Docker: Support running without root

[varesa]

I am setting up nextcloud instances on an Openshift cluster (Redhat's kubernetes distribution) where the default security context prevents running software as uid=0. I would see that as a good practice in general.

What it would need (at least):

• Not binding to privileged ports (e.g. change 80 -> 8080, can be mapped to any host port anyway)

(13)Permission denied: AH00072: make_sock: could not bind to address [::]:80
(13)Permission denied: AH00072: make_sock: could not bind to address 0.0.0.0:80

• Making sure apache directories are readable/writable by the non-root user as necessary

[Wed Sep 12 11:06:29.449612 2018] [core:error] [pid 1] (13)Permission denied: AH00099: could not create /var/run/apache2/apache2.pid
[Wed Sep 12 11:06:29.449713 2018] [core:error] [pid 1] AH00100: apache2: could not log pid to file /var/run/apache2/apache2.pid

Related: https://github.com/openshift/origin/issues/6629

[tilosp]

I think that this should be fixed in the parent image.
Could you open an issue here docker-library/php?

[rcdailey]

I can verify this issue still exists...

  nextcloud:
    image: nextcloud
    restart: always
    user: $UID:$GID
    sysctls:
      - net.ipv4.ip_unprivileged_port_start=0
    environment:
      - APACHE_RUN_USER=#$UID
      - APACHE_RUN_GROUP=#$GID

[rcdailey]

For reference, I opened an issue here:

https://github.com/docker-library/php/issues/743

[tilosp]

should be fixed by https://github.com/docker-library/php/pull/745 and https://github.com/docker-library/php/pull/755

[varesa]

Great! Thanks @rcdailey and @tilosp

Sorry I got busy with life and didn't have time to evaluate and open an issue upstream as you suggested

[vogelfreiheit]

Is the nextcloud docker image actually capable of running as non root?

[rcdailey]

Is the nextcloud docker image actually capable of running as non root?

Absolutely. I'm running mine that way right now:

app:
  image: nextcloud:16-apache
  restart: unless-stopped
  user: $UID:$GID
  sysctls:
  - net.ipv4.ip_unprivileged_port_start=0
  environment:
  - MYSQL_HOST=db
  - APACHE_RUN_USER=#$UID
  - APACHE_RUN_GROUP=#$GID

(Omitted some irrelevant attributes, such as volume mounts)

[vogelfreiheit]

Nice! Do you have by any chance pointers to a configuration example for using an nginx reverse proxy outside of the container? And having the nextcloud web server running at a non privileged port (so we avoid the pitfall of allowing <1024 ports being opened by non root).

Is nginx supported inside the container or only Apache with mod_php? I would definitely prefer fpm just for the isolation options.

Thank you!