Docker socket is not readable by the www-data user.

[pestotoast]

The container does not start if the docker group does not have the expected group id. This is what I did:

sudo docker run -it --name nextcloud-aio-mastercontainer --restart always -p 80:80 -p 8080:8080 -p 8443:8443 --volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config --volume /var/run/docker.sock:/var/run/docker.sock:ro nextcloud/all-in-one:latest
Unable to find image 'nextcloud/all-in-one:latest' locally
latest: Pulling from nextcloud/all-in-one
eff15d958d66: Pull complete 
933427dc39f7: Pull complete 
35bb08dc7ee2: Pull complete 
58a3f26800d7: Pull complete 
bba5c0e912ac: Pull complete 
62e5c0d120c5: Pull complete 
410a26230a3b: Pull complete 
cfd99187016c: Pull complete 
c32ab7d5171e: Pull complete 
0d32eb2980c3: Pull complete 
991f816a61cc: Pull complete 
c8667ca62702: Pull complete 
6405e507a13e: Pull complete 
108fd50a39c4: Pull complete 
a4802c6a0ae4: Pull complete 
4f4fb700ef54: Pull complete 
ed2a8c5d896a: Pull complete 
918f8b879784: Pull complete 
ef811a9a19da: Pull complete 
5957cd578fac: Pull complete 
16271f6bc746: Pull complete 
1fad265ca45b: Pull complete 
d3cff4a42d6b: Pull complete 
ed82917488d5: Pull complete 
e306f9b356b0: Pull complete 
71afc1271985: Pull complete 
0ec4a207d9fd: Pull complete 
891138b323b3: Pull complete 
9ba4b052261a: Pull complete 
df2f9d124a4f: Pull complete 
48b90860d7f8: Pull complete 
2ae887bcd224: Pull complete 
2283bd5bb2d5: Pull complete 
Digest: sha256:9a47ed4b666f74027d710490ae1fac5a078275d2516ce8e671046cb2337fb88b
Status: Downloaded newer image for nextcloud/all-in-one:latest
Docker socket is not readable by the www-data user. Cannot continue.

After checking out the source code I found that the docker group id is explicitly specified in the Dockerfile. This id has to match the docker group id of the host system otherwise we can't control the docker from with the container.

I was able to resolve the issue on my system by changing the id of my docker group with: sudo groupmod -g 998 docker but it probably should be fixed in the image.

[szaimen]

Thanks for your report!

So the problem here is that the docker groupid of the docker group inside the container needs to match the groupid of the docker group outside the container and that we run everything after the containers creation as www-data user and not as root user which you can see here:

all-in-one/Containers/mastercontainer/Dockerfile

Line 85 in 3f67259

USER www-data

hence we are not able to change the groupid of the docker group inside the container after its creation (during the entrypoint or afterwards). Hence this check ist correct.

Also in my testing it was always using the groupid 998 when installing docker via curl -fsSL get.docker.com | sudo sh so you probably installed docker a bit differently?

I'll leave this issue open for now so that we can see if other users experience this issue as well. If yes, we'll probably need to think about solutions to make this work also if the groupids don't match.

[majst01]

Same here, host ubuntu-21.10, docker installed as explained at docker.com

[szaimen]

Hi, as I've said there is not much we can do here but I improved the documentation in #13 so that the instructions are more clear.
See https://github.com/nextcloud/all-in-one/blob/fix/9%2Ffix-credential-screen/readme.md#how-to-use-this

[majst01]

OK, but this will make things hard to deploy it to kubernetes, or is there a helm chart or similar available for this all in one deployment ?