GH-3541 docker data permissions & cleanup (#4148)

* fix markdown linter errors

* use named volumes; fix data paths

docker/Dockerfile

@@ -13,20 +13,20 @@ FROM golang:1.18.3@sha256:b203dc573d81da7b3176264bfa447bd7c10c9347689be405403818
 WORKDIR /go/src/focalboard
 ADD . /go/src/focalboard
 
-
 RUN  EXCLUDE_PLUGIN=true EXCLUDE_SERVER=true EXCLUDE_ENTERPRISE=true make server-linux
-RUN mkdir /data
 
 ## Final image
-FROM gcr.io/distroless/base-debian10@sha256:d2ce069a83a6407e98c7e0844f4172565f439dab683157bf93b6de20c5b46155
+FROM debian:buster-slim@sha256:5b0b1a9a54651bbe9d4d3ee96bbda2b2a1da3d2fa198ddebbced46dfdca7f216
+
+RUN mkdir -p /opt/focalboard/data/files
+RUN chown -R nobody:nogroup /opt/focalboard
 
 WORKDIR /opt/focalboard
 
-COPY --from=gobuild --chown=nobody:nobody /data /data
-COPY --from=nodebuild --chown=nobody:nobody /webapp/pack pack/
-COPY --from=gobuild --chown=nobody:nobody /go/src/focalboard/bin/linux/focalboard-server bin/
-COPY --from=gobuild --chown=nobody:nobody /go/src/focalboard/LICENSE.txt LICENSE.txt
-COPY --from=gobuild --chown=nobody:nobody /go/src/focalboard/docker/server_config.json config.json
+COPY --from=nodebuild --chown=nobody:nogroup /webapp/pack pack/
+COPY --from=gobuild --chown=nobody:nogroup /go/src/focalboard/bin/linux/focalboard-server bin/
+COPY --from=gobuild --chown=nobody:nogroup /go/src/focalboard/LICENSE.txt LICENSE.txt
+COPY --from=gobuild --chown=nobody:nogroup /go/src/focalboard/docker/server_config.json config.json
 
 USER nobody
 
@@ -34,6 +34,6 @@ EXPOSE 8000/tcp
 
 EXPOSE 8000/tcp 9092/tcp
 
-VOLUME /data
+VOLUME /opt/focalboard/data
 
 CMD ["/opt/focalboard/bin/focalboard-server"]

docker/README.md

@@ -2,33 +2,32 @@
 
 ## Docker
 
-The Dockerfile gives a quick and easy way to pull the latest Focalboard server and deploy it locally.
-Please note that if you wish to have persistence and mount a volume for the `/data` directory, the host directory must be owned by user `nobody`.
+The Dockerfile gives a quick and easy way to pull the latest Focalboard server and deploy it locally. In the example below,
+the Focalboard database and files will be persisted in a named volumed called `fbdata`.
 
-```
-sudo chown -R nobody /home/user/focalboard-data
-docker build -t focalboard .
-docker run -it -v "/home/user/focalboard-data:/data" -p 80:8000 focalboard
+From the Focalboard project root directory:
+
+```bash
+docker build -f docker/Dockerfile -t focalboard .
+docker run -it -v "fbdata:/opt/focalboard/data" -p 80:8000 focalboard
 ```
 
-> The `-v` flag can be used to store Focalboard's database and uploaded files in a directory on the Docker host
-
-Open a browser to http://localhost to start
+Open a browser to [localhost](http://localhost) to start
 
 ## Docker-Compose
 
 Docker-Compose provides the option to automate the build and run step, or even include some of the steps from the [personal server setup](https://www.focalboard.com/download/personal-edition/ubuntu/).
 
-To start the server run
+To start the server, change directory to `focalboard/docker` and run:
 
-```
+```bash
 docker-compose up
 ```
 
-This will automatically build the focalboard image and start it with the http port mapping.
+This will automatically build the focalboard image and start it with the http port mapping. These examples also create a persistent named volume called `fbdata`.
 
-To run focalboard with a nginx proxy and a postgres backend run
+To run Focalboard with a nginx proxy and a postgres backend, change directory to `focalboard/docker` and run:
 
-```
+```bash
 docker-compose -f docker-compose-db-nginx.yml up
 ```

docker/config.json

@@ -6,7 +6,7 @@
     "postgres_dbconfig": "dbname=boards sslmode=disable",
     "useSSL": false,
     "webpath": "./pack",
-    "filespath": "./files",
+    "filespath": "./data/files",
     "telemetry": true,
     "prometheusaddress": ":9092",
     "session_expire_time": 2592000,

docker/docker-compose-db-nginx.yml

@@ -16,6 +16,7 @@ services:
       - VIRTUAL_PROTO=http
     volumes:
       - "./config.json:/opt/focalboard/config.json"
+      - fbdata:/opt/focalboard/data
     restart: always
     networks:
       - proxy
@@ -37,11 +38,16 @@ services:
     container_name: focalboard-postgres
     restart: always
     volumes:
-      - "./data:/var/lib/postgresql/data"
+      - pgdata:/var/lib/postgresql/data
     environment:
       POSTGRES_DB: boards
       POSTGRES_USER: boardsuser
       POSTGRES_PASSWORD: boardsuser-password
 
+volumes:
+  fbdata:
+  pgdata:
+
 networks:
   proxy:
+

docker/docker-compose.yml

@@ -5,8 +5,13 @@ services:
       context: ../
       dockerfile: docker/Dockerfile
     container_name: focalboard
+    volumes:
+      - fbdata:/opt/focalboard/data
     ports:
       - 80:8000
     environment:
       - VIRTUAL_HOST=focalboard.local
       - VIRTUAL_PORT=8000
+
+volumes:
+  fbdata:

docker/server_config.json

@@ -2,11 +2,11 @@
   "serverRoot": "http://localhost:8000",
   "port": 8000,
   "dbtype": "sqlite3",
-  "dbconfig": "/data/focalboard.db",
+  "dbconfig": "./data/focalboard.db",
   "postgres_dbconfig": "dbname=focalboard sslmode=disable",
   "useSSL": false,
   "webpath": "./pack",
-  "filespath": "/data/files",
+  "filespath": "./data/files",
   "telemetry": true,
   "session_expire_time": 2592000,
   "session_refresh_time": 18000,