docker nfs volume for datadir doesn't receive correct permissions

[jreedsellers]

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

Steps to reproduce

1. Create an NFS docker volume
2. Mount NFS volume to /mnt/ncdata in nextcloud-aio-mastercontainer
3. Set environment variable NEXTCLOUD_DATADIR="mnt/ncdata"

Expected behavior

nextcloud-aio-nextcloud container should start and create a test file in /mnt/ncdata

Actual behavior

touch: /mnt/ncdata/this-is-a-test-file: Permission denied
The www-data user doesn't seem to have access rights in /mnt/ncdata.

Host OS

Raspbian 64-bit

Nextcloud AIO version

v1.2.1

Current channel

latest-arm64

Other valuable info

I can access and edit the mount in the mastercontainer with no problems. But the nextcloud-aio-nextcloud container doesn't seem to get the correct permissions.

Mastercontainer Logs:

�[0;92mInitial startup of Nextcloud All In One complete!
You should be able to open the Nextcloud AIO Interface now on port 8080 of this server!
E.g. https://internal.ip.of.this.server:8080

If your server has port 80 and 8443 open and you point a domain to your server, you can get a valid certificate automatially by opening the Nextcloud AIO Interface via:
https://your-domain-that-points-to-this-server.tld:8443�[0m
2022-05-23 15:51:31,444 CRIT Supervisor is running as root.  Privileges were not dropped because no user is specified in the config file.  If you intend to run as root, you can set user=root in the config file to avoid this message.
{"level":"info","ts":1653321092.5881336,"msg":"using provided configuration","config_file":"/Caddyfile","config_adapter":""}
{"level":"warn","ts":1653321092.592096,"msg":"Caddyfile input is not formatted; run the 'caddy fmt' command to fix inconsistencies","adapter":"caddyfile","file":"/Caddyfile","line":2}
{"level":"info","ts":1653321092.595568,"logger":"admin","msg":"admin endpoint started","address":"tcp/localhost:2019","enforce_origin":false,"origins":["//localhost:2019","//[::1]:2019","//127.0.0.1:2019"]}
{"level":"warn","ts":1653321092.5969822,"logger":"http","msg":"automatic HTTP->HTTPS redirects are disabled","server_name":"srv0"}
{"level":"info","ts":1653321092.5971923,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0x400022eee0"}
{"level":"warn","ts":1653321092.5991838,"logger":"tls","msg":"YOUR SERVER MAY BE VULNERABLE TO ABUSE: on-demand TLS is enabled, but no protections are in place","docs":"https://caddyserver.com/docs/automatic-https#on-demand-tls"}
{"level":"info","ts":1653321092.6003673,"logger":"tls","msg":"cleaning storage unit","description":"FileStorage:/mnt/docker-aio-config/caddy/"}
{"level":"info","ts":1653321092.600464,"logger":"tls","msg":"finished cleaning storage units"}
{"level":"error","ts":1653321092.6014302,"msg":"unable to create folder for config autosave","dir":"/var/www/.config/caddy","error":"mkdir /var/www/.config: permission denied"}
{"level":"info","ts":1653321092.6022735,"msg":"serving initial configuration"}
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 172.17.0.2. Set the 'ServerName' directive globally to suppress this message
[Mon May 23 15:51:32.644770 2022] [ssl:warn] [pid 83] AH01906: 172.17.0.2:8080:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Mon May 23 15:51:32.644913 2022] [ssl:warn] [pid 83] AH01909: 172.17.0.2:8080:0 server certificate does NOT include an ID which matches the server name
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 172.17.0.2. Set the 'ServerName' directive globally to suppress this message
[Mon May 23 15:51:32.712589 2022] [ssl:warn] [pid 83] AH01906: 172.17.0.2:8080:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Mon May 23 15:51:32.712643 2022] [ssl:warn] [pid 83] AH01909: 172.17.0.2:8080:0 server certificate does NOT include an ID which matches the server name
[Mon May 23 15:51:32.721493 2022] [mpm_prefork:notice] [pid 83] AH00163: Apache/2.4.53 (Debian) PHP/8.0.19 OpenSSL/1.1.1n configured -- resuming normal operations

[szaimen]

Hi, can you post the complete docker run command that you used?

[jreedsellers]

I've been using the commands below.

docker volume create --driver local --opt type=nfs --opt o=addr=local.ip.address.here,rw --opt device=:/volume1/ncdata nextcloud

docker run -it --name nextcloud-aio-mastercontainer \
--restart always \
-p 80:80 \
-p 8080:8080 \
-p 8443:8443 \
--volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
--volume /var/run/docker.sock:/var/run/docker.sock:ro \
--volume ncdata:/mnt/ncdata:rw \
-e NEXTCLOUD_DATADIR="/mnt/ncdata" \
nextcloud/all-in-one:latest-arm64

Now rereading the docs I see that the NEXTCLOUD_DATADIR references a directory on the host, not the container. I'm hoping to not mount the NFS drive on the host and just connect it as a docker volume. I don't see how that is currently possible if the environment variable to change the data directory can only reference the host filesystem. Am I missing an option?

[szaimen]

I'm hoping to not mount the NFS drive on the host and just connect it as a docker volume

why?

Am I missing an option?

There is no such option, indeed.

[jreedsellers]

I was able to make it work by naming the NFS volume nextcloud_aio_nextcloud_datadir like in the Windows example. This only works with #700 so I had to use the develop image. I prefer this method to use an NFS share for the datadir since it can all be handled in a docker-compose file without having to manually set up an NFS mount on the host machine. It also lets docker handle the permissions without having to run chmod and chown on the host machine.

docker volume create --driver local --opt type=nfs --opt o=addr=local.ip.address.here,rw --opt device=:/volume1/ncdata nextcloud nextcloud_aio_nextcloud_datadir

docker run -it --name nextcloud-aio-mastercontainer \
--restart always \
-p 80:80 \
-p 8080:8080 \
-p 8443:8443 \
--volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
--volume /var/run/docker.sock:/var/run/docker.sock:ro \
--volume ncdata:/mnt/ncdata:rw \
-e NEXTCLOUD_DATADIR="nextcloud_aio_nextcloud_datadir" \
nextcloud/all-in-one:latest-arm64

[szaimen]

All right. Almost forgot this new feature 😅

Great that you found a way that works for you!

[szaimen]

Also did you see