Wrong folder 777 permissions when persisting wp-content only

[iamcryptoki]

WHAT HAPPENED

I have a custom image that inherits from wordpress:5.3.2-apache (see below).

I'm trying to create a non-root Wordpress container and persist wp-content folder ONLY (not the whole Wordpress at /var/www/html).

When running the container:

• /var/www/html is set to 777.
• New plugins installed using the dashboard have a folder set to 777.
• New folders automatically created in wp-content and uploads are set to 777.

Tried to chmod /var/www/html in the Dockerfile, but it does nothing.

Folders have proper permissions when persisting /var/www/html (all Wordpress files).

WHAT YOU EXPECTED TO HAPPEN

Persist /var/www/html/wp-content ONLY with /var/www/html permission set to 755.

DOCKERFILE "wpcustom:5.3.2"

FROM wordpress:5.3.2-apache

ENV TZ="Europe/Paris"
RUN cp /usr/share/zoneinfo/${TZ} /etc/localtime

ENV APACHE_SERVER_NAME="localhost" \
 APACHE_RUN_USER="myuser" \
 APACHE_RUN_GROUP="myuser" \
 APACHE_PORT_HTTP="8080" \
 APACHE_PORT_HTTPS="8443" \
 APACHE_LOG_DIR="/var/log/apache2"

RUN groupadd -g 2000 ${APACHE_RUN_GROUP} && \
 useradd -s /bin/bash -u 2000 -g ${APACHE_RUN_GROUP} ${APACHE_RUN_USER};

RUN sed -i 's/Listen 80/Listen ${APACHE_PORT_HTTP}/g' /etc/apache2/ports.conf; \
 sed -i 's/Listen 443/Listen ${APACHE_PORT_HTTPS}/g' /etc/apache2/ports.conf; \
 sed -i 's/:80/:${APACHE_PORT_HTTP}/g' /etc/apache2/sites-enabled/000-default.conf; \
 sed -i 's/#ServerName www.example.com/ServerName ${APACHE_SERVER_NAME}/g' /etc/apache2/sites-enabled/000-default.conf;

USER ${APACHE_RUN_USER}

EXPOSE ${APACHE_PORT_HTTP} ${APACHE_PORT_HTTPS}

CMD ["apache2-foreground"]

HOW TO REPRODUCE IT

Using Docker:

$ docker run --name wp -v ./wp-content:/var/www/html/wp-content -p 80:8080 -p 443:8443 wpcustom:5.3.2
$ docker exec -i -t wp /bin/bash
$ ls -la /var/www

Note: you can also reproduce it with the original image wordpress:5.3.2-apache.

Using Kubernetes:

apiVersion: apps/v1
kind: Deployment
metadata:
 name: school-wordpress
 namespace: dev
 labels:
 app: school
spec:
 selector:
 matchLabels:
 app: school
 role: frontend
 tier: wordpress
 replicas: 4
 strategy:
 type: RollingUpdate
 rollingUpdate:
 maxSurge: 50%
 maxUnavailable: 50%
 template:
 metadata:
 labels:
 app: school
 role: frontend
 tier: wordpress
 spec:
 securityContext:
 fsGroup: 2000
 runAsNonRoot: true
 volumes:
 - name: school-wordpress
 persistentVolumeClaim:
 claimName: school-wordpress
 containers:
 - name: school-wordpress
 image: customwp:5.3.2
 imagePullPolicy: Always
 securityContext:
 runAsUser: 2000
 runAsGroup: 2000
 allowPrivilegeEscalation: false
 volumeMounts:
 - name: school-wordpress
 mountPath: /var/www/html/wp-content
 ports:
 - name: liveness
 containerPort: 8080
 readinessProbe:
 initialDelaySeconds: 5
 tcpSocket:
 port: liveness
 timeoutSeconds: 5
 periodSeconds: 30
 failureThreshold: 5
 livenessProbe:
 initialDelaySeconds: 5
 tcpSocket:
 port: liveness
 timeoutSeconds: 5
 periodSeconds: 30
 failureThreshold: 5
 envFrom:
 - configMapRef: { name: school-wordpress }
 - secretRef: { name: school-wordpress }
 env:
 - name: APACHE_SERVER_NAME
 valueFrom:
 fieldRef:
 fieldPath: status.podIP

$ kubectl exec -it school-wordpress -n dev -- ls -la /var/www

Thank you!

[iamcryptoki]

issue

[wglambert]

You want /var/www/html to have 775 permissions? It's a volume in the Dockerfile so it can't be modified without mounting a folder on top of it to overwrite it.
There's also this workaround #232 (comment)

FROM wordpress:5.3.2-php7.2-apache
RUN mkdir -p /var/www/test/ \
 && chown 1000:1000 /var/www/test \
 && find /etc/apache2 -name '*.conf' -type f -exec sed -ri -e 's!/var/www/html!/var/www/test!g' -e 's!Directory /var/www/!Directory /var/www/test!g' '{}' +
RUN chmod 775 /var/www/test
WORKDIR /var/www/test

Checking permissions on the folder

$ docker run -it --rm wordpress:test bash
root@7d62bcadb014:/var/www/test# ls -al
total 8 
drwxrwxr-x 2 www-data www-data 4096 Feb 28 18:39 . 
drwxr-xr-x 6 root root 4096 Feb 28 18:47 ..

Mounting wp-content to the new directory /var/www/test/

version: '3.1'
 
services:

 wordpress:
 image: wordpress:test
 restart: always
 ports:
 - 8080:80
 sysctls:
 net.ipv4.ip_unprivileged_port_start: 0
 user: 1000:1000
 environment:
 APACHE_RUN_USER: '#1000'
 APACHE_RUN_GROUP: '#1000'
 WORDPRESS_DB_HOST: db
 WORDPRESS_DB_USER: exampleuser
 WORDPRESS_DB_PASSWORD: examplepass
 WORDPRESS_DB_NAME: exampledb
 volumes:
 - ./wp-content:/var/www/test/wp-content

 db:
 image: mysql:5.7
 restart: always
 environment:
 MYSQL_DATABASE: exampledb
 MYSQL_USER: exampleuser
 MYSQL_PASSWORD: examplepass
 MYSQL_RANDOM_ROOT_PASSWORD: '1'

However I am getting a permission denied Cannot open: No such file or directory from the entrypoint now
Works fine

$ mkdir wp-content && chown 1000:1000 wp-content && chmod 777 wp-content

$ docker-compose up -d
Creating network "wordpress1_default" with the default driver
Creating wordpress1_wordpress_1 ... done
Creating wordpress1_db_1 ... done

$ docker exec -it wordpress1_wordpress_1 bash

I have no name!@a6cc7587f938:/var/www/test$ ls -al 
total 224 
drwxrwxr-x 5 1000 1000 4096 Feb 28 22:25 . 
drwxr-xr-x 7 root root 4096 Feb 28 22:24 .. 
-rw-r--r-- 1 1000 1000 234 Feb 28 22:24 .htaccess 
-rw-r--r-- 1 1000 1000 420 Nov 30 2017 index.php 
-rw-r--r-- 1 1000 1000 19935 Jan 1 2019 license.txt 
-rw-r--r-- 1 1000 1000 7368 Sep 2 21:44 readme.html 
-rw-r--r-- 1 1000 1000 6939 Sep 3 00:41 wp-activate.php 
drwxr-xr-x 9 1000 1000 4096 Dec 18 22:16 wp-admin 
-rw-r--r-- 1 1000 1000 369 Nov 30 2017 wp-blog-header.php 
-rw-r--r-- 1 1000 1000 2283 Jan 21 2019 wp-comments-post.php 
-rw-r--r-- 1 1000 1000 2808 Feb 28 22:24 wp-config-sample.php 
-rw-r--r-- 1 1000 1000 3183 Feb 28 22:25 wp-config.php 
drwxrwxrwx 4 1000 1000 4096 Feb 28 22:24 wp-content 
-rw-r--r-- 1 1000 1000 3955 Oct 10 22:52 wp-cron.php
drwxr-xr-x 20 1000 1000 12288 Dec 18 22:16 wp-includes
-rw-r--r-- 1 1000 1000 2504 Sep 3 00:41 wp-links-opml.php
-rw-r--r-- 1 1000 1000 3326 Sep 3 00:41 wp-load.php
-rw-r--r-- 1 1000 1000 47597 Dec 9 13:30 wp-login.php
-rw-r--r-- 1 1000 1000 8483 Sep 3 00:41 wp-mail.php
-rw-r--r-- 1 1000 1000 19120 Oct 15 15:37 wp-settings.php
-rw-r--r-- 1 1000 1000 31112 Sep 3 00:41 wp-signup.php
-rw-r--r-- 1 1000 1000 4764 Nov 30 2017 wp-trackback.php
-rw-r--r-- 1 1000 1000 3150 Jul 1 2019 xmlrpc.php

[yosifkit]

@wglambert, in your Dockerfile you chown to www-data, but run the image as 1000. It should work if your chown matches the run user (which is why /var/www/html has 777 permissions, so that the container can be run as any user).

[wglambert]

Closing since this is resolved, either make /var/www/html a volume to change its permissions or use this workaround #232 (comment) to use another directory that isn't declared as a volume in the Dockerfile

[iamcryptoki]

This workaround #232 (comment) solved my issue. Many thanks @wglambert @yosifkit!

Dockerfile:

FROM wordpress:5.3.2-apache

ENV TZ="Europe/Paris"
RUN cp /usr/share/zoneinfo/${TZ} /etc/localtime

ENV APACHE_SERVER_NAME="localhost" \
 APACHE_RUN_USER="myuser" \
 APACHE_RUN_GROUP="myuser" \
 APACHE_PORT_HTTP="8080" \
 APACHE_PORT_HTTPS="8443" \
 APACHE_LOG_DIR="/var/log/apache2"

RUN groupadd -g 2000 ${APACHE_RUN_GROUP} && \
 useradd -s /bin/bash -u 2000 -g ${APACHE_RUN_GROUP} ${APACHE_RUN_USER};

RUN mkdir -p /var/www/wordpress/ && \
 chown 2000:2000 /var/www/wordpress && \
 chmod 755 /var/www/wordpress;

RUN find /etc/apache2 -name '*.conf' -type f -exec sed -ri \
 -e 's!Listen 80!Listen ${APACHE_PORT_HTTP}!g' \
 -e 's!Listen 443!Listen ${APACHE_PORT_HTTPS}!g' \
 -e 's!:80!:${APACHE_PORT_HTTP}!g' \
 -e 's!#ServerName www.example.com!ServerName ${APACHE_SERVER_NAME}!g' \
 -e 's!/var/www/html!/var/www/wordpress!g' \
 -e 's!Directory /var/www/!Directory /var/www/wordpress!g' '{}' +;

WORKDIR /var/www/wordpress

USER ${APACHE_RUN_USER}

EXPOSE ${APACHE_PORT_HTTP} ${APACHE_PORT_HTTPS}

CMD ["apache2-foreground"]

[jefferyto]

I'm in a similar situation (have a bind mount for /var/www/html/wp-content and directories created by WordPress inside it have 777 permissions). I don't care if /var/www/html inside the container has 777 permissions.

So the reason why WordPress insists on creating directories with 777 permissions in this case is because it uses the value of FS_CHMOD_DIR when creating directories, and if it is not set, then it is computed from the permissions of ABSPATH (ABSPATH is /var/www/html and hence the 777 permissions).

The easier way to work around this issue is to set FS_CHMOD_DIR explicitly with WORDPRESS_CONFIG_EXTRA, e.g.:

define('FS_CHMOD_DIR', 0755);