[GH-ISSUE #190] Postgres: permission denied #107

Closed
opened 2026-02-26 09:36:27 +03:00 by kerem · 1 comment
Owner

Originally created by @jcfischer on GitHub (Oct 30, 2019).
Original GitHub issue: https://github.com/ONLYOFFICE/Docker-DocumentServer/issues/190

Do you want to request a feature or report a bug?

Bug

What is the current behavior?

After successful installation of the onlyoffice-document server with docker-compose in an ownCloud 10.2.3 installation (integration working) I updated the owncloud server to 10.3. At that time the document server stopped working. Debugging this, it seems that the PG server cannot access its database files (I get several permission denied errors like error: could not open relation mapping file "global/pg_filenode.map": Permission denied

I recreated the data directories, and the errors happen when PG is trying to access the data directories - even for freshly created PG database.

If the current behavior is a bug, please provide the steps to reproduce and if possible a minimal demo of the problem.

What is the expected behavior?

Did this work in previous versions of DocumentServer?

Worked with the previous version of ownCloud...?

DocumentServer Docker tag:

Host Operating System:

Ubuntu 18.04

docker-compose.yml

version: '2.1'

volumes:
  mysql:
    driver: local
  backup:
    driver: local
  redis:
    driver: local

services:
  owncloud:
    image: owncloud/server:${OWNCLOUD_VERSION}
    restart: always
    depends_on:
      - db
      - redis
    environment:
      - OWNCLOUD_DOMAIN=${OWNCLOUD_DOMAIN}
      - OWNCLOUD_DB_TYPE=mysql
      - OWNCLOUD_DB_NAME=owncloud
      - OWNCLOUD_DB_USERNAME=owncloud
      - OWNCLOUD_DB_PASSWORD=owncloud
      - OWNCLOUD_DB_HOST=db
      - OWNCLOUD_ADMIN_USERNAME=${ADMIN_USERNAME}
      - OWNCLOUD_ADMIN_PASSWORD=${ADMIN_PASSWORD}
      - OWNCLOUD_MYSQL_UTF8MB4=true
      - OWNCLOUD_REDIS_ENABLED=true
      - OWNCLOUD_REDIS_HOST=redis
    networks:
      - web
      - internal
    labels:
      - traefik.enable=true
      - traefik.frontend.rule=Host:box.invisible.ch
      - traefik.port=8080
      - traefik.docker.network=web
    healthcheck:
      test: ["CMD", "/usr/bin/healthcheck"]
      interval: 30s
      timeout: 10s
      retries: 5
    volumes:
      - /mnt/data:/mnt/data

  onlyoffice:
    image: onlyoffice/documentserver:latest
    restart: always
    networks:
      - web
    labels:
      - traefik.enable=true
      - traefik.frontend.rule=Host:docs.invisible.ch
      - traefik.port=80
      - traefik.docker.network=web
    volumes:
      - /mnt/data/onlyoffice/DocumentServer/logs:/var/log/onlyoffice
      - /mnt/data/onlyoffice/DocumentServer/data:/var/www/onlyoffice/Data
      - /mnt/data/onlyoffice/DocumentServer/lib:/var/lib/onlyoffice
      - /mnt/data/onlyoffice/DocumentServer/db:/var/lib/postgresql

  db:
    image: webhippie/mariadb:latest
    restart: always
    environment:
      - MARIADB_ROOT_PASSWORD=owncloud
      - MARIADB_USERNAME=owncloud
      - MARIADB_PASSWORD=owncloud
      - MARIADB_DATABASE=owncloud
      - MARIADB_MAX_ALLOWED_PACKET=128M
      - MARIADB_INNODB_LOG_FILE_SIZE=64M
    networks:
      - internal
    healthcheck:
      test: ["CMD", "/usr/bin/healthcheck"]
      interval: 30s
      timeout: 10s
      retries: 5
    volumes:
      - mysql:/var/lib/mysql
      - backup:/var/lib/backup

  redis:
    image: webhippie/redis:latest
    restart: always
    environment:
      - REDIS_DATABASES=1
    networks:
      - internal
    healthcheck:
      test: ["CMD", "/usr/bin/healthcheck"]
      interval: 30s
      timeout: 10s
      retries: 5
    volumes:
      - redis:/var/lib/redis

networks:
  web:
    external: true
  internal:

Permissions in file system:

root@box:/mnt/data/onlyoffice/DocumentServer# ll
total 0
drwxr-xr-x 6 www-data root 51 Oct 30 12:59 ./
drwxr-xr-x 3 www-data root 28 Oct 30 12:59 ../
drwxr-xr-x 2 www-data root  6 Oct 30 12:59 data/
drwx------ 3 www-data root 17 Oct 30 12:59 db/
drwxr-xr-x 3 www-data root 28 Oct 30 12:59 lib/
drwxr-xr-x 4 www-data root 58 Oct 30 12:59 logs/

The db directories permission are reset by the startup script of the container. (to user postgres). I also installed the postgresql package on the host in order to have that user on the system - this didn't make any difference.

I also used a docker volume instead of a real filesystem when setting up the container - with the same results.

Any ideas?

Originally created by @jcfischer on GitHub (Oct 30, 2019). Original GitHub issue: https://github.com/ONLYOFFICE/Docker-DocumentServer/issues/190 **Do you want to request a *feature* or report a *bug*?** Bug **What is the current behavior?** After successful installation of the onlyoffice-document server with docker-compose in an ownCloud 10.2.3 installation (integration working) I updated the owncloud server to 10.3. At that time the document server stopped working. Debugging this, it seems that the PG server cannot access its database files (I get several `permission denied` errors like `error: could not open relation mapping file "global/pg_filenode.map": Permission denied` I recreated the data directories, and the errors happen when PG is trying to access the data directories - even for freshly created PG database. **If the current behavior is a bug, please provide the steps to reproduce and if possible a minimal demo of the problem.** **What is the expected behavior?** **Did this work in previous versions of DocumentServer?** Worked with the previous version of ownCloud...? **DocumentServer Docker tag:** **Host Operating System:** Ubuntu 18.04 docker-compose.yml ``` version: '2.1' volumes: mysql: driver: local backup: driver: local redis: driver: local services: owncloud: image: owncloud/server:${OWNCLOUD_VERSION} restart: always depends_on: - db - redis environment: - OWNCLOUD_DOMAIN=${OWNCLOUD_DOMAIN} - OWNCLOUD_DB_TYPE=mysql - OWNCLOUD_DB_NAME=owncloud - OWNCLOUD_DB_USERNAME=owncloud - OWNCLOUD_DB_PASSWORD=owncloud - OWNCLOUD_DB_HOST=db - OWNCLOUD_ADMIN_USERNAME=${ADMIN_USERNAME} - OWNCLOUD_ADMIN_PASSWORD=${ADMIN_PASSWORD} - OWNCLOUD_MYSQL_UTF8MB4=true - OWNCLOUD_REDIS_ENABLED=true - OWNCLOUD_REDIS_HOST=redis networks: - web - internal labels: - traefik.enable=true - traefik.frontend.rule=Host:box.invisible.ch - traefik.port=8080 - traefik.docker.network=web healthcheck: test: ["CMD", "/usr/bin/healthcheck"] interval: 30s timeout: 10s retries: 5 volumes: - /mnt/data:/mnt/data onlyoffice: image: onlyoffice/documentserver:latest restart: always networks: - web labels: - traefik.enable=true - traefik.frontend.rule=Host:docs.invisible.ch - traefik.port=80 - traefik.docker.network=web volumes: - /mnt/data/onlyoffice/DocumentServer/logs:/var/log/onlyoffice - /mnt/data/onlyoffice/DocumentServer/data:/var/www/onlyoffice/Data - /mnt/data/onlyoffice/DocumentServer/lib:/var/lib/onlyoffice - /mnt/data/onlyoffice/DocumentServer/db:/var/lib/postgresql db: image: webhippie/mariadb:latest restart: always environment: - MARIADB_ROOT_PASSWORD=owncloud - MARIADB_USERNAME=owncloud - MARIADB_PASSWORD=owncloud - MARIADB_DATABASE=owncloud - MARIADB_MAX_ALLOWED_PACKET=128M - MARIADB_INNODB_LOG_FILE_SIZE=64M networks: - internal healthcheck: test: ["CMD", "/usr/bin/healthcheck"] interval: 30s timeout: 10s retries: 5 volumes: - mysql:/var/lib/mysql - backup:/var/lib/backup redis: image: webhippie/redis:latest restart: always environment: - REDIS_DATABASES=1 networks: - internal healthcheck: test: ["CMD", "/usr/bin/healthcheck"] interval: 30s timeout: 10s retries: 5 volumes: - redis:/var/lib/redis networks: web: external: true internal: ``` Permissions in file system: ``` root@box:/mnt/data/onlyoffice/DocumentServer# ll total 0 drwxr-xr-x 6 www-data root 51 Oct 30 12:59 ./ drwxr-xr-x 3 www-data root 28 Oct 30 12:59 ../ drwxr-xr-x 2 www-data root 6 Oct 30 12:59 data/ drwx------ 3 www-data root 17 Oct 30 12:59 db/ drwxr-xr-x 3 www-data root 28 Oct 30 12:59 lib/ drwxr-xr-x 4 www-data root 58 Oct 30 12:59 logs/ ``` The `db` directories permission are reset by the startup script of the container. (to user `postgres`). I also installed the `postgresql` package on the host in order to have that user on the system - this didn't make any difference. I also used a docker volume instead of a real filesystem when setting up the container - with the same results. Any ideas?
kerem closed this issue 2026-02-26 09:36:27 +03:00
Author
Owner

@jcfischer commented on GitHub (Oct 31, 2019):

I was holding it wrong.

/mnt/data held both ownCloud and onlyoffice directories. Both containers were setting file/directory permissions on their respective directories. This led to a race condition, where sometimes the permissions were correct for onlyoffice db and sometimes not. The soliution was to create two directories: /mnt/data/owncloud and /mnt/data/onlyoffice and expose those two paths to the respective containers

<!-- gh-comment-id:548300467 --> @jcfischer commented on GitHub (Oct 31, 2019): I was holding it wrong. `/mnt/data` held both ownCloud and onlyoffice directories. Both containers were setting file/directory permissions on their respective directories. This led to a race condition, where sometimes the permissions were correct for onlyoffice db and sometimes not. The soliution was to create two directories: `/mnt/data/owncloud` and `/mnt/data/onlyoffice` and expose those two paths to the respective containers
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/Docker-DocumentServer-ONLYOFFICE#107
No description provided.