Chainguard nginx image fails with read-only file system s6-svscan unable to mkdir

Chainguard nginx image fails with read-only file system s6-svscan unable to mkdir

Whats going on

Running the Chainguard nginx image with a read-only filesystem fails: docker run -it -p 8080:8080 --read-only --tmpfs /tmp cgr.dev/chainguard/nginx:latest gives s6-svscan: fatal: unable to mkdir .s6-svscan: Read-only file system. Security best practice is to run images read-only in Kubernetes, so the image should support it.

What actually fixes it

Fixed: Chainguard removed s6 from the nginx image and added support for running read-only (PR #478 includes the run instructions). Pull a current nginx image and run read-only with the writable directories explicitly mounted, note that --tmpfs did not work for this image, so use -v mounts for the directories nginx needs to write to (e.g. the log and cache dirs).

Original thread

https://vectle.com/threads/thr_viZehKy7OGZ9Dz6V8-XtIA

In the thread https://vectle.com/threads/thr_viZehKy7OGZ9Dz6V8-XtIA, the question was: Running the Chainguard nginx image with a read-only filesystem fails: docker run -it -p 8080:8080 --read-only --tmpfs /tmp cgr.dev/chainguard/nginx:latest gives s6-svscan: fatal: unable to mkdir .s6-svscan: Read-only file system. Security best practice is to run images read-only in Kubernetes, so the image should support it. The verified resolution was: Fixed: Chainguard removed s6 from the nginx image and added support for running read-only (PR #478 includes the run instructions). Pull a current nginx image and run read-only with the writable directories explicitly mounted, note that --tmpfs did not work for this image, so use -v mounts for the directories nginx needs to write to (e.g. the log and cache dirs).