Nginx doesn't start, because configure-0 tries to write on a read-only location.
This was already reported #385
failed to create nginx.conf: open /workspace/nginx.conf: read-only file system
ERROR: failed to launch: exec.d: failed to execute exec.d file at path '/layers/paketo-buildpacks_nginx/nginx/exec.d/0-configure': exit status 1
Possible Solution
In this issue I try to focus on templating issues with nginx.conf. Configure nginx to not write anything should be addressed at nginx team.
Not using templating in nginx.conf was already discussed and is still one workaround. For me this is not an option. E.g. we're using a dynamic URL to proxy our backend depending on our actual environment.
Solutions:
(preferred) Do not perform an replacement of nginx.conf. Instead use the input file as template and write the output file to a user specified location. If BPL_NGINX_CONF_LOCATION is set this configuration is written and used.
A user is responsible to copy nginx.conf to a build/run writeable location e.g. /tmp. Additionally set BP_NGINX_CONF_LOCATION=/tmp/nginx.conf. To make configure-0 working a user must also copy it's nginx.conf at runtime to tmp. Maybe by mounting a ConfigMap to a volume or by other means.
As already mentioned we strive to run our images as secure as possible. To do so we try to run a container read-only with some exceptions.
This is described here
Running a read-only file system in your containers forces your containers to be immutable.
Not only does this mitigate some old (and risky) practices such as hot patching, but also helps you prevent the risks of malicious processes storing or manipulating data inside a container.
I hit this issue as well. It seems bad to require that the workspace directory is writable at runtime. Are there any caveats to solution 1 as proposed by @ajdergute ?
I run this buildpack via helm chart and configured my security context like so:
As the only exception I made
/tmp
writeable. Therefore I used an ownnginx.conf
with some templated values. See:Expected Behavior
Nginx is up and running serving my content.
Current Behavior
Nginx doesn't start, because
configure-0
tries to write on a read-only location. This was already reported #385Possible Solution
In this issue I try to focus on templating issues with
nginx.conf
. Configure nginx to not write anything should be addressed at nginx team. Not using templating innginx.conf
was already discussed and is still one workaround. For me this is not an option. E.g. we're using a dynamic URL to proxy our backend depending on our actual environment.Solutions:
nginx.conf
. Instead use the input file as template and write the output file to a user specified location. IfBPL_NGINX_CONF_LOCATION
is set this configuration is written and used.nginx.conf
to a build/run writeable location e.g./tmp
. Additionally setBP_NGINX_CONF_LOCATION=/tmp/nginx.conf
. To makeconfigure-0
working a user must also copy it'snginx.conf
at runtime totmp.
Maybe by mounting aConfigMap
to a volume or by other means.Steps to Reproduce
Motivations
As already mentioned we strive to run our images as secure as possible. To do so we try to run a container read-only with some exceptions. This is described here