How to access Foundry data with sftp

[arson-diops]

Feature description

Integrate support directly in this docker image for an optional OpenSSH server to run with a specified and configurable user for use with SFTP Clients like FileZIlla and Cyberduck.
This would allow for several users, including myself, to use these programs to manage Foundry's User Data without the need for the Foundry in-built file manager (which is rather unideal for some situations) or an SSH shell, and allow users to easily upload, delete, and download data from the container without the use of commands like cp or rm, which can be quite cumbersome to use for those unfamiliar with Linux or Shells in general.

Motivation

I self-host several containers on an Ubuntu server within my apartment, and utilize this image for said containers. However, a consistent issue I continuously run into is File Management. This is a problem due to the following:

1. Foundry's in-built file manager is rather cumbersome to use, especially for myself as I tend to upload large files to the server. It also notably lacks a way to delete files from the container easily.
2. Utilizing a SFTP Client from a top-level user which is above the container also runs into issues with permissions, with the Foundry user owning the directories and files within it.
3. Using a Shell to manage files is (rather obviously) very difficult to do, especially for those with a lack of experience with them.
4. I wish to provide players an easy and intuitive way to manage files as well, without granting them complete access to the entire server or container.

Example

As an example of how I imagine this feature being implemented optionally, here is a pseudo docker-compose.yml file:

---
version: "3.8"

services:
  foundry:
    image: felddy/foundryvtt:release
    hostname: my_foundry_host
    volumes:
      - type: bind
        source: <your_data_dir>
        target: /data
    environment:
      - FOUNDRY_PASSWORD=<your_password>
      - FOUNDRY_USERNAME=<your_username>
      - FOUNDRY_ADMIN_KEY=atropos
      - SSH_SERVER=true
      - SSH_USER=sftpuser
      - SSH_PASSWORD=sftppassword
    ports:
      - target: 30000
        published: 30000
        protocol: tcp
      - target: 2222
        published: 22
        protocol: tcp

Pitch

There is a good amount of reasons why implementing a native OpenSSH server would improve this project:

1. Allowing simple and easy management of the container through any SSH client, not just an SFTP Client.
2. Providing access to easy file management to users less familiar with how Linux works or a shell in general.
3. Allowing those who self-host their Foundry environments to provide their players access to specific containers and folders of that container without the need to provide them admin-level permissions to the entire server.

Code of Conduct

• I agree to follow this project's Code of Conduct

[arson-diops]

Something I forgot to mention in the feature description, I have a hogpiled implementation of an OpenSSH server set up currently for the containers I run. It does work, but along the way I ran into several issues in making it, if you wish to contact me for further information about these issues, feel free to contact me on GitHub or Discord at @arsonus.

Thanks for reading, and thanks for an awesome image so that I didn't have to make one.

[felddy]

Thank you for your feature request. While I understand the convenience of having an OpenSSH server inside the FoundryVTT container, this is not a good fit for the project for a few reasons:

1. Containerization Best Practices: The FoundryVTT container is designed to run a single process (Foundry itself). Adding an OpenSSH server would introduce unnecessary complexity, increase attack surface, and break the principle of single-purpose containers.

2. Security Risks: Running an SSH server inside a container creates potential security vulnerabilities, especially if not properly managed. Best practices suggest keeping containers as minimal as possible, reducing potential attack vectors.

3. Maintenance and Support Overhead: Including an SSH server would introduce additional dependencies that require ongoing maintenance, increasing the difficulty of supporting the container.

That said, I think you can there's a simple and effective way to achieve the desired outcome while maintaining a clean containerized setup. Instead of modifying the FoundryVTT container, you can deploy a separate SFTP container that shares a volume with FoundryVTT.

For example:

---

services:
  foundry:
    image: felddy/foundryvtt:12
    hostname: my_foundry_host
    volumes:
      - type: bind
        source: ./foundry_data
        target: /data
    environment:
      - FOUNDRY_PASSWORD=<your_password>
      - FOUNDRY_USERNAME=<your_username>
      - FOUNDRY_ADMIN_KEY=atropos
    ports:
      - target: 30000
        published: 30000
        protocol: tcp

  sftp:
    image: atmoz/sftp:latest
    container_name: sftp
    volumes:
      - type: bind
        source: ./foundry_data
        target: /home/foundryvtt
    command: foundryvtt:password:1000
    ports:
      - target: 22
        published: 2222
        protocol: tcp

• The felddy/foundryvtt container runs as usual, storing data in the foundry_data volume.
• The SFTP container atmoz/sftp provides an SSH-based file transfer service, exposing port 2222.
• The shared foundry_data volume allows users to upload/download files via SFTP without modifying the FoundryVTT container.

See:

• https://github.com/atmoz/sftp

I haven't tested this out, but I think it'd work. Also, there are several sftp containers out there, I just picked one that seems popular. I'd recommend vetting the project before you deploy it publicly.

Let me know if you think this solution would work for you.

[arson-diops]

That solution works great! Thanks!

I'm still a little new to Docker in general so thank you for your in depth answer, learned something new today.

Again your solution works great, just requires a little finicking with permissions and volumes to get it to work nicely