diff options
author | Tobias Brunner <tobias@tobru.ch> | 2017-07-17 21:35:16 +0200 |
---|---|---|
committer | Tilo Spannagel <development@tilosp.de> | 2017-08-14 19:05:25 +0200 |
commit | bd3fc10d7d6b8e94293ceb3887c44bed2a77d721 (patch) | |
tree | f49ff7ed5ac8308ec239572964c06401f4eae8ad /12.0/fpm | |
parent | 2220249a20b6b92e25f51eb7c1f39a77b7838c49 (diff) |
update directory permissions to be compatible with non-root
This commit updates the directory permissions to be more compatible when
running the image without root f.e. on OpenShift or when specifying it
when running with `docker run --user www-data:root ...`.
It adds detection logic to the entrypoint script as sudo is not always
allowed.
This change in directory permissions was also proposed by the official
documentation, see https://github.com/nextcloud/documentation/commit/22e2530.
The `chown` before the volume definition is needed to prepare the volume
as it inherits the permissions.
refs https://github.com/nextcloud/docker/issues/107
Diffstat (limited to '12.0/fpm')
-rw-r--r-- | 12.0/fpm/Dockerfile | 10 | ||||
-rwxr-xr-x | 12.0/fpm/docker-entrypoint.sh | 22 |
2 files changed, 19 insertions, 13 deletions
diff --git a/12.0/fpm/Dockerfile b/12.0/fpm/Dockerfile index 02ef6f61..09eb43de 100644 --- a/12.0/fpm/Dockerfile +++ b/12.0/fpm/Dockerfile @@ -41,6 +41,8 @@ RUN set -ex \ && docker-php-ext-enable apcu redis memcached ENV NEXTCLOUD_VERSION 12.0.2 + +RUN chown -R www-data:root /var/www/html VOLUME /var/www/html COPY config/* /usr/src/nextcloud/config/ @@ -57,16 +59,8 @@ RUN curl -fsSL -o nextcloud.tar.bz2 \ && tar -xjf nextcloud.tar.bz2 -C /usr/src/ \ && rm nextcloud.tar.bz2 \ && rm -rf /usr/src/nextcloud/updater \ - # https://docs.nextcloud.com/server/11/admin_manual/installation/installation_wizard.html#setting-strong-directory-permissions && mkdir -p /usr/src/nextcloud/data \ && mkdir -p /usr/src/nextcloud/custom_apps \ - && find /usr/src/nextcloud/ -type f -print0 | xargs -0 chmod 0640 \ - && find /usr/src/nextcloud/ -type d -print0 | xargs -0 chmod 0750 \ - && chown -R root:www-data /usr/src/nextcloud/ \ - && chown -R www-data:www-data /usr/src/nextcloud/custom_apps/ \ - && chown -R www-data:www-data /usr/src/nextcloud/config/ \ - && chown -R www-data:www-data /usr/src/nextcloud/data/ \ - && chown -R www-data:www-data /usr/src/nextcloud/themes/ \ && chmod +x /usr/src/nextcloud/occ COPY docker-entrypoint.sh /entrypoint.sh diff --git a/12.0/fpm/docker-entrypoint.sh b/12.0/fpm/docker-entrypoint.sh index f073581e..61242d41 100755 --- a/12.0/fpm/docker-entrypoint.sh +++ b/12.0/fpm/docker-entrypoint.sh @@ -11,6 +11,13 @@ function directory_empty() { [ -n "$(find "$1"/ -prune -empty)" ] } +function run_as() { + if [[ $EUID -eq 0 ]]; then + su - www-data -s /bin/bash -c "$1" + else + bash -c "$1" + fi +} installed_version="0.0.0~unknown" if [ -f /var/www/html/version.php ]; then @@ -25,10 +32,15 @@ fi if version_greater "$image_version" "$installed_version"; then if [ "$installed_version" != "0.0.0~unknown" ]; then - su - www-data -s /bin/bash -c 'php /var/www/html/occ app:list' > /tmp/list_before + run_as 'php /var/www/html/occ app:list' > /tmp/list_before + fi + if [[ $EUID -eq 0 ]]; then + rsync_options=-a + else + rsync_options=-rlD fi - rsync -a --delete --exclude /config/ --exclude /data/ --exclude /custom_apps/ --exclude /themes/ /usr/src/nextcloud/ /var/www/html/ - + rsync $rsync_options --delete --exclude /config/ --exclude /data/ --exclude /custom_apps/ --exclude /themes/ /usr/src/nextcloud/ /var/www/html/ + for dir in config data themes; do if [ ! -d /var/www/html/"$dir" ] || directory_empty /var/www/html/"$dir"; then cp -arT /usr/src/nextcloud/"$dir" /var/www/html/"$dir" @@ -44,9 +56,9 @@ if version_greater "$image_version" "$installed_version"; then fi if [ "$installed_version" != "0.0.0~unknown" ]; then - su - www-data -s /bin/bash -c 'php /var/www/html/occ upgrade --no-app-disable' + run_as 'php /var/www/html/occ upgrade --no-app-disable' - su - www-data -s /bin/bash -c 'php /var/www/html/occ app:list' > /tmp/list_after + run_as 'php /var/www/html/occ app:list' > /tmp/list_after echo "The following apps have beed disabled:" diff <(sed -n "/Enabled:/,/Disabled:/p" /tmp/list_before) <(sed -n "/Enabled:/,/Disabled:/p" /tmp/list_after) | grep '<' | cut -d- -f2 | cut -d: -f1 rm -f /tmp/list_before /tmp/list_after |