mount volumes for tmp directories, apply best practice to sc #38
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
🦋 Changeset detectedLatest commit: 5b59709 The changes in this PR will be included in the next version bump. Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
machisuji
force-pushed
the
maintenance/security-context-and-tmp-directories
branch
from
893eac0
to
25bcde7
Compare
machisuji
force-pushed
the
maintenance/security-context-and-tmp-directories
branch
from
25bcde7
to
5dd885a
Compare
…context-and-tmp-directories
oliverguenther
approved these changes
Nov 29, 2023
oliverguenther
deleted the
maintenance/security-context-and-tmp-directories
branch
oliverguenther
added a commit
that referenced
this pull request
Nov 29, 2023
* mount volumes for tmp directories, apply best practice to sc * bump version * use safe sc for bundled apps (postgres, memcached) too * use read-only filesystem with mounted tmp volumes unless in development mode * revert version bump to let this be handled by changeset flow * amend dev readme * Create bright-students-eat.md --------- Co-authored-by: Oliver Günther <mail@oliverguenther.de>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
/app/tmpand/tmprespectively to allow for read-only root file systems**
emptyDir**
epheremalvolumeAt least on minikube both have problems with wrong permissions (world write access without sticky bit) which makes it unusable because Ruby will complain with the following.
Where
/appis of course not writable and shouldn't be used to begin with.I'm looking into the issue and will try to reproduce it on my OpenShift cluster.
If it's an issue specific to minikube we may not have a problem.
Edit: it works fine on mz OpenShift cluster. So it might really just be a minikube bug.
Will try this on another cluster to confirm, though.