Docker: Data directory permissions error message (docker for windows)

[ShaunCurrier]

After completing the web setup wizard on a new Nextcloud docker container, I am getting the following error message:
Data directory (/var/www/html/data) is readable by other users. Please change the permissions to 0770 so that the directory cannot be listed by other users.

The docker image I am using is version 11 apache latest. I looked at the dockerfile and I can't see anywhere that the permissions are being set according to the requirement mentioned in the error message. Is this an omission?

Other information. I am running docker via docker tool box on Windows 7 and am mounting an NTFS directory for /var/www/html via the docker -v argument.

[marvinwankersteen]

Check the permission of the host-folder which you have mounted with -v in /var/www/html.
You can try to set the permission with user root in the container to chmod -R 770 /var/www/html. If it's not working, try it on the host.

[ShaunCurrier]

The host is Windows 7.

The permissions on the -v host folder mounted at /var/www/html do not include the Everyone permission and neither does data, yet I can see from within the container that the directory permissions on /var/www/html/data are drwxrwxrwx.

The only users that have access to the host folders are SYSTEM, my user name, and Administrators.

Running the following on the container has no effect.
docker exec -it -u root nextcloud chmod -R 770 /var/www/html

I can't run a similar command on the host because it's Windows 7.

[ShaunCurrier]

Switched over to Windows 10 Pro and Docker for Windows. I can get the volume to appear and be writeable, same as before, but again get stuck when Nextcloud refuses to proceed due to the other permissions. Curiously the directory permissions from within the container are now drwxr-xr-x. I've tried removing all permissions on the host folder except for the user that is used by Docker for Windows to access the host share, but to no avail. Attempting to change the directory permissions from within the container using the command mentioned in my previous post again has no effect.

[ShaunCurrier]

In https://github.com/docker/for-win/issues/497 someone says

Inside the VM the directories are mounted with the default user and permission (root and 0755).

That matches my case now, exactly. So what setting's default are they referring to, I wonder? That would seem to be key to this.

[ShaunCurrier]

@rneugeba could you elaborate on your post in the thread that I reference in the post above where you say this?

Inside the VM the directories are mounted with the default user and permission (root and 0755).

Where can we find documentation about changing permissions inside the VM? I have tried changing the source Windows folder permissions many different ways and found no effect inside the VM. A quick pointer to any documentation would be much appreciated.

Note to all:
The official Docker for Windows documentation apparently does not cover the finer points of controlling permissions, so I made an issue on their tracker to see if this can be improved: https://github.com/docker/docker.github.io/issues/3298

[ShaunCurrier]

Looks like it's impossible to change permissions inside the VM, per this definitive comment: https://github.com/docker/docker.github.io/issues/3298#issuecomment-302106793

So what should be done on the nextcloud side to address this roadblock for users of Docker for Windows? Nothing? Provide a way to take a risk by disabling this permissions check?

[SnowMB]

Have you tried using a named volume instead of mounting a volume from your host? I'm curious how this is handled in docker for windows.

[ShaunCurrier]

Sorry, I didn't try that. I ended up making an Ubuntu VM manually and working with Docker in that VM, which removed the limitations of Docker for Windows. What should we do with this issue?

At the least, perhaps the documentation should be updated with a caveat that Docker for Windows will not work, so that others do not waste time as I did.

[UnrealKazu]

I've got the exact same problems. As @ShaunCurrier stated: all volumes are mounted with permissions that cannot be changed, resulting in problems when Nextcloud does its round of security checks when booting.

This is an inherit problem when using Docker on Windows, because this uses a lightweight VM as an intermediary between Windows and Linux containers. This VM is inaccessible (or, at least without some very dirty workarounds), and thus we cannot do anything on our end to fix these permission problems.

[awickham10]

Has there been any work on this or do we know if there is going to be a fix/workaround? I would prefer to not have my documents in a docker volume.

[darkneo29]

I haven't seen a fix. Just tried yesterday. Same issue. Created a docker volume and used that for data. I only need next cloud for external mounts but would be nice to have this issue fixed

[darkneo29]

Is there a way to remove the check for permissions? I tried a few commands from other post but no luck

[tilosp]

@darkneo29 currently not, but there is a open issue nextcloud/server#3245

[MorrisJobke]

nextcloud/server#3245 is fixed in 13 and will also get a backport to 12.0.5

[tilosp]

Nextcloud 12.0.5 is released now

[STaRDoGG]

Looks like it was never fixed. I just installed the latest NC container (on Win 10) and I'm stuck at that same screen. when I chmod 0770 data/ ssh'd into the container as root, nothing happens; no error msg, but also no perms change when I ls -l after.

[Razva]

Looks like it was never fixed. I just installed the latest NC container (on Win 10) and I'm stuck at that same screen. when I chmod 0770 data/ ssh'd into the container as root, nothing happens; no error msg, but also no perms change when I ls -l after.

You should add 'check_data_directory_permissions' => false, into config.php.

[STaRDoGG]

@Razva That did it, thanks!