Nextcloud External Storage: Add a Drive (and Fix \"Blocked by Access Control\")
External storage ships with Nextcloud but switched off. Enable it, add your drive as Local storage at the path the server (on Docker, the container) sees, and give that folder to the web server user, because "Connected" does not mean Nextcloud can write to it.
External storage is already part of Nextcloud; it is just switched off. Enable External storage support under Apps, then add your drive under Administration settings, External storage, as Local storage. The location is a path on the server, and on Docker that means a path inside the container, so map the drive in first. Then make sure the folder belongs to the web server user. Nextcloud will show the mount as Connected even when it can only read it, and every upload fails.
Everything below was checked in October 2026 on Nextcloud 35.0.1, the official
nextcloud:35.0.1-apache Docker image on a Linux server, against the
version 35 administration manual.
How do I turn on external storage in Nextcloud?
Apps, Disabled apps, External storage support, Enable. Nothing to download. The manual: "External Storage Support is provided by a bundled (automatically installed) app. It is disabled by default, so to use this feature you simply need to enable it under Apps." Once it is on, Administration settings gains an External storage page with an Add external storage button.
Why does my mount say "Local storage path does not exist"?
Because Nextcloud looks for the path on its side. On a plain Linux
install that is the server's own filesystem. In Docker it is the container's, and a
container only sees folders you map into it. A drive mounted on the host at
/mnt/media is invisible to Nextcloud until the container gets a volume
for it:
# docker run
-v /mnt/media:/mnt/media
# compose.yaml, under the app service
volumes:
- /mnt/media:/mnt/mediaRecreate the container after adding it, then use /mnt/media as the
Location. In the new Nextcloud 35 dialog the error is on the status icon: click it
to re-check, then hover it to read the message.
Why does Nextcloud say "Operation is blocked by access control" on my external storage?
On a Local mount this almost always means Nextcloud can read the folder but not
write to it. We reproduced it: a folder owned by root showed
Connected, its photos listed fine, and an upload failed with "Operation
is blocked by access control" and "Unknown error during upload". The
status check only proves Nextcloud can reach the folder.
The manual's requirement: "This directory must be readable and writable by
your HTTP server user." Give it to that user (www-data on Debian and
Ubuntu, and in the official Docker image):
# Docker (container named nextcloud)
docker exec -u root nextcloud chown -R www-data:www-data /mnt/media
# Plain Linux install, as the manual shows it
sudo chown -R www-data:www-data /path/to/localdir
sudo chmod -R 0750 /path/to/localdirOn Docker you can also run the chown on the host with the numeric id,
33:33, which is what www-data is inside the official image.
After that, the same upload worked.
Will files I copy onto the drive directly show up in Nextcloud?
Yes, by default. The mount option Check filesystem changes starts at
Once every direct access: Nextcloud rescans the folder when someone opens it.
We copied a photo onto the drive on the server, opened the folder, and it was there.
On a very large drive you can set it to Never and rescan on a schedule with
occ files:scan --all instead.
Who can see an external storage mount?
Everyone, unless you restrict it. The dialog says so: "Without a restriction this storage is available to every account on this server." Pick groups or accounts under Restrict to.
Sharing from a mount is off by default too. With Enable sharing off, Nextcloud refused a share link for a file on the drive ("You are not allowed to share"); with it on, the same request worked. Turn it on under the mount's Mount options only if people should share from that drive.
Why is there no SMB option in Nextcloud's external storage?
Because the server has no SMB client. The list in the official Docker image offers FTP, Local, Nextcloud, OpenStack Swift, S3, SFTP and WebDAV, and no SMB, and the page does not say why. The manual does: "The SMB/CIFS backend requires smbclient or the PHP smbclient module (php-smbclient / libsmbclient-php) to be installed on the Nextcloud server." The image ships neither. Its README: "If the image does not include the packages you need, you can easily build your own image on top of it." Its SMB example is two lines:
FROM nextcloud:apache
RUN apt-get update && apt-get install -y procps smbclient && rm -rf /var/lib/apt/lists/*The manual prefers the PHP module (pecl install smbclient) for
performance and large files; the examples README lists those commands too. On a plain
Linux install, install your distribution's smbclient package instead.
We have not filmed an SMB mount; this part is from the two official sources.
Is external storage the right way to give Nextcloud more space?
It adds a separate folder people see in Files. If you want Nextcloud's own storage to live on a bigger disk, that is the data directory, a different and riskier move with its own steps in the manual. Server-side encryption, if you use it, can apply to external mounts too; our encryption explainer covers what it does and does not protect.
Can I set this up from the command line?
Yes, with occ. In Docker, prefix each with
docker exec -u www-data nextcloud:
php occ app:enable files_external
php occ files_external:create /Media local null::null -c datadir=/mnt/media
php occ files_external:verify <mount id>
php occ files_external:option <mount id> enable_sharing trueFull video transcript
1
00:00:00,000 --> 00:00:03,656
External storage is built into
Nextcloud, just switched off.
2
00:00:03,696 --> 00:00:07,106
Turn it on, add your drive at
the path your server sees,
3
00:00:07,146 --> 00:00:09,570
and make sure Nextcloud can write to it.
4
00:00:09,610 --> 00:00:11,849
It says connected even when it can't.
5
00:00:11,889 --> 00:00:15,338
And on Docker, the option for
Windows shares is missing.
6
00:00:16,506 --> 00:00:19,975
This is Nextcloud thirty
five, the current release.
7
00:00:20,015 --> 00:00:23,415
It runs in Docker, on a
Linux server I run myself.
8
00:00:23,455 --> 00:00:25,864
We're in Apps, under Disabled apps.
9
00:00:27,100 --> 00:00:32,302
External storage support is already
on this list. It came with Nextcloud.
10
00:00:32,342 --> 00:00:33,993
It's just switched off.
11
00:00:35,235 --> 00:00:39,893
Click Enable. Nextcloud asks for your
password before changes like this one.
12
00:00:43,040 --> 00:00:45,579
Nextcloud's own manual says the same.
13
00:00:47,044 --> 00:00:51,620
External Storage Support is provided by
a bundled, automatically installed app.
14
00:00:51,660 --> 00:00:53,139
It is disabled by default,
15
00:00:53,179 --> 00:00:56,861
so to use this feature you simply
need to enable it under Apps.
16
00:00:58,106 --> 00:01:02,158
Before the settings, one picture. Your
drive is plugged into the server.
17
00:01:02,198 --> 00:01:04,715
But Nextcloud runs inside
a Docker container,
18
00:01:04,755 --> 00:01:07,727
and a container only sees
the folders you hand to it.
19
00:01:07,767 --> 00:01:10,625
So first, the drive gets
mapped into the container.
20
00:01:10,665 --> 00:01:15,268
That takes a single line in your Docker
setup, and it's on the page linked below.
21
00:01:16,552 --> 00:01:22,388
With the app on, Administration settings
has a new page. External storage.
22
00:01:23,602 --> 00:01:25,548
Add external storage.
23
00:01:25,852 --> 00:01:29,947
First, a folder name. This is the
name people will see in their files.
24
00:01:29,987 --> 00:01:31,168
I'll call it Photos.
25
00:01:32,424 --> 00:01:37,072
Then the kind of storage. For a drive
on the same server, that's Local.
26
00:01:38,291 --> 00:01:39,372
And the location.
27
00:01:39,412 --> 00:01:43,327
Say your photos sit at slash
srv slash photos on the server,
28
00:01:43,367 --> 00:01:46,795
but that folder was never
mapped into the container.
29
00:01:48,041 --> 00:01:52,034
Create it. Nextcloud asks
for the password again.
30
00:01:52,074 --> 00:01:55,531
On this page, it asks before every change.
31
00:01:57,971 --> 00:02:02,420
The icon is red. Point at
it, and Nextcloud says why.
32
00:02:02,460 --> 00:02:05,339
Local storage path does not exist.
33
00:02:06,576 --> 00:02:08,556
The folder is real on the server.
34
00:02:08,596 --> 00:02:12,657
Nextcloud just can't see it, because
it looks inside its container.
35
00:02:12,697 --> 00:02:15,942
On Docker, this is what a
missing mapping looks like.
36
00:02:17,186 --> 00:02:18,532
Delete that one.
37
00:02:23,339 --> 00:02:26,486
Add another, this time at
the path that is mapped in.
38
00:02:27,699 --> 00:02:28,894
Call it Media.
39
00:02:29,560 --> 00:02:30,890
Local again.
40
00:02:32,477 --> 00:02:36,524
And this location is where the server's
drive shows up inside the container.
41
00:02:37,745 --> 00:02:40,033
Create, and type the password again.
42
00:02:40,073 --> 00:02:43,783
Nextcloud then checks whether
it can reach the new folder,
43
00:02:43,823 --> 00:02:46,538
and puts the answer on the icon beside it.
44
00:02:47,750 --> 00:02:53,148
Connected. Nextcloud can see the drive.
That sounds like the job is done.
45
00:02:53,188 --> 00:02:54,380
It isn't, quite.
46
00:02:55,612 --> 00:02:56,283
Open Files.
47
00:02:56,323 --> 00:03:01,560
The drive is a folder now, called Media,
with the photos that were already on it.
48
00:03:03,084 --> 00:03:06,686
Now save a photo to it. Upload one.
49
00:03:09,492 --> 00:03:14,945
Operation is blocked by access control.
And, unknown error during upload.
50
00:03:16,184 --> 00:03:20,089
That message points at access
rules, but that's not the problem.
51
00:03:20,129 --> 00:03:24,773
The folder on the drive belongs to root,
the server's administrator account.
52
00:03:24,813 --> 00:03:28,040
Nextcloud runs as a different
user, the web server's.
53
00:03:28,080 --> 00:03:32,147
It can read the drive, so it says
connected. It can't write to it.
54
00:03:33,439 --> 00:03:36,496
The manual's page on local
storage says it plainly.
55
00:03:37,703 --> 00:03:42,360
This directory must be readable and
writable by your HTTP server user.
56
00:03:43,590 --> 00:03:46,331
The fix is one command, run on the server.
57
00:03:46,371 --> 00:03:49,178
It hands the folder to
the web server user.
58
00:03:49,218 --> 00:03:52,621
In Docker, you run it inside
the container, as root.
59
00:03:52,661 --> 00:03:56,461
On a plain Linux install, it's
the same command with sudo,
60
00:03:56,501 --> 00:03:58,355
the way the manual shows it.
61
00:03:59,684 --> 00:04:02,512
I've run it on this server.
Nothing else changes.
62
00:04:03,727 --> 00:04:06,317
Back in Files, the same folder.
63
00:04:10,356 --> 00:04:12,749
Upload the same photo again.
64
00:04:17,049 --> 00:04:20,732
This time, it's there.
Same drive, same photo.
65
00:04:20,772 --> 00:04:23,929
The only change is who owns the folder.
66
00:04:25,167 --> 00:04:26,896
One more thing worth knowing.
67
00:04:26,936 --> 00:04:31,167
I've just copied another photo onto
the drive, straight on the server,
68
00:04:31,207 --> 00:04:32,549
not through Nextcloud.
69
00:04:33,802 --> 00:04:35,238
Open the folder again.
70
00:04:39,576 --> 00:04:40,443
And it's here.
71
00:04:40,483 --> 00:04:41,156
By default,
72
00:04:41,196 --> 00:04:45,951
Nextcloud checks the drive for changes
each time someone opens the folder.
73
00:04:45,991 --> 00:04:51,304
On a very big drive, that check is a setting
you can change, in the mount options.
74
00:04:52,564 --> 00:04:55,011
Two more settings, on the mount itself.
75
00:04:58,115 --> 00:04:58,717
Edit it.
76
00:05:00,276 --> 00:05:01,195
Read this note.
77
00:05:01,235 --> 00:05:06,310
Without a restriction this storage is
available to every account on this server.
78
00:05:06,350 --> 00:05:09,483
On a family server, that's
everyone with a login.
79
00:05:10,740 --> 00:05:14,620
To keep it to some people, pick
a group here. I'll pick admin.
80
00:05:16,670 --> 00:05:19,044
Then, Mount options.
81
00:05:19,353 --> 00:05:20,793
Enable sharing is off.
82
00:05:20,833 --> 00:05:25,638
Until you turn it on, nobody can share
a link to anything on this drive.
83
00:05:25,678 --> 00:05:27,293
That's the safe default.
84
00:05:28,545 --> 00:05:30,804
Turn it on if you want to share from it.
85
00:05:32,019 --> 00:05:34,851
And save, with the password once more.
86
00:05:34,891 --> 00:05:40,029
Under Restricted to, the row now
says admin instead of all accounts.
87
00:05:41,021 --> 00:05:43,697
Last, the other kinds of storage.
88
00:05:44,909 --> 00:05:51,627
FTP. Another Nextcloud. OpenStack.
S3 compatible storage. SFTP. WebDAV.
89
00:05:51,667 --> 00:05:57,854
Each one asks for its own address
and login, in this same dialog.
90
00:05:59,113 --> 00:06:05,497
What's missing is SMB. That's how Windows
shares folders, and how most NAS boxes do.
91
00:06:05,537 --> 00:06:08,596
And this page doesn't say why it's gone.
92
00:06:09,848 --> 00:06:11,538
The manual does.
93
00:06:13,835 --> 00:06:18,264
The SMB backend requires smbclient,
or the PHP smbclient module,
94
00:06:18,304 --> 00:06:21,057
to be installed on the Nextcloud server.
95
00:06:21,097 --> 00:06:23,959
The Docker image I'm running has neither.
96
00:06:25,214 --> 00:06:28,909
The Docker image's own instructions
say what to do about that.
97
00:06:31,704 --> 00:06:35,007
If the image does not include
the packages you need,
98
00:06:35,047 --> 00:06:38,157
you can easily build your
own image on top of it.
99
00:06:38,197 --> 00:06:41,025
Its examples folder has
one for SMB support.
100
00:06:42,269 --> 00:06:46,021
So on Docker, Windows shares
mean a small custom image.
101
00:06:46,061 --> 00:06:48,750
The page linked below walks through it.
102
00:06:50,585 --> 00:06:53,826
So, external storage in
Nextcloud. Enable the app.
103
00:06:53,866 --> 00:06:58,354
Use the path your server sees, and
on Docker, map the drive in first.
104
00:06:58,394 --> 00:07:00,848
Give the drive to the web server user,
105
00:07:00,888 --> 00:07:04,129
because connected doesn't
mean you can save to it.
106
00:07:04,169 --> 00:07:05,507
Restrict who sees it.
107
00:07:05,547 --> 00:07:09,773
And for Windows shares on Docker,
build the image with smbclient.
108
00:07:09,813 --> 00:07:15,260
The commands for Docker and for a plain
Linux install are on the page linked below.