- Some variables to avoid writting too much and create some folders:
export PODNAME="nextcloud"
mkdir -p ~/containers/nextcloud/{db,nginx,html}
- Copy the
nginx.conffile:
cp ~/nginx.conf ~/containers/nextcloud/nginx/nginx.conf
- Create an empty pod exposing port 8080/tcp only
podman pod create --hostname ${PODNAME} --name ${PODNAME} -p 8080:80
Start adding containers to the pod.
- MariaDB:
podman run \
-d --restart=always --pod=${PODNAME} \
-e MYSQL_ROOT_PASSWORD="myrootpass" \
-e MYSQL_DATABASE="nextcloud" \
-e MYSQL_USER="nextcloud" \
-e MYSQL_PASSWORD="mynextcloudpass" \
-v ${HOME}/containers/nextcloud/db:/var/lib/mysql:z \
--name=${PODNAME}-db docker.io/library/mariadb:latest \
--transaction-isolation=READ-COMMITTED --binlog-format=ROW
It will listen into the 3306/tcp port ONLY within the pod.
- Redis:
podman run \
-d --restart=always --pod=${PODNAME} \
--name=${PODNAME}-redis docker.io/library/redis:alpine \
redis-server --requirepass yourpassword
It will listen into the 6379/tcp port ONLY within the pod.
- Nextcloud App:
podman run \
-d --restart=always --pod=${PODNAME} \
-e REDIS_HOST="localhost" \
-e REDIS_HOST_PASSWORD="yourpassword" \
-e MYSQL_HOST="localhost" \
-e MYSQL_USER="nextcloud" \
-e MYSQL_PASSWORD="mynextcloudpass" \
-e MYSQL_DATABASE="nextcloud" \
-v ${HOME}/containers/nextcloud/html:/var/www/html:Z \
--name=${PODNAME}-app docker.io/library/nextcloud:fpm-alpine
It will listen into the 9000/tcp port ONLY within the pod.
- Nextcloud Cron:
podman run \
-d --restart=always --pod=${PODNAME} \
-v ${HOME}/containers/nextcloud/html:/var/www/html:Z \
--entrypoint=/cron.sh \
--name=${PODNAME}-cron docker.io/library/nextcloud:fpm-alpine
It will listen into the 9000/tcp port ONLY within the pod.
- Nginx:
podman run \
-d --restart=always --pod=${PODNAME} \
-v ${HOME}/containers/nextcloud/html:/var/www/html:ro,Z \
-v ${HOME}/containers/nextcloud/nginx/nginx.conf:/etc/nginx/nginx.conf:ro,z \
--name=${PODNAME}-nginx docker.io/library/nginx:alpine
It will listen into the 80/tcp port... and as the pod expose that port as 8080/tcp in the host, you can reach the app!
podman exec -it -u www-data nextcloud-app /bin/sh
php occ maintenance:install \
--database "mysql" \
--database-host "127.0.0.1" \
--database-name "nextcloud" \
--database-user "nextcloud" \
--database-pass "mynextcloudpass" \
--admin-pass "password" \
--data-dir "/var/www/html"
php occ config:system:set \
trusted_domains 1 --value=192.168.1.98
php occ config:system:set \
trusted_domains 2 --value=nextcloud.example.com
php occ config:system:set \
check_data_directory_permissions --value="false" --type=boolean
php occ config:system:set \
overwrite.cli.url --value "https://nextcloud.example.com"
php occ config:system:set \
overwriteprotocol --value "https"
exit
The reason behind the directory permissions is here. Basically, NextCloud resets the data directory permissions to 770, but nginx requires to access that folder, otherwise it complains about file not found.
I tried to use --group-add flags to force group allocation of the user running both nginx and nextcloud but they run as root and then they change to a different user (www-data and nginx) so the group is not inherited...
sudo chmod 775 ~/containers/nextcloud/html
podman pod restart nextcloud
The official documentation says to generate the unit files using podman generate systemd but I don't like the way it creates it (see this blog post for more information).
Instead, I prefer to create this kind of systemd unit files
[Unit]
Description=Podman container-mosquitto.service
[Service]
Restart=on-failure
ExecStartPre=/usr/bin/rm -f /%t/%n-pid /%t/%n-cid
ExecStart=/usr/bin/podman run --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \
-d -p 1883:1883 -p 9001:9001 \
-v /home/edu/containers/mosquitto/config/:/mosquitto/config/:Z\
--name mosquitto \
eclipse-mosquitto
ExecStop=/usr/bin/podman stop -t 10 eclipse-mosquitto
#ExecStop=/usr/bin/podman stop --ignore --cidfile %t/%n-cid -t 10
#ExecStopPost=/usr/bin/podman rm --ignore -f --cidfile %t/%n-cid
ExecStopPost=/usr/bin/sh -c "/usr/bin/podman rm -f `cat /%t/%n-cid`"
KillMode=none
Type=forking
PIDFile=/%t/%n-pid
[Install]
WantedBy=default.target
systemctl --user daemon-reload
systemctl --user enable pod-nextcloud.service
sudo loginctl enable-linger $(whoami)
The reason behind modifying the unit files is here
sudo firewall-cmd --add-port=8080/tcp
sudo firewall-cmd --add-port=8080/tcp --permanent
I think this problem can be circumvented by using different UID/GID-mappings for each container.
This gist runs containers in a pod with the command-line option
--pod=${PODNAME}.By running containers without
--pod=${PODNAME}, it's possible to have different UID/GID-mappings for the containers.I tried it out. Two empty directories were bind-mounted as volumes. After running Nextcloud/MariaDB/nginx/redis, I checked the ownership of all created files and directories. They were all owned by the regular user on the host. For more info see https://github.com/eriksjolund/nextcloud-podman (The example is not based on this gist)