Configuration when using readOnlyRootFilesystem

[geoff-maddock]

Our team is working on improving security in our cluster, so for our dashy deployment we've made a few security changes to the deployment, including modifying the security context:

        securityContext:
          runAsGroup: 999 # needed if default container user is root.
          runAsUser: 999 # needed if default container user is root.
          allowPrivilegeEscalation: false
          capabilities:
            drop:
              - ALL
          privileged: false
          readOnlyRootFilesystem: true
          runAsNonRoot: true

However, now I find the app cannot start, after erroring out on some build steps:

Using Dashy V-2.0.5. Update Check Complete
✅ Dashy is Up-to-Date
-  Building for production...
 WARN  A new version of sass-loader is available. Please upgrade for best experience.
 ERROR  Error: EROFS: read-only file system, rmdir '/app/dist'
Error: EROFS: read-only file system, rmdir '/app/dist'
error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.
ERROR: "build-watch" exited with 1.
error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

I added /app/dist as an emptyDir volume and mounted into the container, but still see the same error above.

Anyone have tips on running dashy in this sort of secured deployment?

[Lissy93]

Yes, i think this relates to PR: #502 which was to make these changes to the privileges.

I've been away couple weeks, so it's now bit outdated, but take a look at that dockerfile and see if that helps. When i get back, I'll look into this again and rebase, test and hopefully merge that PR.