title: Docker php-fpm running as www-data
body: <p>I've recently been learning to build images and containers with Docker. I was getting fairly confident with it when using a Mac, but recently switched to Ubuntu, I'm fairly new to this side of development.</p>
  
  <p>I'm using a standard new Laravel project as my "code", and am currently just using a php container and nginx container.</p>
  
  <p>I'm using a <code>docker-compose.yml</code> file to create my containers:</p>
  
  <pre><code>version: "3.1"
  
  services:
      nginx:
          image: nginx:latest
          volumes:
              - ./code:/var/www
              - ./nginx_conf.conf:/etc/nginx/conf.d/default.conf
          ports:
              - "80:80"
      php:
          image: php:7.3-fpm
          ports:
              - 9000
          volumes:
              - ./code:/var/www
  </code></pre>
  
  <p>There may or may not be a mistake in the code above just because I've just typed it out rather than copy and pasting - but it works on my machine.</p>
  
  <p>The problem is:</p>
  
  <ul>
  <li><p>php-fpm is configured with <code>--with-fpm-user=www-data</code> and <code>--with-fpm-group=www-data</code>, and that's set in the <code>php:7.3-fpm</code> Dockerfile <a href="https://github.com/docker-library/php/blob/master/7.3/alpine3.9/fpm/Dockerfile#L50" rel="noreferrer">(see here)</a>.</p></li>
  <li><p>The files on my host machine, are saved with my user name and group as owner / group.</p></li>
  <li>When I go into the container, the files are owned by 1000 and group 1000 (I assume a mapping to my user account and group on the host machine?)</li>
  </ul>
  
  <p>However, when I access the application through the browser, I get a permission denied error on start up (when Laravel tries to create an error log file in storage). I think this is because <code>php-fpm</code> is running as www-data, but the storage directory has permissions <code>drwxr-xr-x</code> for owner / group phil:phil - my host owner and group.</p>
  
  <p>I've tried the following, after hours of googling and trials:</p>
  
  <ul>
  <li><p>Recursively change the owner and group of the code directory on the host machine to <code>www-data:www-data</code>. This allows the Laravel application to work, but I now cant create or edit etc files on the host using PHPStorm, because the directory is read-only (I guess because phpstorm is running as my user, and directory is owned by a different user / group).</p></li>
  <li><p>I've added my host user account to the <code>www-data</code> group, and granted <code>write</code> permissions to the group using <code>sudo chmod -R g+w ./code</code>, which now allows the application to run the application, and for phpstorm to write, execute etc files, but when i create or edit a file, the files ownership and group change back to my host <code>phil:phil</code>, and I guess this would break the application again.</p></li>
  <li><p>I've tried to create a php image, and set the env (as described in the link above) to configure with <code>--with-fpm-user=phil --with-fpm-group=phil</code>, but after building, it doesn't change anything - it's still running with www-data (after reading a github issue I think this is because envs cant be changed until later, at which point php is already configured?) <a href="https://github.com/docker-library/php/issues/698" rel="noreferrer">(see github issue here)</a></p></li>
  </ul>
  
  <p>I'm running out of ideas to try. The only other thing I can think of, is to recursively set owner and group of the code directory on my host to <code>www-data</code> and try run phpstorm as <code>www-data</code> instead, but that feels weird (Update: I tried to open phpstorm as www-data user, using <code>sudo -u www-data phpstorm.sh</code>, but i get a java exception - something to do with graphics -so this approach is unfeasible as well)</p>
  
  <p>Now the only thing I can think of to try is to create a new php image from alpine base image and bypass php's images completely - which seems like an awful lot of inconvenience just because the maintainers want to use <code>ENV</code> instead of <code>ARG</code>?</p>
  
  <p>I'm not sure of best practice for this scenario. Should I be trying to change how php-fpm is run (user/group)? should I be updating the directory owner/group on my host? should I be running phpstorm as a different user?</p>
  
  <p>Literally any advice will be greatly appreciated.</p>