Enable readonlyRootFilesystem in our ECS Task config (#934)

* container cannot write to the root filesystem

* Create mount point for writeable directory

* Don't install RDS CA

* Add a volume to container Cloudquery internal data

* Add volume for /tmp folder

* Publish a new Cloudquery image with Amazon RDS CA

* trigger first workflow run

* only run on changes under particular paths

* use new container image

* load cloudquery version from .env

* refer to new image

* remove log lines

* move github cresentials to ephemeral storage

* Add a comment to additionalCommands instructing users to write to the `/data` folder

* Don't use external action for setting CQ_CLI env variable

* Use Standard linux folder for storing config

* update old /data paths

* remove debug comment

* use commit hashes instead of versions

---------

Co-authored-by: Natasha <67543397+NovemberTang@users.noreply.github.com>
Co-authored-by: Ashleigh Carr <ashcorr20@gmail.com>

.github/workflows/cq-image.yml

@@ -0,0 +1,71 @@
+# Find full documentation here https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions
+name: CQ image
+
+on:
+  pull_request:
+    paths:
+      - 'containers/cloudquery/**'
+  push:
+    branches:
+      - main
+    paths:
+      - 'containers/cloudquery/**'
+
+  # Manual invocation.
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}/cloudquery
+
+# Ensure we only ever have one build running at a time.
+# If we push twice in quick succession, the first build will be stopped once the second starts.
+# This avoids any race conditions.
+concurrency:
+  group: ${{ github.ref }}/cloudquery
+  cancel-in-progress: true
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=sha,format=long
+
+      - name: Set CQ_CLI Github Env variable from .env
+        run: |
+          source .env
+          echo "CQ_CLI=${CQ_CLI}" >> "$GITHUB_ENV"
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
+        with:
+          context: ./
+          file: containers/cloudquery/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: CQ_CLI=${{ env.CQ_CLI }}

containers/cloudquery/Dockerfile

@@ -0,0 +1,7 @@
+ARG CQ_CLI
+
+FROM ghcr.io/cloudquery/cloudquery:${CQ_CLI}
+
+# Need to install RDS certs before running Cloudquery container due to
+# access to the root filesystem being restricted
+RUN wget -O /usr/local/share/ca-certificates/global-bundle.crt -q https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem && update-ca-certificates