Repository navigation
Allow the UID/GID to be changed #359
Description
Activity
I see in the instructions that you can do the following:
docker exec --user www-data CONTAINER_ID php occ
But how do you specify the user in the docker-compose.yml file?- changed the title
[-]How to change UID/GID in NextCloud container?[/-][+]Allow the UID/GID to be changed[/+]on Jun 7, 2018 There is currently no way to change the UID and GID. I think this is supported by the parent image. But the entrypoint script does not properly support it.
this should be possible. this works for me:
docker run --user 1234 -p 8080:80 --sysctl net.ipv4.ip_unprivileged_port_start=0 nextcloudReacted by Bitrevo, marianrh, Martin Rasmusson, jtagcat and PRIHLOPReacted by Quinn Bast@tilosp Thanks for your comment. Unfortunately I don't seem able to reproduce this.
My host system has a user with the ID
1000. When I run the following command, the files created in the/storage/docker/nextcloud/configbelong towww-data root.docker run \ -d \ --user 1000 \ --name=nextcloud \ --network=private-network \ -e NEXTCLOUD_DATA_DIR=/data \ -v /storage/docker/nextcloud/config:/var/www/html \ -v /storage/docker/nextcloud/data:/data \ nextcloudAre you sure this worked on your end?
@caillou I'm using the suggestion by @tilosp via docker-compose. I can confirm that files uploaded to Nextcloud get the UID/GID as set in
docker-compose.yaml. However, I converted an existing installation to this and didn't try upgrading the container to a newer version yet, so I cannot say anything about what permissions Nextcloud's own files will receive then.when I use
user: "${uid}:${guid}"field in a compose file with docker swarm (sudo docker stack deploy --compose-file...) I get permissions errors:Initializing nextcloud 15.0.6.1 ... rsync: mkstemp "/var/www/html/config/.htaccess.oCsWlP" failed: Permission denied (13) rsync: mkstemp "/var/www/html/config/.apache-pretty-urls.config.php.1OjgZw" failed: Permission denied (13) rsync: mkstemp "/var/www/html/config/.apcu.config.php.qFhACe" failed: Permission denied (13) rsync: mkstemp "/var/www/html/config/.apps.config.php.lijUfW" failed: Permission denied (13) rsync: mkstemp "/var/www/html/config/.autoconfig.php.EgpeTD" failed: Permission denied (13) rsync: mkstemp "/var/www/html/config/.config.sample.php.toAywl" failed: Permission denied (13) rsync: mkstemp "/var/www/html/config/.redis.config.php.ahOV92" failed: Permission denied (13) rsync error: some files/attrs were not transferred (see previous errors) (code 23) at main.c(1196) [sender=3.1.2]running
image: nextcloud:apachecontainer as well as a separate one with the .cron entry-point, volumes are just named volumes created on up.@mabushey Sure, this is the docker-compose file I'm using:
version: "3.3" services: nextcloud: image: nextcloud:15.0.6-apache dns: - <...> - <...> user: 5003:5003 sysctls: - net.ipv4.ip_unprivileged_port_start=0 # Allow an unprivileged user to listen on any port (https://github.com/nextcloud/docker/issues/359) ports: - 8092:80 volumes: - /applications/nextcloud:/var/www/html networks: default: driver: bridge ipam: driver: default config: - subnet: <...>Of course, the directory on the host system has to have the proper owner set.
Reacted by 云与原Thanks @marianrh. I added this to the nextcloud config:
user: 1000:1000 sysctls: - net.ipv4.ip_unprivileged_port_start=0(BTW the comment on the sysctls entry just refers to this thread)
Removing the config directory and runningdocker-compose up -dresults in a config dir (mapped - "/home/michael/docker/nextcloud:/var/www/html") that'sroot:rootinstead ofwww-data:root. I'm looking formichael:michael(1000:1000). I'm running MySQL outside of docker on the same box with the jwilder & lets encrypt companion Nginx proxy.Does the dns / networks have some part in this?
Reacted by Julio Montoya and Alaa AliI was able to set
mapall=michaelto the ZFS share property on the FreeBSD NFS server and it seems to be working just fine with Nextcloud running as www-data.Hi there!
For those who are using Swarm like me,
sysctlsoption is not supported... Keeping in mind that the only thing that crashes when starting up using another username is apache2 process, I've mapped the following volumes:volumes: - nextcloud_apache_ports:/etc/apache2/ports.conf - nextcloud_apache_default:/etc/apache2/sites-enabled/000-default.confAnd, of course, local files have been changed to use port 20080 instead of port 80.
Reacted by maxemoose, vmService, Rysle, Jacob Block, PRIHLOP and Julius Bullinger12 remaining items
I had to build from the official image to be able to change the UID and GID. My normal user's id is
1000, and this is what my Dockerfile looks likeFROM nextcloud:23.0.5-fpm-alpine RUN apk --no-cache add shadow && \ groupmod --gid 1001 www-data && \ usermod --uid 1000 www-data
After that I call this file to build my image:
app: build: context: ./ dockerfile: Dockerfile restart: always
I hope it helps someone :)
Reacted by Steve Fatula, Ivan Pedrazas, Anna Gerasimova, Alexander, Kyle Spearrin, Tobias, ldgabet, Scott Hansen, Kevin, mibarubaru and 5 more- added 2 commits that reference this issue
on Sep 1, 2022 - added a commit that references this issue
on Sep 6, 2022 - added a commit that references this issue
on May 10, 2024 It's insane that this has been closed and has not been addressed after 6 years. Setting the user only when you shell or via docker
useris not enough of a solution. We need to be able to set the user id. Most other apps supportUIDandGIDfor setting the user and group ID.Reacted by qdii, pj, gianluca.dev, perahoky and Ing. Lukas JosaiHello,
i switched to linuxservers/nextcloud image to get uid/gid support. I'm running nextcloud in a docker container on a synology nas where uid/gid on the host are different from the IDs in a container. This results in permissions conflicts, not just on external storage but also on config files and so on. Linuxservers Docker Image Provider solves this problem.
Reacted by Quinn BastSetting the user only when you shell or via docker
useris not enough of a solution. We need to be able to set the user id.The
userparameter is not just for the command-line. It is what you specify in Compose too.Most other apps support UID and GID for setting the user and group ID.
Those apps added support in that way before
userwas the convention. Even those are switching touser(see the box at the top of this page):https://docs.linuxserver.io/general/understanding-puid-and-pgid/
Linuxservers Docker Image Provider solves this problem.
Can you elaborate what you tried with the image here that didn't work?
This is well supported.
As a run command:
docker run -d \ --name nextcloud \ --user 1000:1000 \ -p 8080:80 \ -v /path/to/data:/var/www/html/data \ nextcloudAs a Compose file:
services: nextcloud: image: nextcloud container_name: nextcloud user: "1000:1000" restart: always ports: - "8080:80" volumes: - /path/to/data:/var/www/html/dataReacted by Daniel Langbein@joshtrichards Thanks for confirming
user:is supported. It works in your example, but fails whenREDIS_HOSTis set. The entrypoint tries to writeredis-session.inito/usr/local/etc/php/conf.d/, which isdrwxr-xr-x root root— the non-root user can't create files there.Minimal repro:
services: nextcloud: image: nextcloud:32.0.8-apache user: "1000:1000" environment: - NEXTCLOUD_ADMIN_USER=admin - NEXTCLOUD_ADMIN_PASSWORD=admin - REDIS_HOST=redis volumes: - ./data:/var/www/html/data redis: image: valkey/valkey:9
Error on startup:
=> Configuring PHP session handler... ==> Using Redis as PHP session handler... /entrypoint.sh: 121: cannot create /usr/local/etc/php/conf.d/redis-session.ini: Permission deniedIs there a supported way to use
user:together with Redis?Thanks, that issue didn't come up in my search. I can test your solution if there is a prebuilt image available, or if it's easy to build one myself. @joshtrichards
I'm more worried about other things that might be breaking in the background when using
user: 1000:1000(or any other uid and gid). We can just not use redis and the container will start seemingly fine, but will we run into trouble somewhere later in the process?Edit
One error that might prove my point (from the docker logs):nextcloud_new | Fontconfig error: No writable cache directories nextcloud_new | Fontconfig error: No writable cache directories nextcloud_new | Fontconfig error: No writable cache directories nextcloud_new | Fontconfig error: No writable cache directoriesI will mention, that using the built-in docker flags for user are not possible in Kubernetes without setting a custom security context, but in certain kubernetes environments, it might not be possible to set a security context, while setting ENV is possible.
I will mention, that using the built-in docker flags for user are not possible in Kubernetes without setting a custom security context, but in certain kubernetes environments, it might not be possible to set a security context, while setting ENV is possible.
Right but in that case the container would have to start as root and use the uuid/guid env vars to drop to that user in the entrypoint script with is not good practice at all
I have a CIFS/SMB volume mounted on my docker host, accessed by many of my containers. For all the other containers, I can specify a UID/GID in the docker-compose file so that they have read/write access to this volume.
How do you specify the UID/GID for NextCloud? As it stands, it can read the volume but doesn't have write access.
Thanks