Composer is the de facto dependency manager for PHP. It resolves and installs PHP library dependencies declared in a project’s composer.json manifest, downloads them from Packagist (the central PHP package repository), generates an optimised autoloader, and manages version constraints with semantic versioning. Composer transformed PHP development by enabling the modern package-based ecosystem — frameworks like Laravel, Symfony, Slim, and thousands of libraries are distributed exclusively through Composer. Composer also manages development-only dependencies (test frameworks, code analysers) separately from production dependencies, and generates a composer.lock file that pins exact installed versions for reproducible builds across development, staging, and production environments. This guide covers installing Composer 2 on RHEL 9 globally, initialising a project, installing packages, and optimising the autoloader for production.

Prerequisites

  • PHP 8.1 or newer installed on RHEL 9
  • PHP extensions: curl, json, mbstring, openssl, phar, zip (included in standard PHP installs)

Step 1 — Download and Verify Composer

# Download the Composer installer
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"

# Verify the installer hash (get the current hash from https://composer.github.io/pubkeys.html)
EXPECTED_HASH=$(curl -s https://composer.github.io/installer.sig)
ACTUAL_HASH=$(php -r "echo hash_file('sha384', 'composer-setup.php');")

if [ "$EXPECTED_HASH" = "$ACTUAL_HASH" ]; then
    echo "Installer verified"
else
    echo "HASH MISMATCH — do not proceed"
    exit 1
fi

Step 2 — Install Composer Globally

php composer-setup.php --install-dir=/usr/local/bin --filename=composer
rm composer-setup.php

# Verify installation
composer --version

# Make available for all users
chmod +x /usr/local/bin/composer

Step 3 — Initialise a New Project

mkdir /var/www/myproject && cd /var/www/myproject

# Interactive project initialisation
composer init

# Or non-interactive
composer init --name="mycompany/myproject" --description="My PHP project" --type=project --no-interaction

Step 4 — Install Dependencies

# Install a specific package (adds to require in composer.json)
composer require guzzlehttp/guzzle

# Install development-only dependencies
composer require --dev phpunit/phpunit vlucas/phpdotenv

# Install from existing composer.json (no dev dependencies in production)
composer install --no-dev --optimize-autoloader

# Update all dependencies to latest allowed versions
composer update

# Install specific version
composer require monolog/monolog:^3.0

Step 5 — Autoloading

# Add PSR-4 autoloading to composer.json
# "autoload": {
#     "psr-4": {
#         "App\": "src/"
#     }
# }

# Regenerate the autoloader after adding classes
composer dump-autoload

# Production-optimised autoloader (classmap — faster than PSR-4 file scan)
composer dump-autoload --optimize --no-dev
# Use the autoloader in your PHP scripts
get('https://api.example.com/data');
echo $response->getBody();

Step 6 — Update Composer Itself

composer self-update

# Pin to a specific channel
composer self-update --stable

Conclusion

Composer on RHEL 9 is the foundation of modern PHP development. The composer.lock file is critical — always commit it to version control so that composer install installs the exact same package versions on all environments. For production deployments, always run composer install --no-dev --optimize-autoloader to exclude development dependencies and generate a classmap-based autoloader that is significantly faster than the default PSR-4 autoloader.

Next steps: How to Install Laravel on RHEL 9, How to Install Symfony on RHEL 9, and How to Install PHP 8.3 on RHEL 9.