Code Server 4.7.1 fails to start if /config/.ssh is mounted readonly

[mrdavidkovacs]

Update from 4.7.0 -> 4.7.1.
One of the following two commits destroyed the existing behavior:

• 76b18b2
• 04cdba5#diff-a25f5713f61633518046ff3abd3233e61a3b8f660f4ad096e258e8de311ae584

---

Expected Behavior

The image should not touch permissions of /config/.ssh.

Current Behavior

The image tries to chown the whole directory /config/.ssh which results in an error as the directory is mounted readonly in docker.

Here the log after the update:

[custom-init] No custom services found, skipping...
[migrations] started
[migrations] no migrations found

-------------------------------------
          _         ()
         | |  ___   _    __
         | | / __| | |  /  \
         | | \__ \ | | | () |
         |_| |___/ |_|  \__/


Brought to you by linuxserver.io
-------------------------------------

To support LSIO projects visit:
https://www.linuxserver.io/donate/
-------------------------------------
GID/UID
-------------------------------------

User uid:    1000
User gid:    1001
-------------------------------------

chown: changing ownership of '/config/.ssh': Read-only file system
chown: changing ownership of '/config/.ssh/known_hosts.old': Read-only file system
chown: changing ownership of '/config/.ssh/id_ed25519.pub': Read-only file system
chown: changing ownership of '/config/.ssh/authorized_keys': Read-only file system
chown: changing ownership of '/config/.ssh/id_ed25519': Read-only file system
chown: changing ownership of '/config/.ssh/known_hosts': Read-only file system
chmod: changing permissions of '/config/.ssh': Read-only file system
chmod: changing permissions of '/config/.ssh/authorized_keys': Read-only file system
chmod: changing permissions of '/config/.ssh/id_ed25519': Read-only file system
chmod: changing permissions of '/config/.ssh/id_ed25519.pub': Read-only file system
chmod: changing permissions of '/config/.ssh/known_hosts': Read-only file system
chmod: changing permissions of '/config/.ssh/known_hosts.old': Read-only file system
s6-rc: warning: unable to start service init-code-server: command exited 1

Log prior update:

[custom-init] no custom services found, skipping...
s6-rc: info: service s6rc-oneshot-runner: starting
s6-rc: info: service s6rc-oneshot-runner successfully started
s6-rc: info: service fix-attrs: starting
s6-rc: info: service 00-legacy: starting
s6-rc: info: service 00-legacy successfully started
s6-rc: info: service fix-attrs successfully started
s6-rc: info: service legacy-cont-init: starting
cont-init: info: running /etc/cont-init.d/01-envfile
cont-init: info: /etc/cont-init.d/01-envfile exited 0
cont-init: info: running /etc/cont-init.d/01-migrations
[migrations] started
[migrations] no migrations found
cont-init: info: /etc/cont-init.d/01-migrations exited 0
cont-init: info: running /etc/cont-init.d/02-tamper-check
cont-init: info: /etc/cont-init.d/02-tamper-check exited 0
cont-init: info: running /etc/cont-init.d/10-adduser

-------------------------------------
          _         ()
         | |  ___   _    __
         | | / __| | |  /  \
         | | \__ \ | | | () |
         |_| |___/ |_|  \__/


Brought to you by linuxserver.io
-------------------------------------

To support LSIO projects visit:
https://www.linuxserver.io/donate/
-------------------------------------
GID/UID
-------------------------------------

User uid:    1000
User gid:    1001
-------------------------------------

cont-init: info: /etc/cont-init.d/10-adduser exited 0
cont-init: info: running /etc/cont-init.d/30-config
setting permissions::configuration
chown: changing ownership of '/config/.ssh/known_hosts.old': Read-only file system
chown: changing ownership of '/config/.ssh/id_ed25519.pub': Read-only file system
chown: changing ownership of '/config/.ssh/authorized_keys': Read-only file system
chown: changing ownership of '/config/.ssh/id_ed25519': Read-only file system
chown: changing ownership of '/config/.ssh/known_hosts': Read-only file system
chown: changing ownership of '/config/.ssh': Read-only file system
chown: changing ownership of '/config/.ssh/known_hosts.old': Read-only file system
chown: changing ownership of '/config/.ssh/id_ed25519.pub': Read-only file system
chown: changing ownership of '/config/.ssh/authorized_keys': Read-only file system
chown: changing ownership of '/config/.ssh/id_ed25519': Read-only file system
chown: changing ownership of '/config/.ssh/known_hosts': Read-only file system
chown: changing ownership of '/config/.ssh': Read-only file system
setting permissions::workspace
cont-init: info: /etc/cont-init.d/30-config exited 0
cont-init: info: running /etc/cont-init.d/90-custom-folders
cont-init: info: /etc/cont-init.d/90-custom-folders exited 0
cont-init: info: running /etc/cont-init.d/99-custom-scripts
[custom-init] no custom files found, skipping...
cont-init: info: /etc/cont-init.d/99-custom-scripts exited 0
s6-rc: info: service legacy-cont-init successfully started
s6-rc: info: service init-mods: starting
s6-rc: info: service init-mods successfully started
s6-rc: info: service init-mods-package-install: starting
s6-rc: info: service init-mods-package-install successfully started
s6-rc: info: service init-mods-end: starting
s6-rc: info: service init-mods-end successfully started
s6-rc: info: service init-services: starting
s6-rc: info: service init-services successfully started
s6-rc: info: service legacy-services: starting
services-up: info: copying legacy longrun code-server (no readiness notification)
s6-rc: info: service legacy-services successfully started
s6-rc: info: service 99-ci-service-check: starting
[ls.io-init] done.
s6-rc: info: service 99-ci-service-check successfully started
[2022-10-04T06:44:45.100Z] info  Wrote default config file to ~/.config/code-server/config.yaml
[2022-10-04T06:44:45.371Z] info  code-server 4.7.0 7f108c61ab670ccaae4cfde5de2909c003db1ce8
[2022-10-04T06:44:45.372Z] info  Using user-data-dir ~/data
[2022-10-04T06:44:45.380Z] info  Using config file ~/.config/code-server/config.yaml
[2022-10-04T06:44:45.380Z] info  HTTP server listening on http://0.0.0.0:8443/ 

Steps to Reproduce

Mounted volume as readonly:

• "/home/user/.ssh:/config/.ssh:ro"

Environment

OS:
CPU architecture: x86_64
How docker service was installed:
Ubuntu 22 LTS

Command used to create docker container (run/create/compose/screenshot)

Used the following compose part:

code-server:
   image: ghcr.io/linuxserver/code-server:4.7.0
   container_name: code-server
   networks:
     - traefik-network
   ports:
     - 8443:8443
   environment:
     - PGID
     - PUID
     - TZ
     - PROXY_DOMAIN=sub.domain.com
     - PASSWORD=${VSCODE_PWD}
   volumes:
     - "./vscode:/workspaces/config"
     - "/home/user/.gitconfig:/etc/gitconfig:ro"
     - "/home/user/ssh:/config/.ssh:ro" # mount ssh keys
     - "/etc/localtime:/etc/localtime:ro"
     - "./dir1:/workspaces/workspaces/dir1"
     - "./dir2:/workspaces/dir2"
   restart: unless-stopped
   healthcheck:
     test: ["CMD", "curl", "-f", "http://127.0.0.1:8443"]
     interval: 30s
     timeout: 10s
     retries: 6
   labels:
     - "traefik.enable=true"
     -  "traefik labels omitted"

Docker logs

[aptalca]

We did not intend for that folder to be mounted. We also don't recommend nested mounting (mounting things into subfolders of an already mounted folder like config).

You can copy your keys into the config folder.

[mrdavidkovacs]

So, I mounted my keys in /run/.ssh.
Created a script 10-copy-ssh-keys with the following content:

#!/usr/bin/with-contenv sh

cp -r /run/.ssh /config/.ssh

And mounted it in /etc/cont-init.d/10-copy-ssh-keys

Is that the correct way?

[drizuid]

This seems reasonable to me, did it work for you?

[aptalca]

even if it works now, it won't work when we switch to s6v3
that action is best done on the host, just copy the keys into the config folder on host as needed

[mrdavidkovacs]

Yes, @drizuid it worked for me.
But I wanted to know if it would last.
But @aptalca already wrote, that it will not continue to work in the future.

Thank you, then I have to manage that in another way.

[Marck]

If someone is running into the same issue, is on kubernetes and want to use secrets:
Fixed it by using a init container that has the keys mounted (from a secret) to /tmp/.ssh and a mount with the actual data.

initContainers:
      - name: init-copy-keys
        image: busybox:1.36.1
        command: ['sh', '-c', 'cp -LR /tmp/.ssh/id* /config/.ssh/ && echo "done"']
        volumeMounts:
          - name: github-repo-keys
            mountPath: /tmp/.ssh
          - name: volume0
            mountPath: /config

volumes:
        - name: github-repo-keys
          secret: 
            secretName: github-keys
            items:
            - key: public-key
              path: id_ed25519.pub
            - key: private-key
              path: id_ed25519

Maybe this helps someone in the future