Permission denied writing config file - external directories (Docker rootless)

[SuperGripM]

Hello,

I've been testing OC 4.0.0 and when I decided to move the directories from docker volumes to host directories, I'm getting a permission denied while creating config files, on container launch.

Docker is running rootless, as uid:gid 1000:1000 (matches the compose file).

The directories were created by user 1000 and have rwx permissions for that user.
I've tried explicitly stating the user in the compose file, to no avail.

I tried starting anew, but it still does the same. If I comment out the external storage lines, it'll start perfectly fine on the internal volumes.

What might be wrong here?

[micbar]

That is a problem of docker. Mounted config files are always mounted as root. Maybe that becomes a problem when running docker rootless.

[SuperGripM]

I had a suspicion it was related to Docker and not Opencloud.
Are you aware of any workarounds for this? Or do I have no other option than running it on Docker volumes?

[xImMoRtALitY99]

You have to check the UID of the Opencloud Docker Process and change the file and folder owner to that one. At least that worked for me.

[SuperGripM]

Thank you. The UID is listed as the user that's also running the Docker daemon (makes sense). That's also the owner of the directories.
The only difference is that running docker inspect $(docker ps -q) --format '{{.Config.User}} {{.Name}}' shows UID:GUID, whereas docker top [process] results in the explicit username. The compose file is in UID:GUID format, but that should make no difference shouldnt it?

[xImMoRtALitY99]

Thank you. The UID is listed as the user that's also running the Docker daemon (makes sense). That's also the owner of the directories. The only difference is that running docker inspect $(docker ps -q) --format '{{.Config.User}} {{.Name}}' shows UID:GUID, whereas docker top [process] results in the explicit username. The compose file is in UID:GUID format, but that should make no difference shouldnt it?

I'm currently not sure if rootless docker works as expected with the UID/GID mapping as any UID/GID inside the container is a high digit number on the host itself(usually 100000+). In my test setup I removed the "user" flag from my compose file and mounted the config and data folder as host directories. For the first start I needed to change the permission of both folders to 777 to give any UID write access to those folders as I didn't know which one docker is going to use. With those permissions the Opencloud container should be able to create the config file. Then you can check the UID/GID of that file outside the container, adjust the owner/group of the config and data directory accordingly and change the folders permission back to the previous state.

[SuperGripM]

Thank you, that did it. I'm fighting other issues now but that seems to have sorted that out.
Strangely, I also used Immich in the past which runs directly on the existing folder system, and I had to do no such thing - it just worked out the box, rootless, with the daemon and compose UID:GUID matching the actual ownership. I won't try to understand why as I'm pretty much illiterate when it comes to Docker, but just saying it FWIW.