Run AOI containers under non-root user

I am installing the NextCloud All In One (AIO) appliance on my Raspberry pi. I used the following command to install:

sudo docker run --init --sig-proxy=false --name nextcloud-aio-mastercontainer --restart always --publish 8080:8080 --volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config --volume /var/run/docker.sock:/var/run/docker.sock:ro --env NEXTCLOUD_DATADIR=/srv/dev-disk/data --env SKIP_DOMAIN_VALIDATION=true --env APACHE_PORT=11000 --env APACHE_IP_BINDING= --env PUID=1001 --env PGID=1001 nextcloud/all-in-one:latest

Somehow the container still gets started under the root user in Linux. And also all the AIO containers are run under root.
The problem with that is security, if an attacker gets access to AIO containers, they can also get root to the full box.
In addition, now all files get written to disk under O=www-data and G=root. Which means non of the other users on the device can access the files.

Is there a way to force the containers to run under a less privileged user? And is there a possibility to make sure the files get written under a specified user?

Hi, see all-in-one/ at main · nextcloud/all-in-one · GitHub

I don’t want to install Docker itself rootless.
I just want the containers to run under a different user.
Normally you can do that with specifying the PUID and PGID in your docker file.
AIO seems to ignore that.

Yes, indeed AIO does not support PUID and also not PGID due to technical reasons.

1 Like

Thanks, so if I want to run the containers with a non-root user. I should setup my own dockerfile I assume?

Thanks for the very quick help! Really appreciated