Don't give read permission to the entire objects directory

galaxyproject / galaxy-helm

Minimal setup required to run Galaxy under Kubernetes

MIT License

38 stars 36 forks source link

Don't give read permission to the entire objects directory #481

Closed ksuderman closed 5 days ago

ksuderman commented 1 week ago

Versions of Galaxy prior to 24.1.1 (to be released) contain a bug that did not mount the extra_files directories to jobs causing some tools to fail. Once 24.1.1 is available we can merge this to restrict jobs so they can only read their inputs and only write to their output locations.

See PR #18462

Closes #480 Closes #478

ksuderman commented 5 days ago

My simple test of running the variant calling workflow passes so I think this is safe to merge now.