The goal of this howto is to

• set up a dokuwiki container using docker (and not e. g. podman, slightly different)
• use an SMB share for storing the data
• on a server using enforcing SELinux (Centos 7)

Add something similar to this to your /etc/fstab:

//vmhost/dokumente/dokuwiki     /home/<user>/dokuwiki-data      cifs  credentials=/root/.cifs,vers=3.0,uid=1000,gid=1000,context=system_u:object_r:container_file_t:s0,noexec,nosuid  0 0

Note: on an SELinux enabled system you need the set the SEContext correctly (as in exactly what you see in a directory that works in a container with ls -lZ)

The credentials can be stored in a file only root can read. Use the highest number for vers possible, it maybe even better to use the smb3 filesystem with posix in newer versions of Linux.

sudo mount $(pwd)/dokuwiki-data

We use an “official” container image. This image assumes to run as a docker and therefore root image. We run it using podmans pseudo root (mapped to the current user) technology. That's why we only use the root user. This is mapped to the current user automatically. php-fpm tries hard to prevent users from running it as root. We need to change the startup options using this script $HOME/dokuwiki-svc-php-fpm-run:

#!/usr/bin/with-contenv bash
# shellcheck shell=bash
 
exec /usr/sbin/php-fpm82 -F -R

$(pwd) is meant to run from <user> home directory:

podman run -d \
  --name=dokuwiki \
  -e PUID=0 \
  -e PGID=0 \
  -e TZ=Europe/Vienna \
  -p 50080:80 \
  -p 50443:443 \
  -v $(pwd)/dokuwiki:/config:z -v $(pwd)/dokuwiki-data/:/config/dokuwiki/data/:z \
  -v $(pwd)/dokuwiki-svc-php-fpm-run:/etc/s6-overlay/s6-rc.d/svc-php-fpm/run:z
  lscr.io/linuxserver/dokuwiki:latest

For podman we can create such a container but need to mange start/stop with systemd. podman has a build in generator for this. This recreates the container, it does not just start it so we can delete the container we created manually.

podman generate systemd --new --files --name dokuwiki
mkdir -p ~/.config/systemd/user/
cp -Z container-dokuwiki.service ~/.config/systemd/user/
systemctl --user daemon-reload
podman stop dokuwiki
podman rm dokuwiki
podman volume prune
systemctl --user start container-dokuwiki
systemctl --user status container-dokuwiki
systemctl --user enable container-dokuwiki

/etc/httpd/conf.d/sites-enabled/dokuwiki.siam.homeunux.net.conf

<VirtualHost *:80>
  ServerName dokuwiki.machine-deck.jeffries-tube.at
  ServerAlias dokuwiki.machine-deck.jeffries-tube.at
 
  Redirect / https://dokuwiki.machine-deck.jeffries-tube.at/
</VirtualHost>
<VirtualHost *:443>
  ServerName dokuwiki.machine-deck.jeffries-tube.at
  ServerAlias dokuwiki.machine-deck.jeffries-tube.at
 
  Include /etc/httpd/conf.d/shared/ssl.conf
 
 
 AllowEncodedSlashes NoDecode
 SSLProxyEngine On
 ProxyPreserveHost On
 
 
 # cert is issued for collaboraonline.example.com and we proxy to localhost
 SSLProxyVerify None
 SSLProxyCheckPeerCN Off
 SSLProxyCheckPeerName Off
 
 
 # static html, js, images, etc. served from coolwsd
 # browser is the client part of Collabora Online
 ProxyPass           / https://127.0.0.1:50443/ retry=0
 ProxyPassReverse    / https://127.0.0.1:50443/

setenforce 0
systemctl stop httpd
sudo docker run -it --rm --name certbot \
            -v "/etc/letsencrypt:/etc/letsencrypt" \
            -v "/var/lib/letsencrypt:/var/lib/letsencrypt" -v "/var/log/letsencrypt/:/var/log/letsencrypt/" \
            -p 80:80 -p 443:443 \
            certbot/certbot certonly --standalone -d [... the other letsencrypt domains],dokuwiki.machine-deck.jeffries-tube.at
systemctl start httpd
setenforce 1