|
| ▲ | hxtk 4 days ago | parent | next [-] |
| Many fail if you do it without any additional configuration. In Kubernetes you can mostly get around it by mounting `emptyDir` volumes to the specific directories that need to be writable, `/tmp` being a common culprit. If they need to be writable and have content that exists in the base image, you'd usually mount an emptyDir to `/tmp` and copy the content into it in an `initContainer`, then mount the same `emptyDir` volume to the original location in the runtime container. Unfortunately, there is no way to specify those `emptyDir` volumes as `noexec` [1]. I think the docker equivalent is `--tmpfs` for the `emptyDir` volumes. 1: https://github.com/kubernetes/kubernetes/issues/48912 |
|
| ▲ | flowerthoughts 4 days ago | parent | prev | next [-] |
| Readonly and rootless are my two requirements for Docker containers. Most images can't run readonly because they try to create a user in some startup script. Since I want my UIDs unique to isolate mounted directories, this is meaningless. I end up having to wrap or copy Dockerfiles to make them behave reasonably. Having such a nice layered buildsystem with mountpoints, I'm amazed Docker made readonly an afterthought. |
| |
| ▲ | subscribed 4 days ago | parent [-] | | I like steering docker runs with docker-compose, especially with .env files - easy to store in repositories, easy to customise and have sane defaults. | | |
| ▲ | flowerthoughts 4 days ago | parent [-] | | Yeah agreed. I use docker-compose. But it doesn't help if the Docker images try to update /etc/passwd, or force a hardcoded UID, or run some install.sh at runtime instead of buildtime. |
|
|
|
| ▲ | tracker1 4 days ago | parent | prev | next [-] |
| It's hit or miss... you sometimes have to make /tmp writable or another data directory... some images just don't operate right because of initialization steps that happen on first run. It's hit or miss and depends... but a lot of your own apps can definitely be made to work with limited, or no write surface. |
|
| ▲ | s_ting765 4 days ago | parent | prev [-] |
| Depends on specific app use case. Nginx doesn't work with it but valkey will. |
