Allow reboot and sys.config rewrite to be optionally disabled for releases

[mobileoverlord]

The releases.exs script allows developers to execute some elixir code in the release before any applications are started. This is a helpful way to make modifications to the Application env's sys.config values but because :init.restart/0 is called this means that the values placed into the Application env are subject to the restrictions of sys.config encoding.

One example of this is with erlang ssl options and ssl engines. Nerves devices can delegate ssh to be performed on a hardware security module through the use of ssl engines. The data structure that is used to configure ssl to use an ssl engine contains a reference which is unable to be serialized back to the sys.config. It would be helpful if we could evaluate the releases.exs file without rebooting or writing back to the sys.config file. Since these two aspects are closely related, the option name could be something like read_only: true.

[michalmuskala]

Not doing the reboot has the downsides that it wouldn't allow configuring applications started before the file is evaluated, most notably kernel and elixir itself.

[josevalim]

One example of this is with erlang ssl options and ssl engines.

Can you provide examples for such options?

Given the issue described here also happens in Erlang/OTP sys.config, I am thinking we should rather send a PR to ssl so it allows these functions to be written as MFArgs tuples.

/cc @tsloughter

[mobileoverlord]

When using an openssl engine, the value of the ssl key would be set to the following data structure:

%{
  algorithm: :ecdsa,
  engine: #Reference<0.936959767.807272449.154635>,
  key_id: "pkcs11:id=1"
}

The reference in this data structure is the product of calling crypto:engine_load/3

For this situation, an MFA would allow us to get past this specific issue with ssl, however, I do believe there is value in offering the ability to use config providers on read only filesystems. I understand that this prevents the ability to configure kernel and stdlib, but in the case of Nerves the configuration of these are typically known at compile time. I think this could be easily solved by checking if the sys.config file could be written to when executing the runtime code. If the file is un-writeable, skip the restart and render a warning.

[tsloughter]

Regarding read only filesystems. Is the directory it writes to configurable? With relx I wanted to be able to have the release file system be read-only so there is an environment variable, RELX_OUT_FILE_PATH, which lets you specify where to write these files.

Then it works to have a read-only docker container (--read-only) with a tmpfs mounted volume that is used just for writing these files.

Also used so the user the docker container is run as can be a random uid, not have to be root or the same uid as who the release directory is owned by.

[josevalim]

Regarding read only filesystems. Is the directory it writes to configurable?

Yes.

We can add an option so the config provider does not reboot but then it must raise if any option for kernel, stdlib, or elixir are set during boot. A PR is welcome.