Forem: SnowCode

Installing Nextcloud in isolation with podman

SnowCode — Wed, 02 Jul 2025 16:51:01 +0000

I recently wanted to install Nextcloud, I wanted to use containers because I like when things are very organized and each thing is in its own little box, rather than scattered across the system.

However, I saw that the official method with Docker was using the Docker socket, meaning that this Nextcloud container has direct access to Docker itself and can interact with other containers than its own.

I don't want this, I want to use Podman (which is rootless) and I want that Nextcloud be only able to access its own containers.

Quick note : This tutorial has been tested on a blank Debian 12 virtual machine with unstable source enabled and ssh installed. The test has been made on 2nd July 2025. At time of writing the Nextcloud AIO version was v11.2.1, the Nextcloud version was v31.0.6 and the podman version was v5.4.2.

Why this method

Official Nextcloud's installation method
Very complete, AIO can automatically set up office, Talk, high performance backend for NC Talk, etc.
Fast and easy
Rootless configuration (more secure)
Isolated from the rest of your containers and system. Unlike in the official instructions, Nextcloud won't be able to interact with other containers than its own.
Great for trying out Nextcloud quickly locally, even if you can't open the ports of your router or don't have any domain name

Requirements

Before going on this, we obviously need Podman to be installed. If you're doing this from your home network and can't (or don't want to) open the ports of your router, you might want to also install localtunnel.

On Debian unstable (sid), installing Podman is very easy.

sudo apt install podman

The version of Podman on the stable branch is quite outdated and I've had a lot of trouble to make it work, so I recommend you to use sid instead.

For localtunnel, I personally prefer to use bun rather than install NodeJS (because bun is a lot lighter)

sudo apt install unzip
curl -fsSL https://bun.sh/install | bash
source ~/.bashrc

# The command to run localtunnel now is:
bun x localtunnel # args go here

Create a dedicated Nextcloud user to isolate it

Run those command as a dedicated Nextcloud user for isolation

sudo useradd -m nextcloud
sudo loginctl enable-linger nextcloud

Enter into a shell of that new user

sudo -u nextcloud bash
cd

Enable the Podman daemon in that user

XDG_RUNTIME_DIR=/run/user/$(id -u) systemctl --user enable --now podman.socket

Install Nextcloud

Please note, containers cannot directly contact the host, here it's not an issue since localtunnel acts as a reverse proxy on a different IP, but if you use a reverse proxy on the same IP

You'll need to add the option --add-host your.domain.name:host-gateway to let the container access it.

This command is based on the official AIO instructions, you can find them here: https://nextcloud.com/install/aio and here : https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md

I simply added --network bridge so that it can access the other containers it creates (all in the same network) and changed the path of the docker socket, to Podman's socket.

podman run \
    --init \
    --sig-proxy=false \
    --name nextcloud-aio-mastercontainer \
    --restart always \
    --publish 8080:8080 \
    --env APACHE_PORT=11000 \
    --env APACHE_IP_BINDING=0.0.0.0 \
    --env APACHE_ADDITIONAL_NETWORK="" \
    --env SKIP_DOMAIN_VALIDATION=false \
    --volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
    --volume /run/user/$(id -u)/podman/podman.sock:/var/run/docker.sock:ro \
    --network bridge \
    ghcr.io/nextcloud-releases/all-in-one:latest

Create a tunnel to Nextcloud to automatically encrypt the traffic, get a domain name and forward the traffic without needing to open the ports of the router

This is only for testing quickly, but should not use in production. Use a proper reverse proxy instead for production. This command will require you have localtunnel installed.

lt --port 11000
# or if you used bun like me to install localtunnel:
bun x localtunnel --port 11000

Go on https://localhost:8080 and specify your domain name, timezone and apps (I personally disabled Collabora though, as I prefer to use OnlyOffice). Disable it as well if you want to use OnlyOffice.

If you're doing those instructions on a remote server, you can use SSH port forwarding as such:
ssh -L 8080:localhost:8080 <your usual ssh things>
It will launch what looks like a usual SSH session, but in bonus you'll also be able to access that localhost:8080 from your own machine! So you can just now go in your browser and go on https://localhost:8080 and it should work :)

Once you're done, you can then click on the "Start containers" button and wait for a few minutes for everything to be done. Then you can use the credentials provided by the page to login as admin on your new instance.

If you use localtunnel you'll have to provide a password the first time you access it. This password is actually the public IP address of the host. You can find a link to get it below on the page.

The configuration of OnlyOffice is not directly in the UI because the Nextcloud AIO team wanted to only propose one choice of office suite (better defaults instead of more choice, they said).

However, I personally prefer OnlyOffice, as it's much faster and more compatible with stinky MS Office documents. You can enable it by running this command.

podman unshare sed -i 's/isOnlyofficeEnabled": 0/isOnlyofficeEnabled": 1/g' ~/.local/share/containers/storage/volumes/nextcloud_aio_mastercontainer/_data/data/configuration.json

Restart the containers from the web interface

Go to the admin panel, change your password and go into OnlyOffice and click on save. You might also want to enable the odt, ods and odp extensions to be able to edit LibreOffice files

If you want to disable things or get more features, go into the "Apps" section. You can now proceed to go through the settings and app to customize your cloud.

If you want to remove Nextcloud (and all its data)

WARNING!!! This will delete all the data of Nextcloud, not just the image and containers

First, stop the session of the new user

sudo loginctl disable-linger nextcloud

Remove the user

sudo userdel nextcloud

Remove all of its files

sudo rm -rf /home/nextcloud

Discord in Firefox, with themes, plugins and RPC for free

SnowCode — Wed, 07 Feb 2024 19:54:31 +0000

Discord traditionally runs on an Electron app, which means it's basically just a website wrapped in a Chromium browser, so it's pretty heavy, and I really don't want that. I prefer to have Discord in the browser.

Getting Discord in the browser is easy, just go to https://discord.com/app. The problem however is that you don't get RPC (rich presence, which is the famous "blabla is playing ...").

Luckily, there's a project that lets you do all of that, plus it also lets you get plugins to Discord and themes, which looks pretty great. This project is named Vencord and is very easy to install on Chromium based browsers, but unfortunately doesn't work on Firefox because the developers had some trouble getting it to the Add-ons store.

That's why I want to write about how to get it working on Firefox.

Installing Vencord

First, you need to install Firefox Developer Edition. You can probably find it in your package manager (firefox-devedition under NixOS for instance) or on the Mozilla website here
Download the Vencord Firefox extension from the GitHub Release. Here's a direct download link.
You now have to disable the signing verification of Firefox add-ons by going in about:config, searching xpinstall.signatures.required and toggle it to false.
Load Vencord by going into about:addons, clicking on the settings wheel and clicking on Install Add-On From File

Load Discord in your browser. If you now open the Discord settings, you should see a new section called "Vencord"

Vencord is now successfully installed.

Getting rich presence

Getting Discord rich presence (RPC) you'll need to install a software on your computer to listen to the RPC connections and transmit them to Discord through the RPC plugin of Vencord.

Enable the RPC plugin by going into the Vencord plugin settings of your Discord settings and enable the WebRichPresence (arRPC) plugin.
Install NodeJS 18 or above, which is required to run the arRPC server. You can probably install it from your package manager or set it up manually from the official website
Download/clone the GitHub arRPC repository, then run npm install and node src to run the server.



git clone https://github.com/OpenAsar/arrpc
cd arrpc
npm install
node src

If you reload Discord and run some game, it should now show up on Discord without any problem.
Tell your operating system to run at boot in the background (for example in the "exec" section in Hyprland, or in a systemd service, a cron job, etc) that way you won't have to worry about starting the server since it will be done automatically for you.

Other Vencord stuff

Vencord is also pretty nice because you can install themes and get a ton of other plugins. You have plugins like "FakeNitro" which lets you get some Nitro features without paying anything, and many more.

Vencord also prevents some Discord tracking out of the box.

You can also install themes by going to the "Theme" settings tab, then click on "BetterDiscord Themes" and choose whatever theme you like. Download the themes you like, then return to the Vencord settings and upload the theme.

Now congratulations you just themed, added features, removed some tracking, and removed Electron from Discord. Have fun!

🗃️ Using Docker to archive a service (BookStack)

SnowCode — Thu, 09 Feb 2023 14:04:38 +0000

I was on a process to dockerize my infrastructure and I wanted to archive a service I couldn't simply migrate to a newer version nor really use anymore.

So I used Docker to archive it without depending on any dependency.

# First I go into the website's directory
cd /var/www/BookStack

# I generate a SQL script as a backup of the database named "bookstack_db"
mysqldump -u root bookstack_db > bookstack-backup-db.sql

# Then I used tar to create an archive of files (.env, uploads)
tar -czvf bookstack-backup-files.tar.gz .env public/uploads storage/uploads

# Then I take the version of BookStack
cat version

Then I download those files back to my laptop.

mkdir bookstack-backup
cd bookstack-backup
rsync -rv debian@snowcode.ovh:/var/www/BookStack/bookstack-backup-* .

Then, I created a docker-compose file with the following content to describe my infrastructure.

version: "2"
services:
  bookstack:
    image: ghcr.io/linuxserver/bookstack:version-v0.31.4 # Here goes my bookstack version
    container_name: bookstack
    environment:
      - PUID=1000
      - PGID=1000
      - APP_URL=http://localhost:8080
      - DB_HOST=bookstack_db
      - DB_PORT=3306
      - DB_USER=bookstack
      - DB_PASS=secret
      - DB_DATABASE=bookstackapp
    volumes:
      - ./bookstack_files:/config
    ports:
      - 8080:80
    depends_on:
      - bookstack_db
  bookstack_db:
    image: lscr.io/linuxserver/mariadb:10.6.10
    container_name: bookstack_db
    environment:
      - PUID=1000
      - PGID=1000
      - MYSQL_ROOT_PASSWORD=secret
      - TZ=Europe/Brussels
      - MYSQL_DATABASE=bookstackapp
      - MYSQL_USER=bookstack
      - MYSQL_PASSWORD=secret
    volumes:
      - ./bookstack_db:/config

Finally I can start the server with that config...

sudo docker-compose up

...and place the files into the right volumes/directories.

sudo su # I need to be root for accessing the volumes
mv bookstack-backup-files.tar.gz bookstack_files
mv bookstack-backup-db.sql bookstack_db
cd bookstack_files
tar xvzf bookstack-backup-files.tar.gz

Finally I can enter the running container of my database to import the script

sudo docker exec -it bookstack_db bash -c "mysql -u bookstack -p bookstackapp < /config/bookstack-backup-db.sql"
# The default password is secret as defined in the docker-compose

The website can be accessed at http://localhost:8080

Archiving the Docker images

Now to not depend of the Docker registeries we can also archive the images of mariadb and bookstack

First we can list the images:

sudo docker images

Then take the IDs of the mariadb and bookstack images to export them into a TAR archive.

sudo docker image save aad0c49aebf3 -o bookstack.tar
sudo docker image save 39a4293c3071 -o mariadb.tar

Now it's done ! When we need it we can import the images back from the archives using those commands:

sudo docker image import bookstack.tar ghcr.io/linuxserver/bookstack:version-v0.31.4 
sudo docker image import mariadb.tar lscr.io/linuxserver/mariadb:10.6.10

And now you no longer depends on those registeries either for using this backup.