Why not use PHP hardened (distroless) images as a base for the final image?
Why build your own images at all? I'm not sure I understood what advantage that gives you.
Harbor looks interesting but that install procedure is ridiculous. Why would I run an installer script just to pull docker images, just give me a compose file ffs. The only way I'd ever consider it is inside an LXC container or a VM.
Also, it sounds like they've never heard of a reverse proxy and don't know you can do TLS that way? That does not inspire confidence.