Wrong folder 777 permissions when persisting wp-content only

[iamcryptoki]

WHAT HAPPENED

I have a custom image that inherits from wordpress:5.3.2-apache (see below).

I'm trying to create a non-root Wordpress container and persist wp-content folder ONLY (not the whole Wordpress at /var/www/html).

When running the container:

• /var/www/html is set to 777.
• New plugins installed using the dashboard have a folder set to 777.
• New folders automatically created in wp-content and uploads are set to 777.

Tried to chmod /var/www/html in the Dockerfile, but it does nothing.

Folders have proper permissions when persisting /var/www/html (all Wordpress files).

WHAT YOU EXPECTED TO HAPPEN

Persist /var/www/html/wp-content ONLY with /var/www/html permission set to 755.

DOCKERFILE "wpcustom:5.3.2"

FROM wordpress:5.3.2-apache

ENV TZ="Europe/Paris"
RUN cp /usr/share/zoneinfo/${TZ} /etc/localtime

ENV APACHE_SERVER_NAME="localhost" \
    APACHE_RUN_USER="myuser" \
    APACHE_RUN_GROUP="myuser" \
    APACHE_PORT_HTTP="8080" \
    APACHE_PORT_HTTPS="8443" \
    APACHE_LOG_DIR="/var/log/apache2"

RUN groupadd -g 2000 ${APACHE_RUN_GROUP} && \
    useradd -s /bin/bash -u 2000 -g ${APACHE_RUN_GROUP} ${APACHE_RUN_USER};

RUN sed -i 's/Listen 80/Listen ${APACHE_PORT_HTTP}/g' /etc/apache2/ports.conf; \
    sed -i 's/Listen 443/Listen ${APACHE_PORT_HTTPS}/g' /etc/apache2/ports.conf; \
    sed -i 's/:80/:${APACHE_PORT_HTTP}/g' /etc/apache2/sites-enabled/000-default.conf; \
    sed -i 's/#ServerName www.example.com/ServerName ${APACHE_SERVER_NAME}/g' /etc/apache2/sites-enabled/000-default.conf;

USER ${APACHE_RUN_USER}

EXPOSE ${APACHE_PORT_HTTP} ${APACHE_PORT_HTTPS}

CMD ["apache2-foreground"]

HOW TO REPRODUCE IT

Using Docker:

$ docker run --name wp -v ./wp-content:/var/www/html/wp-content -p 80:8080 -p 443:8443 wpcustom:5.3.2
$ docker exec -i -t wp /bin/bash
$ ls -la /var/www

Note: you can also reproduce it with the original image wordpress:5.3.2-apache.

Using Kubernetes:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: school-wordpress
  namespace: dev
  labels:
    app: school
spec:
  selector:
    matchLabels:
      app: school
      role: frontend
      tier: wordpress
  replicas: 4
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 50%
      maxUnavailable: 50%
  template:
    metadata:
      labels:
        app: school
        role: frontend
        tier: wordpress
    spec:
      securityContext:
        fsGroup: 2000
        runAsNonRoot: true
      volumes:
        - name: school-wordpress
          persistentVolumeClaim:
            claimName: school-wordpress
      containers:
        - name: school-wordpress
          image: customwp:5.3.2
          imagePullPolicy: Always
          securityContext:
            runAsUser: 2000
            runAsGroup: 2000
            allowPrivilegeEscalation: false
          volumeMounts:
            - name: school-wordpress
              mountPath: /var/www/html/wp-content
          ports:
            - name: liveness
              containerPort: 8080
          readinessProbe:
            initialDelaySeconds: 5
            tcpSocket:
              port: liveness
            timeoutSeconds: 5
            periodSeconds: 30
            failureThreshold: 5
          livenessProbe:
            initialDelaySeconds: 5
            tcpSocket:
              port: liveness
            timeoutSeconds: 5
            periodSeconds: 30
            failureThreshold: 5
          envFrom:
            - configMapRef: { name: school-wordpress }
            - secretRef: { name: school-wordpress }
          env:
            - name: APACHE_SERVER_NAME
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP

$ kubectl exec -it school-wordpress -n dev -- ls -la /var/www

Thank you!

[iamcryptoki]

issue

[wglambert]

You want /var/www/html to have 775 permissions? It's a volume in the Dockerfile so it can't be modified without mounting a folder on top of it to overwrite it.
There's also this workaround #232 (comment)

FROM wordpress:5.3.2-php7.2-apache
RUN mkdir -p /var/www/test/ \
        && chown 1000:1000 /var/www/test \
        && find /etc/apache2 -name '*.conf' -type f -exec sed -ri -e 's!/var/www/html!/var/www/test!g' -e 's!Directory /var/www/!Directory /var/www/test!g' '{}' +
RUN chmod 775 /var/www/test
WORKDIR /var/www/test

Checking permissions on the folder

$ docker run -it --rm wordpress:test bash
root@7d62bcadb014:/var/www/test# ls -al
total 8                                                                                                                                                       
drwxrwxr-x 2 www-data www-data 4096 Feb 28 18:39 .                                                                                                            
drwxr-xr-x 6 root     root     4096 Feb 28 18:47 ..

Mounting wp-content to the new directory /var/www/test/

version: '3.1'
  
services:

  wordpress:
    image: wordpress:test
    restart: always
    ports:
      - 8080:80
    sysctls:
      net.ipv4.ip_unprivileged_port_start: 0
    user: 1000:1000
    environment:
      APACHE_RUN_USER: '#1000'
      APACHE_RUN_GROUP: '#1000'
      WORDPRESS_DB_HOST: db
      WORDPRESS_DB_USER: exampleuser
      WORDPRESS_DB_PASSWORD: examplepass
      WORDPRESS_DB_NAME: exampledb
    volumes:
      - ./wp-content:/var/www/test/wp-content

  db:
    image: mysql:5.7
    restart: always
    environment:
      MYSQL_DATABASE: exampledb
      MYSQL_USER: exampleuser
      MYSQL_PASSWORD: examplepass
      MYSQL_RANDOM_ROOT_PASSWORD: '1'

However I am getting a permission denied Cannot open: No such file or directory from the entrypoint now
Works fine

$ mkdir wp-content && chown 1000:1000 wp-content && chmod 777 wp-content

$ docker-compose up -d
Creating network "wordpress1_default" with the default driver
Creating wordpress1_wordpress_1 ... done
Creating wordpress1_db_1        ... done

$ docker exec -it wordpress1_wordpress_1 bash

I have no name!@a6cc7587f938:/var/www/test$ ls -al                                                                                                            
total 224                                                                                                                                                     
drwxrwxr-x  5 1000 1000  4096 Feb 28 22:25 .                                                                                                                  
drwxr-xr-x  7 root root  4096 Feb 28 22:24 ..                                                                                                                 
-rw-r--r--  1 1000 1000   234 Feb 28 22:24 .htaccess                                                                                                          
-rw-r--r--  1 1000 1000   420 Nov 30  2017 index.php                                                                                                          
-rw-r--r--  1 1000 1000 19935 Jan  1  2019 license.txt                                                                                                        
-rw-r--r--  1 1000 1000  7368 Sep  2 21:44 readme.html                                                                                                        
-rw-r--r--  1 1000 1000  6939 Sep  3 00:41 wp-activate.php                                                                                                    
drwxr-xr-x  9 1000 1000  4096 Dec 18 22:16 wp-admin                                                                                                           
-rw-r--r--  1 1000 1000   369 Nov 30  2017 wp-blog-header.php                                                                                                 
-rw-r--r--  1 1000 1000  2283 Jan 21  2019 wp-comments-post.php                                                                                               
-rw-r--r--  1 1000 1000  2808 Feb 28 22:24 wp-config-sample.php                                                                                               
-rw-r--r--  1 1000 1000  3183 Feb 28 22:25 wp-config.php                                                                                                      
drwxrwxrwx  4 1000 1000  4096 Feb 28 22:24 wp-content                                                                                                         
-rw-r--r--  1 1000 1000  3955 Oct 10 22:52 wp-cron.php
drwxr-xr-x 20 1000 1000 12288 Dec 18 22:16 wp-includes
-rw-r--r--  1 1000 1000  2504 Sep  3 00:41 wp-links-opml.php
-rw-r--r--  1 1000 1000  3326 Sep  3 00:41 wp-load.php
-rw-r--r--  1 1000 1000 47597 Dec  9 13:30 wp-login.php
-rw-r--r--  1 1000 1000  8483 Sep  3 00:41 wp-mail.php
-rw-r--r--  1 1000 1000 19120 Oct 15 15:37 wp-settings.php
-rw-r--r--  1 1000 1000 31112 Sep  3 00:41 wp-signup.php
-rw-r--r--  1 1000 1000  4764 Nov 30  2017 wp-trackback.php
-rw-r--r--  1 1000 1000  3150 Jul  1  2019 xmlrpc.php

[yosifkit]

@wglambert, in your Dockerfile you chown to www-data, but run the image as 1000. It should work if your chown matches the run user (which is why /var/www/html has 777 permissions, so that the container can be run as any user).

[wglambert]

Closing since this is resolved, either make /var/www/html a volume to change its permissions or use this workaround #232 (comment) to use another directory that isn't declared as a volume in the Dockerfile

[iamcryptoki]

This workaround #232 (comment) solved my issue. Many thanks @wglambert @yosifkit!

Dockerfile:

FROM wordpress:5.3.2-apache

ENV TZ="Europe/Paris"
RUN cp /usr/share/zoneinfo/${TZ} /etc/localtime

ENV APACHE_SERVER_NAME="localhost" \
    APACHE_RUN_USER="myuser" \
    APACHE_RUN_GROUP="myuser" \
    APACHE_PORT_HTTP="8080" \
    APACHE_PORT_HTTPS="8443" \
    APACHE_LOG_DIR="/var/log/apache2"

RUN groupadd -g 2000 ${APACHE_RUN_GROUP} && \
    useradd -s /bin/bash -u 2000 -g ${APACHE_RUN_GROUP} ${APACHE_RUN_USER};

RUN mkdir -p /var/www/wordpress/ && \
    chown 2000:2000 /var/www/wordpress && \
    chmod 755 /var/www/wordpress;

RUN find /etc/apache2 -name '*.conf' -type f -exec sed -ri \
    -e 's!Listen 80!Listen ${APACHE_PORT_HTTP}!g' \
    -e 's!Listen 443!Listen ${APACHE_PORT_HTTPS}!g' \
    -e 's!:80!:${APACHE_PORT_HTTP}!g' \
    -e 's!#ServerName www.example.com!ServerName ${APACHE_SERVER_NAME}!g' \
    -e 's!/var/www/html!/var/www/wordpress!g' \
    -e 's!Directory /var/www/!Directory /var/www/wordpress!g' '{}' +;

WORKDIR /var/www/wordpress

USER ${APACHE_RUN_USER}

EXPOSE ${APACHE_PORT_HTTP} ${APACHE_PORT_HTTPS}

CMD ["apache2-foreground"]

[jefferyto]

I'm in a similar situation (have a bind mount for /var/www/html/wp-content and directories created by WordPress inside it have 777 permissions). I don't care if /var/www/html inside the container has 777 permissions.

So the reason why WordPress insists on creating directories with 777 permissions in this case is because it uses the value of FS_CHMOD_DIR when creating directories, and if it is not set, then it is computed from the permissions of ABSPATH (ABSPATH is /var/www/html and hence the 777 permissions).

The easier way to work around this issue is to set FS_CHMOD_DIR explicitly with WORDPRESS_CONFIG_EXTRA, e.g.:

define('FS_CHMOD_DIR', 0755);