Skip to content

Commit

Permalink
compose: Use read-only filesystem
Browse files Browse the repository at this point in the history 
This adds needed tmpfs volumes and read only flag to all containers.

See WeblateOrg/docker#1831
  • Loading branch information
@nijel
nijel committed Jun 8, 2023
1 parent bf3ba64 commit f3661ef
Show file tree
Hide file tree
Showing 6 changed files with 84 additions and 6 deletions.
43 changes: 41 additions & 2 deletions .github/workflows/dockerimage.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ name: Docker Image CI
on: [push, pull_request]

jobs:
build:
read-only:
runs-on: ubuntu-20.04
env:
# Use short project name, otherwise inspect output is messy
Expand All @@ -13,7 +13,46 @@ jobs:
steps:
- uses: actions/checkout@v3
- name: Generate configuration
run: ./test-generate
run: ./test-generate 8080 http
- name: Startup container
run: ./test-boot
- name: List Python packages
run: ./test-pip
- name: Inspect container
run: ./test-inspect
- name: Check service is running
run: ./test-online
- name: Check service health status
run: ./test-health
- name: Run Django Checks
run: ./test-checks
- name: Verify supervisor
run: ./test-supervisor
- name: Test admin creation
run: ./test-admin
- name: Verify SAML certificate
run: ./test-saml
- name: Run commands
run: ./test-commands
- name: Run tests
run: ./test-tests
- name: Display logs
run: ./test-logs
if: always()
- name: Shutdown service
run: ./test-stop

read-write:
runs-on: ubuntu-20.04
env:
# Use short project name, otherwise inspect output is messy
COMPOSE_PROJECT_NAME: wl
TEST_EXTRA_ENV: 'WEBLATE_SAML_IDP_URL: https://example.com/idp'

steps:
- uses: actions/checkout@v3
- name: Generate configuration
run: ./test-generate 8080 http read-write
- name: Startup container
run: ./test-boot
- name: List Python packages
Expand Down
6 changes: 6 additions & 0 deletions docker-compose-https.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,16 @@ version: '3'
services:
weblate:
image: weblate/weblate
tmpfs:
- /run
- /tmp
volumes:
- weblate-data:/app/data
- weblate-cache:/app/cache
env_file:
- ./environment
restart: always
read_only: true
depends_on:
- database
- cache
Expand All @@ -24,6 +28,7 @@ services:
cache:
image: redis:7-alpine
restart: always
read_only: true
command: [redis-server, --save, '60', '1']
volumes:
- redis-data:/data
Expand All @@ -33,6 +38,7 @@ services:
- 80:80
- 443:443
restart: always
read_only: true
environment:
STAGE: production
PROXY_READ_TIMEOUT: 3600
Expand Down
22 changes: 22 additions & 0 deletions docker-compose-split.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@ services:
weblate:
image: weblate/weblate
tmpfs:
- /run
- /tmp
- /app/cache
volumes:
- type: volume
Expand All @@ -11,6 +13,7 @@ services:
env_file:
- ./environment
restart: always
read_only: true
depends_on:
- database
- cache
Expand All @@ -20,6 +23,8 @@ services:
weblate-celery-backup:
image: weblate/weblate
tmpfs:
- /run
- /tmp
- /app/cache
volumes:
- type: volume
Expand All @@ -30,6 +35,7 @@ services:
env_file:
- ./environment
restart: always
read_only: true
depends_on:
- database
- cache
Expand All @@ -38,6 +44,8 @@ services:
weblate-celery-beat:
image: weblate/weblate
tmpfs:
- /run
- /tmp
- /app/cache
volumes:
- type: volume
Expand All @@ -48,6 +56,7 @@ services:
env_file:
- ./environment
restart: always
read_only: true
depends_on:
- database
- cache
Expand All @@ -56,6 +65,8 @@ services:
weblate-celery-celery:
image: weblate/weblate
tmpfs:
- /run
- /tmp
- /app/cache
volumes:
- type: volume
Expand All @@ -66,6 +77,7 @@ services:
env_file:
- ./environment
restart: always
read_only: true
depends_on:
- database
- cache
Expand All @@ -75,6 +87,8 @@ services:
weblate-celery-memory:
image: weblate/weblate
tmpfs:
- /run
- /tmp
- /app/cache
volumes:
- type: volume
Expand All @@ -85,6 +99,7 @@ services:
env_file:
- ./environment
restart: always
read_only: true
depends_on:
- database
- cache
Expand All @@ -94,6 +109,8 @@ services:
weblate-celery-notify:
image: weblate/weblate
tmpfs:
- /run
- /tmp
- /app/cache
volumes:
- type: volume
Expand All @@ -104,6 +121,7 @@ services:
env_file:
- ./environment
restart: always
read_only: true
depends_on:
- database
- cache
Expand All @@ -113,6 +131,8 @@ services:
weblate-celery-translate:
image: weblate/weblate
tmpfs:
- /run
- /tmp
- /app/cache
volumes:
- type: volume
Expand All @@ -123,6 +143,7 @@ services:
env_file:
- ./environment
restart: always
read_only: true
depends_on:
- database
- cache
Expand All @@ -139,6 +160,7 @@ services:
cache:
image: redis:7-alpine
restart: always
read_only: true
command: [redis-server, --save, '60', '1']
volumes:
- redis-data:/data
Expand Down
5 changes: 5 additions & 0 deletions docker-compose.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,16 @@ version: '3'
services:
weblate:
image: weblate/weblate
tmpfs:
- /run
- /tmp
volumes:
- weblate-data:/app/data
- weblate-cache:/app/cache
env_file:
- ./environment
restart: always
read_only: true
depends_on:
- database
- cache
Expand All @@ -21,6 +25,7 @@ services:
cache:
image: redis:7-alpine
restart: always
read_only: true
command: [redis-server, --save, '60', '1']
volumes:
- redis-data:/data
Expand Down
10 changes: 8 additions & 2 deletions test-generate
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ cat > docker-compose.override.yml <<EOT
version: '3'
services:
weblate:
image: ${TEST_CONTAINER:-weblate/weblate:latest}
image: ${TEST_CONTAINER:-weblate/weblate:edge}
environment:
WEBLATE_TIME_ZONE: Europe/Prague
WEBLATE_SITE_DOMAIN: test.example.com
Expand All @@ -18,13 +18,19 @@ if [ "$3" = "split" ] ; then
for service in celery-backup celery-beat celery-celery celery-memory celery-notify celery-translate ; do
cat >> docker-compose.override.yml <<EOT
weblate-${service}:
image: ${TEST_CONTAINER:-weblate/weblate:latest}
image: ${TEST_CONTAINER:-weblate/weblate:edge}
environment:
WEBLATE_TIME_ZONE: Europe/Prague
WEBLATE_SITE_DOMAIN: test.example.com
EOT
done
fi
if [ "$3" = "read-write" ] ; then
sed -i -e '/- \/tmp/D' -e '/read_only: true/D' docker-compose.yml
else
# Allow execution in tmp
sed -i 's/- \/tmp/- \/tmp:exec/' docker-compose.yml
fi


IP=127.0.0.1
Expand Down
4 changes: 2 additions & 2 deletions test-tests
View file
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
#!/bin/sh
set -e
docker-compose exec -T --user weblate --env CI_DATABASE=postgresql --env CI_DB_HOST=database --env CI_DB_NAME=weblate --env CI_DB_USER=weblate --env CI_DB_PASSWORD=weblate --env DJANGO_SETTINGS_MODULE=weblate.settings_test weblate weblate collectstatic --noinput
docker-compose exec -T --user weblate --env CI_DATABASE=postgresql --env CI_DB_HOST=database --env CI_DB_NAME=weblate --env CI_DB_USER=weblate --env CI_DB_PASSWORD=weblate --env DJANGO_SETTINGS_MODULE=weblate.settings_test weblate weblate test --noinput weblate
docker-compose exec -T --user weblate --env CI_BASE_DIR=/tmp --env CI_DATABASE=postgresql --env CI_DB_HOST=database --env CI_DB_NAME=weblate --env CI_DB_USER=weblate --env CI_DB_PASSWORD=weblate --env DJANGO_SETTINGS_MODULE=weblate.settings_test weblate weblate collectstatic --noinput
docker-compose exec -T --user weblate --env CI_BASE_DIR=/tmp --env CI_DATABASE=postgresql --env CI_DB_HOST=database --env CI_DB_NAME=weblate --env CI_DB_USER=weblate --env CI_DB_PASSWORD=weblate --env DJANGO_SETTINGS_MODULE=weblate.settings_test weblate weblate test --noinput weblate
RET=$?
if [ $RET -ne 0 ] ; then
docker-compose logs
Expand Down

3 comments on commit f3661ef

@endquote
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this broke something. In the dockerfile here, there are rm commands:
https://github.com/WeblateOrg/docker/blob/main/Dockerfile#L185

They now fail in my log:

2023-06-08T22:45:06.440017249Z rm: cannot remove '/var/log/nginx/access.log': Read-only file system
2023-06-08T22:45:06.440047263Z rm: cannot remove '/var/log/nginx/error.log': Read-only file system

This causes the container to not start.

@nijel
Copy link
Member Author

@nijel nijel commented on f3661ef Jun 9, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is no reason to ask same question on multiple places. It has been already answered at WeblateOrg/docker#1831 (comment).

@endquote
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, just saw the commit before seeing the issue.

Please sign in to comment.