Docker Install for Paid Members Set License as ENV Variable

[neoark]

Can you make it easier for paid members to install/upgrade Docker? Currently, it requires re-entering the key. Can the key be set as an environment variable in Docker, enabling the paid version to be enabled at the start of Docker?

 

[Rodolfo]

It is indeed already easy, is just that the documentation sucks.

When you set CHEVERETO_SERVICING=server what you cause is that the Chevereto application is served in the old "root" way of doing things, including application filesystem upgrades. That enables you to enter the key, store it, and upgrade to the paid application files.

But docker is designed to be persistent, when you re-start the container it will revert to the original state (the application files from Chevereto free edition).

To avoid this, simply mount a volume at /var/www/html/.

docker run -d \
  --name chevereto \
  -p 80:80 \
  -e CHEVERETO_DB_HOST=database \
  -e CHEVERETO_DB_USER=chevereto \
  -e CHEVERETO_DB_PASS=user_database_password \
  -e CHEVERETO_DB_PORT=3306 \
  -e CHEVERETO_DB_NAME=chevereto \
  -e CHEVERETO_ASSET_STORAGE_TYPE=local \
  -e CHEVERETO_ASSET_STORAGE_URL=/images/_assets/ \
  -e CHEVERETO_ASSET_STORAGE_BUCKET=/var/www/html/images/_assets/ \
  -e CHEVERETO_MAX_POST_SIZE=2G \
  -e CHEVERETO_MAX_UPLOAD_SIZE=2G \
  -e CHEVERETO_SERVICING=server \
  -v /var/www/html/images/ \
  -v /var/www/html/ \
  ghcr.io/chevereto/chevereto:latest

Or if you use docker-compose:

services:
  database:
    image: mariadb:jammy
    networks:
      - chevereto
    volumes:
      - database:/var/lib/mysql
    restart: always
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--su-mysql", "--connect"]
      interval: 10s
      timeout: 5s
      retries: 3
    environment:
      MYSQL_ROOT_PASSWORD: password
      MYSQL_DATABASE: chevereto
      MYSQL_USER: chevereto
      MYSQL_PASSWORD: user_database_password
  php:
    image: chevereto/chevereto:latest # tweak with target image to run
    networks:
      - chevereto
    volumes:
      - storage:/var/www/html/images/
      # - app:/var/www/html/ # uncomment when using CHEVERETO_SERVICING=server
    restart: always
    depends_on:
      database:
        condition: service_healthy
    expose:
      - 80
    environment:
      CHEVERETO_DB_HOST: database
      CHEVERETO_DB_USER: chevereto
      CHEVERETO_DB_PASS: user_database_password
      CHEVERETO_DB_PORT: 3306
      CHEVERETO_DB_NAME: chevereto
      CHEVERETO_HOSTNAME: hostname.com
      CHEVERETO_HOSTNAME_PATH: /
      CHEVERETO_HTTPS: 0
      CHEVERETO_ASSET_STORAGE_TYPE: local
      CHEVERETO_ASSET_STORAGE_URL: http://hostname.com/images/_assets/ #hostname-aware URL
      CHEVERETO_ASSET_STORAGE_BUCKET: /var/www/html/images/_assets/
      CHEVERETO_MAX_POST_SIZE: 2G
      CHEVERETO_MAX_UPLOAD_SIZE: 2G
      # CHEVERETO_SERVICING: server # uncomment to enable application filesystem upgrades
volumes:
  database:
  storage:
  # app: # uncomment when using CHEVERETO_SERVICING=server
networks:
  chevereto:

 

[neoark]

Hello,

That doesn't work with Unraid—every time I pull from docker. I have to go through activation.

Tue Oct 08 19:57:34.401394 2024] [autoindex:error] [pid 81] [client 172.18.0.1:35100] AH01276: Cannot serve directory /var/www/html/: No matching DirectoryIndex (index.php,index.html) found, and server-generated directory index forbidden by Options directive
172.18.0.1 - - [08/Oct/2024:19:57:34 -0400] "GET / HTTP/1.1" 403 455 "-" "Mozilla/5.0 (X11; Linux x86_64) Apple

Need a way to be able to be able to specify a path and not a mount.

 

[Rodolfo]

In my example I used a volume, but you can also bind mount. It doesn't matter for the application.

 

[neoark]

In my example I used a volume, but you can also bind mount. It doesn't matter for the application.

Is there a way to make user:group agnostic and only worry about permissions? It seems like Chevereto is creating /var/www/html with root:root permission instead of www-data www-data.

 

[neoark]

Need a way to set PUID and PGID from the docker environment variable.

Reference:

Understanding PUID and PGID - LinuxServer.io

Welcome to the home of the LinuxServer.io documentation!

docs.linuxserver.io

Understanding the Docker USER Instruction | Docker

Discover best practices and common pitfalls associated with the Docker USER instruction. Also get a hands-on demo to learn the importance of these practices.

www.docker.com

Running a Docker container as a non-root user

The Problem: Docker writes files as root

medium.com

If I set --user 99:100 I get the following error:

 

[Rodolfo]

The reason why a volume works right away is because that's different from a bind mount when it comes to permissions. The volume is like adding another disk within the same container's filesystem type.

If you bind mount the Chevereto container under any Debian based distro this works right away. But when you bind mount a path, and the host and the container don't match the same file system (for example Windows, some Linux distros) what you get is that the container runtime doesn't have access to that mount.

You need to review the mount options to make sure you setup the right permission to make the path available to the container.

This is also easy, but again the documentation sucks. Enter the container, run this:

chown www-data: /var/www/html/ -R

That will take care of the permissions on the mounted path.

 

[Rodolfo]

Need a way to set PUID and PGID from the docker environment variable.

In your pure docker command or compose file you can easily add the container runtime user.

Running containers

Running and configuring containers with the Docker CLI

docs.docker.com

At docker compose you can also indicate the user for each service:

user: my_user

 

[neoark]

The above approach doesn't work because SMTP needs root and doesn't like being run as www-data. The only other viable option is to set the www-data UID in the container to 99 and the www-data group's GID to 100. Can you share the docker file used to create the container?

# Replace new_uid with your new UID and username with the user's username sudo usermod -u new_uid username
# Replace new_gid with your new GID and group with the user's groupname sudo` groupmod -g new_uid groupname`

replace old_uid_of_user_X with the old UID of the user_X# Also replace user_X with the given username find / -user old_uid_of_user_X -exec chown -h user_X {} \;

I will try to see if I can add this to the dockerfile.

 

[Rodolfo]

SMTP needs root

🤨

Can you share the docker file used to create the container?

docker/Dockerfile at 4.1 · chevereto/docker

Template project for deploying Chevereto V4 based applications using Docker - chevereto/docker

github.com

Good luck.

 

[neoark]

It still doesn't work, lol: No matching DirectoryIndex (index.php,index.html) found, and server-generated directory index forbidden by Options directive

 

[Rodolfo]

Try running the command, that always works.

 

[neoark]

Try running the command, that always works.

It's already owned by www-data. I am unsure why I still get a directory Index error when setting the volume at /html. It doesn't happen when it is set to volume at /html/images. Some Apache conf issue?