Unprivileged container, bind mounts and Nextcloud -- permissions

[inxsible]

This has to be something that others must have encountered. I am losing my head trying to wrap the permissions.

I have Nextcloud setup for myself in an unprivileged LXC container. The data directory for this install is on a FreeNAS server. The way I set it up in the host is as an NFS share




Then in the container i have

Obviously nextcloud is a directory under /mnt/pve/media. This works great -- My nextcloud instance can read/write to the nextcloud data directory (defined as /mnt/freenas/nextcloud in the config.php)

When I check the ownership of the folder from the container I see :


and yet, I don't have any problems reading/writing to that directory from within the container with the www-data user that nextcloud requires.

However, I am now trying to setup a similar Nextcloud instance for a friend. The only difference is that he does not have a separate FreeNAS server and would like to use the other disks in the Proxmox server for the Nextcloud data directory -- However I am getting into the whole permissions hell with this setup
Here's what I have done on the new system:

I set up a lvm partition and then mapped that in the /etc/fstab

/dev/mapper/vg-data /mnt/data ext4 defaults 0 0

Then I chowned the /mnt/data directory and it's sub-directories to the user:group www-data:www-data

Then I added the storage under Datacenter--> Storage as a Directory :


Then in the container I set up a Bind mount using

mp0: /mnt/data/nextcloud,mp=/mnt/nextcloud

Then when setting up Nextcloud it complained that it couldn't write to the data directory. I checked the permissions and it was similar to how I have it in my server. The group was nogroup instead of nobody but no other difference.

So for testing, I set up chmod -R 777 on the PVE host. That allowed me to go through the Nextcloud setup and I can see the data written from within the container and also from the host. But now when I try to access Nextcloud from a browser -- it indicates that the permissions are set to 777 and should be changed to 770 --- Of course when I do this, the www-data user can no longer write to that directory and we are back in the same loop


I understand the whole subuid and subgid mapping that is needed --- OR -- I can make the container a Privileged container.


But what I don't understand is -- why does it work on my server and not on the new one? The only difference is using the Nextcloud data directory on theNFS share (for my server) vs the local disk on the Proxmox node itself (for my friend's server)



Please help !!!

 

[Dunuin]

Not sure why it worked at your server without the user mapping edits. I think it shouldn't. That wiki article helped me: https://pve.proxmox.com/wiki/Unprivileged_LXC_containers

 

[inxsible]

Not sure why it worked at your server without the user mapping edits. I think it shouldn't. That wiki article helped me: https://pve.proxmox.com/wiki/Unprivileged_LXC_containers

Yes I have seen that before but my question was more towards -- how is it working for my server but not for the new install that I have done.


Secondly, when I set the perms as 777 on the host -- I was able to write to the directory from within the container.. Also when I set the permissions as

chown -R 100033:100033 /mnt/data

on the host, everything works including Nextcloud because the mapping between the pve host and the container is offset by 100000.

I understand all that --- I am just trying to figure out what is different between my setup and the new setup that I have for my friend -- just for my sanity's sake.

 

[Dunuin]

Are there any ACLs set for the nextcloud datset on your FreeNAS server?
If I remeber right ACLs are priorized so your 750 permissions would be ignored. And atleast with SMB shares FreeNAS will default the ACLs with read/write permission for everyone at creation of the share.

But I don't know if it is possible at all that NFS could be using ACLs.

 

[inxsible]

Are there any ACLs set for the nextcloud datset on your FreeNAS server?
If I remeber right ACLs are priorized so your 750 permissions would be ignored. And atleast with SMB shares FreeNAS will default the ACLs with read/write permission for everyone at creation of the share.

But I don't know if it is possible at all that NFS could be using ACLs.

No, I haven't set any ACLs for my server. I haven't even mounted the FreeNAS NFS share in the fstab of the PVE host. I simply created a storage of type NFS and pointed to the media share and mounted it at /etc/pve/media. Then I created a folder called "nextcloud" on my FreeNAS box's media share and mounted that folder to my nextcloud container using a bind mount in the container's conf file. No other configuration.