Docker compose volume Permissions linux

Question

I try to run wordpress in a docker container my docker-compose.yaml file is:

version: "2"
services:
  my-wpdb:
    image: mariadb
    ports:
      - "8081:3306"
    environment:
      MYSQL_ROOT_PASSWORD: ChangeMeIfYouWant
  my-wp:
    image: wordpress
    volumes:
      - ./:/var/www/html
    ports:
      - "8080:80"
    links:
      - my-wpdb:mysql
    environment:
      WORDPRESS_DB_PASSWORD: ChangeMeIfYouWant

When i build the docker structure the volume is mounted but belongs to root.

I tried to change that with:

my-wp:
  image: wordpress
  user: 1000:1000    # added
  volumes:
    - ./:/var/www/html
  ports:
    - "8080:80"
  links:
    - my-wpdb:mysql
  environment:
    WORDPRESS_DB_PASSWORD: ChangeMeIfYouWant

Now I can edit files. But then the container doesn't serve the website anymore.

What is the right way to solve this permission issue?

Solution

According to the docker-compose and docker run reference, the user option sets the user id (and group id) of the process running in the container. If you set this to 1000:1000, your webserver is not able to bind to port 80 any more. Binding to a port below 1024 requires root permissions. This means you should remove the added user: 1000:1000 statement again.

To solve the permission issue with the shared volume, you need to change the ownership of the directory. Run chown 1000:1000 /path/to/volume. This can be executed inside the container or directly on the host system. The change is persistent and effective immediately (no container restarted required).

In general, I think the volume should be in a sub-directory, e.g.

  volumes:
    - ./public:/var/www/html

Make sure that the correct user owns ./public. If you start the container and the directory does not exist, docker creates it for you. In this case, the directory is owned by root and you need to change ownership manually as explained above.

---

Alternatively, you can run the webserver as an unprivileged user (user: 1000:1000), let the server listen on port 8080 and change the routing to

 ports:
    - "8080:8080"