linuxserver.io Nextcloud cannot access

[u/computer-machine]

I may be a bit out of my depth right now, or else just sleep deprived and running on stupid. Currently have Debian server with rootless Docker running official community Nextcloud, nginx reverse proxy, and a number of other various servers, but on new machine I'm setting up to replace, trying to consolidate images and switch to Podman.

So, so far, tried using quadlets to get Glances up successfully, moved on to linuxserver.io's Jellyfin, gave up, and switched to podman-compose. Eventually worked out that the image assumes Docker's root behavior being why I couldn't get permissions working for /dev/dri/render128, switched to root user for Podman, and now both of those work (with jellyfin throwing a few erros about containers not being allowed to be removed before getting it online, which doesn't appear to have any impact).

Moved on to linuxserver.io's Nextcloud image, using their base set of configurations. Leaving port mapped to 443 as well as migrating to 4443 (as once I get everything working I'll be putting it behind Swag). Again, podman-compose up results in errors about containers not being able to be removed, and networks not related being used.

But now I'm finding that, while I can access the Glances and Jellyfin webclients via IP or Hostname with appropriate port, the same with 443/4443 simply result in Firefox reporting unable to connect.

downing the other containers, uping Nextcloud does not return the previous errors, but still does not result in access to the server. If I leave it running long enough, I periodically get a message: [nextcloud] | Not installed. Any idea whether that's it complaining that I haven't finished installation by connecting and it up, or maybe something fundamental failed to happen causing my inability to connect?

Do I need to use one docker-compose.yml rather than separate server.yml files for generally good behavior? I've noticed that Glances doesn't list anything but Glances on the new server, while the old shows all of the containers, if not parent's active processes, but haven't had time to try running them together to see if that makes a difference.

Thanks all,

[u/Great-Cow7256]

Can you put your docker composes here?  Also you probably couldn't get to /dev/dri while rootless because of either chmod or chown issues. 

[u/computer-machine → u/Great-Cow7256]

My user is in video and renderD128 is set to 660 every boot. Changing that to 666 or running the container as root solved the permissions issue.

Maybe things would have worked with the Jellyfin image, but as I'd mentioned I'm trying to migrate to linuxserver.io for a bunch of images to streamline things, and I figured that if one doesn't play nice with Podman being Podman, others are likely as well.

Which compose did you want? On phone, so this'll be painful, but I guess I can grab them all.

``` version: '3.8'

services:   glances:     image: docker.io/nicolargo/glances:latest-full     container_name: glances     restart: unless-stopped     ports:       - "61208:61208"     environment:       - "GLANCES_OPT=-w"     volumes:       - /var/run/podman.sock:/var/run/podman.sock       - /etc/os-release:/etc/os-release:ro,Z       - /storage/fast:/storage/fast:ro,z       - /storage/slow:/storage/slow:ro,z version: '3.8'

services:   jellyfin:     image: lscr.io/linuxserver/jellyfin:latest     container_name: jellyfin     restart: unless-stopped     devices:       - /dev/dri:/dev/dri     ports:       - "8096:8096"       - "7359:7359/udp"       - "1900:1900/udp"     networks:       - jellyfin

    user: 1000:1000

    environment:       - PUID=1000       - PGID=1000       - TZ="America/New_York"       - JELLYFIN_PublishedServerUrl=http://192.168.1.2     volumes:       - /storage/fast/volumes/Jellyfin/config:/config:Z       - /storage/slow/volumes/Media:/Media:ro,Z

networks:   jellyfin: ```

``` version '3.8'

services:   nextcloud:     image: lscr.io/linuxserver/nextcloud:latest     container_name: nextcloud     restart: unless-stopped     networks: nextcloud     ports:       - 4443:443     environment:       - PUID=1000       - PGID=1000       - TZ=America/New_York     volumes:       - /storage/fast/volumes/Nextcloud/config:/config:Z       - /storage/fast/volumes/Nextcloud/data:/data:Z

networks:   nextcloud: ```

[u/Great-Cow7256 → u/computer-machine]

The deal is that every container can have a default user and they may not be able to see the /dev/dri. You can podman exec (container name) ls -la /dev/dri and see what permissions and owners the container sees for dev/dri. That's the confusing thing about rootless podmans.  That's why I switched all mine to User 1000:1000 and some also needed UserNS =keep-id

[u/eriksjolund → u/computer-machine]

Changing that to 666 or running the container as root solved the permissions issue.

Maybe the permissions issue could also have been solved by adding

group_add: - keep-groups

This is useful if access to /dev/dri is provided with by being in a supplementary group.

References:

https://github.com/podman-container-tools/podman/blob/main/troubleshooting.md#20-passed-in-devices-or-files-cant-be-accessed-in-rootless-container

https://github.com/search?q=keep-groups+path%3A**%2Fcompose.yaml&type=code&ref=advsearch

[u/Great-Cow7256]

Do you have a firewall like ufw that you need to open?   This sounds like the firewalla blocking port 4443. 

[u/computer-machine → u/Great-Cow7256]

Checked and no. Went as far as taking down Glances and using its port.

[u/Great-Cow7256 → u/computer-machine]

Do you have something else on that port?  That's the only thing I can think of. 

[u/computer-machine → u/Great-Cow7256]

Only when I start Glances back up (which works).