Buzu's questions

I have the following settings, and I restart the sshd service every time I make a change.

Match Group sftp_users                                                                                                                 
ChrootDirectory /home/sftp-data                                                                                                        
ForceCommand internal-sftp 

But when I log into the server, it goes to the server's root directory. If I remove the Match Group line, it works as expected changing the root to /home/sftp-data and logging the user straight to its home dir.

The group name is correct. I've also tried using Match User with the user name, and no luck.

/home/ and /home/sftp-data are owned by root. in /home/sftp-data I have a directory m that is owned by my sftp user. The sftp user's home directory is specified as /m.

"OpenSSH_8.2p1, OpenSSL 1.1.1g FIPS 21 Apr 2020"

What could be wrong?

UPDATE:

This is the user info

$ id sftp_user
uid=1002(sftp_user) gid=1002(sftp_users) groups=1002(sftp_users)

I've set up a laravel project on Fedora using Podman. For this I wrote a small script that attempts to replace the build process usually done by sail.

#!/usr/bin/env bash

if [ -f ./.env ]; then
  # Surce .env so Laravel's env variables are available...
  source ./.env
fi

export WWWGROUP=$(id -g)
export PODNAME=laravel

podman build -t laravel:image --build-arg=WWWGROUP=${WWWGROUP} vendor/laravel/sail/runtimes/7.4

podman pod create -n ${PODNAME} -p 8080:80
podman create --name laraveldb \
  -e MYSQL_USER=${DB_USERNAME} \
  -e MYSQL_PASSWORD=${DB_PASSWORD} \
  -e MYSQL_DATABASE=${DB_DATABASE} \
  -e MYSQL_ROOT_PASSWORD=rootpassword \
  --pod ${PODNAME} \
  centos/mariadb

podman create --name laravelphp \
  -v ./:/var/www/html:Z \
  --pod ${PODNAME} \
  -e WWWUSER=$(id -u) \
  datapics:image

I'm aware this script may have a few issues, but I'm not looking to distribute it, I just want to be able to repeat these steps easily for my testings.

Everything works well, and I can build, and run the project, but when I open localhost:8080 I get the following error

The stream or file "/var/www/html/storage/logs/laravel.log" could not be opened in append mode: failed to open stream: Permission denied

If I give "other" write permissions on the storage directory I can fix this problem, but what I would like to do is to have the sail user be the owner of the files in the mounted directory so that it has rw permissions without opening those permissions to everyone in the host.

I've tried adding --userns keep-id when creating the laravelphp container, but that doesn't work. The container fails to start. I've also tried adding -u $(id -u) when creating the container, but that doesn't work either. The container fails to start.

I've successfully changed the ownership of the files inside the container with podman exec laravelphp chown -R sail /var/www/html but that changes the onwnership of the files outside the container as well. I know this is expected to happen because of how podman and user namespaces work.

Is there a way to mount a directory so that inside the container it is owned by the sail user, and not by root? The sail user inside the container has the same id that my user has in the host (1000).

As far as I can tell, the php container must be run as root, otherwise it fails to start or to even be created.