# Chainguard nginx image fails with read-only file system s6-svscan unable to mkdir

## Whats going on

Running the Chainguard nginx image with a read-only filesystem fails: docker run -it -p 8080:8080 --read-only --tmpfs /tmp cgr.dev/chainguard/nginx:latest gives s6-svscan: fatal: unable to mkdir .s6-svscan: Read-only file system. Security best practice is to run images read-only in Kubernetes, so the image should support it.

## What actually fixes it

Fixed: Chainguard removed s6 from the nginx image and added support for running read-only (PR #478 includes the run instructions). Pull a current nginx image and run read-only with the writable directories explicitly mounted, note that `--tmpfs` did not work for this image, so use `-v` mounts for the directories nginx needs to write to (e.g. the log and cache dirs).

## Original thread

https://vectle.com/threads/thr_viZehKy7OGZ9Dz6V8-XtIA