[marcleblanc2]

Problem

Some customers need a read-only root filesystem on every container

No Compose service set read_only: true, so a process could modify its own container image at runtime

• Code scanning flagged each service with sg-infra-writable-filesystem-service

Solution

Set read_only: true on every service in every Compose file, except prometheus

Services that write outside their volumes get a writable path, mirroring the Helm chart's emptyDir mounts where it has them:

Service	Writable path
gitserver, searcher, blobstore, executor	tmpfs /tmp
frontend, frontend-internal	tmpfs /tmp, new named volume at /home/sourcegraph
pgsql, codeintel-db, codeinsights-db	new named volume at /var/run/postgresql
precise-code-intel-worker, syntactic-code-intel-worker	new named volume at /tmp

Review notes:

• /var/run/postgresql and /home/sourcegraph are named volumes, because a tmpfs over an existing directory is owned by root, which broke postgres in CI
  • A named volume takes the owner and mode of the image directory, so the Compose file names no UID, GID, or mode
• The code intel workers' /tmp is on disk, because uploads can be several GB, and a tmpfs counts against mem_limit
• caddy, cadvisor, blobstore, otel-collector, the postgres exporters, and the executor have no read-only precedent in Helm
  • They are read-only here from reading their entrypoints, and the executor has no CI coverage
• Breaking for anyone who writes into a container by hand (docker exec, docker cp) outside a volume

Not changed:

• prometheus, which is fix/observability: Prometheus read only root volume #1479, and waits on an image change
• Image tags and SHA256 sums

Test plan

• docker-compose config -q (v1 1.29.2, same as CI) passes for the main file, the db-only file, the executor file, and the jaeger and dev overlays
• The Semgrep rule goes from 30 findings to 1 (prometheus)

Docker Compose

• CI smoke test: starts the stack, expects 25 running containers, and curls the frontend
  • This proves the services start, not that every runtime path works

Not run:

• Cloning, SCIP uploads, executor jobs, the jaeger overlay, and the db-only file

Helm

• See sourcegraph: read-only root filesystem for blobstore, cadvisor, otel, and pgsql-exporter deploy-sourcegraph-helm#1003

Linked PRs

• fix/observability: Prometheus read only root volume #1479: the same for prometheus, which this PR is stacked on
• sourcegraph: read-only root filesystem for blobstore, cadvisor, otel, and pgsql-exporter deploy-sourcegraph-helm#1003: the same for the Helm containers that lacked it
• docker-compose: Set no-new-privileges on every service #1463: set no-new-privileges on every service, which this follows

Amp threads

• Design and implementation

[github-actions]

Open the Diff Tour for this PR in Sourcegraph