From 587d6d599091932c6d5f1e40b3c815cb4e3936bd Mon Sep 17 00:00:00 2001
From: Daniel Rudolf <github.com@daniel-rudolf.de>
Date: Fri, 22 Dec 2023 17:12:40 +0100
Subject: [PATCH] Run update.sh

Signed-off-by: Daniel Rudolf <github.com@daniel-rudolf.de>
---
 26/apache/Dockerfile        |  5 +++--
 26/apache/entrypoint.sh     | 28 ++++++++++++----------------
 26/apache/occ               | 14 ++++++++++++++
 26/apache/occ-cron          | 19 +++++++++++++++++++
 26/fpm-alpine/Dockerfile    |  5 +++--
 26/fpm-alpine/entrypoint.sh | 28 ++++++++++++----------------
 26/fpm-alpine/occ           | 14 ++++++++++++++
 26/fpm-alpine/occ-cron      | 19 +++++++++++++++++++
 26/fpm/Dockerfile           |  5 +++--
 26/fpm/entrypoint.sh        | 28 ++++++++++++----------------
 26/fpm/occ                  | 14 ++++++++++++++
 26/fpm/occ-cron             | 19 +++++++++++++++++++
 27/apache/Dockerfile        |  5 +++--
 27/apache/entrypoint.sh     | 28 ++++++++++++----------------
 27/apache/occ               | 14 ++++++++++++++
 27/apache/occ-cron          | 19 +++++++++++++++++++
 27/fpm-alpine/Dockerfile    |  5 +++--
 27/fpm-alpine/entrypoint.sh | 28 ++++++++++++----------------
 27/fpm-alpine/occ           | 14 ++++++++++++++
 27/fpm-alpine/occ-cron      | 19 +++++++++++++++++++
 27/fpm/Dockerfile           |  5 +++--
 27/fpm/entrypoint.sh        | 28 ++++++++++++----------------
 27/fpm/occ                  | 14 ++++++++++++++
 27/fpm/occ-cron             | 19 +++++++++++++++++++
 28/apache/Dockerfile        |  5 +++--
 28/apache/entrypoint.sh     | 28 ++++++++++++----------------
 28/apache/occ               | 14 ++++++++++++++
 28/apache/occ-cron          | 19 +++++++++++++++++++
 28/fpm-alpine/Dockerfile    |  5 +++--
 28/fpm-alpine/entrypoint.sh | 28 ++++++++++++----------------
 28/fpm-alpine/occ           | 14 ++++++++++++++
 28/fpm-alpine/occ-cron      | 19 +++++++++++++++++++
 28/fpm/Dockerfile           |  5 +++--
 28/fpm/entrypoint.sh        | 28 ++++++++++++----------------
 28/fpm/occ                  | 14 ++++++++++++++
 28/fpm/occ-cron             | 19 +++++++++++++++++++
 36 files changed, 432 insertions(+), 162 deletions(-)
 create mode 100755 26/apache/occ
 create mode 100755 26/apache/occ-cron
 create mode 100755 26/fpm-alpine/occ
 create mode 100755 26/fpm-alpine/occ-cron
 create mode 100755 26/fpm/occ
 create mode 100755 26/fpm/occ-cron
 create mode 100755 27/apache/occ
 create mode 100755 27/apache/occ-cron
 create mode 100755 27/fpm-alpine/occ
 create mode 100755 27/fpm-alpine/occ-cron
 create mode 100755 27/fpm/occ
 create mode 100755 27/fpm/occ-cron
 create mode 100755 28/apache/occ
 create mode 100755 28/apache/occ-cron
 create mode 100755 28/fpm-alpine/occ
 create mode 100755 28/fpm-alpine/occ-cron
 create mode 100755 28/fpm/occ
 create mode 100755 28/fpm/occ-cron

diff --git a/26/apache/Dockerfile b/26/apache/Dockerfile
index cc287529bf..9b55ba62ae 100644
--- a/26/apache/Dockerfile
+++ b/26/apache/Dockerfile
@@ -15,7 +15,7 @@ RUN set -ex; \
     rm -rf /var/lib/apt/lists/*; \
     \
     mkdir -p /var/spool/cron/crontabs; \
-    echo '*/5 * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data
+    echo '*/5 * * * * occ-cron' > /var/spool/cron/crontabs/www-data
 
 # install the PHP extensions we need
 # see https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html
@@ -165,7 +165,8 @@ RUN set -ex; \
     apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps; \
     rm -rf /var/lib/apt/lists/*
 
-COPY *.sh upgrade.exclude /
+COPY entrypoint.sh cron.sh upgrade.exclude /
+COPY occ occ-cron /usr/local/bin/
 COPY config/* /usr/src/nextcloud/config/
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/26/apache/entrypoint.sh b/26/apache/entrypoint.sh
index edb539a01e..4ec86cd564 100755
--- a/26/apache/entrypoint.sh
+++ b/26/apache/entrypoint.sh
@@ -11,14 +11,6 @@ directory_empty() {
     [ -z "$(ls -A "$1/")" ]
 }
 
-run_as() {
-    if [ "$(id -u)" = 0 ]; then
-        su -p "$user" -s /bin/sh -c "$1"
-    else
-        sh -c "$1"
-    fi
-}
-
 # Execute all executable files in a given directory in alphanumeric order
 run_path() {
     local hook_folder_path="/docker-entrypoint-hooks.d/$1"
@@ -32,7 +24,7 @@ run_path() {
     echo "=> Searching for scripts (*.sh) to run, located in the folder: ${hook_folder_path}"
 
     (
-        find "${hook_folder_path}" -type f -maxdepth 1 -iname '*.sh' -print | sort | while read -r script_file_path; do
+        find "${hook_folder_path}" -maxdepth 1 -type f -iname '*.sh' -print | sort | while read -r script_file_path; do
             if ! [ -x "${script_file_path}" ]; then
                 echo "==> The script \"${script_file_path}\" was skipped, because it didn't have the executable flag"
                 continue
@@ -40,7 +32,11 @@ run_path() {
 
             echo "==> Running the script (cwd: $(pwd)): \"${script_file_path}\""
 
-            run_as "${script_file_path}" || return_code="$?"
+            if [ "$(id -u)" = 0 ]; then
+                su -p "$user" -s /bin/sh "${script_file_path}" || return_code="$?"
+            else
+                "${script_file_path}" || return_code="$?"
+            fi
 
             if [ "${return_code}" -ne "0" ]; then
                 echo "==> Failed at executing \"${script_file_path}\". Exit code: ${return_code}"
@@ -163,7 +159,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                     exit 1
                 fi
                 echo "Upgrading nextcloud from $installed_version ..."
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
             fi
             if [ "$(id -u)" = 0 ]; then
                 rsync_options="-rlDog --chown $user:$group"
@@ -225,7 +221,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                         echo "Starting nextcloud installation"
                         max_retries=10
                         try=0
-                        until run_as "php /var/www/html/occ maintenance:install $install_options" || [ "$try" -gt "$max_retries" ]
+                        until eval "occ maintenance:install $install_options" || [ "$try" -gt "$max_retries" ]
                         do
                             echo "Retrying install..."
                             try=$((try+1))
@@ -240,7 +236,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                             NC_TRUSTED_DOMAIN_IDX=1
                             for DOMAIN in $NEXTCLOUD_TRUSTED_DOMAINS ; do
                                 DOMAIN=$(echo "$DOMAIN" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-                                run_as "php /var/www/html/occ config:system:set trusted_domains $NC_TRUSTED_DOMAIN_IDX --value=$DOMAIN"
+                                occ config:system:set trusted_domains "$NC_TRUSTED_DOMAIN_IDX" --value="$DOMAIN"
                                 NC_TRUSTED_DOMAIN_IDX=$((NC_TRUSTED_DOMAIN_IDX+1))
                             done
                         fi
@@ -254,9 +250,9 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
             else
                 run_path pre-upgrade
 
-                run_as 'php /var/www/html/occ upgrade'
+                occ upgrade
 
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
                 echo "The following apps have been disabled:"
                 diff /tmp/list_before /tmp/list_after | grep '<' | cut -d- -f2 | cut -d: -f1
                 rm -f /tmp/list_before /tmp/list_after
@@ -269,7 +265,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
 
         # Update htaccess after init if requested
         if [ -n "${NEXTCLOUD_INIT_HTACCESS+x}" ] && [ "$installed_version" != "0.0.0.0" ]; then
-            run_as 'php /var/www/html/occ maintenance:update:htaccess'
+            occ maintenance:update:htaccess
         fi
     ) 9> /var/www/html/nextcloud-init-sync.lock
 
diff --git a/26/apache/occ b/26/apache/occ
new file mode 100755
index 0000000000..70b08e7d36
--- /dev/null
+++ b/26/apache/occ
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+[ -e /var/www/html/occ ] || { echo "Unable to run \`occ\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/occ ] || { echo "Unable to run \`occ\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/occ)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/occ -- "$@"' -- '/bin/sh' "$@"
+else
+    exec php -f /var/www/html/occ -- "$@"
+fi
diff --git a/26/apache/occ-cron b/26/apache/occ-cron
new file mode 100755
index 0000000000..798cc175a1
--- /dev/null
+++ b/26/apache/occ-cron
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+
+if [ "$(occ status 2> /dev/null | sed -ne 's/^  - installed: \(.*\)$/\1/p')" != "true" ]; then
+    echo "Nextcloud is not installed - cronjobs are not available" >&2
+    exit 1
+fi
+
+[ -e /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/cron.php)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ-cron\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/cron.php' -- '/bin/sh'
+else
+    exec php -f /var/www/html/cron.php
+fi
diff --git a/26/fpm-alpine/Dockerfile b/26/fpm-alpine/Dockerfile
index dce75c8b70..7466945b71 100644
--- a/26/fpm-alpine/Dockerfile
+++ b/26/fpm-alpine/Dockerfile
@@ -10,7 +10,7 @@ RUN set -ex; \
     ; \
     \
     rm /var/spool/cron/crontabs/root; \
-    echo '*/5 * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data
+    echo '*/5 * * * * occ-cron' > /var/spool/cron/crontabs/www-data
 
 # install the PHP extensions we need
 # see https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html
@@ -134,7 +134,8 @@ RUN set -ex; \
     chmod +x /usr/src/nextcloud/occ; \
     apk del --no-network .fetch-deps
 
-COPY *.sh upgrade.exclude /
+COPY entrypoint.sh cron.sh upgrade.exclude /
+COPY occ occ-cron /usr/local/bin/
 COPY config/* /usr/src/nextcloud/config/
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/26/fpm-alpine/entrypoint.sh b/26/fpm-alpine/entrypoint.sh
index edb539a01e..4ec86cd564 100755
--- a/26/fpm-alpine/entrypoint.sh
+++ b/26/fpm-alpine/entrypoint.sh
@@ -11,14 +11,6 @@ directory_empty() {
     [ -z "$(ls -A "$1/")" ]
 }
 
-run_as() {
-    if [ "$(id -u)" = 0 ]; then
-        su -p "$user" -s /bin/sh -c "$1"
-    else
-        sh -c "$1"
-    fi
-}
-
 # Execute all executable files in a given directory in alphanumeric order
 run_path() {
     local hook_folder_path="/docker-entrypoint-hooks.d/$1"
@@ -32,7 +24,7 @@ run_path() {
     echo "=> Searching for scripts (*.sh) to run, located in the folder: ${hook_folder_path}"
 
     (
-        find "${hook_folder_path}" -type f -maxdepth 1 -iname '*.sh' -print | sort | while read -r script_file_path; do
+        find "${hook_folder_path}" -maxdepth 1 -type f -iname '*.sh' -print | sort | while read -r script_file_path; do
             if ! [ -x "${script_file_path}" ]; then
                 echo "==> The script \"${script_file_path}\" was skipped, because it didn't have the executable flag"
                 continue
@@ -40,7 +32,11 @@ run_path() {
 
             echo "==> Running the script (cwd: $(pwd)): \"${script_file_path}\""
 
-            run_as "${script_file_path}" || return_code="$?"
+            if [ "$(id -u)" = 0 ]; then
+                su -p "$user" -s /bin/sh "${script_file_path}" || return_code="$?"
+            else
+                "${script_file_path}" || return_code="$?"
+            fi
 
             if [ "${return_code}" -ne "0" ]; then
                 echo "==> Failed at executing \"${script_file_path}\". Exit code: ${return_code}"
@@ -163,7 +159,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                     exit 1
                 fi
                 echo "Upgrading nextcloud from $installed_version ..."
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
             fi
             if [ "$(id -u)" = 0 ]; then
                 rsync_options="-rlDog --chown $user:$group"
@@ -225,7 +221,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                         echo "Starting nextcloud installation"
                         max_retries=10
                         try=0
-                        until run_as "php /var/www/html/occ maintenance:install $install_options" || [ "$try" -gt "$max_retries" ]
+                        until eval "occ maintenance:install $install_options" || [ "$try" -gt "$max_retries" ]
                         do
                             echo "Retrying install..."
                             try=$((try+1))
@@ -240,7 +236,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                             NC_TRUSTED_DOMAIN_IDX=1
                             for DOMAIN in $NEXTCLOUD_TRUSTED_DOMAINS ; do
                                 DOMAIN=$(echo "$DOMAIN" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-                                run_as "php /var/www/html/occ config:system:set trusted_domains $NC_TRUSTED_DOMAIN_IDX --value=$DOMAIN"
+                                occ config:system:set trusted_domains "$NC_TRUSTED_DOMAIN_IDX" --value="$DOMAIN"
                                 NC_TRUSTED_DOMAIN_IDX=$((NC_TRUSTED_DOMAIN_IDX+1))
                             done
                         fi
@@ -254,9 +250,9 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
             else
                 run_path pre-upgrade
 
-                run_as 'php /var/www/html/occ upgrade'
+                occ upgrade
 
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
                 echo "The following apps have been disabled:"
                 diff /tmp/list_before /tmp/list_after | grep '<' | cut -d- -f2 | cut -d: -f1
                 rm -f /tmp/list_before /tmp/list_after
@@ -269,7 +265,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
 
         # Update htaccess after init if requested
         if [ -n "${NEXTCLOUD_INIT_HTACCESS+x}" ] && [ "$installed_version" != "0.0.0.0" ]; then
-            run_as 'php /var/www/html/occ maintenance:update:htaccess'
+            occ maintenance:update:htaccess
         fi
     ) 9> /var/www/html/nextcloud-init-sync.lock
 
diff --git a/26/fpm-alpine/occ b/26/fpm-alpine/occ
new file mode 100755
index 0000000000..70b08e7d36
--- /dev/null
+++ b/26/fpm-alpine/occ
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+[ -e /var/www/html/occ ] || { echo "Unable to run \`occ\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/occ ] || { echo "Unable to run \`occ\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/occ)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/occ -- "$@"' -- '/bin/sh' "$@"
+else
+    exec php -f /var/www/html/occ -- "$@"
+fi
diff --git a/26/fpm-alpine/occ-cron b/26/fpm-alpine/occ-cron
new file mode 100755
index 0000000000..798cc175a1
--- /dev/null
+++ b/26/fpm-alpine/occ-cron
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+
+if [ "$(occ status 2> /dev/null | sed -ne 's/^  - installed: \(.*\)$/\1/p')" != "true" ]; then
+    echo "Nextcloud is not installed - cronjobs are not available" >&2
+    exit 1
+fi
+
+[ -e /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/cron.php)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ-cron\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/cron.php' -- '/bin/sh'
+else
+    exec php -f /var/www/html/cron.php
+fi
diff --git a/26/fpm/Dockerfile b/26/fpm/Dockerfile
index 1325022028..cb18381a28 100644
--- a/26/fpm/Dockerfile
+++ b/26/fpm/Dockerfile
@@ -15,7 +15,7 @@ RUN set -ex; \
     rm -rf /var/lib/apt/lists/*; \
     \
     mkdir -p /var/spool/cron/crontabs; \
-    echo '*/5 * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data
+    echo '*/5 * * * * occ-cron' > /var/spool/cron/crontabs/www-data
 
 # install the PHP extensions we need
 # see https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html
@@ -150,7 +150,8 @@ RUN set -ex; \
     apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps; \
     rm -rf /var/lib/apt/lists/*
 
-COPY *.sh upgrade.exclude /
+COPY entrypoint.sh cron.sh upgrade.exclude /
+COPY occ occ-cron /usr/local/bin/
 COPY config/* /usr/src/nextcloud/config/
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/26/fpm/entrypoint.sh b/26/fpm/entrypoint.sh
index edb539a01e..4ec86cd564 100755
--- a/26/fpm/entrypoint.sh
+++ b/26/fpm/entrypoint.sh
@@ -11,14 +11,6 @@ directory_empty() {
     [ -z "$(ls -A "$1/")" ]
 }
 
-run_as() {
-    if [ "$(id -u)" = 0 ]; then
-        su -p "$user" -s /bin/sh -c "$1"
-    else
-        sh -c "$1"
-    fi
-}
-
 # Execute all executable files in a given directory in alphanumeric order
 run_path() {
     local hook_folder_path="/docker-entrypoint-hooks.d/$1"
@@ -32,7 +24,7 @@ run_path() {
     echo "=> Searching for scripts (*.sh) to run, located in the folder: ${hook_folder_path}"
 
     (
-        find "${hook_folder_path}" -type f -maxdepth 1 -iname '*.sh' -print | sort | while read -r script_file_path; do
+        find "${hook_folder_path}" -maxdepth 1 -type f -iname '*.sh' -print | sort | while read -r script_file_path; do
             if ! [ -x "${script_file_path}" ]; then
                 echo "==> The script \"${script_file_path}\" was skipped, because it didn't have the executable flag"
                 continue
@@ -40,7 +32,11 @@ run_path() {
 
             echo "==> Running the script (cwd: $(pwd)): \"${script_file_path}\""
 
-            run_as "${script_file_path}" || return_code="$?"
+            if [ "$(id -u)" = 0 ]; then
+                su -p "$user" -s /bin/sh "${script_file_path}" || return_code="$?"
+            else
+                "${script_file_path}" || return_code="$?"
+            fi
 
             if [ "${return_code}" -ne "0" ]; then
                 echo "==> Failed at executing \"${script_file_path}\". Exit code: ${return_code}"
@@ -163,7 +159,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                     exit 1
                 fi
                 echo "Upgrading nextcloud from $installed_version ..."
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
             fi
             if [ "$(id -u)" = 0 ]; then
                 rsync_options="-rlDog --chown $user:$group"
@@ -225,7 +221,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                         echo "Starting nextcloud installation"
                         max_retries=10
                         try=0
-                        until run_as "php /var/www/html/occ maintenance:install $install_options" || [ "$try" -gt "$max_retries" ]
+                        until eval "occ maintenance:install $install_options" || [ "$try" -gt "$max_retries" ]
                         do
                             echo "Retrying install..."
                             try=$((try+1))
@@ -240,7 +236,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                             NC_TRUSTED_DOMAIN_IDX=1
                             for DOMAIN in $NEXTCLOUD_TRUSTED_DOMAINS ; do
                                 DOMAIN=$(echo "$DOMAIN" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-                                run_as "php /var/www/html/occ config:system:set trusted_domains $NC_TRUSTED_DOMAIN_IDX --value=$DOMAIN"
+                                occ config:system:set trusted_domains "$NC_TRUSTED_DOMAIN_IDX" --value="$DOMAIN"
                                 NC_TRUSTED_DOMAIN_IDX=$((NC_TRUSTED_DOMAIN_IDX+1))
                             done
                         fi
@@ -254,9 +250,9 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
             else
                 run_path pre-upgrade
 
-                run_as 'php /var/www/html/occ upgrade'
+                occ upgrade
 
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
                 echo "The following apps have been disabled:"
                 diff /tmp/list_before /tmp/list_after | grep '<' | cut -d- -f2 | cut -d: -f1
                 rm -f /tmp/list_before /tmp/list_after
@@ -269,7 +265,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
 
         # Update htaccess after init if requested
         if [ -n "${NEXTCLOUD_INIT_HTACCESS+x}" ] && [ "$installed_version" != "0.0.0.0" ]; then
-            run_as 'php /var/www/html/occ maintenance:update:htaccess'
+            occ maintenance:update:htaccess
         fi
     ) 9> /var/www/html/nextcloud-init-sync.lock
 
diff --git a/26/fpm/occ b/26/fpm/occ
new file mode 100755
index 0000000000..70b08e7d36
--- /dev/null
+++ b/26/fpm/occ
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+[ -e /var/www/html/occ ] || { echo "Unable to run \`occ\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/occ ] || { echo "Unable to run \`occ\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/occ)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/occ -- "$@"' -- '/bin/sh' "$@"
+else
+    exec php -f /var/www/html/occ -- "$@"
+fi
diff --git a/26/fpm/occ-cron b/26/fpm/occ-cron
new file mode 100755
index 0000000000..798cc175a1
--- /dev/null
+++ b/26/fpm/occ-cron
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+
+if [ "$(occ status 2> /dev/null | sed -ne 's/^  - installed: \(.*\)$/\1/p')" != "true" ]; then
+    echo "Nextcloud is not installed - cronjobs are not available" >&2
+    exit 1
+fi
+
+[ -e /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/cron.php)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ-cron\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/cron.php' -- '/bin/sh'
+else
+    exec php -f /var/www/html/cron.php
+fi
diff --git a/27/apache/Dockerfile b/27/apache/Dockerfile
index 9671fde0e8..baaab32c84 100644
--- a/27/apache/Dockerfile
+++ b/27/apache/Dockerfile
@@ -15,7 +15,7 @@ RUN set -ex; \
     rm -rf /var/lib/apt/lists/*; \
     \
     mkdir -p /var/spool/cron/crontabs; \
-    echo '*/5 * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data
+    echo '*/5 * * * * occ-cron' > /var/spool/cron/crontabs/www-data
 
 # install the PHP extensions we need
 # see https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html
@@ -165,7 +165,8 @@ RUN set -ex; \
     apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps; \
     rm -rf /var/lib/apt/lists/*
 
-COPY *.sh upgrade.exclude /
+COPY entrypoint.sh cron.sh upgrade.exclude /
+COPY occ occ-cron /usr/local/bin/
 COPY config/* /usr/src/nextcloud/config/
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/27/apache/entrypoint.sh b/27/apache/entrypoint.sh
index edb539a01e..4ec86cd564 100755
--- a/27/apache/entrypoint.sh
+++ b/27/apache/entrypoint.sh
@@ -11,14 +11,6 @@ directory_empty() {
     [ -z "$(ls -A "$1/")" ]
 }
 
-run_as() {
-    if [ "$(id -u)" = 0 ]; then
-        su -p "$user" -s /bin/sh -c "$1"
-    else
-        sh -c "$1"
-    fi
-}
-
 # Execute all executable files in a given directory in alphanumeric order
 run_path() {
     local hook_folder_path="/docker-entrypoint-hooks.d/$1"
@@ -32,7 +24,7 @@ run_path() {
     echo "=> Searching for scripts (*.sh) to run, located in the folder: ${hook_folder_path}"
 
     (
-        find "${hook_folder_path}" -type f -maxdepth 1 -iname '*.sh' -print | sort | while read -r script_file_path; do
+        find "${hook_folder_path}" -maxdepth 1 -type f -iname '*.sh' -print | sort | while read -r script_file_path; do
             if ! [ -x "${script_file_path}" ]; then
                 echo "==> The script \"${script_file_path}\" was skipped, because it didn't have the executable flag"
                 continue
@@ -40,7 +32,11 @@ run_path() {
 
             echo "==> Running the script (cwd: $(pwd)): \"${script_file_path}\""
 
-            run_as "${script_file_path}" || return_code="$?"
+            if [ "$(id -u)" = 0 ]; then
+                su -p "$user" -s /bin/sh "${script_file_path}" || return_code="$?"
+            else
+                "${script_file_path}" || return_code="$?"
+            fi
 
             if [ "${return_code}" -ne "0" ]; then
                 echo "==> Failed at executing \"${script_file_path}\". Exit code: ${return_code}"
@@ -163,7 +159,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                     exit 1
                 fi
                 echo "Upgrading nextcloud from $installed_version ..."
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
             fi
             if [ "$(id -u)" = 0 ]; then
                 rsync_options="-rlDog --chown $user:$group"
@@ -225,7 +221,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                         echo "Starting nextcloud installation"
                         max_retries=10
                         try=0
-                        until run_as "php /var/www/html/occ maintenance:install $install_options" || [ "$try" -gt "$max_retries" ]
+                        until eval "occ maintenance:install $install_options" || [ "$try" -gt "$max_retries" ]
                         do
                             echo "Retrying install..."
                             try=$((try+1))
@@ -240,7 +236,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                             NC_TRUSTED_DOMAIN_IDX=1
                             for DOMAIN in $NEXTCLOUD_TRUSTED_DOMAINS ; do
                                 DOMAIN=$(echo "$DOMAIN" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-                                run_as "php /var/www/html/occ config:system:set trusted_domains $NC_TRUSTED_DOMAIN_IDX --value=$DOMAIN"
+                                occ config:system:set trusted_domains "$NC_TRUSTED_DOMAIN_IDX" --value="$DOMAIN"
                                 NC_TRUSTED_DOMAIN_IDX=$((NC_TRUSTED_DOMAIN_IDX+1))
                             done
                         fi
@@ -254,9 +250,9 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
             else
                 run_path pre-upgrade
 
-                run_as 'php /var/www/html/occ upgrade'
+                occ upgrade
 
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
                 echo "The following apps have been disabled:"
                 diff /tmp/list_before /tmp/list_after | grep '<' | cut -d- -f2 | cut -d: -f1
                 rm -f /tmp/list_before /tmp/list_after
@@ -269,7 +265,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
 
         # Update htaccess after init if requested
         if [ -n "${NEXTCLOUD_INIT_HTACCESS+x}" ] && [ "$installed_version" != "0.0.0.0" ]; then
-            run_as 'php /var/www/html/occ maintenance:update:htaccess'
+            occ maintenance:update:htaccess
         fi
     ) 9> /var/www/html/nextcloud-init-sync.lock
 
diff --git a/27/apache/occ b/27/apache/occ
new file mode 100755
index 0000000000..70b08e7d36
--- /dev/null
+++ b/27/apache/occ
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+[ -e /var/www/html/occ ] || { echo "Unable to run \`occ\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/occ ] || { echo "Unable to run \`occ\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/occ)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/occ -- "$@"' -- '/bin/sh' "$@"
+else
+    exec php -f /var/www/html/occ -- "$@"
+fi
diff --git a/27/apache/occ-cron b/27/apache/occ-cron
new file mode 100755
index 0000000000..798cc175a1
--- /dev/null
+++ b/27/apache/occ-cron
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+
+if [ "$(occ status 2> /dev/null | sed -ne 's/^  - installed: \(.*\)$/\1/p')" != "true" ]; then
+    echo "Nextcloud is not installed - cronjobs are not available" >&2
+    exit 1
+fi
+
+[ -e /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/cron.php)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ-cron\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/cron.php' -- '/bin/sh'
+else
+    exec php -f /var/www/html/cron.php
+fi
diff --git a/27/fpm-alpine/Dockerfile b/27/fpm-alpine/Dockerfile
index cfc8a79e50..869edc889c 100644
--- a/27/fpm-alpine/Dockerfile
+++ b/27/fpm-alpine/Dockerfile
@@ -10,7 +10,7 @@ RUN set -ex; \
     ; \
     \
     rm /var/spool/cron/crontabs/root; \
-    echo '*/5 * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data
+    echo '*/5 * * * * occ-cron' > /var/spool/cron/crontabs/www-data
 
 # install the PHP extensions we need
 # see https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html
@@ -134,7 +134,8 @@ RUN set -ex; \
     chmod +x /usr/src/nextcloud/occ; \
     apk del --no-network .fetch-deps
 
-COPY *.sh upgrade.exclude /
+COPY entrypoint.sh cron.sh upgrade.exclude /
+COPY occ occ-cron /usr/local/bin/
 COPY config/* /usr/src/nextcloud/config/
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/27/fpm-alpine/entrypoint.sh b/27/fpm-alpine/entrypoint.sh
index edb539a01e..4ec86cd564 100755
--- a/27/fpm-alpine/entrypoint.sh
+++ b/27/fpm-alpine/entrypoint.sh
@@ -11,14 +11,6 @@ directory_empty() {
     [ -z "$(ls -A "$1/")" ]
 }
 
-run_as() {
-    if [ "$(id -u)" = 0 ]; then
-        su -p "$user" -s /bin/sh -c "$1"
-    else
-        sh -c "$1"
-    fi
-}
-
 # Execute all executable files in a given directory in alphanumeric order
 run_path() {
     local hook_folder_path="/docker-entrypoint-hooks.d/$1"
@@ -32,7 +24,7 @@ run_path() {
     echo "=> Searching for scripts (*.sh) to run, located in the folder: ${hook_folder_path}"
 
     (
-        find "${hook_folder_path}" -type f -maxdepth 1 -iname '*.sh' -print | sort | while read -r script_file_path; do
+        find "${hook_folder_path}" -maxdepth 1 -type f -iname '*.sh' -print | sort | while read -r script_file_path; do
             if ! [ -x "${script_file_path}" ]; then
                 echo "==> The script \"${script_file_path}\" was skipped, because it didn't have the executable flag"
                 continue
@@ -40,7 +32,11 @@ run_path() {
 
             echo "==> Running the script (cwd: $(pwd)): \"${script_file_path}\""
 
-            run_as "${script_file_path}" || return_code="$?"
+            if [ "$(id -u)" = 0 ]; then
+                su -p "$user" -s /bin/sh "${script_file_path}" || return_code="$?"
+            else
+                "${script_file_path}" || return_code="$?"
+            fi
 
             if [ "${return_code}" -ne "0" ]; then
                 echo "==> Failed at executing \"${script_file_path}\". Exit code: ${return_code}"
@@ -163,7 +159,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                     exit 1
                 fi
                 echo "Upgrading nextcloud from $installed_version ..."
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
             fi
             if [ "$(id -u)" = 0 ]; then
                 rsync_options="-rlDog --chown $user:$group"
@@ -225,7 +221,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                         echo "Starting nextcloud installation"
                         max_retries=10
                         try=0
-                        until run_as "php /var/www/html/occ maintenance:install $install_options" || [ "$try" -gt "$max_retries" ]
+                        until eval "occ maintenance:install $install_options" || [ "$try" -gt "$max_retries" ]
                         do
                             echo "Retrying install..."
                             try=$((try+1))
@@ -240,7 +236,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                             NC_TRUSTED_DOMAIN_IDX=1
                             for DOMAIN in $NEXTCLOUD_TRUSTED_DOMAINS ; do
                                 DOMAIN=$(echo "$DOMAIN" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-                                run_as "php /var/www/html/occ config:system:set trusted_domains $NC_TRUSTED_DOMAIN_IDX --value=$DOMAIN"
+                                occ config:system:set trusted_domains "$NC_TRUSTED_DOMAIN_IDX" --value="$DOMAIN"
                                 NC_TRUSTED_DOMAIN_IDX=$((NC_TRUSTED_DOMAIN_IDX+1))
                             done
                         fi
@@ -254,9 +250,9 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
             else
                 run_path pre-upgrade
 
-                run_as 'php /var/www/html/occ upgrade'
+                occ upgrade
 
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
                 echo "The following apps have been disabled:"
                 diff /tmp/list_before /tmp/list_after | grep '<' | cut -d- -f2 | cut -d: -f1
                 rm -f /tmp/list_before /tmp/list_after
@@ -269,7 +265,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
 
         # Update htaccess after init if requested
         if [ -n "${NEXTCLOUD_INIT_HTACCESS+x}" ] && [ "$installed_version" != "0.0.0.0" ]; then
-            run_as 'php /var/www/html/occ maintenance:update:htaccess'
+            occ maintenance:update:htaccess
         fi
     ) 9> /var/www/html/nextcloud-init-sync.lock
 
diff --git a/27/fpm-alpine/occ b/27/fpm-alpine/occ
new file mode 100755
index 0000000000..70b08e7d36
--- /dev/null
+++ b/27/fpm-alpine/occ
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+[ -e /var/www/html/occ ] || { echo "Unable to run \`occ\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/occ ] || { echo "Unable to run \`occ\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/occ)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/occ -- "$@"' -- '/bin/sh' "$@"
+else
+    exec php -f /var/www/html/occ -- "$@"
+fi
diff --git a/27/fpm-alpine/occ-cron b/27/fpm-alpine/occ-cron
new file mode 100755
index 0000000000..798cc175a1
--- /dev/null
+++ b/27/fpm-alpine/occ-cron
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+
+if [ "$(occ status 2> /dev/null | sed -ne 's/^  - installed: \(.*\)$/\1/p')" != "true" ]; then
+    echo "Nextcloud is not installed - cronjobs are not available" >&2
+    exit 1
+fi
+
+[ -e /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/cron.php)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ-cron\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/cron.php' -- '/bin/sh'
+else
+    exec php -f /var/www/html/cron.php
+fi
diff --git a/27/fpm/Dockerfile b/27/fpm/Dockerfile
index 4ca64950b0..d55f1e41ac 100644
--- a/27/fpm/Dockerfile
+++ b/27/fpm/Dockerfile
@@ -15,7 +15,7 @@ RUN set -ex; \
     rm -rf /var/lib/apt/lists/*; \
     \
     mkdir -p /var/spool/cron/crontabs; \
-    echo '*/5 * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data
+    echo '*/5 * * * * occ-cron' > /var/spool/cron/crontabs/www-data
 
 # install the PHP extensions we need
 # see https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html
@@ -150,7 +150,8 @@ RUN set -ex; \
     apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps; \
     rm -rf /var/lib/apt/lists/*
 
-COPY *.sh upgrade.exclude /
+COPY entrypoint.sh cron.sh upgrade.exclude /
+COPY occ occ-cron /usr/local/bin/
 COPY config/* /usr/src/nextcloud/config/
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/27/fpm/entrypoint.sh b/27/fpm/entrypoint.sh
index edb539a01e..4ec86cd564 100755
--- a/27/fpm/entrypoint.sh
+++ b/27/fpm/entrypoint.sh
@@ -11,14 +11,6 @@ directory_empty() {
     [ -z "$(ls -A "$1/")" ]
 }
 
-run_as() {
-    if [ "$(id -u)" = 0 ]; then
-        su -p "$user" -s /bin/sh -c "$1"
-    else
-        sh -c "$1"
-    fi
-}
-
 # Execute all executable files in a given directory in alphanumeric order
 run_path() {
     local hook_folder_path="/docker-entrypoint-hooks.d/$1"
@@ -32,7 +24,7 @@ run_path() {
     echo "=> Searching for scripts (*.sh) to run, located in the folder: ${hook_folder_path}"
 
     (
-        find "${hook_folder_path}" -type f -maxdepth 1 -iname '*.sh' -print | sort | while read -r script_file_path; do
+        find "${hook_folder_path}" -maxdepth 1 -type f -iname '*.sh' -print | sort | while read -r script_file_path; do
             if ! [ -x "${script_file_path}" ]; then
                 echo "==> The script \"${script_file_path}\" was skipped, because it didn't have the executable flag"
                 continue
@@ -40,7 +32,11 @@ run_path() {
 
             echo "==> Running the script (cwd: $(pwd)): \"${script_file_path}\""
 
-            run_as "${script_file_path}" || return_code="$?"
+            if [ "$(id -u)" = 0 ]; then
+                su -p "$user" -s /bin/sh "${script_file_path}" || return_code="$?"
+            else
+                "${script_file_path}" || return_code="$?"
+            fi
 
             if [ "${return_code}" -ne "0" ]; then
                 echo "==> Failed at executing \"${script_file_path}\". Exit code: ${return_code}"
@@ -163,7 +159,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                     exit 1
                 fi
                 echo "Upgrading nextcloud from $installed_version ..."
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
             fi
             if [ "$(id -u)" = 0 ]; then
                 rsync_options="-rlDog --chown $user:$group"
@@ -225,7 +221,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                         echo "Starting nextcloud installation"
                         max_retries=10
                         try=0
-                        until run_as "php /var/www/html/occ maintenance:install $install_options" || [ "$try" -gt "$max_retries" ]
+                        until eval "occ maintenance:install $install_options" || [ "$try" -gt "$max_retries" ]
                         do
                             echo "Retrying install..."
                             try=$((try+1))
@@ -240,7 +236,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                             NC_TRUSTED_DOMAIN_IDX=1
                             for DOMAIN in $NEXTCLOUD_TRUSTED_DOMAINS ; do
                                 DOMAIN=$(echo "$DOMAIN" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-                                run_as "php /var/www/html/occ config:system:set trusted_domains $NC_TRUSTED_DOMAIN_IDX --value=$DOMAIN"
+                                occ config:system:set trusted_domains "$NC_TRUSTED_DOMAIN_IDX" --value="$DOMAIN"
                                 NC_TRUSTED_DOMAIN_IDX=$((NC_TRUSTED_DOMAIN_IDX+1))
                             done
                         fi
@@ -254,9 +250,9 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
             else
                 run_path pre-upgrade
 
-                run_as 'php /var/www/html/occ upgrade'
+                occ upgrade
 
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
                 echo "The following apps have been disabled:"
                 diff /tmp/list_before /tmp/list_after | grep '<' | cut -d- -f2 | cut -d: -f1
                 rm -f /tmp/list_before /tmp/list_after
@@ -269,7 +265,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
 
         # Update htaccess after init if requested
         if [ -n "${NEXTCLOUD_INIT_HTACCESS+x}" ] && [ "$installed_version" != "0.0.0.0" ]; then
-            run_as 'php /var/www/html/occ maintenance:update:htaccess'
+            occ maintenance:update:htaccess
         fi
     ) 9> /var/www/html/nextcloud-init-sync.lock
 
diff --git a/27/fpm/occ b/27/fpm/occ
new file mode 100755
index 0000000000..70b08e7d36
--- /dev/null
+++ b/27/fpm/occ
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+[ -e /var/www/html/occ ] || { echo "Unable to run \`occ\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/occ ] || { echo "Unable to run \`occ\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/occ)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/occ -- "$@"' -- '/bin/sh' "$@"
+else
+    exec php -f /var/www/html/occ -- "$@"
+fi
diff --git a/27/fpm/occ-cron b/27/fpm/occ-cron
new file mode 100755
index 0000000000..798cc175a1
--- /dev/null
+++ b/27/fpm/occ-cron
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+
+if [ "$(occ status 2> /dev/null | sed -ne 's/^  - installed: \(.*\)$/\1/p')" != "true" ]; then
+    echo "Nextcloud is not installed - cronjobs are not available" >&2
+    exit 1
+fi
+
+[ -e /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/cron.php)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ-cron\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/cron.php' -- '/bin/sh'
+else
+    exec php -f /var/www/html/cron.php
+fi
diff --git a/28/apache/Dockerfile b/28/apache/Dockerfile
index f74c1a152c..e408a10d09 100644
--- a/28/apache/Dockerfile
+++ b/28/apache/Dockerfile
@@ -15,7 +15,7 @@ RUN set -ex; \
     rm -rf /var/lib/apt/lists/*; \
     \
     mkdir -p /var/spool/cron/crontabs; \
-    echo '*/5 * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data
+    echo '*/5 * * * * occ-cron' > /var/spool/cron/crontabs/www-data
 
 # install the PHP extensions we need
 # see https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html
@@ -165,7 +165,8 @@ RUN set -ex; \
     apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps; \
     rm -rf /var/lib/apt/lists/*
 
-COPY *.sh upgrade.exclude /
+COPY entrypoint.sh cron.sh upgrade.exclude /
+COPY occ occ-cron /usr/local/bin/
 COPY config/* /usr/src/nextcloud/config/
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/28/apache/entrypoint.sh b/28/apache/entrypoint.sh
index edb539a01e..4ec86cd564 100755
--- a/28/apache/entrypoint.sh
+++ b/28/apache/entrypoint.sh
@@ -11,14 +11,6 @@ directory_empty() {
     [ -z "$(ls -A "$1/")" ]
 }
 
-run_as() {
-    if [ "$(id -u)" = 0 ]; then
-        su -p "$user" -s /bin/sh -c "$1"
-    else
-        sh -c "$1"
-    fi
-}
-
 # Execute all executable files in a given directory in alphanumeric order
 run_path() {
     local hook_folder_path="/docker-entrypoint-hooks.d/$1"
@@ -32,7 +24,7 @@ run_path() {
     echo "=> Searching for scripts (*.sh) to run, located in the folder: ${hook_folder_path}"
 
     (
-        find "${hook_folder_path}" -type f -maxdepth 1 -iname '*.sh' -print | sort | while read -r script_file_path; do
+        find "${hook_folder_path}" -maxdepth 1 -type f -iname '*.sh' -print | sort | while read -r script_file_path; do
             if ! [ -x "${script_file_path}" ]; then
                 echo "==> The script \"${script_file_path}\" was skipped, because it didn't have the executable flag"
                 continue
@@ -40,7 +32,11 @@ run_path() {
 
             echo "==> Running the script (cwd: $(pwd)): \"${script_file_path}\""
 
-            run_as "${script_file_path}" || return_code="$?"
+            if [ "$(id -u)" = 0 ]; then
+                su -p "$user" -s /bin/sh "${script_file_path}" || return_code="$?"
+            else
+                "${script_file_path}" || return_code="$?"
+            fi
 
             if [ "${return_code}" -ne "0" ]; then
                 echo "==> Failed at executing \"${script_file_path}\". Exit code: ${return_code}"
@@ -163,7 +159,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                     exit 1
                 fi
                 echo "Upgrading nextcloud from $installed_version ..."
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
             fi
             if [ "$(id -u)" = 0 ]; then
                 rsync_options="-rlDog --chown $user:$group"
@@ -225,7 +221,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                         echo "Starting nextcloud installation"
                         max_retries=10
                         try=0
-                        until run_as "php /var/www/html/occ maintenance:install $install_options" || [ "$try" -gt "$max_retries" ]
+                        until eval "occ maintenance:install $install_options" || [ "$try" -gt "$max_retries" ]
                         do
                             echo "Retrying install..."
                             try=$((try+1))
@@ -240,7 +236,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                             NC_TRUSTED_DOMAIN_IDX=1
                             for DOMAIN in $NEXTCLOUD_TRUSTED_DOMAINS ; do
                                 DOMAIN=$(echo "$DOMAIN" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-                                run_as "php /var/www/html/occ config:system:set trusted_domains $NC_TRUSTED_DOMAIN_IDX --value=$DOMAIN"
+                                occ config:system:set trusted_domains "$NC_TRUSTED_DOMAIN_IDX" --value="$DOMAIN"
                                 NC_TRUSTED_DOMAIN_IDX=$((NC_TRUSTED_DOMAIN_IDX+1))
                             done
                         fi
@@ -254,9 +250,9 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
             else
                 run_path pre-upgrade
 
-                run_as 'php /var/www/html/occ upgrade'
+                occ upgrade
 
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
                 echo "The following apps have been disabled:"
                 diff /tmp/list_before /tmp/list_after | grep '<' | cut -d- -f2 | cut -d: -f1
                 rm -f /tmp/list_before /tmp/list_after
@@ -269,7 +265,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
 
         # Update htaccess after init if requested
         if [ -n "${NEXTCLOUD_INIT_HTACCESS+x}" ] && [ "$installed_version" != "0.0.0.0" ]; then
-            run_as 'php /var/www/html/occ maintenance:update:htaccess'
+            occ maintenance:update:htaccess
         fi
     ) 9> /var/www/html/nextcloud-init-sync.lock
 
diff --git a/28/apache/occ b/28/apache/occ
new file mode 100755
index 0000000000..70b08e7d36
--- /dev/null
+++ b/28/apache/occ
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+[ -e /var/www/html/occ ] || { echo "Unable to run \`occ\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/occ ] || { echo "Unable to run \`occ\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/occ)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/occ -- "$@"' -- '/bin/sh' "$@"
+else
+    exec php -f /var/www/html/occ -- "$@"
+fi
diff --git a/28/apache/occ-cron b/28/apache/occ-cron
new file mode 100755
index 0000000000..798cc175a1
--- /dev/null
+++ b/28/apache/occ-cron
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+
+if [ "$(occ status 2> /dev/null | sed -ne 's/^  - installed: \(.*\)$/\1/p')" != "true" ]; then
+    echo "Nextcloud is not installed - cronjobs are not available" >&2
+    exit 1
+fi
+
+[ -e /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/cron.php)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ-cron\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/cron.php' -- '/bin/sh'
+else
+    exec php -f /var/www/html/cron.php
+fi
diff --git a/28/fpm-alpine/Dockerfile b/28/fpm-alpine/Dockerfile
index 1133744dd7..8e949def22 100644
--- a/28/fpm-alpine/Dockerfile
+++ b/28/fpm-alpine/Dockerfile
@@ -10,7 +10,7 @@ RUN set -ex; \
     ; \
     \
     rm /var/spool/cron/crontabs/root; \
-    echo '*/5 * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data
+    echo '*/5 * * * * occ-cron' > /var/spool/cron/crontabs/www-data
 
 # install the PHP extensions we need
 # see https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html
@@ -134,7 +134,8 @@ RUN set -ex; \
     chmod +x /usr/src/nextcloud/occ; \
     apk del --no-network .fetch-deps
 
-COPY *.sh upgrade.exclude /
+COPY entrypoint.sh cron.sh upgrade.exclude /
+COPY occ occ-cron /usr/local/bin/
 COPY config/* /usr/src/nextcloud/config/
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/28/fpm-alpine/entrypoint.sh b/28/fpm-alpine/entrypoint.sh
index edb539a01e..4ec86cd564 100755
--- a/28/fpm-alpine/entrypoint.sh
+++ b/28/fpm-alpine/entrypoint.sh
@@ -11,14 +11,6 @@ directory_empty() {
     [ -z "$(ls -A "$1/")" ]
 }
 
-run_as() {
-    if [ "$(id -u)" = 0 ]; then
-        su -p "$user" -s /bin/sh -c "$1"
-    else
-        sh -c "$1"
-    fi
-}
-
 # Execute all executable files in a given directory in alphanumeric order
 run_path() {
     local hook_folder_path="/docker-entrypoint-hooks.d/$1"
@@ -32,7 +24,7 @@ run_path() {
     echo "=> Searching for scripts (*.sh) to run, located in the folder: ${hook_folder_path}"
 
     (
-        find "${hook_folder_path}" -type f -maxdepth 1 -iname '*.sh' -print | sort | while read -r script_file_path; do
+        find "${hook_folder_path}" -maxdepth 1 -type f -iname '*.sh' -print | sort | while read -r script_file_path; do
             if ! [ -x "${script_file_path}" ]; then
                 echo "==> The script \"${script_file_path}\" was skipped, because it didn't have the executable flag"
                 continue
@@ -40,7 +32,11 @@ run_path() {
 
             echo "==> Running the script (cwd: $(pwd)): \"${script_file_path}\""
 
-            run_as "${script_file_path}" || return_code="$?"
+            if [ "$(id -u)" = 0 ]; then
+                su -p "$user" -s /bin/sh "${script_file_path}" || return_code="$?"
+            else
+                "${script_file_path}" || return_code="$?"
+            fi
 
             if [ "${return_code}" -ne "0" ]; then
                 echo "==> Failed at executing \"${script_file_path}\". Exit code: ${return_code}"
@@ -163,7 +159,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                     exit 1
                 fi
                 echo "Upgrading nextcloud from $installed_version ..."
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
             fi
             if [ "$(id -u)" = 0 ]; then
                 rsync_options="-rlDog --chown $user:$group"
@@ -225,7 +221,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                         echo "Starting nextcloud installation"
                         max_retries=10
                         try=0
-                        until run_as "php /var/www/html/occ maintenance:install $install_options" || [ "$try" -gt "$max_retries" ]
+                        until eval "occ maintenance:install $install_options" || [ "$try" -gt "$max_retries" ]
                         do
                             echo "Retrying install..."
                             try=$((try+1))
@@ -240,7 +236,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                             NC_TRUSTED_DOMAIN_IDX=1
                             for DOMAIN in $NEXTCLOUD_TRUSTED_DOMAINS ; do
                                 DOMAIN=$(echo "$DOMAIN" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-                                run_as "php /var/www/html/occ config:system:set trusted_domains $NC_TRUSTED_DOMAIN_IDX --value=$DOMAIN"
+                                occ config:system:set trusted_domains "$NC_TRUSTED_DOMAIN_IDX" --value="$DOMAIN"
                                 NC_TRUSTED_DOMAIN_IDX=$((NC_TRUSTED_DOMAIN_IDX+1))
                             done
                         fi
@@ -254,9 +250,9 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
             else
                 run_path pre-upgrade
 
-                run_as 'php /var/www/html/occ upgrade'
+                occ upgrade
 
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
                 echo "The following apps have been disabled:"
                 diff /tmp/list_before /tmp/list_after | grep '<' | cut -d- -f2 | cut -d: -f1
                 rm -f /tmp/list_before /tmp/list_after
@@ -269,7 +265,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
 
         # Update htaccess after init if requested
         if [ -n "${NEXTCLOUD_INIT_HTACCESS+x}" ] && [ "$installed_version" != "0.0.0.0" ]; then
-            run_as 'php /var/www/html/occ maintenance:update:htaccess'
+            occ maintenance:update:htaccess
         fi
     ) 9> /var/www/html/nextcloud-init-sync.lock
 
diff --git a/28/fpm-alpine/occ b/28/fpm-alpine/occ
new file mode 100755
index 0000000000..70b08e7d36
--- /dev/null
+++ b/28/fpm-alpine/occ
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+[ -e /var/www/html/occ ] || { echo "Unable to run \`occ\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/occ ] || { echo "Unable to run \`occ\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/occ)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/occ -- "$@"' -- '/bin/sh' "$@"
+else
+    exec php -f /var/www/html/occ -- "$@"
+fi
diff --git a/28/fpm-alpine/occ-cron b/28/fpm-alpine/occ-cron
new file mode 100755
index 0000000000..798cc175a1
--- /dev/null
+++ b/28/fpm-alpine/occ-cron
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+
+if [ "$(occ status 2> /dev/null | sed -ne 's/^  - installed: \(.*\)$/\1/p')" != "true" ]; then
+    echo "Nextcloud is not installed - cronjobs are not available" >&2
+    exit 1
+fi
+
+[ -e /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/cron.php)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ-cron\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/cron.php' -- '/bin/sh'
+else
+    exec php -f /var/www/html/cron.php
+fi
diff --git a/28/fpm/Dockerfile b/28/fpm/Dockerfile
index a4924ce877..054b32fd81 100644
--- a/28/fpm/Dockerfile
+++ b/28/fpm/Dockerfile
@@ -15,7 +15,7 @@ RUN set -ex; \
     rm -rf /var/lib/apt/lists/*; \
     \
     mkdir -p /var/spool/cron/crontabs; \
-    echo '*/5 * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data
+    echo '*/5 * * * * occ-cron' > /var/spool/cron/crontabs/www-data
 
 # install the PHP extensions we need
 # see https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html
@@ -150,7 +150,8 @@ RUN set -ex; \
     apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps; \
     rm -rf /var/lib/apt/lists/*
 
-COPY *.sh upgrade.exclude /
+COPY entrypoint.sh cron.sh upgrade.exclude /
+COPY occ occ-cron /usr/local/bin/
 COPY config/* /usr/src/nextcloud/config/
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/28/fpm/entrypoint.sh b/28/fpm/entrypoint.sh
index edb539a01e..4ec86cd564 100755
--- a/28/fpm/entrypoint.sh
+++ b/28/fpm/entrypoint.sh
@@ -11,14 +11,6 @@ directory_empty() {
     [ -z "$(ls -A "$1/")" ]
 }
 
-run_as() {
-    if [ "$(id -u)" = 0 ]; then
-        su -p "$user" -s /bin/sh -c "$1"
-    else
-        sh -c "$1"
-    fi
-}
-
 # Execute all executable files in a given directory in alphanumeric order
 run_path() {
     local hook_folder_path="/docker-entrypoint-hooks.d/$1"
@@ -32,7 +24,7 @@ run_path() {
     echo "=> Searching for scripts (*.sh) to run, located in the folder: ${hook_folder_path}"
 
     (
-        find "${hook_folder_path}" -type f -maxdepth 1 -iname '*.sh' -print | sort | while read -r script_file_path; do
+        find "${hook_folder_path}" -maxdepth 1 -type f -iname '*.sh' -print | sort | while read -r script_file_path; do
             if ! [ -x "${script_file_path}" ]; then
                 echo "==> The script \"${script_file_path}\" was skipped, because it didn't have the executable flag"
                 continue
@@ -40,7 +32,11 @@ run_path() {
 
             echo "==> Running the script (cwd: $(pwd)): \"${script_file_path}\""
 
-            run_as "${script_file_path}" || return_code="$?"
+            if [ "$(id -u)" = 0 ]; then
+                su -p "$user" -s /bin/sh "${script_file_path}" || return_code="$?"
+            else
+                "${script_file_path}" || return_code="$?"
+            fi
 
             if [ "${return_code}" -ne "0" ]; then
                 echo "==> Failed at executing \"${script_file_path}\". Exit code: ${return_code}"
@@ -163,7 +159,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                     exit 1
                 fi
                 echo "Upgrading nextcloud from $installed_version ..."
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_before
             fi
             if [ "$(id -u)" = 0 ]; then
                 rsync_options="-rlDog --chown $user:$group"
@@ -225,7 +221,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                         echo "Starting nextcloud installation"
                         max_retries=10
                         try=0
-                        until run_as "php /var/www/html/occ maintenance:install $install_options" || [ "$try" -gt "$max_retries" ]
+                        until eval "occ maintenance:install $install_options" || [ "$try" -gt "$max_retries" ]
                         do
                             echo "Retrying install..."
                             try=$((try+1))
@@ -240,7 +236,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
                             NC_TRUSTED_DOMAIN_IDX=1
                             for DOMAIN in $NEXTCLOUD_TRUSTED_DOMAINS ; do
                                 DOMAIN=$(echo "$DOMAIN" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-                                run_as "php /var/www/html/occ config:system:set trusted_domains $NC_TRUSTED_DOMAIN_IDX --value=$DOMAIN"
+                                occ config:system:set trusted_domains "$NC_TRUSTED_DOMAIN_IDX" --value="$DOMAIN"
                                 NC_TRUSTED_DOMAIN_IDX=$((NC_TRUSTED_DOMAIN_IDX+1))
                             done
                         fi
@@ -254,9 +250,9 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
             else
                 run_path pre-upgrade
 
-                run_as 'php /var/www/html/occ upgrade'
+                occ upgrade
 
-                run_as 'php /var/www/html/occ app:list' | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
+                occ app:list | sed -n "/Enabled:/,/Disabled:/p" > /tmp/list_after
                 echo "The following apps have been disabled:"
                 diff /tmp/list_before /tmp/list_after | grep '<' | cut -d- -f2 | cut -d: -f1
                 rm -f /tmp/list_before /tmp/list_after
@@ -269,7 +265,7 @@ if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ] || [ "${NEXTCLOUD_UP
 
         # Update htaccess after init if requested
         if [ -n "${NEXTCLOUD_INIT_HTACCESS+x}" ] && [ "$installed_version" != "0.0.0.0" ]; then
-            run_as 'php /var/www/html/occ maintenance:update:htaccess'
+            occ maintenance:update:htaccess
         fi
     ) 9> /var/www/html/nextcloud-init-sync.lock
 
diff --git a/28/fpm/occ b/28/fpm/occ
new file mode 100755
index 0000000000..70b08e7d36
--- /dev/null
+++ b/28/fpm/occ
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+[ -e /var/www/html/occ ] || { echo "Unable to run \`occ\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/occ ] || { echo "Unable to run \`occ\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/occ)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/occ -- "$@"' -- '/bin/sh' "$@"
+else
+    exec php -f /var/www/html/occ -- "$@"
+fi
diff --git a/28/fpm/occ-cron b/28/fpm/occ-cron
new file mode 100755
index 0000000000..798cc175a1
--- /dev/null
+++ b/28/fpm/occ-cron
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+
+if [ "$(occ status 2> /dev/null | sed -ne 's/^  - installed: \(.*\)$/\1/p')" != "true" ]; then
+    echo "Nextcloud is not installed - cronjobs are not available" >&2
+    exit 1
+fi
+
+[ -e /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: No such file or directory" >&2 ; exit 1 ; }
+[ -f /var/www/html/cron.php ] || { echo "Unable to run \`occ-cron\`: Not a file" >&2 ; exit 1 ; }
+
+RUN_AS="$(stat -c %U /var/www/html/cron.php)"
+[ -n "$RUN_AS" ] && [ "$RUN_AS" != "UNKNOWN" ] || { echo "Unable to run \`occ-cron\`: Failed to determine www-data user" >&2 ; exit 1 ; }
+
+if [ "$(id -u)" = 0 ]; then
+    exec su -p "$RUN_AS" -s /bin/sh -c 'exec php -f /var/www/html/cron.php' -- '/bin/sh'
+else
+    exec php -f /var/www/html/cron.php
+fi