[BUG] PUID/PGID not work for rootless docker

[adoyle-h]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

In my host, the uid/gid of my current login user is 1000:1000. And I want to set nextcloud folder with uid/gid to 1000:1000.

I'm using rootless docker. And I have read the https://docs.linuxserver.io/images/docker-nextcloud/#user-group-identifiers and https://docs.linuxserver.io/general/understanding-puid-and-pgid/ .

1. sudo chown 1000:1000 ./nextcloud

2. docker compose up -d with rootless docker. I find the uid/gid changed for ./nextcloud/config and ./nextcloud/data from 1000 to 100999, and files in ./nextcloud/data/* are still 1000:1000 on host.

   

   But these files in container has different uid/gid. the ./nextcloud/data is 1000:1000, the files in ./nextcloud/data/* are 0:0.

   

3. The server start up without error logs. But nextcloud client cannot sync file to remote.

   

Expected Behavior

No response

Steps To Reproduce

1. sudo chown 1000:1000 ./nextcloud
2. docker compose up -d

Environment

- OS: arch linux
- How docker service was installed: follow https://docs.docker.com/engine/security/rootless/

CPU architecture

x86-64

Docker creation

version: "3"

services:
    nextcloud:
    image: linuxserver/nextcloud:latest
    restart: unless-stopped
    environment:
        - PUID=1000
        - PGID=1000
        - TZ=Asia/Shanghai
    volumes:
        - ./nextcloud/config:/config
        - ./nextcloud/data:/data

Container logs

adoyle-nextcloud-1  | ───────────────────────────────────────
adoyle-nextcloud-1  |
adoyle-nextcloud-1  |
adoyle-nextcloud-1  |       ██╗     ███████╗██╗ ██████╗
adoyle-nextcloud-1  |       ██║     ██╔════╝██║██╔═══██╗
adoyle-nextcloud-1  |       ██║     ███████╗██║██║   ██║
adoyle-nextcloud-1  |       ██║     ╚════██║██║██║   ██║
adoyle-nextcloud-1  |       ███████╗███████║██║╚██████╔╝
adoyle-nextcloud-1  |       ╚══════╝╚══════╝╚═╝ ╚═════╝
adoyle-nextcloud-1  |
adoyle-nextcloud-1  |
adoyle-nextcloud-1  |    Brought to you by linuxserver.io
adoyle-nextcloud-1  | ───────────────────────────────────────
adoyle-nextcloud-1  |
adoyle-nextcloud-1  |
adoyle-nextcloud-1  | To support LSIO projects visit:
adoyle-nextcloud-1  | https://www.linuxserver.io/donate/
adoyle-nextcloud-1  |
adoyle-nextcloud-1  |
adoyle-nextcloud-1  | ───────────────────────────────────────
adoyle-nextcloud-1  | GID/UID
adoyle-nextcloud-1  | ───────────────────────────────────────
adoyle-nextcloud-1  |
adoyle-nextcloud-1  |
adoyle-nextcloud-1  | User UID:    1000
adoyle-nextcloud-1  | User GID:    1000
adoyle-nextcloud-1  | ───────────────────────────────────────
adoyle-nextcloud-1  | Linuxserver.io version: 31.0.4-ls379
adoyle-nextcloud-1  | Build-date: 2025-05-06T11:55:23+00:00
adoyle-nextcloud-1  | ───────────────────────────────────────
adoyle-nextcloud-1  |
adoyle-nextcloud-1  | using keys found in /config/keys
adoyle-nextcloud-1  | Initializing nextcloud 31.0.4.1 (this can take a while) ...
adoyle-nextcloud-1  | Setting permissions
adoyle-nextcloud-1  | Initializing finished
adoyle-nextcloud-1  | [custom-init] No custom files found, skipping...
adoyle-nextcloud-1  | [ls.io-init] done.

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[thespad]

Correct, that is how rootless docker operates. You can disable user namespace remapping if you really need the container user to match the host user, but either way it's not something specific to our image.

[adoyle-h]

I just want the volume files keeping same uid/gid between host and container. I don't care the container user. What should I do?

[thespad]

It's a core part of rootless containerisation, to segregate container users from the host. You could run a custom startup script to change the ownership of the files on startup to match the mapped user, but if you've got a lot of data that's going to be slow.

While docker does technically support disabling userns remapping it's an imperfect implementation and can cause things to break because it doesn't change the container filesystem permissions.

Realistically if you need a rootless container environment and you need host userns then your best option is to use podman, as it properly supports disabling userns remapping with rootless containers. That said, we don't provide formal support for it.

[adoyle-h]

Thanks for you reply. The custom startup script may be a solution but that's going to be slow. So I came up with another solution.

The rootless docker has remapped user namespace. So I think the PUID/GUID and user "abc" are useless for rootless docker. I wish all processes are run under user root in the container. The user root will be remapped to host user by rootless docker.

But current nginx sub-processes and php-fpm processes are running under user "abc".
So I copied and modified files /etc/passwd and /etc/group, in which modify the uid/gid of abc same to the uid/gid of root.
And I modified the s6-rc.d/svc-php-fpm/run file. Add an "-R" option to exec /usr/sbin/php-fpm83 -F -R, which means allow pool to run as root.

The final compose.yaml like:

version: "3"

services:
    nextcloud:
    image: linuxserver/nextcloud:latest
    restart: unless-stopped
    environment:
       # PUID/PGID are unnecessary
        - TZ=Asia/Shanghai
    volumes:
        - ./nextcloud/config:/config
        - ./nextcloud/data:/data
        - ./nextcloud/passwd:/etc/passwd:ro
        - ./nextcloud/group:/etc/group:ro
        - ./nextcloud/svc-php-fpm-run:/etc/s6-overlay/s6-rc.d/svc-php-fpm/run:ro

The group file, the abc line should be abc:!:0:.
The passwd file, the abc line should be abc:x:0:0::/config:/bin/false.
The svc-php-fpm-run file, just changed to exec /usr/sbin/php-fpm83 -F -R.

Finally, it works well with rootless docker. All processes under root user. And nextcloud client sync files without error.

# ps -ef
UID          PID    PPID  C STIME TTY          TIME CMD
root           1       0  0 16:02 ?        00:00:00 /package/admin/s6/command/s6-svscan -d4 -- /run/service
root          17       1  0 16:02 ?        00:00:00 s6-supervise s6-linux-init-shutdownd
root          19      17  0 16:02 ?        00:00:00 /package/admin/s6-linux-init/command/s6-linux-init-shutdownd -d3 -c /run/s6/basedir
root          36       1  0 16:02 ?        00:00:00 s6-supervise svc-nginx
root          37       1  0 16:02 ?        00:00:00 s6-supervise s6rc-oneshot-runner
root          38       1  0 16:02 ?        00:00:00 s6-supervise s6rc-fdholder
root          39       1  0 16:02 ?        00:00:00 s6-supervise svc-cron
root          40       1  0 16:02 ?        00:00:00 s6-supervise svc-php-fpm
root          48      37  0 16:02 ?        00:00:00 /package/admin/s6/command/s6-ipcserverd -1 -- /package/admin/s6/command/s6-ipcserve
root         332      40  0 16:03 ?        00:00:00 php-fpm: master process (/etc/php83/php-fpm.conf)
root         333      39  0 16:03 ?        00:00:00 busybox crond -f -S -l 5
root         335      36  0 16:03 ?        00:00:00 nginx: master process /usr/sbin/nginx -e stderr
root         362     335  0 16:03 ?        00:00:00 nginx: worker process
root         363     335  0 16:03 ?        00:00:00 nginx: worker process
root         364     335  0 16:03 ?        00:00:00 nginx: worker process
root         366     335  0 16:03 ?        00:00:00 nginx: worker process
root         367     335  0 16:03 ?        00:00:00 nginx: cache manager process
root         370     332  0 16:03 ?        00:00:04 php-fpm: pool www
root         373     332  0 16:12 ?        00:00:00 php-fpm: pool www
root         374     332  0 16:13 ?        00:00:00 php-fpm: pool www
root         377       0  1 16:15 pts/0    00:00:00 sh
root         386     377  0 16:15 pts/0    00:00:00 ps -ef