Make cron.php be executed by UID provided at startup.

Expectation:

Cron should execute cron.php with the UID the container is started with (in case a UID is provided).

Status Quo:

Cron.php is executed with www-data, which is UID 33 / 34 (depends on distribution) in the container.

Result: Cron fails to execute cron.php withe the appropriate user.

Details:

Due to security reasons, I am running all my containers rootless and with seperated user accounts. I think rootless non-root execution will be the future of containerization anyways.

I utilize user 1008 for nextcloud.

Nextcloud recognizes this fact and reminds the user that cron is to be executed by the same user in the web interface:

Use system cron service to call the cron.php file every 5 minutes. The cron.php needs to be executed by the system user "1008".

Therefore, I want to start the cron container with the same UID as the app:

$ podman run -d \
  --name=nextcloud-cron \
  --pod=nextcloud \
  --restart unless-stopped \
  --runtime crun \
  --user 1008:1008 \
  -v ~/nc/html:/var/www/html:z \
  -v ~/nc/data:/var/www/data:z \
  --cap-add=CAP_NET_BIND_SERVICE \
  --cap-add=CAP_SETGID \
  --cap-add=CAP_SETUID \
  --entrypoint=/cron.sh \
  docker.io/library/nextcloud:latest

The containers works, file access is fine for UID 1008 - however, the execution of cron.php fails:

crond: USER www-data pid   4 cmd php -f /var/www/html/cron.php
Could not open input file: /var/www/html/cron.php

Nevermind, as "www-data" would be UID 33 and not the appropriate user anyways (should be 1008, as announced by nextcloud). File access for UID 1008 is working fine though.

If I change the UID of www-data in passwd to the designated UID 1008 and passthrough the passwd to the container, the execution fails:

Passwd line:

www-data:x:1008:33:www-data:/var/www:/usr/sbin/nologin

Additional passthrough of passwd for the start of podman:

  -v ~/nc/passwd:/etc/passwd:ro \

Output of the cron-log:

crond: USER www-data pid   2 cmd php -f /var/www/html/cron.php
This account is currently not available.

There is a solution, but it is crap: The execution of cron-php via host works fine:

$ podman exec --user 1008 -t nextcloud-cron php -f /var/www/html/cron.php

Desperate users could execute this line via crond of the host but hopefully you agree that this is not what we want to see ;)

Start with the mentioned cron.sh entrypoint and trace how it launches crond and invokes /var/www/html/cron.php. Check the container's UID and user handling under the provided podman --user setup, then verify that cron.php runs as that UID rather than www-data and remains usable with the documented volume mounts.