garethgeorge / backrest

Backrest is a web UI and orchestrator for restic backup.
GNU General Public License v3.0
1.72k stars 50 forks source link

Docker compose setup: restored files have wrong owner and group #573

Open gturi opened 1 week ago

gturi commented 1 week ago

I am opening this issue to track down the problem with file restore functionality that arises with docker compose based setup, so that it is not lost in the discussion section :)

To sum up the issue this is the result of running ls -la after restoring the same file (my-script.sh) from a previous backup:

# restored using binary based setup
drwx------.  2 myuser myuser 4096 20 nov 18.29 my-script.sh-backrest-restore-64b0f3f7
# restored using docker compose based setup
drwx------.  2 root root 4096 20 nov 15.17 my-script.sh-backrest-restore-93d6208c

Discussed in https://github.com/garethgeorge/backrest/discussions/471

Originally posted by **robflate** September 12, 2024 I'm running Backrest in Docker. When it creates a repo and subsequent snapshots, all file permissions of the original files are ignored and all files are owned by root when restored. How can I run Backrest in Docker and respect file permissions and `user:group`? Also, how can I run the container as a non-root user but still run `HOOK` commands with `docker` e.g. `docker stop container`? If I set `user: 1000:1000` (my host user) in my compose, I get permission denied errors when running docker commands. Incidentally, I can run rclone commands. Also, when using `user: 1000:1000`, Backrest fails on files where that user doesn't have permission inside the container. To simplify, I want to; - Run the container as `1000:1000` so bind mounts (`/data`, `/config`, `/repos` etc) have the same owner as my host. - Respect file permissions when restoring files. - Run docker commands without getting permission denied. - Run Backups on files/folders regardless of `user:group`. Maybe it would be possible to to have env vars `PUID` and `PGID` that set the user inside the container. This user could also be added to the `Docker` group inside the container? Thanks.