cron won't run inside server container with custom uid

[meonkeys]

I set up cron following https://github.com/nextcloud/docker/tree/master/.examples/dockerfiles/cron/apache . This has been working well for a while now. Just now I tried running my Nextcloud container as a non-root user (following #1812) and I'm getting an error from the container:

crond: can't set groups: Operation not permitted

Here's my Dockerfile:

FROM nextcloud:25.0.2-apache

RUN apt-get update \
  && apt-get install -y --no-install-recommends \
    supervisor \
    ffmpeg \
    ghostscript \
    libmagickcore-6.q16-6-extra \
  && rm -rf /var/lib/apt/lists/* \
  && mkdir /var/log/supervisord /var/run/supervisord \
  && sed -i '/^.\+coder.\+PDF.\+$/s/none/read | write/' /etc/ImageMagick-6/policy.xml

COPY supervisord.conf /

# Avoid permission error later. This is likely suboptimal but it seems to work.
# The error is: PermissionError: [Errno 13] Permission denied: '/var/log/supervisord/supervisord.log'
RUN chown -R www-data:www-data /var/log/supervisord /var/run/supervisord

ENV NEXTCLOUD_UPDATE=1

CMD ["/usr/bin/supervisord", "-c", "/supervisord.conf"]

My workaround is to run the container as root.

See also:

• https://help.nextcloud.com/t/cron-in-kubernetes-cant-set-groups-operation-not-permitted/152538
• https://serverfault.com/questions/836091/crond-cant-set-groups-operation-not-permitted/836885#836885

[J0WI]

duplicate of #1740

[meonkeys]

Thank you, "not planned" sounds fine, and we should add a note in the docs (I'll submit a patch). I don't think this is a dup of #1740 though. That issue is about running cron as a user the sysadmin chooses. This issue is, when running as a nonprivileged user, busybox's crond fails to run cron.php. I think the error message crond: can't set groups: Operation not permitted is coming from busybox's crond, which perhaps expects it is running as root. That would explain the likely attempt to drop permissions or whatever it is doing when it calls setgroups(). I didn't look to deep though, so I suppose some PHP code could be trying to call setgroups(). It does look like a busybox error message though.