Fails to start with readOnlyFilesystem + emptyDir mount

[MartinEmrich]

fluentd expects to have a "secure" temporary directory to write its lockfile. This means that it is eiter not world-writable, or has the sticky bit (t) set.

Running in Kubernetes with readOnlyFilesystem on, one has to explicitly provide that directory (e.g. /tmp) using a volumeMount. But that mount is world-writable and has no sticky bit set, so fluentd crashes with this error:

...
2022-11-08 11:15:33 +0000 [info]: init supervisor logger path=nil rotate_age=nil rotate_size=nil
system temporary path is world-writable: /tmp
/tmp is world-writable: /tmp
. is world-writable: /home/fluent
Unexpected error could not find a temporary directory
  /usr/local/lib/ruby/3.1.0/tmpdir.rb:39:in `tmpdir'
...

Fluentd itself apparently does not consider this a bug (see https://github.com/fluent/fluentd/issues/3924), in non-containerized environments, that behaviour would of couse be desireable.

This could possibly be fixed in the entrypoint.sh by adding chmod +t /tmp before executing fluentd?

[github-actions[bot]]

This issue has been automatically marked as stale because it has been open 90 days with no activity. Remove stale label or comment or this issue will be closed in 30 days

[github-actions[bot]]

This issue was automatically closed because of stale in 30 days

[MartinEmrich]

Workaround: use an initcontainer to chmod the directories, e.g:

...
      initContainers:
        - name: chmod-tempdirs
          image: fluent/fluentd-kubernetes-daemonset:v1.16-debian-graylog-1
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            # runAsNonRoot: true
            capabilities:
              drop:
                - all
          command: "/bin/sh"
          args:
          - "-c"
          - "chmod o-rwx /home/fluent /tmp"
          volumeMounts:
            - name: tmp
              mountPath: /tmp
            - name: homefluent
              mountPath: /home/fluent
...