How to correctly set uid and gid in podman-compose file for nextcloud?

[g4njawizard]

I've been for a couple of days trying to run multiple container on my NVME Raspberry Pi 5 running rootless podman. I use systemd to control my services. I have 3 services setup, but one of those (nextcloud) had some permission issues.
I got it somehow working, but I cant access the files.

My Compose File:

services:
  app:
    image: docker.io/nextcloud:latest
    restart: always
    container_name: nextcloud
    userns_mode: keep-id:uid=$uid,gid=$gid
    security_opt:
      - "label=disabled"
    ports:
      - 8666:80
    volumes:
      - "/home/user/data/nextcloud/html:/var/www/html"
      - "/home/user/data/nextcloud/data:/var/www/html/data"
    environment:
      NEXTCLOUD_ADMIN_USER:##${NEXTCLOUD_ADMIN_USER}
      NEXTCLOUD_ADMIN_PASSWORD:##${NEXTCLOUD_ADMIN_PASSWORD}
      MYSQL_HOST: <sqlserver>
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_PASSWORD: ${NEXTCLOUD_MYSQL_PASSWORD}
      NEXTCLOUD_DATA_DIR: /var/www/html/data
      TRUSTED_PROXIES: <myproxy>
      NEXTCLOUD_TRUSTED_DOMAINS: <mydomain> 

Looking at the directories, I can see it becomes the following ID's assigned.

drwxr-xr-x 16 100032 100032 4.0K Jan  1 01:58 html
drwxr-xr-x  2 100032 100032 4.0K Jan  1 01:58 data

When I try to follow: https://github.com/containers/podman/blob/main/troubleshooting.md#33-container-creates-a-file-that-is-not-owned-by-the-users-regular-uid

I receive the following mapping:

$:~/data/nextcloud$ echo $uid
33
$:~/data/nextcloud$ echo $gid
33

I want to try if I can use these id's to create a file with my ownership.

 podman run --rm -v ./html/:/var/www/html:Z --user $uid:$gid --userns keep-id:uid=$uid,gid=$gid docker.io/nextcloud:latest bash -c "touch /var/www/html/test; chmod 600 /var/www/html/test"

OK user@pinode01:~/data/nextcloud$ ll html/test 
-rw------- 1 user odin 0 Jan  1 13:36 html/test

When I now want to set these in my compose file, I receive a permission denied error.

 app:
    image: docker.io/nextcloud:latest
    restart: always
    container_name: nextcloud
    user: 33:33
    userns: keep-id:uid=33,gid=33 
    security_opt:

Result:

podman-compose -f ../../nextcloud-compose.yml --podman-args="--log-

level debug" up --force-recreate --remove-orphans
[DEBUG netavark::commands::setup] "Setup complete"
DEBU[0001] rootlessport: time="2025-01-01T14:23:04+01:00" level=info msg="Starting parent driver"
time="2025-01-01T14:23:04+01:00" level=info msg="opaque=map[builtin.readypipepath:/run/user/1000/libpod/tmp/rootlessport2155673901/.bp-ready.pipe builtin.socketpath:/run/user/1000/libpod/tmp/rootlessport2155673901/.bp.sock]" 
DEBU[0001] rootlessport: time="2025-01-01T14:23:04+01:00" level=info msg="Starting child driver in child netns (\"/proc/self/exe\" [rootlessport-child])" 
DEBU[0001] rootlessport: time="2025-01-01T14:23:04+01:00" level=info msg="Waiting for initComplete" 
DEBU[0001] rootlessport: time="2025-01-01T14:23:04+01:00" level=info msg="initComplete is closed; parent and child established the communication channel" 
DEBU[0001] rootlessport: time="2025-01-01T14:23:04+01:00" level=info msg="Exposing ports [{ 80 8666 1 tcp}]" 
DEBU[0001] rootlessport: time="2025-01-01T14:23:04+01:00" level=info msg=Ready 
DEBU[0001] rootlessport is ready                        
DEBU[0001] Adding nameserver(s) from network status of '["10.89.0.1"]' 
DEBU[0001] Adding search domain(s) from network status of '["dns.podman"]' 
DEBU[0001] Modifying container 46648fcdcebdd9aeb58e54f57d66622d400b7cd027673bc79e60e3bbe5bc0bdd /etc/passwd 
DEBU[0001] Modifying container 46648fcdcebdd9aeb58e54f57d66622d400b7cd027673bc79e60e3bbe5bc0bdd /etc/group 
DEBU[0001] /etc/system-fips does not exist on host, not mounting FIPS mode subscription 
DEBU[0001] Setting Cgroups for container 46648fcdcebdd9aeb58e54f57d66622d400b7cd027673bc79e60e3bbe5bc0bdd to user.slice:libpod:46648fcdcebdd9aeb58e54f57d66622d400b7cd027673bc79e60e3bbe5bc0bdd 
DEBU[0001] reading hooks from /usr/share/containers/oci/hooks.d 
DEBU[0001] Workdir "/var/www/html" resolved to a volume or mount 
DEBU[0001] Created OCI spec for contaodininer 46648fcdcebdd9aeb58e54f57d66622d400b7cd027673bc79e60e3bbe5bc0bdd at /home/odin/.local/share/containers/storage/vfs-containers/46648fcdcebdd9aeb58e54f57d66622d400b7cd027673bc79e60e3bbe5bc0bdd/userdata/config.json 
DEBU[0001] /usr/bin/conmon messages will be logged to syslog 
DEBU[0001] running conmon: /usr/bin/conmon               args="[--api-version 1 -c 46648fcdcebdd9aeb58e54f57d66622d400b7cd027673bc79e60e3bbe5bc0bdd -u 46648fcdcebdd9aeb58e54f57d66622d400b7cd027673bc79e60e3bbe5bc0bdd -r /usr/bin/crun -b /home/user/.local/share/containers/storage/vfs-containers/46648fcdcebdd9aeb58e54f57d66622d400b7cd027673bc79e60e3bbe5bc0bdd/userdata -p /run/user/1000/containers/vfs-containers/46648fcdcebdd9aeb58e54f57d66622d400b7cd027673bc79e60e3bbe5bc0bdd/userdata/pidfile -n nextcloud --exit-dir /run/user/1000/libpod/tmp/exits --full-attach -s -l journald --log-level debug --syslog --conmon-pidfile /run/user/1000/containers/vfs-containers/46648fcdcebdd9aeb58e54f57d66622d400b7cd027673bc79e60e3bbe5bc0bdd/userdata/conmon.pid --exit-command /usr/bin/podman --exit-command-arg --root --exit-command-arg /home/odin/.local/share/containers/storage --exit-command-arg --runroot --exit-command-arg /run/user/1000/containers --exit-command-arg --log-level --exit-command-arg debug --exit-command-arg --cgroup-manager --exit-command-arg systemd --exit-command-arg --tmpdir --exit-command-arg /run/user/1000/libpod/tmp --exit-command-arg --network-config-dir --exit-command-arg  --exit-command-arg --network-backend --exit-command-arg netavark --exit-command-arg --volumepath --exit-command-arg /home/odin/.local/share/containers/storage/volumes --exit-command-arg --runtime --exit-command-arg crun --exit-command-arg --storage-driver --exit-command-arg vfs --exit-command-arg --events-backend --exit-command-arg journald --exit-command-arg --syslog --exit-command-arg container --exit-command-arg cleanup --exit-command-arg 46648fcdcebdd9aeb58e54f57d66622d400b7cd027673bc79e60e3bbe5bc0bdd]"
[conmon:d]: failed to write to /proc/self/oom_score_adj: Permission denied

INFO[0001] Running conmon under slice user.slice and unitName libpod-conmon-46648fcdcebdd9aeb58e54f57d66622d400b7cd027673bc79e60e3bbe5bc0bdd.scope 
DEBU[0001] Received: 1193410                            
INFO[0001] Got Conmon PID as 1193408                    
DEBU[0001] Created container 46648fcdcebdd9aeb58e54f57d66622d400b7cd027673bc79e60e3bbe5bc0bdd in OCI runtime 
DEBU[0001] Attaching to container 46648fcdcebdd9aeb58e54f57d66622d400b7cd027673bc79e60e3bbe5bc0bdd 
DEBU[0001] Starting container 46648fcdcebdd9aeb58e54f57d66622d400b7cd027673bc79e60e3bbe5bc0bdd with command [/entrypoint.sh apache2-foreground] 
DEBU[0001] Started container 46648fcdcebdd9aeb58e54f57d66622d400b7cd027673bc79e60e3bbe5bc0bdd 
DEBU[0001] Notify sent successfully                     
INFO[0001] Received shutdown.Stop(), terminating!        PID=1193321
DEBU[0001] Enabling signal proxying                     
/entrypoint.sh: 137: cannot create /var/www/html/nextcloud-init-sync.lock: Permission denied
DEBU[0021] Exceeded conmon timeout waiting for container 46648fcdcebdd9aeb58e54f57d66622d400b7cd027673bc79e60e3bbe5bc0bdd to exit 
DEBU[0021] Called start.PersistentPostRunE(podman start --log-level debug -a nextcloud) 
exit code: 2

The used ID inside that container seems to be www-data which makes sense for apache unable to access files. Am I missing here something?

[eriksjolund]

 user: 33:33
 userns: keep-id:uid=33,gid=33 

What happens if you remove the line user: 33:33?

When I tried it out before, I just used

UserNS=keep-id:uid=33,gid=33

in this quadlet unit:

https://github.com/eriksjolund/nextcloud-podman/blob/9b01bdfa282f84d6a5b4d18cd9df5d62ae9e0ea2/nextcloud.container#L23

I noticed that we are not using exactly the same container image
docker.io/nextcloud:latest vs docker.io/library/nextcloud:fpm

The example I wrote is still a bit work in progress because I only tried with HTTP and not with HTTPS.

[g4njawizard]

As you see in my first compose template, I have no user: 33:33.
When I try the same and change to docker.io/library/nextcloud:fpm
Same result:

drwxr-xr-x 16 100032 100032 4.0K Jan 1 19:45 html
drwxrwx--- 3 100032 100032 4.0K Jan 1 19:45 data

Files are written but inaccessible.

[g4njawizard]

Well I tinkered a little bit more and it seems that I somehow now got the permissions set I need.
It seems that I had to set the volumes with :Z

Now it looks like that:

  app:
    image: docker.io/library/nextcloud:latest
    restart: always
    container_name: nextcloud
      #    user: "33:33"
    userns_mode: "keep-id:uid=33,gid=33"
    security_opt:
      - "label=disabled"
    ports:
      - 8666:80
    volumes:
      - "/home/odin/data/nextcloud/html:/var/www/html:Z"
      - "/home/odin/data/nextcloud/data:/var/www/html/data:Z"

Unfortunately, I still get some permission issues...

DEBU[0000] /usr/bin/conmon messages will be logged to syslog 
DEBU[0000] running conmon: /usr/bin/conmon               args="[--api-version 1 -c 78edc03fc6b71ad90240308c7627984a37d96bfe35cc8749bbebd98e8ebe134d -u 78edc03fc6b71ad90240308c7627984a37d96bfe35cc8749bbebd98e8ebe134d -r /usr/bin/crun -b /home/odin/.local/share/containers/storage/vfs-containers/78edc03fc6b71ad90240308c7627984a37d96bfe35cc8749bbebd98e8ebe134d/userdata -p /run/user/1000/containers/vfs-containers/78edc03fc6b71ad90240308c7627984a37d96bfe35cc8749bbebd98e8ebe134d/userdata/pidfile -n nextcloud --exit-dir /run/user/1000/libpod/tmp/exits --full-attach -s -l journald --log-level debug --syslog --conmon-pidfile /run/user/1000/containers/vfs-containers/78edc03fc6b71ad90240308c7627984a37d96bfe35cc8749bbebd98e8ebe134d/userdata/conmon.pid --exit-command /usr/bin/podman --exit-command-arg --root --exit-command-arg /home/odin/.local/share/containers/storage --exit-command-arg --runroot --exit-command-arg /run/user/1000/containers --exit-command-arg --log-level --exit-command-arg debug --exit-command-arg --cgroup-manager --exit-command-arg systemd --exit-command-arg --tmpdir --exit-command-arg /run/user/1000/libpod/tmp --exit-command-arg --network-config-dir --exit-command-arg  --exit-command-arg --network-backend --exit-command-arg netavark --exit-command-arg --volumepath --exit-command-arg /home/odin/.local/share/containers/storage/volumes --exit-command-arg --runtime --exit-command-arg crun --exit-command-arg --storage-driver --exit-command-arg vfs --exit-command-arg --events-backend --exit-command-arg journald --exit-command-arg --syslog --exit-command-arg container --exit-command-arg cleanup --exit-command-arg 78edc03fc6b71ad90240308c7627984a37d96bfe35cc8749bbebd98e8ebe134d]"
[conmon:d]: failed to write to /proc/self/oom_score_adj: Permission denied

INFO[0000] Running conmon under slice user.slice and unitName libpod-conmon-78edc03fc6b71ad90240308c7627984a37d96bfe35cc8749bbebd98e8ebe134d.scope 
DEBU[0000] Received: 2991323                            
INFO[0000] Got Conmon PID as 2991321                    
DEBU[0000] Created container 78edc03fc6b71ad90240308c7627984a37d96bfe35cc8749bbebd98e8ebe134d in OCI runtime 
DEBU[0000] Attaching to container 78edc03fc6b71ad90240308c7627984a37d96bfe35cc8749bbebd98e8ebe134d 
DEBU[0000] Starting container 78edc03fc6b71ad90240308c7627984a37d96bfe35cc8749bbebd98e8ebe134d with command [/entrypoint.sh apache2-foreground] 
DEBU[0000] Started container 78edc03fc6b71ad90240308c7627984a37d96bfe35cc8749bbebd98e8ebe134d 
DEBU[0000] Notify sent successfully                     
INFO[0000] Received shutdown.Stop(), terminating!        PID=2991254
DEBU[0000] Enabling signal proxying                     
=> Searching for scripts (*.sh) to run, located in the folder: /docker-entrypoint-hooks.d/before-starting
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 10.89.0.47. Set the 'ServerName' directive globally to suppress this message
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 10.89.0.47. Set the 'ServerName' directive globally to suppress this message
[Wed Jan 01 19:01:46.740174 2025] [mpm_prefork:notice] [pid 1:tid 1] AH00163: Apache/2.4.62 (Debian) PHP/8.2.27 configured -- resuming normal operations
[Wed Jan 01 19:01:46.740282 2025] [core:notice] [pid 1:tid 1] AH00094: Command line: 'apache2 -D FOREGROUND'
[Wed Jan 01 19:03:24.140065 2025] [php:notice] [pid 52:tid 52] [client 10.89.0.47:49844] {"reqId":"wzmfPUhn2RINTfobdhEA","level":3,"time":"2025-01-01T19:03:24+00:00","remoteAddr":"10.89.0.47","user":"--","app":"PHP","method":"GET","url":"/","message":"fopen(/var/www/html/config/config.php): Failed to open stream: Permission denied at /var/www/html/lib/private/Config.php#190","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0","version":"","data":{"app":"PHP"}}

Nextcloud shows: Configuration was not read or initialized correctly, not overwriting /var/www/html/config/config.php

What I noticed is, that besides www-data user, my rootless user is also generating files that result in some inaccessiblities for www-data for example nextcloud-init-sync.lock:

drwxr-xr-x 16 100032 100032    4096 Jan  1 20:39 .
drwxr-xr-x  5 odin   users     4096 Jan  1 20:39 ..
drwxr-xr-x 42 100032 100032    4096 Jan  1 20:39 3rdparty
drwxr-xr-x 54 100032 100032    4096 Jan  1 20:39 apps
-rw-r--r--  1 100032 100032   26314 Jan  1 20:39 AUTHORS
-rw-r--r--  1 100032 100032    2079 Jan  1 20:39 composer.json
-rw-r--r--  1 100032 100032    3400 Jan  1 20:39 composer.lock
drwxr-xr-x  2 100032 100032    4096 Jan  1 20:39 config
-rw-r--r--  1 100032 100032    3810 Jan  1 20:39 console.php
-rw-r--r--  1 100032 100032   34520 Jan  1 20:39 COPYING
drwxr-xr-x 24 100032 100032    4096 Jan  1 20:39 core
-rw-r--r--  1 100032 100032    7550 Jan  1 20:39 cron.php
drwxr-xr-x  2 100032 100032    4096 Jan  1 20:39 custom_apps
drwxr-xr-t  2 myuser   myuser      4096 Jan  1 20:39 data
drwxr-xr-x  2 100032 100032   28672 Jan  1 20:39 dist
-rw-r--r--  1 100032 100032    5487 Jan  1 20:39 .htaccess
-rw-r--r--  1 100032 100032     331 Jan  1 20:39 index.html
-rw-r--r--  1 100032 100032    3485 Jan  1 20:39 index.php
drwxr-xr-x  6 100032 100032    4096 Jan  1 20:39 lib
drwxr-xr-x  2 100032 100032    4096 Jan  1 20:39 LICENSES
-rw-r--r--  1 myuser   myuser         0 Jan  1 20:39 nextcloud-init-sync.lock
-rwxr-xr-x  1 100032 100032     308 Jan  1 20:39 occ
drwxr-xr-x  2 100032 100032    4096 Jan  1 20:39 ocs
drwxr-xr-x  2 100032 100032    4096 Jan  1 20:39 ocs-provider
-rw-r--r--  1 100032 100032    7228 Jan  1 20:39 package.json
-rw-r--r--  1 100032 100032 1129564 Jan  1 20:39 package-lock.json
-rw-r--r--  1 100032 100032    2821 Jan  1 20:39 public.php
-rw-r--r--  1 100032 100032    4435 Jan  1 20:39 remote.php
drwxr-xr-x  4 100032 100032    4096 Jan  1 20:39 resources
drwxr-xr-x  2 100032 100032    4096 Jan  1 20:39 .reuse
-rw-r--r--  1 100032 100032      26 Jan  1 20:39 robots.txt
-rw-r--r--  1 100032 100032    1327 Jan  1 20:39 status.php
drwxr-xr-x  3 100032 100032    4096 Jan  1 20:39 themes
-rw-r--r--  1 100032 100032     271 Jan  1 20:39 .user.ini
-rw-r--r--  1 100032 100032     383 Jan  1 20:39 version.php

When I remove the userns_mode and keep user: 33:33 instead, the files that are here shown as "myuser" wont get created.
/entrypoint.sh: 137: cannot create /var/www/html/nextcloud-init-sync.lock: Permission denied
Therefore I somehow need to map 2 user or a group maybe? dont know how to aproach this.