So writing this as I havent seen this posted anywhere here as clearly and if this saves someone time or prompts some update, great.
I run Nextcloud in a container also with portainer-ce but thee method should work in any used method.
After a restart of my container the twofactor backend of my container failed for some reason. My setup also has twofactor enforced for all users. As the result of these two things together I could no longer log into my nextcloud, with either my personal or my admin account. Removing or disabling twofactor methods from my user had no effect, the system still wanted second factor authentication. For reasons unknown even the backup codes didn’t work, the interface informed me the code was invalid.
The solution: For me to enter the container console as user 33 to get the correct permission. Then use the occ to install Two-Factor Admin Support. Then use it to create a one-time code for my admin account. That apparently triggered something that allowed me to log in and remove the totp backend and reinstall it. After that the system just started to work for all users.
For those in need, commands were:
“./occ app:install twofactor_admin”
Now in my case the twofactor-admin failed to install as it wasn’t supported with version 24 but adding the “–force” behind made it install.
"./occ twofactorauth:admin:generate-code
An issue to note with the Two-Factor Admin Support. For some reason it allows all users to generate codes to other users accounts, so limiting the who can use it to a select group, like admins or disabling after use is highly recommendable.