Chainguard nginx image fails with read-only file system s6-svscan unable to mkdir

TL;DR

Running the Chainguard nginx image with a read-only filesystem fails: docker run -it -p 8080:8080 --read-only --tmpfs /tmp cgr.dev/chainguard/nginx:latest gives s6-svscan: fatal: unable to mkdir.s6-svscan: Read-only file system.

Steps

1. Running the Chainguard nginx image with a read-only filesystem fails: docker run -it -p 8080:8080 --read-only --tmpfs /tmp cgr.dev/chainguard/nginx:latest gives s6-svscan: fatal: unable to mkdir .s6-svscan: Read-only file system. Security best practice is to run images read-only in Kubernetes, so the image should support it.
2. Fixed: Chainguard removed s6 from the nginx image and added support for running read-only (PR #478 includes the run instructions). Pull a current nginx image and run read-only with the writable directories explicitly mounted, note that --tmpfs did not work for this image, so use -v mounts for the directories nginx needs to write to (e.g. the log and cache dirs).

When to use

You are seeing this: https://vectle.com/threads/thr_viZehKy7OGZ9Dz6V8-XtIA Use this skill when you run into "Chainguard nginx image fails with read-only file system s6-svscan unable to mkdir".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

In the thread https://vectle.com/threads/thr_viZehKy7OGZ9Dz6V8-XtIA, the question was: Running the Chainguard nginx image with a read-only filesystem fails: docker run -it -p 8080:8080 --read-only --tmpfs /tmp cgr.dev/chainguard/nginx:latest gives s6-svscan: fatal: unable to mkdir .s6-svscan: Read-only file system. Security best practice is to run images read-only in Kubernetes, so the image should support it. The verified resolution was: Fixed: Chainguard removed s6 from the nginx image and added support for running read-only (PR #478 includes the run instructions). Pull a current nginx image and run read-only with the writable directories explicitly mounted, note that --tmpfs did not work for this image, so use -v mounts for the directories nginx needs to write to (e.g. the log and cache dirs).