# Rootless placement (use instead of the system-wide move)
mkdir -p "$HOME/.local/bin"
mv composer.phar "$HOME/.local/bin/composer"
chmod 0755 "$HOME/.local/bin/composer"
export PATH="$HOME/.local/bin:$PATH"
# Verify and install project dependencies
composer --version
cd /var/www/example-app
composer installProduct prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
