wonderfall / docker-nextcloud

All-in-one Nextcloud Docker image, based on Alpine Linux. Aims at being simple and hardened.

wonderfall/nextcloud

⚠️ This image is OBSOLETE. If you're still using this, you should upgrade your server as soon as possible to apply security fixes. You can migrate to another image, or make your own based on this repository. Thanks for sticking by all these years!

The self-hosted productivity platform that keeps you in control.

About

This non-official image is intended as an all-in-one (as in monolithic) Nextcloud production image. If you're not sure you want this image, you should probably use the official image. The main goal is to provide an easy-to-use image with decent security standards.

Check out Nextcloud official website and source code.

---

• Features
• Security
• Tags
• Build-time variables
• Environment variables
  • Runtime
  • Startup
• Volumes
• Ports
• Migration
• Usage

Features

• Based on Alpine Linux.
• Fetching PHP/nginx from their official images.
• Rootless: no privilege at any time, even at startup.
• Uses s6 as a lightweight process supervisor.
• Supports MySQL/MariaDB, PostgresQL and SQLite3 database backends.
• Includes OPcache and APCu for improved caching & performance, also supports redis.
• Tarball integrity & authenticity checked during build process.
• Includes hardened_malloc, a hardened memory allocator.
• Includes Snuffleupagus, a PHP security module.
• Includes a simple built-in cron system.
• Much easier to maintain thanks to multi-stages build.
• Does not include imagick, samba, etc. by default.

You're free to make your own image based on this one if you want a specific feature. Uncommon features won't be included as they can increase attack surface: this image intends to stay minimal, but functional enough to cover basic needs.

Security

Don't run random images from random dudes on the Internet. Ideally, you want to maintain and build it yourself.

• Images are scanned every day by Trivy for OS vulnerabilities. Known vulnerabilities will be automatically uploaded to GitHub Security Lab for full transparency. This also warns me if I have to take action to fix a vulnerability.
• Latest tag/version is automatically built weekly, so you should often update your images regardless if you're already using the latest Nextcloud version.
• Build production images without cache (use docker build --no-cache for instance) if you want to build your images manually. Latest dependencies will hence be used instead of outdated ones due to a cached layer.
• A security module for PHP called Snuffleupagus is used by default. This module aims at killing entire bug and security exploit classes (including XXE, weak PRNG, file-upload based code execution), thus raising the cost of attacks. For now we're using a configuration file derived from the default one, with some explicit exceptions related to Nextcloud. This configuration file is tested and shouldn't break basic functionality, but it can cause issues in specific and untested use cases: if that happens to you, get logs from either syslog or /nginx/logs/error.log inside the container, and open an issue. You can also disable the security module altogether by changing the PHP_HARDENING environment variable to false before recreating the container.
• Images are signed with the GitHub-provided OIDC token in Actions using the experimental "keyless" signing feature provided by cosign. You can verify the image signature using cosign as well:

COSIGN_EXPERIMENTAL=true cosign verify ghcr.io/wonderfall/nextcloud

Verifying the signature isn't a requirement, and might not be as seamless as using Docker Content Trust (which is not supported by GitHub's OCI registry). However, it's strongly recommended to do so in a sensitive environment to ensure the authenticity of the images and further limit the risk of supply chain attacks.

Tags

• latest : latest Nextcloud version
• x : latest Nextcloud x.x (e.g. 24)
• x.x.x : Nextcloud x.x.x (e.g. 24.0.0)

You can always have a glance here. Only the latest stable version will be maintained by myself.

Note: automated builds only target linux/amd64 (x86_64). There is no technical reason preventing the image to be built for arm64 (in fact you can build it yourself), but GitHub Actions runners are limited in memory, and this limit makes it currently impossible to target both platforms.

Build-time variables

Variable	Description	Default
NEXTCLOUD_VERSION	version of Nextcloud	*
ALPINE_VERSION	version of Alpine Linux	*
PHP_VERSION	version of PHP	*
NGINX_VERSION	version of nginx	*
HARDENED_MALLOC_VERSION	version of hardened_malloc	*
SNUFFLEUPAGUS_VERSION	version of Snuffleupagus (php ext)	*
SHA256_SUM	checksum of Nextcloud tarball (sha256)	*
GPG_FINGERPRINT	fingerprint of Nextcloud GPG key	*
UID	user id	1000
GID	group id	1000
CONFIG_NATIVE	native code for hardened_malloc	false
VARIANT	variant of hardened_malloc (see repo)	light

* latest known available, likely to change regularly

For convenience they were put at the very top of the Dockerfile and their usage should be quite explicit if you intend to build this image yourself. If you intend to change NEXTCLOUD_VERSION, change SHA256_SUM accordingly.

Environment variables

Runtime

Variable	Description	Default
UPLOAD_MAX_SIZE	file upload maximum size	10G
APC_SHM_SIZE	apc shared memory size	128M
OPCACHE_MEM_SIZE	opcache available memory	128M
MEMORY_LIMIT	max php command mem usage	512M
CRON_PERIOD	cron time interval (min.)	5m
CRON_MEMORY_LIMIT	cron max memory usage	1G
DB_TYPE	sqlite3, mysql, pgsql	sqlite3
DOMAIN	host domain	localhost
PHP_HARDENING	enables snuffleupagus	true

Leave them at default if you're not sure what you're doing.

Startup

Variable	Description
ADMIN_USER	admin username
ADMIN_PASSWORD	admin password
DB_TYPE	sqlite3, mysql, pgsql
DB_NAME	name of the database
DB_USER	name of the database user
DB_PASSWORD	password of the db user
DB_HOST	database host

ADMIN_USER and ADMIN_PASSWORD are optional and mainly for niche purposes. Obviously, avoid clear text passwords. Once setup.sh has run for the first time, these variables can be removed. You should then edit /nextcloud/config/config.php directly if you want to change something in your configuration.

The usage of Docker secrets will be considered in the future, but config.php already covers quite a lot.

Volumes

Variable	Description
/data	data files
/nextcloud/config	config files
/nextcloud/apps2	3rd-party apps
/nextcloud/themes	custom themes
/php/session	PHP session files

Note: mounting /php/session isn't required but could be desirable in some circumstances.

Ports

Port	Use
8888 (tcp)	Nextcloud web

A reverse proxy like Traefik or Caddy can be used, and you should consider:

• Redirecting all HTTP traffic to HTTPS
• Setting the HSTS header correctly

Migration

From now on you'll need to make sure all volumes have proper permissions. The default UID/GID is now 1000, so you'll need to build the image yourself if you want to change that, or you can just change the actual permissions of the volumes using chown -R 1000:1000. The flexibility provided by the legacy image came at some cost (performance & security), therefore this feature won't be provided anymore.

Other changes that should be reflected in your configuration files:

• /config volume is now /nextcloud/config
• /apps2 volume is now /nextcloud/apps2
• ghcr.io/wonderfall/nextcloud is the new image location

You should edit your docker-compose.yml and config.php accordingly.

Usage

To do.

docker-nextcloud's Issues

Redirect Error

Hi,

I deploy a stack on my swarm with this compose:

version: '3'

networks:
  nextcloud_network:
    external: false
  proxy_private:
    external: true

volumes:
  nextcloud-data:
  nextcloud-db:
  nextcloud-redis:
  nextcloud-config:
  nextcloud-apps:
  nextcloud-themes:

services:
  nextcloud:
    image: wonderfall/nextcloud
    depends_on:
      - mariadb                # If using MySQL
      - redis                  # If using Redis
    environment:
      - UID=1000
      - GID=1000
      - UPLOAD_MAX_SIZE=10G
      - APC_SHM_SIZE=128M
      - OPCACHE_MEM_SIZE=128
      - CRON_PERIOD=15m
      - TZ=America/Sao_Paulo
      - DOMAIN=cloud.domain.com
      - DB_TYPE=mysql
      - DB_NAME=nextcloud
      - DB_USER=nextcloud
      - DB_PASSWORD=supersecretpassword
      - DB_HOST=mariadb
      - ADMIN_USER=admin           # Don't set to configure through browser
      - ADMIN_PASSWORD=admin  
    volumes:
      - 'nextcloud-data:/data'
      - 'nextcloud-config:/config'
      - 'nextcloud-apps:/apps2'
      - 'nextcloud-themes:/nextcloud/themes'
    networks:
      - nextcloud_network
      - proxy_private
    deploy:
      placement: {constraints: ['node.labels.type == nextcloud']}
      update_config: {parallelism: 1, delay: 10s}
      restart_policy: {condition: on-failure}
      labels: 
        - caddy.address=cloud.domain.com
        - caddy.targetport=8888

  # If using MySQL

  mariadb:
    image: bianjp/mariadb-alpine
    environment:
      MYSQL_ROOT_PASSWORD: supersecretpassword
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_PASSWORD: supersecretpassword
    volumes:
      - nextcloud-db:/var/lib/mysql
    networks:
      - nextcloud_network
    deploy:
      placement: {constraints: ['node.labels.type == nextcloud']}
      update_config: {parallelism: 1, delay: 10s}
      restart_policy: {condition: on-failure}

  # If using Redis
  redis:
    image: redis:alpine
    volumes:
      - nextcloud-redis:/data
    networks:
      - nextcloud_network
    deploy:
      placement: {constraints: ['node.labels.type == nextcloud']}
      update_config: {parallelism: 1, delay: 10s}
      restart_policy: {condition: on-failure}

And i'm using caddy as reverse proxy.

After successfully installation, Nextcloud redirects me to http://nextcloud_nextcloud:8888/apps/files/ instead of https://cloud.domain.com/apps/files/

Cloud u help me?

Nextcloud is not able to automatically generate favicons

It seams PHP module imagick and/or SVG support for imagick (e.g. libmagickcore5-extra) are missing.

These modules are needed according to Nextcloud documentation

[Suggestion] Allow us to SSH into the container

Currently, if we try to SSH into the container via docker exec, we get this:

(user)@(server):~/folder1$ docker exec -i -t (container id) bash OCI runtime exec failed: exec failed: container_linux.go:348: starting container process caused "exec: \"bash\": executable file not found in $PATH": unknown

Nextcloud 16 update

Hi there,

I wanted to notify you that there is an update for it, it's version 16 and their repo is here:
https://github.com/nextcloud/docker
If you'd let me know how to track changes between versions, I think if the version 17 will come in the future I could make a pull request next time.

I really appreciate your time in that project. Thanks!

can't download big files > 200MB

Hi, Is there any here experiencing can't download > 200mb size of file?

Imposible to resolve "/.well-known/webfinger" & "/.well-known/nodeinfo"

Hi,

Following warnings are raised by Nextcloud:

Your web server is not properly set up to resolve "/.well-known/webfinger". Further information can be found in the documentation.
Your web server is not properly set up to resolve "/.well-known/nodeinfo". Further information can be found in the documentation.

Requested Rebuild at Dockerhub?

We're up to 13.0.2. Could you do a rebuild for us?

Thanks!

how to add ffmpeg to docker-compose.yml ?

how to add ffmpeg to docker-compose.yml ?

From wonderfall/nextcloud migrate to ghcr.io/wonderfall/nextcloud:22 appear exception

From wonderfall/nextcloud migrate to ghcr.io/wonderfall/nextcloud:22 appear exception

When I has edited the docker-compose.yml and start the docker, I visit to the nextcloud web, The nextcloud prompts me to update, When I click the update button, It shows me some exception.

Exception: Updates between multiple major versions and downgrades are unsupported.

my new docker-compose.yml

version: '3'

networks:
nextcloud_network:
external: false

services:
nextcloud:
image: ghcr.io/wonderfall/nextcloud:22
depends_on:
- nextcloud-db # If using MySQL
- redis # If using Redis
environment:
- UID=1000
- GID=1000
- UPLOAD_MAX_SIZE=10G
- APC_SHM_SIZE=128M
- OPCACHE_MEM_SIZE=128
- CRON_PERIOD=15m
- TZ=Europe/Berlin
- DOMAIN=localhost
- ADMIN_USER=xxx
- ADMIN_PASSWORD=xxx
- DB_TYPE=mysql
- DB_NAME=nextcloud
- DB_USER=nextcloud
- DB_PASSWORD=xxx
- DB_HOST=nextcloud-db
volumes:
- /data/nextcloud/html/data:/data
- /data/nextcloud/html/config:/nextcloud/config
- /data/nextcloud/html/apps:/nextcloud/apps2
- /data/nextcloud/html/themes:/nextcloud/themes
networks:
- nextcloud_network
ports:
- 8888:8888

nextcloud-db:
image: mariadb
volumes:
- /data/mariadb/datadir:/var/lib/mysql
- /data/mariadb/conf.d/:/etc/mysql/conf.d/
environment:
- MYSQL_ROOT_PASSWORD=xxx
- MYSQL_DATABASE=nextcloud
- MYSQL_USER=nextcloud
- MYSQL_PASSWORD=xxx
networks:
- nextcloud_network
ports:
- 3306:3306

redis:
image: redis:alpine
container_name: redis
volumes:
- /data/redis/data:/data
networks:
- nextcloud_network

Nextcloud is not installed - only a limited number of commands are available

Actually, it is not a real "migration" issue, as I give up migrating instances based on an elder image to the recent. Instead, I created a brand new environment with a docker-compose.yml. I tried both, downloading the latest image 22.1.0 ghcr.io/wonderfall/nextcloud:22 and building it from scratch, but on both versions I had the same issue:
In both cases - as in earlier versions from this year - even a fresh created instance does not initialize as given in the environment variables of docker-compose.yml.

Nextcloud container always comes up with a partially installed nextcloud, in the logs with messages like this.

nextcloud       | Automatic configuration finished.
nextcloud       | Nextcloud is not installed - only a limited number of commands are available
nextcloud       |
nextcloud       |
nextcloud       |  Command "app:disable" is not defined.
nextcloud       |
nextcloud       |
nextcloud       |  Do you want to run "app:check-code" instead?  (yes/no) [no]:

The docker-compose.yml is

version: '3'

networks:
  internal:
    external: false
  extern:
    external: true

services:
  db_nextcloud:
    container_name: db_nextcloud
    image: mariadb:10
    volumes:
      - ../volumes/db_nextcloud:/var/lib/mysql/
      - /etc/localtime:/etc/localtime:ro
    environment:
      - MYSQL_ROOT_PASSWORD=MYDBROOTPASSWORD
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_PASSWORD=MYDBPASSWORD
    restart: unless-stopped
    command: ['--innodb_read_only_compressed=OFF'] # added because of https://help.nextcloud.com/t/update-to-next-cloud-21-0-2-has-get-an-error/117028/27
    networks:
      - internal

  nextcloud:
    container_name: nextcloud
    # see https://github.com/Wonderfall/docker-nextcloud/pkgs/container/nextcloud for latest versions
    image: ghcr.io/wonderfall/nextcloud:22
    #build:
    #  context: ./docker-nextcloud
    depends_on:
      - db_nextcloud
    environment:
      - UID=1000
      - GID=1000
      - UPLOAD_MAX_SIZE=10G
      - APC_SHM_SIZE=128M
      - OPCACHE_MEM_SIZE=128
      - CRON_PERIOD=15m
      - TZ=Etc/UTC
      - ADMIN_USER=admin
      - ADMIN_PASSWORD=MYADMINPASSWD
      - DOMAIN=my.fqdn
      - DB_TYPE=mysql
      - DB_NAME=nextcloud
      - DB_USER=nextcloud
      - DB_PASSWORD=DBPASSWORD
      - DB_HOST=db_nextcloud
      - VIRTUAL_HOST=my.fqdn
    networks:
      - extern
      - internal
    volumes:
      - /var/lib/nextcloud/data:/data
      - ../volumes/nextcloud/config:/nextcloud/config
      - ../volumes/nextcloud/apps2:/nextcloud/apps2
      - ../volumes/nextcloud/themes:/nextcloud/themes
    labels:
      - "traefik.enable=true"
      - traefik.http.routers.nextcloud.rule=Host(`my.fqdn`) 
      - "traefik.http.routers.nextcloud.tls.certResolver=default"
      - "traefik.http.routers.nextcloud.tls=true"

Here the docker-compose output on docker-compose up after cleansing the volumes:

Building with native build. Learn about native build in Compose here: https://docs.docker.com/go/compose-native-build/
Creating network "compose_internal" with the default driver
Creating db_nextcloud ... done
Creating nextcloud    ... done
Attaching to nextcloud, db_nextcloud
db_nextcloud    | 2021-08-28 18:38:18+02:00 [Note] [Entrypoint]: Entrypoint script for MariaDB Server 1:10.6.4+maria~focal started.
db_nextcloud    | 2021-08-28 18:38:18+02:00 [Note] [Entrypoint]: Switching to dedicated user 'mysql'
db_nextcloud    | 2021-08-28 18:38:18+02:00 [Note] [Entrypoint]: Entrypoint script for MariaDB Server 1:10.6.4+maria~focal started.
db_nextcloud    | 2021-08-28 18:38:19+02:00 [Note] [Entrypoint]: Initializing database files
db_nextcloud    | 2021-08-28 18:38:19 0 [Warning] You need to use --log-bin to make --expire-logs-days or --binlog-expire-logs-seconds work.
nextcloud       | Starting automatic configuration...
nextcloud       | Automatic configuration finished.
nextcloud       | Nextcloud is not installed - only a limited number of commands are available
nextcloud       |
nextcloud       |
nextcloud       |  Command "app:disable" is not defined.
nextcloud       |
nextcloud       |
nextcloud       |  Do you want to run "app:check-code" instead?  (yes/no) [no]:
db_nextcloud    |
db_nextcloud    |
db_nextcloud    | PLEASE REMEMBER TO SET A PASSWORD FOR THE MariaDB root USER !
db_nextcloud    | To do so, start the server, then issue the following command:
db_nextcloud    |
db_nextcloud    | '/usr/bin/mysql_secure_installation'
db_nextcloud    |
db_nextcloud    | which will also give you the option of removing the test
db_nextcloud    | databases and anonymous user created by default.  This is
db_nextcloud    | strongly recommended for production servers.
db_nextcloud    |
db_nextcloud    | See the MariaDB Knowledgebase at https://mariadb.com/kb or the
db_nextcloud    | MySQL manual for more instructions.
db_nextcloud    |
db_nextcloud    | Please report any problems at https://mariadb.org/jira
db_nextcloud    |
db_nextcloud    | The latest information about MariaDB is available at https://mariadb.org/.
db_nextcloud    | You can find additional information about the MySQL part at:
db_nextcloud    | https://dev.mysql.com
db_nextcloud    | Consider joining MariaDB's strong and vibrant community:
db_nextcloud    | https://mariadb.org/get-involved/
db_nextcloud    |
db_nextcloud    | 2021-08-28 18:38:21+02:00 [Note] [Entrypoint]: Database files initialized
db_nextcloud    | 2021-08-28 18:38:21+02:00 [Note] [Entrypoint]: Starting temporary server
db_nextcloud    | 2021-08-28 18:38:21+02:00 [Note] [Entrypoint]: Waiting for server startup
db_nextcloud    | 2021-08-28 18:38:21 0 [Note] mysqld (server 10.6.4-MariaDB-1:10.6.4+maria~focal) starting as process 101 ...
db_nextcloud    | 2021-08-28 18:38:21 0 [Note] InnoDB: Compressed tables use zlib 1.2.11
db_nextcloud    | 2021-08-28 18:38:21 0 [Note] InnoDB: Number of pools: 1
db_nextcloud    | 2021-08-28 18:38:21 0 [Note] InnoDB: Using crc32 + pclmulqdq instructions
db_nextcloud    | 2021-08-28 18:38:21 0 [Note] mysqld: O_TMPFILE is not supported on /tmp (disabling future attempts)
db_nextcloud    | 2021-08-28 18:38:21 0 [Note] InnoDB: Using Linux native AIO
db_nextcloud    | 2021-08-28 18:38:21 0 [Note] InnoDB: Initializing buffer pool, total size = 134217728, chunk size = 134217728
db_nextcloud    | 2021-08-28 18:38:21 0 [Note] InnoDB: Completed initialization of buffer pool
db_nextcloud    | 2021-08-28 18:38:21 0 [Note] InnoDB: 128 rollback segments are active.
db_nextcloud    | 2021-08-28 18:38:21 0 [Note] InnoDB: Creating shared tablespace for temporary tables
db_nextcloud    | 2021-08-28 18:38:21 0 [Note] InnoDB: Setting file './ibtmp1' size to 12 MB. Physically writing the file full; Please wait ...
db_nextcloud    | 2021-08-28 18:38:21 0 [Note] InnoDB: File './ibtmp1' size is now 12 MB.
db_nextcloud    | 2021-08-28 18:38:21 0 [Note] InnoDB: 10.6.4 started; log sequence number 42161; transaction id 14
db_nextcloud    | 2021-08-28 18:38:21 0 [Note] InnoDB: Loading buffer pool(s) from /var/lib/mysql/ib_buffer_pool
db_nextcloud    | 2021-08-28 18:38:21 0 [Note] Plugin 'FEEDBACK' is disabled.
db_nextcloud    | 2021-08-28 18:38:21 0 [Warning] You need to use --log-bin to make --expire-logs-days or --binlog-expire-logs-seconds work.
db_nextcloud    | 2021-08-28 18:38:21 0 [Warning] 'user' entry 'root@77cef25aef24' ignored in --skip-name-resolve mode.
db_nextcloud    | 2021-08-28 18:38:21 0 [Warning] 'proxies_priv' entry '@% root@77cef25aef24' ignored in --skip-name-resolve mode.
db_nextcloud    | 2021-08-28 18:38:21 0 [Note] InnoDB: Buffer pool(s) load completed at 210828 18:38:21
db_nextcloud    | 2021-08-28 18:38:21 0 [Note] mysqld: ready for connections.
db_nextcloud    | Version: '10.6.4-MariaDB-1:10.6.4+maria~focal'  socket: '/run/mysqld/mysqld.sock'  port: 0  mariadb.org binary distribution
db_nextcloud    | 2021-08-28 18:38:22+02:00 [Note] [Entrypoint]: Temporary server started.
db_nextcloud    | Warning: Unable to load '/usr/share/zoneinfo/leap-seconds.list' as time zone. Skipping it.
db_nextcloud    | Warning: Unable to load '/usr/share/zoneinfo/leapseconds' as time zone. Skipping it.
db_nextcloud    | Warning: Unable to load '/usr/share/zoneinfo/tzdata.zi' as time zone. Skipping it.
db_nextcloud    | 2021-08-28 18:38:25 5 [Warning] 'proxies_priv' entry '@% root@77cef25aef24' ignored in --skip-name-resolve mode.
db_nextcloud    | 2021-08-28 18:38:25+02:00 [Note] [Entrypoint]: Creating database nextcloud
db_nextcloud    | 2021-08-28 18:38:25+02:00 [Note] [Entrypoint]: Creating user nextcloud
db_nextcloud    | 2021-08-28 18:38:25+02:00 [Note] [Entrypoint]: Giving user nextcloud access to schema nextcloud
db_nextcloud    |
db_nextcloud    | 2021-08-28 18:38:25+02:00 [Note] [Entrypoint]: Stopping temporary server
db_nextcloud    | 2021-08-28 18:38:25 0 [Note] mysqld (initiated by: root[root] @ localhost []): Normal shutdown
db_nextcloud    | 2021-08-28 18:38:25 0 [Note] InnoDB: FTS optimize thread exiting.
db_nextcloud    | 2021-08-28 18:38:25 0 [Note] InnoDB: Starting shutdown...
db_nextcloud    | 2021-08-28 18:38:25 0 [Note] InnoDB: Dumping buffer pool(s) to /var/lib/mysql/ib_buffer_pool
db_nextcloud    | 2021-08-28 18:38:25 0 [Note] InnoDB: Buffer pool(s) dump completed at 210828 18:38:25
db_nextcloud    | 2021-08-28 18:38:25 0 [Note] InnoDB: Removed temporary tablespace data file: "./ibtmp1"
db_nextcloud    | 2021-08-28 18:38:25 0 [Note] InnoDB: Shutdown completed; log sequence number 42173; transaction id 15
db_nextcloud    | 2021-08-28 18:38:25 0 [Note] mysqld: Shutdown complete
db_nextcloud    |
db_nextcloud    | 2021-08-28 18:38:26+02:00 [Note] [Entrypoint]: Temporary server stopped
db_nextcloud    |
db_nextcloud    | 2021-08-28 18:38:26+02:00 [Note] [Entrypoint]: MariaDB init process done. Ready for start up.
db_nextcloud    |
db_nextcloud    | 2021-08-28 18:38:26 0 [Note] mysqld (server 10.6.4-MariaDB-1:10.6.4+maria~focal) starting as process 1 ...
db_nextcloud    | 2021-08-28 18:38:26 0 [Note] InnoDB: Compressed tables use zlib 1.2.11
db_nextcloud    | 2021-08-28 18:38:26 0 [Note] InnoDB: Number of pools: 1
db_nextcloud    | 2021-08-28 18:38:26 0 [Note] InnoDB: Using crc32 + pclmulqdq instructions
db_nextcloud    | 2021-08-28 18:38:26 0 [Note] mysqld: O_TMPFILE is not supported on /tmp (disabling future attempts)
db_nextcloud    | 2021-08-28 18:38:26 0 [Note] InnoDB: Using Linux native AIO
db_nextcloud    | 2021-08-28 18:38:26 0 [Note] InnoDB: Initializing buffer pool, total size = 134217728, chunk size = 134217728
db_nextcloud    | 2021-08-28 18:38:26 0 [Note] InnoDB: Completed initialization of buffer pool
db_nextcloud    | 2021-08-28 18:38:26 0 [Note] InnoDB: 128 rollback segments are active.
db_nextcloud    | 2021-08-28 18:38:26 0 [Note] InnoDB: Creating shared tablespace for temporary tables
db_nextcloud    | 2021-08-28 18:38:26 0 [Note] InnoDB: Setting file './ibtmp1' size to 12 MB. Physically writing the file full; Please wait ...
db_nextcloud    | 2021-08-28 18:38:26 0 [Note] InnoDB: File './ibtmp1' size is now 12 MB.
db_nextcloud    | 2021-08-28 18:38:26 0 [Note] InnoDB: 10.6.4 started; log sequence number 42173; transaction id 14
db_nextcloud    | 2021-08-28 18:38:26 0 [Note] InnoDB: Loading buffer pool(s) from /var/lib/mysql/ib_buffer_pool
db_nextcloud    | 2021-08-28 18:38:26 0 [Note] Plugin 'FEEDBACK' is disabled.
db_nextcloud    | 2021-08-28 18:38:26 0 [Warning] You need to use --log-bin to make --expire-logs-days or --binlog-expire-logs-seconds work.
db_nextcloud    | 2021-08-28 18:38:26 0 [Note] Server socket created on IP: '0.0.0.0'.
db_nextcloud    | 2021-08-28 18:38:26 0 [Note] InnoDB: Buffer pool(s) load completed at 210828 18:38:26
db_nextcloud    | 2021-08-28 18:38:26 0 [Note] Server socket created on IP: '::'.
db_nextcloud    | 2021-08-28 18:38:26 0 [Warning] 'proxies_priv' entry '@% root@77cef25aef24' ignored in --skip-name-resolve mode.
db_nextcloud    | 2021-08-28 18:38:26 0 [Note] mysqld: ready for connections.
db_nextcloud    | Version: '10.6.4-MariaDB-1:10.6.4+maria~focal'  socket: '/run/mysqld/mysqld.sock'  port: 3306  mariadb.org binary distribution

If I run a shell inside of the docker container dsh () { sudo docker exec -it $* /bin/sh; }; dsh nextcloud and run occ I get

Nextcloud is not installed - only a limited number of commands are available
Nextcloud 22.1.0

Usage:
  command [options] [arguments]

Options:
  -h, --help            Display this help message
  -q, --quiet           Do not output any message
  -V, --version         Display this application version
      --ansi            Force ANSI output
      --no-ansi         Disable ANSI output
  -n, --no-interaction  Do not ask any interactive question
      --no-warnings     Skip global warnings, show command output only
  -v|vv|vvv, --verbose  Increase the verbosity of messages: 1 for normal output, 2 for more verbose output and 3 for debug

Available commands:
  check                 check dependencies of the server environment
  help                  Display help for a command
  list                  List commands
  status                show some status information
 app
  app:check-code        check code to be compliant
 integrity
  integrity:check-app   Check integrity of an app using a signature.
  integrity:check-core  Check integrity of core code using a signature.
  integrity:sign-app    Signs an app using a private key.
  integrity:sign-core   Sign core using a private key.
 l10n
  l10n:createjs         Create javascript translation files for a given app
 maintenance
  maintenance:install   install Nextcloud

I checked the env variables to be set :

/nextcloud $ env | grep ADMIN
ADMIN_PASSWORD=MYADMINPASSWD
ADMIN_USER=admin

So I tried to run the occ maintenance:install and that unveils that these variables seem not to be used:

/nextcloud $ occ maintenance:install
What is the password you like to use for the admin account <admin>?

When I try to run the install command manually specifying the parameters I need I get

occ maintenance:install --admin-user=$ADMIN_USER --admin-pass=$ADMIN_PASSWORD --database=$DB_TYPE --database-name=$DB_NAME --database-host=$DB_HOST --database-user=$DB_USER --database-pass=$DB_PASSWORD
Nextcloud was successfully installed

However to get access I have manually to add the fqdn (the content of $DOMAIN env variable ) of the installation in /nextcloud/config/config.php

Shoulddn't all this be done automatically?

running on different port than 80

Hi there,
first of all I would like to thank you for this great dockers.
However, I am trying to have a nextcloud session running on port 8080/8443, because 80/443 is already taken. Of course using the reverse proxy.
The first problem that occurd was with letsencrypt. I could easily copy the cert files into the ssl path though which fixed the problem, just ignoring the letsencrypt part. I added a routine to my cron which copies the certs everytime they get renewd.
I now have the following issue: I get redirected to myurl.com/app instead of myurl.com:8443/app after login.
Also 8080 points to 443 instead of 8443, but for this problem I know a solution in the nginx conf.
Any idea how I can fix the myurl.com/app instead of myurl.com:8443/app issue?

Blank files browser in nextcloud web interface

This morning I updated from Nextcloud 22, to Nextcloud 23. The upgrade was performed by changing the image tag in a docker-compose file and restarting the containers and didn't encounter any issues or unexpected log messages.

After the update, I am now getting a mostly blank /apps/files/ that does not list any files or external storages (just has the header and left menu).

There are no logs in the container output advising of any errors at the server side or errors in /data/nextcloud.log or /var/log/nginx/error.log, however there are javascript errors in console:

My setup is pretty straightforward, I have nextcloud running via podman-compose on debian 11 with an nginx ingress controller in front acting as a reverse proxy and managing certs via certmanager + lets encrypt.

I've tried both chromium and firefox, and both have the same issue, for separate users.

Here is the proxy configuration I have in front of nextcloud (personal domain replaced with cloud.example.com):

---
kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
  name: cloud-example-com
  namespace: cloud-example-com
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/proxy-body-size: 10G
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/configuration-snippet: |
      more_set_headers "X-XSS-Protection: 1";
      more_set_headers "X-Content-Type-Options: nosniff";
      more_set_headers "X-Frame-Options: SAMEORIGIN";
      more_set_headers "Content-Security-Policy: frame-src 'self'; default-src 'self'; script-src 'self' 'unsafe-inline' blob: 'unsafe-eval' https://cloud.example.com https://maxcdn.bootstrapcdn.com https://ajax.googleapis.com; img-src 'self' data: https://secure.gravatar.com; style-src 'self' 'unsafe-inline' https://maxcdn.bootstrapcdn.com https://fonts.googleapis.com; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://fonts.gstatic.com; form-action 'self'; upgrade-insecure-requests";
      more_set_headers "Referrer-Policy: strict-origin-when-cross-origin";
      more_set_headers "Permissions-Policy: geolocation=(none);midi=(self);notifications=(self);push=(self);sync-xhr=();microphone=(none);camera=(none);magnetometer=(none);gyroscope=(none);speaker=(self);vibrate=(self);fullscreen=(self);payment=(none);";
      more_clear_headers "X-Powered-By";
spec:
  tls:
  - hosts:
    - cloud.example.com
    secretName: tls-cloud-example-com
  rules:
  - host: cloud-example-com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nextcloud
            port:
              number: 8888

I can browse files fine using android clients, or via DAV. It is only the web interface that is having problems.

Any ideas what might be causing this?

Fix Urgent security issue in NGINX/php-fpm

Please, could you update wonderfall/nextcloud image in order to fix that security issue : https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm/

Thanks.

Version in version.php incorrect?

Hi,
i was just about to migrate from my local instance to your docker image and i'm running into a "downgrading" issue.
My local instance is running 15.0.6.1 and the docker image claims to be 15.0.5.3 (i'm using the nextcloud:15 image which i've pulled a few minutes ago).

Related to the dockerfile and the documentation the image version should be something like 15.0.7.x.
So i guess there is a bug in the version.php provided in the docker image. So i repulled the image and checked the content of the version.php and yes it claims to be 15.0.5.3.
The version.php of my local instance is having 15.0.6.1 as a version.

So is this a bug in the file? Or did i missed something?

Thanks

How can i update them

emm..it semms there is a new version,18.0.3. I want to know how can i update my website?Can i click update in setting?Or i need to wait for your update version?Thank you

Exit code 132 when starting the container / AVX instructions in hardened malloc

Hey man, thanks for the great image!

I've been having some trouble upgrading to the new refactored image tonight, it keeps restarting with exit code 132.

I did some digging and found that if I run the container with -e LD_PRELOAD="" it starts up fine.

In addition changing from image: ghcr.io/wonderfall/nextcloud to build: ./docker-nextcloud to build the image locally on the host it also runs fine.

Managed to get a crashdump from it, it crashes on the vmovdqa instruction. Looking that up it's an AVX instruction, the poor old G3220 CPU I run Nextcloud on doesn't support that.

(gdb) display/i $pc
1: x/i $pc
=> 0x7f456d22bc80 <chacha_keysetup>:    vmovdqa 0x49a8(%rip),%xmm0        # 0x7f456d230630
(gdb)

Per the readme for hardened malloc:

CONFIG_NATIVE: true (default) or false to control whether the code is optimized for the detected CPU on the host. If this is disabled, setting up a custom -march higher than the baseline architecture is highly recommended due to substantial performance benefits for this code.

So by default it's compiled with native code which is bad news for guys like me with old CPU's. I'm not sure if there's a suitable march setting that allows it to run on older CPU's, but still doesn't remove all the performance benefits of native code.

upgrade path versions older than nextcloud 19

Hello,

I understand that only the newest versions are supported, however is there an upgrade path for anyone on an older version of the images?

If I am not mistaken one should not skip versions, even if its only running the container once to update the data i.e. 16 -> 17 -> 18 -> 19 -> 20 -> 21
Since there are no tags for anything lower than 20, how can older setups be updated?

Any help would be much appreciated!

Not running as root?

Hello,

I went to deploy your image in OpenShift 3.11, however, I'm getting an error that the image is actually running as root. Any idea why that might be the case?

Image wonderfall/nextcloud runs as the root user which might not be permitted by your cluster administrator.

Configuration Warnings

The following warnings will be displayed on my NAS after successful installation:

• Your web server is not configured correctly to resolve "/.well-known/caldav". For more information, see the documentation.
• Your web server is not configured correctly to resolve "/.well-known/carddav". For more information, see the documentation.
• The "Referrer-Policy" HTTP header is not set to "no-referrer", "no-referrer-when-downgrade", "strict-origin" or "strict-origin-when-cross-origin". This allows reference information to be disclosed. See the W3C recommendation.
  How can these be fixed or could you correct the configuration in the same way?
  Thank you

Nextcloud - trusted domain access

• how to allow all domains can access Nextcloud and remove the domain verification process,
• I want to upload this online server so my team can access docker from any machine and domain, so can you give me an idea about how can I add multiple domains or remove that functionally from nextcloud so any domain can access the docker homepage

Nginx SSL support

Hey, it seems Nginx doesn't support SSL as ssl module wasn't compiled during image creation.
I set up nginx.conf config file in the way below:
https://gist.github.com/suprovsky/c321e4e7736c6fc11e0851b6b00792d8

Before applying configuration I wanted to check whether is correct and I got the error:

/ # nginx -t
nginx: [emerg] the "ssl" parameter requires ngx_http_ssl_module in /nginx/sites-enabled/nginx.conf:3
nginx: configuration file /nginx/conf/nginx.conf test failed

Nginx documentation says this module isn't compiled by default. It requires --with-http_ssl_module parameter to be used during nginx compilation.

Update nginx version to 7.4.x

The developer of the nextcloud app "Passwords" announced the EOL for the following:

• EOL warning for NC < 19
• EOL warning for PHP < 7.4

Please see https://git.mdns.eu/nextcloud/passwords/blob/master/CHANGELOG.md

Would it be feasible to update to nginx 7.4?

I tried to build my own image using your wonderfall/nextcloud:7.4 image, but unfortunately this version is hanging for ever at occ upgrade.

Migrating / upgrading from versions older than 19th

Hey team,

I am working out a plan to migrate to new versions from wonderfall nextcloud of versions 12 and 14 to newest ones - the biggest issue lies in upgrading the database properly.

At first I was thinking about doing an upgrade using major releases, but I cannot locate images of wonderfall/nextcloud lower than 21st. Is there an archive containing those somewhere - meaning from 12th all the way to 21st?

Otherwise I found install scripts of local installations and was thinking of installing version 12, attaching existing database I have in docker container, upgrading it and reusing with new deployment and newest version - lots of work though, could use those depricated images.

Kind regards,
Michal

Update nginx.conf

Source : https://docs.nextcloud.com/server/16/admin_manual/installation/nginx.html

Update nginx.conf

location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {

location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {

no smb?

Docker logs give error - FPM instance seems to already listen on /php/run/php-fpm.sock

Since I have upgraded from version 12.0 to 13.0.1 I get the following error if I check the docker log for nextcloud container:

Updating permissions...
Updating permissions in /nextcloud...
Permissions in /data are correct.
Permissions in /config are correct.
Permissions in /apps2 are correct.
Updating permissions in /var/log...
Updating permissions in /php...
Updating permissions in /nginx...
Updating permissions in /tmp...
Updating permissions in /etc/s6.d...
Done updating permissions.
Nextcloud is already latest version
[30-Mar-2018 16:43:39] ERROR: An another FPM instance seems to already listen on /php/run/php-fpm.sock
[30-Mar-2018 16:43:39] ERROR: FPM initialization failed
[30-Mar-2018 16:43:40] ERROR: An another FPM instance seems to already listen on /php/run/php-fpm.sock
[30-Mar-2018 16:43:40] ERROR: FPM initialization failed
[30-Mar-2018 16:43:41] ERROR: An another FPM instance seems to already listen on /php/run/php-fpm.sock
[30-Mar-2018 16:43:41] ERROR: FPM initialization failed
[30-Mar-2018 16:43:42] ERROR: An another FPM instance seems to already listen on /php/run/php-fpm.sock
[30-Mar-2018 16:43:42] ERROR: FPM initialization failed
[30-Mar-2018 16:43:43] ERROR: An another FPM instance seems to already listen on /php/run/php-fpm.sock
[30-Mar-2018 16:43:43] ERROR: FPM initialization failed
[30-Mar-2018 16:43:44] ERROR: An another FPM instance seems to already listen on /php/run/php-fpm.sock
[30-Mar-2018 16:43:44] ERROR: FPM initialization failed

Actually nextcloud is up and running, on one client everything works as expected but on another client I get a "Bad Gateway" error when I try to sync.

Do you have any idea what the reason for the issue could be?

Cannot connect to Synology's mariaDB database

Cannot connect to Synology's mariaDB database

Error while trying to create admin user: Failed to connect to the database: An exception occurred in driver: SQLSTATE[HY000] [2002] php_network_getaddresses: getaddrinfo failed: Name does not resolve

I tried the same sql account password, nextcloud docker in docker.io can connect to Synology's mariadb database normally, but no matter I try to use Synology's ip:3307 or 127.0.0.1:3307 or localhost:3307, it can't connect to yours. docker

Stable release gives code signin warning

Hello,

With the current stable release of the docker image, I get the following warning:
Some files have not passed the integrity check. Further information on how to resolve this issue can be found in the documentation.

Is it intended/inevitable?

Cheers!

PHP Deprecated

PHP Deprecated: Required parameter $tagManager follows optional parameter $fileIdentifier in /nextcloud/apps/files/lib/Helper.php on line 220

Chrome problem

When opening from the Chrome browser getting the error:
400 Bad Request – Request Header Or Cookie Too Large

From the Edge, everything works fine.

HOW TO FIX:
ADD to rootfs/nginx/sites-enabled/nginx.conf
server {
...
large_client_header_buffers 4 16k;
...
}

Now everything works.

Add imagick for php8

imagick 3.5.0 PHP 8.0 support
imagick 3.5.1 last version
need to install these packages...
add line in dockerfile:

 && apk add -t build-deps \
        ...
        imagemagick-dev \

and

&& apk --no-cache add \
        ...
        imagemagick \

pecl install imagick \
docker-php-ext-enable imagick \

profit...

Missing FFMPEG

In new docker image 21.0.3 ffmpeg is missing.
In config.php i have:

'enabledPreviewProviders' =>
array (
1 => 'OC\Preview\PDF',
2 => 'OC\Preview\Image',
3 => 'OC\Preview\Photoshop',
4 => 'OC\Preview\TIFF',
5 => 'OC\Preview\SVG',
6 => 'OC\Preview\Movie',
7 => 'OC\Preview\MKV',
8 => 'OC\Preview\MP4',
9 => 'OC\Preview\AVI',
),

And it had work properly. But after upgrade from 21.0.1 to 21.0.3 preview for video dosnt work.

PHP Version in Nextcloud 13 Dockerfile breaks mcrypt

Hi, the mcrypt module got removed in PHP 7.2 and the saml plugin breaks because of this.
Maybe downgrade to PHP 7.1?

Also https://blog.remirepo.net/post/2015/07/07/About-libmcrypt-and-php-mcrypt but this isn't your job :)

Can only upload small files

Trying to run this in a kubernetes cluster. I have MSQL and everything talking and working. The initial install went OK, files are created.

I can also upload files as long as they are only a few KBs. Anything in the MB territory or higher gets an "unknown error"

I did set the environment variable MAX_UPLOAD_SIZE to 10G (Which I think is the default)? I am a little confused on what's causing this.

Some odd permission errors occasionally in the logs, but nothing directly pertaining to this. Any ideas?

502 Bad Gateway on nginx-proxy

I am using the nginx reverse proxy form https://github.com/nginx-proxy/nginx-proxy which was working with the old image version pretty fine so far. Today I tried to migrate to the new version.

When I try to start that one I get a 502 Bad Gateway from my reverse nginx proxy.
In the config I can see the server as beeing shown as down

upstream nextcloud.domain.de {
                                ## Can be connected with "bridge" network
                # nextcloud
                        server 10.0.3.7 down;
}

Looking into docker everything looks fine - also the pod logs look fine.

6824da3c615c   ghcr.io/wonderfall/nextcloud:21.0.2      "docker-php-entrypoi…"   20 hours ago    Up 36 minutes   0.0.0.0:8888->8888/tcp, 9000/tcp           nextcloud

Starting code integrity check...
Finished code integrity check
Update successful
Turned off maintenance mode
Resetting log level
Nextcloud is already latest version

Am I missing some change?
I have tried to login directly using the localhost:8888.
Doing so I am directed to the login prompt. However the login freezes when trying to login.

ENV Needed: DB_PORT

Many times on a host with only one IP, the DB needs to run on a nonstandard port.

nginx.conf inside a volume

Hey, is that possible to link /nginx/sites-enabled/nginx.conf to the volume? It would be much easier to set up HTTPS connection as every update would erase changes in this particular file.
Since I'm a Docker newbie, is there any alternative to set up and store nginx configuration unchanged between updates? I wanted to make sure I don't ask for something useless.

supra

chown is slow, we just need it once for the first start-up

In run.sh we find any mismatched files and update the permission accordingly. This is necessary if you change the uid/gid, that's good, but that's is very slow.

echo "Updating permissions..."
for dir in /nextcloud /data /config /apps2 /var/log /php /nginx /tmp /etc/s6.d; do
  if $(find $dir ! -user $UID -o ! -group $GID|egrep '.' -q); then
    echo "Updating permissions in $dir..."
    chown -R $UID:$GID $dir

I think we need to:

1. print a message "for the first boot it might take 10 minutes to finish" to tell the impatient users to wait.
2. write a flag and skip the check next time if the container is restarted.
   What do you think?

Memcache \OC\Memcache\APCu not available for local cache

Hi, in my audit i have this:

can you add :
apc.enable_cli=1
in rootfs/php/conf.d/apcu.ini ?

Thanks

undefined method: BeforeTemplateRenderedListener::isProfileEnabled()

Hi there!

Since few days, I get this error preventing me to access /files route.

  "message": "Call to undefined method OCA\\UserStatus\\Listener\\BeforeTemplateRenderedListener::isProfileEnabled()",

The beginning of the stack is:

    "File": "/nextcloud/apps/user_status/lib/Listener/BeforeTemplateRenderedListener.php",
    "Line": 99,

WebDAB/WebCAL still work, for instance.

I think it must be caused by a plugin, but I can't figure out which one.
Do you have any idea? Or did you faced this issue too?

I'm available to give some more information if needed.
Thanks

latest release OCI runtime exec failed

My container instance is in some failed state after what i believe was the latest update.
OCI runtime exec failed: exec failed: container_linux.go:345: starting container process caused "exec: "/bin/bash": stat /bin/bash: no such file or directory": unknown

I installed a new blank instance with same docker-compose that has always worked fine and I was able to complete the nextcloud install. It looked like it was working but after I restarted the container, I got the same error.

Never had issue before not sure what has changed. I"m still trying to figure it out. Any help would be greatly appreciated.

MariaDb Problem after container update

After a container update nextcloud is throwing the following error:

2019-06-20 9:10:50 8 [Warning] InnoDB: Table mysql/innodb_table_stats has length mismatch in the column name table_name. Please run mysql_upgrade

this is preventing nextcloud from starting properly and i couldn't run the command from the database container (mariadb), because i seem to have a permission problem.

can someone help?

Redis and SMTP Settings

Hi,

I have already running my database and redis on separate servers, Now we can define the database variables while launching the container but what what is the environment variables for redis server?

2nd I want to mention smtp settings as well, is there way that we can pass environment variable for smtp settings as well?

No LDAP Connection to Local LDAP Server

I have installed the Wonderfall Nextcloud Docker on my Synology NAS Server. I will use the Active Directory Server of my Synology NAS. The Problem is i can't connect to the LDAP Server wich is on the same Server.
My LDAP Configuration:



Nextcloud Log:

Recognize app dosnt work

Hello!
In new image 21.0.3 when i am install Recognize app from store - it dosnt work.

When i use

docker exec -it nextcloud php occ recognize:classify

and i got

Classifier process output: sh: exec: line 1: /nextcloud/apps2/recognize/bin/node-v14.9.0-linux-x64: not found

But file node-v14.9.0-linux-x64 really have been in /nextcloud/apps2/recognize/bin/

I think there may not be enough libraries.
Considering that Nextcloud is a good alternative to the now paid Google Photos, the functionality of the Recognize application can be very useful.

How can this problem be corrected?

[IMPORTANT] Migration to the new image

Hello, if you're reading this you're probably using my Docker image wonderfall/nextcloud. First and foremost, thanks for your interest! As you may already know, the current image is being deprecated. Let me first explain you why (in details) and then I'll give you some suggestions about your options.

I first made this image some years ago (late 2015 if I recall), back in the time when it was still ownCloud (I mean before the hard fork) and there was not even an Alpine-based image. Since then I kept maintaining the image, it has been 5 years already! Of course, I know sometimes I was not fast to update, due to life being life.

I've also said this: don't use third-party images when there's an official one. And at the time, there wasn't, but since 2016 (around that) there is. So if you're not willing to maintain your images, you should probably use official images. If that doesn't work for you, you can take inspiration but really pay attention to the maintenance of your images. Outdated images are security holes and a container is certainly not bulletproof: there is massive attack surface which can be exploited to gain privilege on the host - unless you use alternative runtimes such as gVisor.

Now, back to my image, I kept maintaining it despite the official one being a thing. I wanted it to be very simple to use, e.g. no extra containers for nginx, cron - everything you need is running inside. It's not great for scalability, but it was never meant to be, it's just meant for single-users who want to take back their data. Docker once said "you should run only one process in a container" (not to mention it's rarely the case, technically speaking, but you get the idea), but containers are not defined by that rule, you can do whatever you want as long as it suits your needs.

However, the current image as it is has some flaws:

• The current image is based on wonderfall/nginx-php, a base Alpine image which builds PHP and nginx from source. Great, but painful to maintain. I made the switch from Alpine packages in 2017 because there were some obscure issues I don't recall well, and it's great to have fine-grained versioning. It's still working, currently with PHP 8!
• Since I wanted the image to be "simple to use", I made extensive use of privilege degrading (with su-exec) so permissions are transparent to the end-user. The issues are: it's best to never use root even at startup, and chown has terrible performance on overlayfs (not on btrfs, which I use, but overlayfs is the default). I mean, flexibility is great and all, but users should just learn to fix permissions of their volumes themselves, no?

These are the two main reasons I wanted a complete refactor. Now as you can see on the testing branch, several changes were made to the new image:

• Fetching PHP/nginx from their official images.
• Does not use any privilege at any time, even at startup.
• Much easier to maintain thanks to multi-stages build.
• Includes hardened_malloc, a hardened memory allocator.
• Does not include imagick, samba, etc. by default.

Goals are still to provide a simple image to use, but now with less attack surface, and more maintainability. Migration should be painless except for exotic use-cases. The things to keep in mind when migrating are the changes of volumes:

• /data is now /nextcloud/data it will remain /data for now
• /config is now /nextcloud/config
• /apps2 is now /nextcloud/apps2

Changes should be made in your docker-compose.yml and in config.php to reflect the volume changes. Other than that, it should run like before. This is still in testing, but I made the change myself on my personal server and it's running flawlessly. It's already available in Docker Hub with the next tag.

The plan is to:

• Announce deprecation of the current image
• Maintain the current image for one more major version
• Document migration to the new image
• Eventually make the current image obsolete
• Possibly distribute with ghcr.io

Feel free to discuss the topic here, but keep in mind I got many other things to do so I can't help if you're migrating to another image, official or third-party. Also keep in mind to back up your data in any case. Any migration should be possible, though.

Updating permissions... on start is a problem on large installations

I do have more then 4 million files on my instance. A restart with this, otherwise nice, image takes over half an hour. If one could disable the permissions check with a environment variable, it would be beautiful ;-)

All It would take would be an additional check before line 21 in docker-nextcloud/rootfs/usr/local/bin/run.sh

docker dont install

Updating permissions...
Updating permissions in /nextcloud...
Updating permissions in /data...
Updating permissions in /config...
Permissions in /apps2 are correct.
Updating permissions in /var/log...
Updating permissions in /php...
Updating permissions in /nginx...
Updating permissions in /tmp...
Updating permissions in /etc/s6.d...
ne updating permissions.
Check for UserId 1000
Creating user nextcloud with UID=1000 and GID=1000
Starting automatic configuration...
Automatic configuration finished.

this is my log and stop here.. what im wrong?

my docker file
version: '3'

networks:
nextcloud_network:
external: false
services:
nextcloud:
image: wonderfall/nextcloud
container_name: nextcloud
depends_on:
- nextcloud-db # If using MySQL
- redis # If using Redis
environment:
- UID=1000
- GID=1000
- UPLOAD_MAX_SIZE=10G
- APC_SHM_SIZE=128M
- OPCACHE_MEM_SIZE=128
- CRON_PERIOD=15m
- TZ=Europe/Rome
- DOMAIN=localhost
- DB_TYPE=mysql
- DB_NAME=nextcloud
- DB_USER=nextcloud
- DB_PASSWORD=xxxxxxxx
- DB_HOST=nextcloud-db
volumes:
- /mnt/Data/nextcloud:/data
- /mnt/Config/nextcloud:/config
- /mnt/Config/nextcloud/apps:/apps2
- /mnt/Config/nextcloud/themes:/nextcloud/themes
networks:
- nextcloud_network

If using MySQL

nextcloud-db:
image: mariadb
container_name: nextcloud-db
volumes:
- /mnt/Config/mariadb_nc:/var/lib/mysql
environment:
- MYSQL_ROOT_PASSWORD=xxxxxxxx
- MYSQL_DATABASE=nextcloud
- MYSQL_USER=nextcloud
- MYSQL_PASSWORD=xxxxxxxxxx
networks:
- nextcloud_network

If using Redis

redis:
image: redis:alpine
container_name: redis
volumes:
- /mnt/Config/redis:/data
networks:
- nextcloud_network

Long Startup Time, /nextcloud Permissions

This is kind of like #14, but specifically for the /nextcloud folder. I don't have issues with permissions in my /data folder (yet...)

Every time I recreate my Nextcloud container, it goes through the process of making sure all permissions are correct for a bunch of folders. This is great and all, except that when it processes the /nextcloud folder, it always needs to correct the permissions. Since this is such a large directory, it takes several minutes (of downtime and disk thrashing) to process.

Doing a bit of research, it looks like the user and group of these files is "nobody" and "nogroup", respectively. This probably comes from building the docker file when the whole thing is un-tarred.

Does this folder need to have its permissions changed to still function? I like permission checking/resetting, but I also like my disks to not die doing the same chown task over and over.

WebDAV via /remote.php broken

Hey @Wonderfall, nice work!

I deployed a Nextcloud setup using your image, redis, msql and a custom authentication backend (via the app external-users/webdav).

Everything works great, except WebDAV access via /remote.php.

I tried:

• using the official Nextcloud iOS app: works sometimes when i retry a lot, timeouts a lot
• syncing calendars and contacts with iOS and Gnome: not working at all, timeouts a lot

I observed:

• a lot of upstream 502 errors in my reverse proxy request logs
• sometimes 401 errors when i tried to use generated app-passwords
• no logged errors in nextcloud.log, even with debug loglevel

are there some other logging places that you'd suggest to have a look into?

---

docker containers:

docker run -d \
  -v /opt/nextcloud/redis:/data \
  --name nextcloud-redis \
   --restart always \
  redis:alpine

docker run -d\
  -v /opt/nextcloud/mysql:/var/lib/mysql \
  -e MYSQL_ROOT_PASSWORD=*** \
  -e MYSQL_DATABASE=nextcloud \
  -e MYSQL_USER=nextcloud \
  -e MYSQL_PASSWORD=*** \
  --name nextcloud-mysql \
  --restart always \
  mariadb:10

docker run -d \
  -e UID=1000 \
  -e GID=1000 \
  -e UPLOAD_MAX_SIZE=10G \
  -e APC_SHM_SIZE=128M \
  -e OPCACHE_MEM_SIZE=128 \
  -e CRON_PERIOD=15m \
  -e TZ=Europe/Berlin \
  -e DOMAIN=next.mydomain.com \
  -e DB_TYPE=mysql \
  -e DB_NAME=nextcloud \
  -e DB_USER=nextcloud \
  -e DB_PASSWORD=*** \
  -e DB_HOST=nextcloud-db \
  -v /opt/nextcloud/nextcloud/data:/data \
  -v /opt/nextcloud/nextcloud/config:/config \
  -v /opt/nextcloud/nextcloud/apps:/apps2 \
  -v /opt/nextcloud/nextcloud/themes:/nextcloud/themes \
  -p 8080:8888 \
  --restart always \
  --link nextcloud-mysql:nextcloud-db \
  --link nextcloud-redis:redis \
  --link custom-auth-server \
  --name nextcloud-app \
  wonderfall/nextcloud

and my config looks like this:

<?php
$CONFIG = array (
  'datadirectory' => '/data',
  'apps_paths' => 
  array (
    0 => 
    array (
      'path' => '/nextcloud/apps',
      'url' => '/apps',
      'writable' => false,
    ),
    1 => 
    array (
      'path' => '/apps2',
      'url' => '/apps2',
      'writable' => true,
    ),
  ),
  'instanceid' => '***',
  'mail_from_address' => 'administrator',
  'logtimezone' => 'Europe/Berlin',
  'logdateformat' => 'Y-m-d H:i:s',
  'passwordsalt' => '***',
  'secret' => '***',
  'trusted_domains' => 
  array (
    0 => 'next.mydomain.com',
  ),
  'overwrite.cli.url' => 'https://next.mydomain.com',
  'dbtype' => 'mysql',
  'version' => '13.0.0.14',
  'dbname' => 'nextcloud',
  'dbhost' => 'nextcloud-db',
  'dbport' => '',
  'dbtableprefix' => 'oc_',
  'mysql.utf8mb4' => true,
  'dbuser' => 'nextcloud',
  'dbpassword' => '***',
  'installed' => true,
  'memcache.distributed' => '\\OC\\Memcache\\Redis',
  'memcache.locking' => '\\OC\\Memcache\\Redis',
  'memcache.local' => '\\OC\\Memcache\\Redis',
  'redis' => 
  array (
    'host' => 'redis',
    'port' => 6379,
  ),
  'user_backends' => 
  array (
    0 => 
    array (
      'class' => '\\OCA\\User_External\\WebDAVAuth',
      'arguments' => 
      array (
        0 => 'http://custom-auth-server:9866/nextcloud',
      ),
    ),
  ),
  'loglevel' => '0',
  'maintenance' => false,
);