slow document loading due to coolmount permission errors

[james]

Hello @sponch
I was able to reproduce this issue and also have an idea how to fix this.

[sponch]

Something we can do or must that be done on your side?

[nebulon]

I've tested with SYS_ADMIN cap and the mount error goes away, however I cannot notice any speedups due to that though, but it might depend on how fast the filesystem is. Have to think about how to give collabora such wide system access.

[nebulon]

@sponch can you check how fast your disk I/O is (you can see this in your Cloudron dashboard in Server view). It seems quite risky to give that app such system capabilities as if it has a bug it can easily bring down the server. Might be good to first get an understanding what the root cause for slowness in your case really is.

[sponch]

I/O Rate of the VPS is about 2GB/s DiskIO between 1MB to peaks of 120MB during the last 24h. We are just testing if it is a client thing on one of our staff's Mac, where the problem occured ("long opening times" as the warning can be seen on each client),.

[nebulon]

that is much faster than on my server where I don't really see any difference and it is quite fast actually. I suspect something else is the issue there then.

[nebulon]

@sponch maybe you can enable remote ssh support for us and send a mail with the Cloudron's ip to support@cloudron.io I can then locally apply the patch to give collabora all those system permissions and we can evaluate if that is the root issue in the first place.

FYI to test this one can add the following at https://git.cloudron.io/platform/box/-/blob/master/src/docker.js?ref_type=heads#L731 :

    containerOptions.HostConfig.CapAdd.push('SYS_ADMIN');
    containerOptions.HostConfig.CapAdd.push('SYS_CHROOT');
    containerOptions.HostConfig.CapAdd.push('FOWNER');
    containerOptions.HostConfig.CapAdd.push('CHOWN');

Then systemctl restart box for good measure and then reinstall collabora in the same domain, as it is anyways stateless

[sponch]

@nebulon thanks. We tested the specific Mac today. Must have been a Browser Cache thing (or anything else with Chrome). After clearing CHrome cache the files open immediately (though the warning still appears).

[nebulon]

Thanks for coming back to this. The warning as such is harmless in the logs as the code has a totally fine fallback. So I guess there is no need to elevate permissions for the app, potentially opening up security risks.

[joseph]

There's more information in this comment - https://github.com/CollaboraOnline/online/issues/779#issuecomment-1107512362 . To make those warnings go away, collabora app has to be give admin permissions on the server. Not sure if that is a good idea.