Updating nextcloud docker container on RPI - docker

Question

I am running nextcloud in a docker container on my Raspberry Pi. I have set it up witih self-signed certificates as described here. These are my files to run the docker-compose:
Dockerfile:
FROM nextcloud:apache
COPY setssl.sh /usr/local/bin/
RUN /usr/local/bin/setssl.sh mail#mail.com 172.30.0.2
docker-compose:
version: '2'
services:
nextcloud:
image: nextcloud_ssl
build: .
container_name: nextcloud
restart: always
user: 1000:1000
ports:
- 8443:443
volumes:
- /home/pi/nextcloud/ncdata:/var/www/html
- /home/pi/nextcloud/ssl:/etc/ssl/nextcloud
- /home/pi/pictures:/var/www/html/data/files/pics
- ./php.ini:/usr/local/etc/php/conf.d/zzz-custom.ini
environment:
- MYSQL_PASSWORD=xxx
- MYSQL_DATABASE=xxx
- MYSQL_USER=xxx
- MYSQL_HOST=xxx
- MYSQL_PORT=xxx
networks:
default:
external:
name: mariabridge
setssl.sh
# setssl.sh
# USAGE: setssl.sh <email> <domain>
echo 'SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains"
Header always set X-Frame-Options DENY
Header always set X-Content-Type-Options nosniff
SSLCompression off
SSLSessionTickets Off' > /etc/apache2/conf-available/ssl-params.conf
echo "<IfModule mod_ssl.c>
<VirtualHost _default_:443>
ServerAdmin $2
ServerName $1
" > /etc/apache2/sites-available/default-ssl.conf
echo '
DocumentRoot /var/www/html
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
SSLEngine on
SSLCertificateFile /etc/ssl/nextcloud/cert.pem
SSLCertificateKeyFile /etc/ssl/nextcloud/key.pem
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
SSLOptions +StdEnvVars
</Directory>
</VirtualHost>
</IfModule>' >> /etc/apache2/sites-available/default-ssl.conf
a2enmod ssl >/dev/null
a2ensite default-ssl >/dev/null
a2enconf ssl-params >/dev/null
According to the linked thread above, I have to run these commands to update my container:
docker-compose build --pull
docker-compose up -d
I have used this successfully before. Now, I'm getting the following errors:
docker-compose build --pull
Building with native build. Learn about native build in Compose here: https://docs.docker.com/go/compose-native-build/
Building nextcloud
Sending build context to Docker daemon 45.65GB
Step 1/3 : FROM nextcloud:apache
apache: Pulling from library/nextcloud
Digest: sha256:99d94124b2024c9f7f38dc12144a92bc0d68d110bcfd374169ebb7e8df0adf8e
Status: Image is up to date for nextcloud:apache
---> 0dd24a9c32e9
Step 2/3 : COPY setssl.sh /usr/local/bin/
---> Using cache
---> 360b5260b30a
Step 3/3 : RUN /usr/local/bin/setssl.sh mail#mail.com 172.30.0.2
---> Running in 4e77f23a45f2
touch: setting times of '/var/lib/apache2/module/enabled_by_admin/socache_shmcb': Operation not permitted
ERROR: Failed to create marker '/var/lib/apache2/module/enabled_by_admin/socache_shmcb'!
ERROR: Could not enable dependency socache_shmcb for ssl, aborting
touch: setting times of '/var/lib/apache2/site/enabled_by_admin/default-ssl': Operation not permitted
ERROR: Failed to create marker '/var/lib/apache2/site/enabled_by_admin/default-ssl'!
touch: setting times of '/var/lib/apache2/conf/enabled_by_admin/ssl-params': Operation not permitted
ERROR: Failed to create marker '/var/lib/apache2/conf/enabled_by_admin/ssl-params'!
The command '/bin/sh -c /usr/local/bin/setssl.sh mail#mail.com 172.30.0.2' returned a non-zero code: 1
ERROR: Service 'nextcloud' failed to build
I tried running this as sudo as well (running it as pi usually), but it didn't solve the issue. Not sure what to do here. The nextcloud forums is not really that active to ask for help..

Answer 1

Step 3/3 : RUN /usr/local/bin/setssl.sh mail#mail.com 172.30.0.2
---> Running in 4e77f23a45f2
touch: setting times of '/var/lib/apache2/module/enabled_by_admin/socache_shmcb': Operation not permitted
ERROR: Failed to create marker '/var/lib/apache2/module/enabled_by_admin/socache_shmcb'!
ERROR: Could not enable dependency socache_shmcb for ssl, aborting
touch: setting times of '/var/lib/apache2/site/enabled_by_admin/default-ssl': Operation not permitted
ERROR: Failed to create marker '/var/lib/apache2/site/enabled_by_admin/default-ssl'!
touch: setting times of '/var/lib/apache2/conf/enabled_by_admin/ssl-params': Operation not permitted
ERROR: Failed to create marker '/var/lib/apache2/conf/enabled_by_admin/ssl-params'!
The command '/bin/sh -c /usr/local/bin/setssl.sh mail#mail.com 172.30.0.2' returned a non-zero code: 1
If the RUN step that's filing now used to work, it's because your upstream nextcloud:apache has added a USER line in the dockerfile and the USER they added does not have access to /var/lib/apache2.
The solution is simple, if inelegant.
Figure out which USER is set in the nextcloud:apache upstream image.
Add a USER command of your own before the CMD that runs setssl.sh to set the user to one that has access to /var/lib/apache2
Add another USER command to switch back to the user from nextcloud:apache.
I tried running this as sudo as well (running it as pi usually), but it didn't solve the issue.
No, sudo wouldn't. This all happens in docker land, so running docker build / docker compose with sudo doesn't change any of that.
Let me share one more thought with you. I assume you authored setssl.sh. One of many idiosyncrasies of sh is that failed commands do not typically end the script by default, while most non-shell programming languages won't continue to run after a statement generates an error. You should always run the shell with -e in the shebang line, run set -e, or the equivalent in non-bourn-like shells to make sure your shell command will error if its commands error, which is appropriate for this case. (If you're curious, setssl.sh returns the exit code of the last touch command that ran, but it should have failed after the first command that failed!) Otherwise your docker build will succeed but the docker image won't have the files you need.