Recurrent permissions issue. My files in /var/www/html got a chown some times.

[hydrosIII]

I have the following Wordpress setup using docker swarm. Everything is working fine. But once in a while and I cannot tell when the files inside /var/www/html got chowned so I have to apply a manual fix doing 👍 :

chown -R www-data:www-data

every now and then So I can manage plugins and the wordpress installation by itself through the GUI.

It tries to go back to wodby:wodby. But I am using this setup because f the cron script below:
So that I can run the wordpress cron using wp and sudo

CRONTAB: "0 * * * * wp cron event run --due-now --path=/var/www/html"

Is there some script that actually does a chown automatically to wodby:wodby in any of the containers involved? I mean the wodby/wordpress-php or wodby/nginx ?

Maybe I am doing something wrong and there is some easier way to do this.

version: "3.8"

services:
  php:
    image: wodby/wordpress-php:8.1
    healthcheck:
      test: ["CMD", "php", "-r", "echo 'OK';"]
      interval: 2s
      timeout: 3s
      retries: 5
    environment:
      PHP_MEMORY_LIMIT: "256M"
      PHP_POST_MAX_SIZE: "64M"
      PHP_FPM_PM_MAX_CHILDREN: 100
      PHP_MAX_INPUT_VARS: 4000
      OPCACHE_MEMORY_CONSUMPTION: "128M"
      PHP_FPM_LISTEN: "9000"
    volumes:
      - wordpress_data:/var/www/html
    networks:
      - wpnet
      - mariadb-net
    deploy:
      resources:
        limits:
          cpus: "2.0"
          memory: 512M
  
  crond:
    image: wodby/wordpress-php:8.1
    init: true
    container_name: "${PROJECT_NAME}_crond"
    environment:
      CRONTAB: "0 * * * * wp cron event run --due-now --path=/var/www/html"
    command: sudo crond -f -d 0
    volumes:
    - wordpress_data:/var/www/html
    deploy:
      resources:
        limits:
          cpus: "1"
          memory: 50M  
  nginx:
    image: wodby/nginx:1.28

    environment:
      NGINX_VHOST_PRESET: wordpress
      NGINX_BACKEND_HOST: php

    volumes:
      - wordpress_data:/var/www/html   
    networks:
      - wpnet
      - traefik-public
    depends_on:
      - php
    deploy:
      labels:
         - traefik.enable=true
        - traefik.docker.network=traefik-public
        - traefik.constraint-label=traefik-public

        # HTTP router with redirect to HTTPS
        - traefik.http.routers.mywebsite-http.rule=Host(`mywebsite.mx`) || Host(`www.mywebsite.mx`)
        - traefik.http.routers.mywebsite-http.entrypoints=http
        - traefik.http.routers.mywebsite-http.middlewares=https-redirect

        # Middleware to perform HTTPS redirect
        - traefik.http.middlewares.https-redirect.redirectscheme.scheme=https
        - traefik.http.middlewares.https-redirect.redirectscheme.permanent=true

        # HTTPS router
        - traefik.http.routers.mywebsite-https.rule=Host(`mywebsite.mx`) || Host(`www.mywebsite.mx`)
        - traefik.http.routers.mywebsite-https.entrypoints=https
        - traefik.http.routers.mywebsite-https.tls.certresolver=le
        - traefik.http.routers.mywebsite-https.middlewares=sslheader
        - traefik.http.services.mywebsite-https.loadbalancer.server.port=80

        # Middleware to ensure HTTPS is recognized by WordPress
        - traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https



        
      resources:
        limits:
          cpus: "2"
          memory: 512M

volumes:
  wordpress_data:

networks:
  wpnet:
    driver: overlay
  traefik-public:
    external: true
  mariadb-net:
    external: true

[csandanov]

This is by design, these container images aren't really suited for the updates via GUI because it's not secure to allow the web server (www-data) to modify your codebase. Docker's approach (at least for production setup) is that if you want to change your codebase, you build a new docker image with your updated codebase.

[hydrosIII]

Ok. So how do I keep the wp-content owned by www-data:www-data?I don't understand why it changes sometimes. That is my issue sometimes I cannot just upload pictures becaus my wp-content folders gets the permissions changed. This just happens very often. (like every month ) but it happens anyway. I don't understand why