Starting supervisor programs as another user - php

Question

I have a docker (php:7-fpm-alpine) container with supervisor installed. It is added to a default installation by:
RUN apk add nginx composer php7-fpm php7-session supervisor && \
... ... ...
cp supervisord.conf /etc/supervisor.d/conf.ini
Supervisor has its default config (didn't change it after installation), I have added my own config to append to it (supervisord.conf):
[program:php-fpm7]
command = /usr/sbin/php-fpm7 --nodaemonize --fpm-config /etc/php7/php-fpm.d/www.conf
autostart=true
autorestart=true
priority=5
stdout_logfile=/var/log/supervisor/php-fpm.log
stderr_logfile=/var/log/supervisor/php-fpm.error.log
[program:nginx]
command=/usr/sbin/nginx -g "daemon off;"
autostart=true
autorestart=true
priority=10
stdout_logfile=/var/log/supervisor/nginx.log
stderr_logfile=/var/log/supervisor/nginx.error.log
Now the original issue I have is that my Laravel app can't write to storage folder. I could chmod 777 the folder recursively, and it works, but is not what I want.
So steps I took first is to chown -R nginx:nginx /var/www/* leaving permissions as is. This resolved nothing, still can't write.
Doing a ps aux revealed this:
PID USER TIME COMMAND
1 root 0:00 {supervisord} /usr/bin/python2 /usr/bin/supervisord --nodaemon --configuration /etc/supervisord.conf
8 root 0:00 {php-fpm7} php-fpm: master process (/etc/php7/php-fpm.d/www.conf)
9 root 0:00 nginx: master process /usr/sbin/nginx -g daemon off;
10 nginx 0:00 nginx: worker process
11 nginx 0:00 nginx: worker process
12 nginx 0:00 nginx: worker process
13 nginx 0:00 nginx: worker process
14 nginx 0:00 {php-fpm7} php-fpm: pool www
15 nginx 0:00 {php-fpm7} php-fpm: pool www
So php-fpm is running as nginx user (I've changed it's original config to replace user nobody to nginx). This did nothing good, as with this settings instead of nobody user, request returns 502 error.
Nginx master process is running as root, and worker processes as nginx.
This is a tad confusing as I am not sure which user is my web server using here? Root or nginx? Does it take the user from supervisor, nginx master or nginx worker?
I've tried changing supervisor to start as nginx user, but that fails as supervisor needs root access to create pid.
Reverting supervisor to root and adding user=nginx to [program:nginx] section made supervisor not start nginx at all.
How can I do the permissions here the right way?

Answer 1

I think the best you can do , is to run both nginx and php-fpm as www-data:www-data
step one
add/edit this to your nginx.conf:
user www-data www-data;
step two
add/edit php-fpm.conf and set user and group to www-data more info here
I hope that will help you