Applications cannot write to their own filesystem

[cedricziel]

Booting a simple Laravel5 application results in errors, because it wants to cache the current container to $APP_ROOT/bootstrap/cache/services.json and file_put_contents fails.

Here's an application illustrating the issue: https://github.com/cedricziel/gae-docker-writable-issue

Just deploy it to AppEngine and open up the index route.

The underlying issue seems to be that though permissions seem correct, the application cannot write to the filesystem. While this could be fixed on build-time for this particular application, one of the promises managed vms make is a writable file system so applications caching files to disk don't have to jump through hoops.

[cedricziel]

Revisiting the issue it's caused by a directive in the Dockerfile. I was surprised that the container overrides the filesystem modes originally set.

Do you intend to keep the file modes that restrictive?

[sjlangley]

Writing to the filesystem is probably the most common path of exploits for PHP applications, so we configure the app folder as read-only be default.

I suggest configuring the cache folder somewhere outside of the application root.

[cedricziel]

I'm well aware of the security implications - yet many php applications need one or more compile steps which can be invoked either lazily (on request time) or on build-time.

To save others from investigating about why on earth their file modes where overriden, I added a note to the images' README in #29.

Thank you for your answer :)