Opensuse vs Nextcloud-AIO Docker user wwwrun vs www-data

[OmeLuuk]

Thanks for taking time to demystify

@jtr

Is it sane to manually create a passwordless www-data system user?

Depends on what you’re trying to accomplish.

I also look and sometimes inspect files in my data dir, there I noticed an “unknown user” (no mapping from 33 to username)

@jtr

Is it really needed at all?

No, not on the host. It is needed in the container.

I see that, having read something about Docker and used user. Indeed there the user 33 (www-data) does exist.

@jtr

Would it be ok to use a different user (like in my case wwwrun instead of www-data)?

On your host or in the container? Keep in mind that the username is mostly (though not entirely) cosmetic. The important part is the uid:gid (33:33).

Yeah, I figured that it would be possible to somehow map the used uid:gid in the container to the wwwrun:www on the host system, so that the internally used (docker) user would map to the legit host user/group. This only to avoid possible “ghost” actions with “ghost” users.

@jtr

You could also run rootless as another option.

Well that is an interesting option, because when I run the nextcloud-aio-nextcloud container as a normal user or with the sudo command, both reveal that the user in the container still holds root ID:
$ sudo docker exec -it nextcloud-aio-nextcloud id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)
$ docker exec -it nextcloud-aio-nextcloud id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)

So this would mean that even if you do not run the nextcloud-aio master container as root, it still runs with root permissions and hence can alter all permissions in the attached volumes. That explains why the /cloud folder showed files with id 33 even when that user did not exist on the host system.

But this also raises an eyebrow on my side: should the mastercontainer really need uid=0?