Docker php-fpm running as www-data

Question

I've recently been learning to build images and containers with Docker. I was getting fairly confident with it when using a Mac, but recently switched to Ubuntu, I'm fairly new to this side of development.

I'm using a standard new Laravel project as my "code", and am currently just using a php container and nginx container.

I'm using a docker-compose.yml file to create my containers:

version: "3.1"

services:
    nginx:
        image: nginx:latest
        volumes:
            - ./code:/var/www
            - ./nginx_conf.conf:/etc/nginx/conf.d/default.conf
        ports:
            - "80:80"
    php:
        image: php:7.3-fpm
        ports:
            - 9000
        volumes:
            - ./code:/var/www

There may or may not be a mistake in the code above just because I've just typed it out rather than copy and pasting - but it works on my machine.

The problem is:

• php-fpm is configured with --with-fpm-user=www-data and --with-fpm-group=www-data, and that's set in the php:7.3-fpm Dockerfile (see here).

• The files on my host machine, are saved with my user name and group as owner / group.

• When I go into the container, the files are owned by 1000 and group 1000 (I assume a mapping to my user account and group on the host machine?)

However, when I access the application through the browser, I get a permission denied error on start up (when Laravel tries to create an error log file in storage). I think this is because php-fpm is running as www-data, but the storage directory has permissions drwxr-xr-x for owner / group phil:phil - my host owner and group.

I've tried the following, after hours of googling and trials:

• Recursively change the owner and group of the code directory on the host machine to www-data:www-data. This allows the Laravel application to work, but I now cant create or edit etc files on the host using PHPStorm, because the directory is read-only (I guess because phpstorm is running as my user, and directory is owned by a different user / group).

• I've added my host user account to the www-data group, and granted write permissions to the group using sudo chmod -R g+w ./code, which now allows the application to run the application, and for phpstorm to write, execute etc files, but when i create or edit a file, the files ownership and group change back to my host phil:phil, and I guess this would break the application again.

• I've tried to create a php image, and set the env (as described in the link above) to configure with --with-fpm-user=phil --with-fpm-group=phil, but after building, it doesn't change anything - it's still running with www-data (after reading a github issue I think this is because envs cant be changed until later, at which point php is already configured?) (see github issue here)

I'm running out of ideas to try. The only other thing I can think of, is to recursively set owner and group of the code directory on my host to www-data and try run phpstorm as www-data instead, but that feels weird (Update: I tried to open phpstorm as www-data user, using sudo -u www-data phpstorm.sh, but i get a java exception - something to do with graphics -so this approach is unfeasible as well)

Now the only thing I can think of to try is to create a new php image from alpine base image and bypass php's images completely - which seems like an awful lot of inconvenience just because the maintainers want to use ENV instead of ARG?

I'm not sure of best practice for this scenario. Should I be trying to change how php-fpm is run (user/group)? should I be updating the directory owner/group on my host? should I be running phpstorm as a different user?

Literally any advice will be greatly appreciated.

Answer 1

ran into the same problem a few weeks ago.

what actually happens is that your host and your container are sharing the same files via the volume, therefore, they also share the permissions.

in production, everything is fine - your server (the www-data user) should be the owner of the files, so no problem here. things get complicated in development - when you are trying to access those files from the host.

i know a few workarounds, the most hacky one seems to be to set www-data uid in the container to 1000, so it will match your uid in the host.

another simple one is to open 777 full permissions on the shared directory, since its only needed in the development build - (should never be done in production though, but as i mentioned before, in production you dont have any problem, so you must seperate the 2 processes and do it only in development mode)

to me, the most elegant solution seems to be to allow all group members to access the files (set 770 permissions), and add www-data to your group:

usermod www-data -a -G phill #// add it to your group

chown -r phill ./code #// make yourself the owner. might need sudo.

chmod 770 ./code #//grunt permissions to all group members