Collabora with Docker not working 502 error

I installed Collabora Online using Nextclouds own instructions. It’s online, I’ve checked docker status, it shows online, and I’ve checked nc and it shows it’s open on that port. But still when I try to use it in Nextcloud it tells me it can’t connect.

Nextcloud log error below:

[richdocuments] Error: GuzzleHttp\Exception\ServerException: Server error: `GET https://mydomain.com/hosting/discovery` resulted in a `502 Proxy Error` response:
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>502 Proxy Error</title>
</head><body>
<h1>Proxy E (truncated...)
 at <<closure>>

 0. /var/www/3rdparty/guzzlehttp/guzzle/src/Middleware.php line 66
    GuzzleHttp\Exception\RequestException::create(GuzzleHttp\Psr7\Request {}, "*** sensitive parameter replaced ***")
 1. /var/www/3rdparty/guzzlehttp/promises/src/Promise.php line 203
    GuzzleHttp\Middleware::GuzzleHttp\{closure}("*** sensitive parameters replaced ***")
 2. /var/www/3rdparty/guzzlehttp/promises/src/Promise.php line 156
    GuzzleHttp\Promise\Promise::callHandler(1, "*** sensitive parameter replaced ***", [GuzzleHttp\Prom ... l])
 3. /var/www/3rdparty/guzzlehttp/promises/src/TaskQueue.php line 47
    GuzzleHttp\Promise\Promise::GuzzleHttp\Promise\{closure}("*** sensitive parameters replaced ***")
 4. /var/www/3rdparty/guzzlehttp/promises/src/Promise.php line 246
    GuzzleHttp\Promise\TaskQueue->run(true)
 5. /var/www/3rdparty/guzzlehttp/promises/src/Promise.php line 223
    GuzzleHttp\Promise\Promise->invokeWaitFn()
 6. /var/www/3rdparty/guzzlehttp/promises/src/Promise.php line 267
    GuzzleHttp\Promise\Promise->waitIfPending()
 7. /var/www/3rdparty/guzzlehttp/promises/src/Promise.php line 225
    GuzzleHttp\Promise\Promise->invokeWaitList()
 8. /var/www/3rdparty/guzzlehttp/promises/src/Promise.php line 62
    GuzzleHttp\Promise\Promise->waitIfPending()
 9. /var/www/3rdparty/guzzlehttp/guzzle/src/Client.php line 131
    GuzzleHttp\Promise\Promise->wait()
10. /var/www/lib/private/Http/Client/Client.php line 161
    GuzzleHttp\Client->request("get", "https://col.mic ... y", {verify: false,t ... e})
11. /var/www/apps/richdocuments/lib/WOPI/DiscoveryManager.php line 106
    OC\Http\Client\Client->get("https://col.mic ... y", {timeout: 5,verify: false})
12. /var/www/apps/richdocuments/lib/WOPI/DiscoveryManager.php line 78
    OCA\Richdocuments\WOPI\DiscoveryManager->fetchFromRemote()
13. /var/www/apps/richdocuments/lib/WOPI/Parser.php line 41
    OCA\Richdocuments\WOPI\DiscoveryManager->get()
14. /var/www/apps/richdocuments/lib/TokenManager.php line 183
    OCA\Richdocuments\WOPI\Parser->getUrlSrc("application/vnd.oasis.opendocument.text")
15. /var/www/apps/richdocuments/lib/Controller/DocumentController.php line 236
    OCA\Richdocuments\TokenManager->getToken("*** sensitive parameters replaced ***")
16. /var/www/lib/private/AppFramework/Http/Dispatcher.php line 166
    OCA\Richdocuments\Controller\DocumentController->index("*** sensitive parameter replaced ***")
17. /var/www/lib/private/AppFramework/Http/Dispatcher.php line 99
    OC\AppFramework\Http\Dispatcher->executeController(OCA\Richdocument ... {}, "index")
18. /var/www/lib/private/AppFramework/App.php line 126
    OC\AppFramework\Http\Dispatcher->dispatch(OCA\Richdocument ... {}, "index")
19. /var/www/lib/private/AppFramework/Routing/RouteActionHandler.php line 47
    OC\AppFramework\App::main("OCA\\Richdocume ... r", "index", OC\AppFramework\ ... {}, {_route: "richdocuments.document.index"})
20. <<closure>>
    OC\AppFramework\Routing\RouteActionHandler->__invoke({_route: "richdocuments.document.index"})
21. /var/www/lib/private/Route/Router.php line 297
    undefinedundefinedcall_user_func(OC\AppFramework\ ... {}, {_route: "richdocuments.document.index"})
22. /var/www/lib/base.php line 975
    OC\Route\Router->match("/apps/richdocuments/index")
23. /var/www/index.php line 42
    OC::handleRequest()

GET /index.php/apps/richdocuments/index?fileId=79900&requesttoken={hidden}
from IP by user at 2019-11-06T17:19:36+00:00

The directions I used and copied were these:

Any thoughts?

We have the same problem.

what exactly is online?

means that your proxy config don’t work or the service at https://127.0.0.1:9980/hosting/discovery is not responding.

<VirtualHost *:443>
ServerName office.nextcloud.com:443

# static html, js, images, etc. served from loolwsd
# loleaflet is the client part of LibreOffice Online
ProxyPass           /loleaflet https://127.0.0.1:9980/loleaflet retry=0
ProxyPassReverse    /loleaflet https://127.0.0.1:9980/loleaflet

what did you check?

curl https://127.0.0.1:9980/hosting/discovery
or
curl https://office.nextcloud.com:443/hosting/discovery
# netstat -lnpt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:38927         0.0.0.0:*               LISTEN      22259/containerd    
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      1565/systemd-resolv 
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      721/sshd            
tcp        0      0 127.0.0.1:9980          0.0.0.0:*               LISTEN      6871/docker-proxy   
tcp6       0      0 :::80                   :::*                    LISTEN      28722/apache2       
tcp6       0      0 :::22                   :::*                    LISTEN      721/sshd            
tcp6       0      0 :::443                  :::*                    LISTEN      28722/apache2
# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                      NAMES
684efd3553cd        collabora/code      "/bin/sh -c 'bash st…"   5 days ago          Up 4 minutes        127.0.0.1:9980->9980/tcp   frosty_cartwright
# curl https://127.0.0.1:9980/hosting/discovery
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to 127.0.0.1:9980

# curl http://127.0.0.1:9980/hosting/discovery
curl: (52) Empty reply from server

# curl https://mydomain.com:443/hosting/discovery
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>502 Proxy Error</title>
</head><body>
<h1>Proxy Error</h1>
<p>The proxy server received an invalid
response from an upstream server.<br />
The proxy server could not handle the request<p>Reason: <strong>Error reading from remote server</strong></p></p>
<hr>
<address>Apache/2.4.29 (Ubuntu) Server at mydomain.com Port 443</address>
</body></html>
# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain DOCKER (0 references)
target     prot opt source               destination         

Chain DOCKER-ISOLATION-STAGE-1 (0 references)
target     prot opt source               destination         

Chain DOCKER-ISOLATION-STAGE-2 (0 references)
target     prot opt source               destination         

Chain DOCKER-USER (0 references)
target     prot opt source               destination 

may you try

curl -v https://127.0.0.1:9980/hosting/discovery
# curl -v https://127.0.0.1:9980/hosting/discovery
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 9980 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to 127.0.0.1:9980
* Closing connection 0
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to 127.0.0.1:9980

your ssl connection is causing the trouble.

maybe you’ll find the answer there:

This is usually the case if the other side is simply closing the connection. Microsoft SChannel does this on many kind of handshake problems instead of sending a TLS alert back. This can happen for problems like invalid protocol or no common ciphers etc. It also can happen if you try to do a TLS handshake with a server which does not speak TLS at all on this port. Look at logs at the server side for problems

That doesn’t make any sense, SSL work with Apache, because if I go to the domain of the server with https in front, it works. So that means that the default Docker instance from Collabora is messed up and not working, since that’s what creates that 127.0.0.1:9980 channel.

the “proxypass” goes to https://127.0.0.1:9980/
therefore that connection is also ssl/tls encrypted.

checking the start_script of the container you’ll find that selfsigned certs are created on the fly.

nevertheless the coolabora container is based on ubuntu16 and your curl output says that curl tries to speek TLSv1.3. on a normal ubuntu16 there would be no TLSv1.3.

i would try curl -v --tlsv1.2 https://127.0.0.1:9980/hosting/discovery next and find out why TLSv1.3 is default.

but that’s just guessing.

Same error. I’m on Ubuntu 18.04.3, would that cause issues?

to me something is broken with your collabora container. did you check the logs sudo docker logs frosty_cartwright

wsd-00029-00030 2019-11-12 17:03:22.699303 [ prisoner_poll ] TRC  Poll completed with 0 live polls max (5000ms)(timedout)| ./net/Socket.hpp:497
frk-00031-00031 2019-11-12 17:03:23.184603 [ forkit ] TRC  Finished lok_preinit(/opt/collaboraoffice6.0/program", "file:///user") in 19904 ms.| kit/Kit.cpp:2557
frk-00031-00031 2019-11-12 17:03:23.185785 [ forkit ] ERR  Error: forkit has more than a single thread after pre-init| kit/ForKit.cpp:547
frk-00031-00031 2019-11-12 17:03:23.185867 [ forkit ] INF  Preinit stage OK.| kit/ForKit.cpp:549
frk-00031-00031 2019-11-12 17:03:23.197731 [ forkit ] DBG  Forking a loolkit process with jailId: KPuMeG2RVB33gDRN as spare loolkit #1.| kit/ForKit.cpp:256
frk-00031-00031 2019-11-12 17:03:23.197973 [ forkit ] ERR  Fork failed. (ENOMEM: Cannot allocate memory)| kit/ForKit.cpp:293
frk-00031-00031 2019-11-12 17:03:23.200641 [ forkit ] FTL  Failed to create a kit process.| kit/ForKit.cpp:557

looks normal.

is there something like:

Nov 12 19:43:14 ip-172-31-75-114 loolwsd[3576]: wsd-03576-03576 2019-11-12 19:43:14.585476 [ loolwsd ] INF  Loolwsd version details: 4.0.8 - 2fc9aba| wsd/LOOLWSD.
Nov 12 19:43:14 ip-172-31-75-114 loolwsd[3576]: wsd-03576-03576 2019-11-12 19:43:14.585610 [ loolwsd ] INF  SSL Cert file: /etc/loolwsd/cert.pem| wsd/LOOLWSD.cpp:
Nov 12 19:43:14 ip-172-31-75-114 loolwsd[3576]: wsd-03576-03576 2019-11-12 19:43:14.585792 [ loolwsd ] INF  SSL Key file: /etc/loolwsd/key.pem| wsd/LOOLWSD.cpp:11
Nov 12 19:43:14 ip-172-31-75-114 loolwsd[3576]: wsd-03576-03576 2019-11-12 19:43:14.585907 [ loolwsd ] INF  SSL CA file: /etc/loolwsd/ca-chain.cert.pem| wsd/LOOLW
Nov 12 19:43:14 ip-172-31-75-114 loolwsd[3576]: wsd-03576-03576 2019-11-12 19:43:14.586023 [ loolwsd ] INF  SSL Cipher list: | wsd/LOOLWSD.cpp:1202
Nov 12 19:43:14 ip-172-31-75-114 loolwsd[3576]: wsd-03576-03576 2019-11-12 19:43:14.589707 [ loolwsd ] INF  Registering filesystem for space checks: [/opt/lool/ch
N

Yep

wsd-00029-00029 2019-11-12 17:03:02.534737 [ loolwsd ] INF  Loolwsd version details: 4.0.8 - 2fc9aba| wsd/LOOLWSD.cpp:3124
wsd-00029-00029 2019-11-12 17:03:02.535510 [ loolwsd ] INF  SSL Cert file: /etc/loolwsd/cert.pem| wsd/LOOLWSD.cpp:1193
wsd-00029-00029 2019-11-12 17:03:02.535696 [ loolwsd ] INF  SSL Key file: /etc/loolwsd/key.pem| wsd/LOOLWSD.cpp:1196
wsd-00029-00029 2019-11-12 17:03:02.535772 [ loolwsd ] INF  SSL CA file: /etc/loolwsd/ca-chain.cert.pem| wsd/LOOLWSD.cpp:1199
wsd-00029-00029 2019-11-12 17:03:02.535814 [ loolwsd ] INF  SSL Cipher list: | wsd/LOOLWSD.cpp:1202
wsd-00029-00029 2019-11-12 17:03:02.574726 [ loolwsd ] INF  Registering filesystem for space checks: [/opt/lool/child-roots/.]| common/FileUtil.cpp:201
wsd-00029-00029 2019-11-12 17:03:02.576078 [ loolwsd ] INF  Registering filesystem for space checks: [/var/cache/loolwsd/.]| common/FileUtil.cpp:201
wsd-00029-00029 2019-11-12 17:03:02.576943 [ loolwsd ] DBG  FileServerRoot: /usr/share/loolwsd| wsd/LOOLWSD.cpp:3173
wsd-00029-00029 2019-11-12 17:03:02.583924 [ loolwsd ] DBG  #14 Thread affinity set to 0x7fe290369740.| ./net/Socket.hpp:319
wsd-00029-00029 2019-11-12 17:03:02.585078 [ loolwsd ] INF  Listening to prisoner connections on port 9981| wsd/LOOLWSD.cpp:3055
wsd-00029-00029 2019-11-12 17:03:02.586038 [ loolwsd ] DBG  Inserting socket #14 into prisoner_poll| ./net/Socket.hpp:637
wsd-00029-00029 2019-11-12 17:03:02.586827 [ loolwsd ] DBG  #14 Thread affinity set to 0 (was 0x7fe290369740).| ./net/Socket.hpp:279
wsd-00029-00029 2019-11-12 17:03:02.587133 [ loolwsd ] TRC  Waiting for a new child for a max of 1000000 ms.| wsd/LOOLWSD.cpp:3204
wsd-00029-00030 2019-11-12 17:03:02.587394 [ prisoner_poll ] INF  Thread 30 (7fe28c25e700) of process 29 formerly unnamed is now called [prisoner_poll].| common/Util.cpp:524
wsd-00029-00030 2019-11-12 17:03:02.587717 [ prisoner_poll ] INF  Starting polling thread [prisoner_poll] with thread affinity set to 0x7fe28c25e700.| net/Socket.cpp:167
wsd-00029-00030 2019-11-12 17:03:02.587788 [ prisoner_poll ] TRC  Poll completed with 1 live polls max (5000ms)| ./net/Socket.hpp:497

sorry. running out of ideas.

last chances: sudo docker logs frosty_cartwright | egrep -i 'ERR|FAIL'
and/or remove the container and start again.

if you don’t get an answer here you try open an issue at github. https://github.com/CollaboraOnline/Docker-CODE/issues

p.s. curl -v on my test machine looks like this. also TLSv1.3 on an Ubuntu 18.04 host.

$ curl -v https://127.0.0.1:9980/hosting/discovery --insecure
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 9980 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (OUT), TLS change cipher, Client hello (1):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS Unknown, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Unknown (8):
* TLSv1.3 (IN), TLS Unknown, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS Unknown, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS Unknown, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS Unknown, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: CN=
*  start date: Nov 12 18:56:58 2019 GMT
*  expire date: Nov  9 18:56:58 2029 GMT
*  issuer: CN=
*  SSL certificate verify result: self signed certificate in certificate chain (19), continuing anyway.
* TLSv1.3 (OUT), TLS Unknown, Unknown (23):
> GET /hosting/discovery HTTP/1.1
> Host: 127.0.0.1:9980
> User-Agent: curl/7.58.0
> Accept: */*
>
* TLSv1.3 (IN), TLS Unknown, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS Unknown, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS Unknown, Unknown (23):
< HTTP/1.1 200 OK
< Last-Modified: Tue, 12 Nov 2019 20:26:58 GMT
< User-Agent: LOOLWSD WOPI Agent 4.0.8
< Content-Length: 17996
< Content-Type: text/xml
< X-Content-Type-Options: nosniff
<
<wopi-discovery>
    <net-zone name="external-http">
        <app name="image/svg+xml">
            <action ext="svg" name="view" urlsrc="https://127.0.0.1:9980/loleaflet/2fc9aba/loleaflet.html?"/>
        </app>
        <app name="application/vnd.ms-powerpoint">
            <action ext="pot" name="edit" urlsrc="https://127.0.0.1:9980/loleaflet/2fc9aba/loleaflet.html?"/>
        </app>
        <app name="application/vnd.ms-excel">
            <action ext="xla" name="edit" urlsrc="https://127.0.0.1:9980/loleaflet/2fc9aba/loleaflet.html?"/>
        </app>

        <!-- Writer documents -->
        <app name="application/vnd.sun.xml.writer">
            <action ext="sxw" name="view" urlsrc="https://127.0.0.1:9980/loleaflet/2fc9aba/loleaflet.html?"/>
        </app>
        <app name="application/vnd.oasis.opendocument.text">
            <action ext="odt" name="edit" urlsrc="https://127.0.0.1:9980/loleaflet/2fc9aba/loleaflet.html?"/>

No prob, I’ll try posting there also. Here is the grep.

wsd-00029-00029 2019-11-13 00:17:59.190768 [ loolwsd ] FTL  Failed to fork child processes.| wsd/LOOLWSD.cpp:3208
FATAL: Failed to fork child processes.                                    wsd-00029-00029 2019-11-13 00:17:59.204735 [ loolwsd ] FTL  Failed to fork child processes.| wsd/LOOLWSD.cpp:3380
Failed to fork child processes.                                           wsd-00029-00029 2019-11-13 00:18:02.268920 [ loolwsd ] TRC  Reading file: '/usr/share/loolwsd/loleaflet/dist/l10n/uno/es-override.json as '/loleaflet/dist/l10n/uno/es-override.json'| wsd/FileServer.cpp:478                 wsd-00029-00029 2019-11-13 00:18:02.368923 [ loolwsd ] TRC  Reading file: '/usr/share/loolwsd/loleaflet/dist/l10n/uno/de-override.json as '/loleaflet/dist/l10n/uno/de-override.json'| wsd/FileServer.cpp:478                 wsd-00029-00029 2019-11-13 00:18:02.441856 [ loolwsd ] TRC  Reading file: '/usr/share/loolwsd/loleaflet/dist/l10n/uno-localizations-override.json as '/loleaflet/dist/l10n/uno-localizations-override.json'| wsd/FileServer.cpp:478
wsd-00029-00029 2019-11-13 00:18:02.803519 [ loolwsd ] DBG  FileServerRoot: /usr/share/loolwsd| wsd/LOOLWSD.cpp:3173
preload: merged unordf ucpchelp1 msforms vbaobj pcr vbaswobj sw animcore hwp flash chartcore solver sc wpftcalc xof ucpcmis1 wpftdraw sd svgfilter evtatt ucpftp1 graphicfilter wpftimpress sdfilt sm:failed                  :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                    pdffilter PresentationMinimizer rptxml:failed                            :failed                                                                   :failed                                                                   :failed                                                                    protocolhandler ucpdav1 wpftwriter msword writerfilter t602filter xmlfa basctl binaryurp uuresolver scd chartcontroller ldapbe2 dba sdbt dbu:failed:failed                                                                   :failed                                                                    dbmm:failed                                                              :failed                                                                   :failed                                                                    deploymentgui migrationoo2 migrationoo3 xsltfilter sdd embobj emboleobj log expwrap odfflatxml textfd storagefd xmlfd frm fwl fwm io textconversiondlgs smd:failed                                                            mozbootstrap oox scfilt slideshow proxyfac cairocanvas vclcanvas canvasfactory mtfrenderer simplecanvas oglcanvas rptui:failed                     :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                    rpt:failed                                                               :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                    dlgprov basprov stringresource dbaxml:failed                              mork odbc sdbc2 calc dbase flat writer xsec_xmlsec reflection bootstrap introspection invocation invocadapt namingservice stocservices cmdmail syssh cached1 ucphier1 ucpimage ucppkg1 srtrs1 ucptdoc1 xsltdlg swd cui bib guesslang offacc:failed                                                     :failed                                                                    scn scriptframe dbpool2 xmlsecurity analysis date pricing fps_office:failed
:failed                                                                    i18nsearch wizards.agenda.CallWizard wizards.fax.CallWizard wizards.letter.CallWizard emfio vbaevents PresenterScreen:failed                        pdfimport abp:failed                                                      dbp:failed                                                               :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   :failed                                                                   frk-00031-00031 2019-11-13 00:18:21.361622 [ forkit ] ERR  Error: forkit has more than a single thread after pre-init| kit/ForKit.cpp:547
frk-00031-00031 2019-11-13 00:18:21.379900 [ forkit ] ERR  Fork failed. (ENOMEM: Cannot allocate memory)| kit/ForKit.cpp:293
frk-00031-00031 2019-11-13 00:18:21.383806 [ forkit ] FTL  Failed to create a kit process.| kit/ForKit.cpp:557

What command line did you use to create/start the collabora container?

The same command that was on the Nextcloud link I posted in my OP. I gave up, downgraded to Ubuntu 16, and re-installed. Now it works.