nextcloud docker with mariadb docker: nx requires user nextcloud with root privileges instead just for db `nextcloud`

[bitdruid]

After 3h of try and error with a not working setup (had nextcloud and mariadb previously installed on the host from source) i asume that the current docker image of nextcloud is not able to initialize on the expected way.

Nextcloud throws constant errors into mariadb-log: [Warning] Access denied for user 'nextcloud'@'myinternalcontainerip' (using password: YES)

i then started to play around with user 'nextcloud' privileges. Normally you would just generate by: CREATE USER 'nextcloud'@'%' IDENTIFIED BY 'db-password'; CREATE DATABASE IF NOT EXISTS nextcloud CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci; GRANT ALL PRIVILEGES on nextcloud.* to 'nextcloud'@'%'; FLUSH privileges;

Because this was not working i started at first to switch the envs in hundreds of combination, replicated images and tried several combinations of nextcloud official and linuxserver.io. Finally nextcloud was able to initialize with a recommended standard-setup when i did:

GRANT ALL PRIVILEGES ON *.* TO 'nextcloud'@'%';

... ended up generating multiple oc_admin users in my db. It seems like nextcloud docker works in a different way than non-docker when it comes to db handling? This could also be a security vulnerability as granting root privileges to multiple users on exposed nextcloud instances is not a good idea.

Also using the nextcloud integrated DB is not a solution for me. I'm running more then 1 application on mariadb and want to administrate all my databases at one place as i did before switching to docker.

The Setup:

OS: Manjaro
Kernel: 6.0.19-3
Docker version 20.10.23, build 715524332f

nextcloud:stable image last pulled Feb 10, 2023 at 7:04 am
mariadb:latest image last pulled Feb 7, 2023 at 3:58 am

Expected behaviour:

• create db and user like on a non-docker instance with restricted privileges
• connect db and user in initialization process

[martadinata666]

because you must set db password for nextcloud user

[bitdruid]

because you must set db password for nextcloud user

thank you for helping me :)

unfortunately the passwords are set correct

      - "MYSQL_DATABASE=nextcloud"
      - "MYSQL_USER=nextcloud"
      - "MYSQL_PASSWORD=somepw"
      - "MYSQL_HOST=mariadb:someport"

experimented with errors related to special characters (maybe) and switched passwords to combinations with or without specials but even with password ,,hello" it's not working.

well the missing privilege for user nextcloud is GRANT on all databases...

setting that and wiping all persistent volumes works. troubles again if you want to regenerate the container.

[martadinata666]

I don't really sure, but likely this is because " character thing. You can also try to manually log in with nextcloud user and check their privileged with MySQL command, to ensure it is created correctly. My db compose:

version: "3.5"
services:
  db:
   image: mariadb:latest
   environment:
      - MARIADB_ROOT_PASSWORD=nextcloudrootpass
      - MARIADB_DATABASE=nextcloud
      - MARIADB_USER=nextcloud
      - MARIADB_PASSWORD=nextcloudpass
   volumes:
      - ./db:/var/lib/mysql

[bitdruid]

I don't really sure, but likely this is because " character thing. You can also try to manually log in with nextcloud user and check their privileged with MySQL command, to ensure it is created correctly. My db compose:

version: "3.5"
services:
  db:
   image: mariadb:latest
   environment:
      - MARIADB_ROOT_PASSWORD=nextcloudrootpass
      - MARIADB_DATABASE=nextcloud
      - MARIADB_USER=nextcloud
      - MARIADB_PASSWORD=nextcloudpass
   volumes:
      - ./db:/var/lib/mysql

So after testing and a working setup i can cut it down:

• user nextcloud requires GRANT on all databases
• if you recreate the container on an empty database but with (old) existing data-folder AND already set GRANT then nextcloud will start generating a load of oc_admin users in the database until the container stops. for me it seems that there is a problem with the sequence (check data-dir, check database, generate user)