move nextcloud container back to debian

[Zoey2936]

The most AI functions of Nextcloud seem to do not work with musl... Even if I like alpine, maybe the nextcloud container should be moved back to debian

[szaimen]

Before we do that I will try to discuss this topic internally since this also comes with a few downsides. I will keep you updated as soon as I have something to report.

[Zoey2936]

no, but beside the additional apks, I see nothing that could break. The container could be build with debian testing as base, so security is a smaller problem

[szaimen]

I would use this as base so there is no slim variant of it IIRC? https://hub.docker.com/layers/library/php/8.2.10-fpm-bullseye/images/sha256-5bc5d90807d2b6d00db894bc7c96e4637b85f5f598e48d6118606ae563b732ea?context=explore

Potentially breaking are features like adding additional packages and for example if we forget some needed packages or e.g. if the recognize app suddenly does not work anymore because bundled nodejs is not compatible etc

[Zoey2936]

I would use debian:testing and https://deb.sury.org

[szaimen]

I would use debian:testing and deb.sury.org

I would not do this. Lets keep using the official php images.

[Zoey2936]

And why?

[szaimen]

I am wondering now if we actually need this now that local-ai is available as community container. See https://github.com/nextcloud/all-in-one/tree/main/community-containers/local-ai

[Zoey2936]

does it also support translation, nextcloud asstant, etc?

[szaimen]

cc @julien-nc do you know?

[szaimen]

Based on https://github.com/nextcloud/assistant#text-processing-providers already possible.

[szaimen]

Apparently translating will not work (as the only feature) with local-ai but there is a libretranslate container that I will add as community container going forward.
Added it to the list #3432

[FlattusBlastus]

Commenting here as a Cybersecurity Defense Engineer: Staying on Alpine is more secure. Its attack surface is much smaller than the rest of the available Linux distros. In addition, the community containers are a huge help in adding functionality and keeping the various components in their own little sandboxes.

[szaimen]

Commenting here as a Cybersecurity Defense Engineer: Staying on Alpine is more secure. Its attack surface is much smaller than the rest of the available Linux distros. In addition, the community containers are a huge help in adding functionality and keeping the various components in their own little sandboxes.

Thanks for the positive feedback! I agree :)

[luzfcb]

Although I completely agree that having security is great and is something that everyone wants, as a user of nextcloud-aio I am at a crossroads: I cannot configure Nextcloud AIO, recognize, imaginary, memories, etc. to use my Nvidia GPU for ML because musl makes this very difficult or impossible.

From my point of view, we gain security, but we lose the possibility of innovation/gain new users who, like me are trying to leave Google Photos, because Alpine/musl makes it difficult to install and configure things that are not so trivial.

What would be the solution? Move all plugins that require GPU and are installable via the Nextcloud WEB UI to separate containers with debian-slim?

[szaimen]

Move all plugins that require GPU and are installable via the Nextcloud WEB UI to separate containers with debian-slim?

Already done. See https://github.com/nextcloud/all-in-one/tree/main/community-containers/local-ai and https://github.com/nextcloud/all-in-one/tree/main/community-containers/libretranslate

[priyankub]

How will they utilize cuda without --runtime=nvidia?
For local ai I ended up using a separate localai container with correct config to be able to utilize cuda instead of using the community container