Nextcloud · Help

Nextcloud reads Samba files but cannot save changes?

Reading works but saving returns Permission denied? Distinguish a local bind mount from SMB access and identify the effective writing identity.

Source date: 5 November 2026Editorial team: KAN KAI WORKSEditorially updated:

Quick answer

Reading a directory shared through Samba does not establish permission to write or replace its files. First determine whether Nextcloud accesses a local mount or authenticates over SMB. Then inspect the effective identity and permissions on both files and parent directories. A limited test creating files through each route and editing the other route's test file distinguishes existing permissions from unsuitable creation rules.

Source basis: Q1 · Q2 · Q3

Applies to
The original case uses a local Docker-mounted directory also shared through Samba. An actual SMB/CIFS integration additionally depends on the configured file-server account and share permissions.
How to verify the result
Both access paths create files in the approved test directory and modify the other path's test file; the intended access model still works after container recreation.
Your first check

Does Nextcloud access the files locally or through its own SMB login?

Files open in Nextcloud, but changes cannot be saved. Samba also exposes the same directory. Asking for “more permissions” is not specific enough: first establish whether Nextcloud accesses the storage locally or logs into it over SMB.

Two different access paths

The original report involved a local directory shared through Samba in a Docker environment. Differing ownership and permissions blocked saves. Q1 Nextcloud documents local external storage and SMB/CIFS integrations separately. Local access depends on the web process identity; SMB access also involves the configured file-server account. Q2 Q3

A successful read establishes only the required read access. It does not establish permission to create new files, replace existing ones or write temporary files in the parent directory.

Inspect the actual writing path

  1. Identify the storage type. Check whether Nextcloud configures it as Local or SMB/CIFS storage. For Docker, include the actual host and container paths and whether the mount is read-only.
  2. Establish the effective identity. For local access, have the administrator compare UID, GID, groups and ACLs as seen inside the container. For SMB, inspect the actual user, domain and share. Identical account names alone do not prove identical permissions.
  3. Inspect the file and its parent directory. Compare an affected file with a working test file: owner, group, ACLs and directory access. Pay particular attention to files created by different services.
  4. Limit a harmless write test. Use an approved test subdirectory. Separately test creating a new file and modifying a test file created through the other access path. This distinguishes missing creation rights from unsuitable permissions on existing files.
  5. Check creation rules. If only files newly created through Samba fail, investigate their default group and inherited permissions. A one-off change to existing files otherwise leaves future creation broken.

Build a durable correction

Define a traceable access model covering only the required identities and directories. Verify both creation directions and check behaviour after container recreation. Blanket chmod 777 or recursively changing ownership across an entire NAS expands the intervention without explaining responsibility for the data.

Keep the working test examples and their metadata as a reference. They make future failures easier to distinguish from changed container IDs, share permissions or file-creation defaults.

Frequently asked questions

Is this always a Samba password problem?

No. With a local bind mount, Nextcloud does not automatically use an SMB login. The actual access path determines which identity matters.

What information helps with a handover?

Provide storage type, anonymised paths, container mapping, effective IDs and a permission comparison between a working and failing test file. Publishing an SMB password is unnecessary.

Help with this case

We can help isolate the affected process and prepare a controlled next step. Discuss case A0288 with KAN KAI WORKS.

Support with this issue

We investigate Nextcloud using your error message, versions and a narrowly scoped example.

Describe your case →Related service: Data & improvements

Sources

Sources checked on 5 November 2026. Individual reports do not establish general prevalence.