Installing Nextcloud All-in-One docker image in rootless mode

4 minute read

Running your own instance of Nextcloud is probably one of the best solutions for reclaiming some privacy and avoiding services hosted by Google, Apple or Microsoft. I tried to cover the task of installing Nextcloud on a Synology NAS here by using the archive file provided by Nextcloud. However, they also offer some very handy “AIO - all-in-one docker image” which will pretty much take care of everything.

I will try to guide through the installation process using Ubuntu 22.04 as example server OS. Usually, Docker images will run with root privileges which I don’t consider best practice. As Nextcloud AIO will also work with Docker’s rootless mode I will cover this as well.

I got most of the information from the official installation instructions, you can check them out here:


As said, I will use Ubuntu 22.04 as example server OS. It can run on hardware or as virtualized KVM guest. (You will need to configure grub at one point, so you require a dedicated kernel). HINT: make sure the server’s FQDN is not pointing to any local IP in /etc/hosts!

Install Docker

Assuming you have a fresh, secured and up-to-date installation of Ubuntu, let’s start by installing Docker first. You can either run their convenience-script or simply add their repository manually by following instructions given here. Once everything is installed we will disable dockerd right away (we will not need it once we set up rootless mode):

$ systemctl disable --now docker.service docker.socket

Setup Docker rootless mode

Create a user

Create an unprivileged user/group and lock the user:

$ MYUSER=ncuser
$ groupadd ${MYUSER}
$ useradd -m -d /home/${MYUSER} -s /bin/bash ${MYUSER}
$ passwd -l ${MYUSER}

Now switch to that user and add some variables to its ~/.bashrc:

export XDG_RUNTIME_DIR=/run/user/$(id -u)
export DOCKER_HOST=unix:///run/user/$(id -u)/docker.sock
export PATH=/usr/bin:$PATH

Switch back to root.

Install Docker in rootless mode

We need some packages installed for rootless mode to work:

$ apt install uidmap dbus-user-session

Switch back to the previously created user and run Docker’s script:

$ /usr/bin/ install

In the end you should have Docker daemon running and be able to control it via systemctl --user:

systemctl --user [start|status|stop] docker

Switch back to user root and make user services autostart on boot:

$ loginctl enable-linger ncuser

You should now have Docker installed in rootless mode!

Disable cgroups (Ubuntu 22.04)

There is an issue with cgroups and Ubuntu 22.04 which will prevent Nextcloud containers from starting in rootless mode. To disable cgroups execute as root:

$ echo "GRUB_CMDLINE_LINUX=systemd.unified_cgroup_hierarchy=false" >> /etc/default/grub.d/cgroup.cfg
$ update-grub
$ reboot

Allow to open privileged ports for non-root

As Nextcloud containers require to open privileged ports as non-root user, run as root:

$ setcap cap_net_bind_service=ep $(which rootlesskit)

Switch to ncuser and restart dockerd:

$ systemctl --user restart docker

HINT: make sure to repeat the above upon each Docker update!

Open firewall ports

Open TCP ports 80, 443, 8443 and UDP/TCP port 3478. In case of ufw:

$ ufw allow 80/tcp
$ ufw allow 443/tcp
$ ufw allow 8443/tcp
$ ufw allow 3478/tcp
$ ufw allow 3478/udp

Create a directory for Nextcloud data

We will need a directory outside the Docker container, which will host our user data. The directory needs to be owned by ncuser and others should NOT have access, i.e. (as root):

$ mkdir -p /nc/ncdata
$ chown ncuser:ncuser /nc/ncdata
$ chmod 750 /nc/ncdata

Install Nextcloud AIO

Now we’re actually ready to install Nextcloud AIO. As ncuser run (default settings, replace /nc/ncdata with whatever directory you’ve created before):

$ docker run --sig-proxy=false --name nextcloud-aio-mastercontainer --restart always \
--publish 80:80 --publish 8080:8080 --publish 8443:8443 \
--volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
--volume $XDG_RUNTIME_DIR/docker.sock:/var/run/docker.sock:ro \
--env NEXTCLOUD_DATADIR="/nc/ncdata" nextcloud/all-in-one:latest

Keep it running.

Point your DNS to the IP of your server and open https://<YOUR_URL>:8443 in a browser. It might take a moment but you should be greeted by the password for your AIO container and the site having a valid certificate (I had to refresh the page manually once). Write down the password and login. Follow the instructions given on the following page. You can now choose, which containers to download. It’s ok to keep the defaults here. Once all containers are up, you can follow the link to login to your new Nextcloud instance as user admin. I’d recommend logging in once as admin, create a new admin user from there, then login with your new admin user and delete the old one.

That’s it, you’ve got Nextcloud running!

Postinstallation tweaks

Remove “missing default phone region” warning

On the security check page you will probably find a warning: “missing default phone region”. To fix that, execute as ncuser:

$ docker exec --user www-data nextcloud-aio-nextcloud php occ config:system:set default_phone_region --value="<YOUR_COUNTRY_CODE>"

See here.


I’d also recommend configuring logrotate by following this. However, as we’re running in rootless mode, you’ll have to modify the configuration file a little:

$ cat /etc/logrotate.d/docker-container
/home/ncuser/.local/share/docker/containers/*/*.log {
  rotate 7


Checkout this to configure fail2ban for your AIO installation.


AIO comes with BorgBackup, s. also here. I’d recommend scheduling a daily backup using AIO settings.

Running ‘occ’ commands

In case you need to run occ commands, remember to run them as ncuser and omit sudo of course! (See here on how to run occ commands).

…and done

That should cover a basic installation. You should check all settings and tweak them to your needs, as well in Nextcloud as in Nextcloud AIO. The latter will reveal some more settings once the Nextcloud containers are stopped. Nextcloud AIO container will updated itself and the other containers. Optionally, you can remove port 8443/tcp from your firewall again and just add it each time you want to connect to the AIO container.