docker-compose: Run services with a read-only root filesystem

docker-compose/db-only-migrate.docker-compose.yaml

@@ -23,7 +23,10 @@ services:
 
 volumes:
   pgsql:
+  pgsql-socket:
   codeintel-db:
+  codeintel-db-socket:
   codeinsights-db:
+  codeinsights-db-socket:
 networks:
   sourcegraph:

docker-compose/docker-compose.yaml

@@ -17,6 +17,7 @@ services:
     mem_limit: '500m'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     command: ['up']
     environment:
       - PGHOST=pgsql
@@ -75,6 +76,7 @@ services:
     mem_limit: '4g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     environment:
       - 'XDG_DATA_HOME=/caddy-storage/data'
       - 'XDG_CONFIG_HOME=/caddy-storage/config'
@@ -132,6 +134,7 @@ services:
     mem_limit: '8g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     env_file: sourcegraph-uploads.env
     environment:
       - DEPLOY_TYPE=docker-compose
@@ -166,6 +169,10 @@ services:
       start_period: 300s
     volumes:
       - 'sourcegraph-frontend-0:/mnt/cache'
+      # A volume, not a tmpfs: a volume takes the image directory's owner, a tmpfs is owned by root
+      - 'sourcegraph-frontend-0-home:/home/sourcegraph'
+    tmpfs:
+      - '/tmp'
     networks:
       - sourcegraph
     restart: always
@@ -186,6 +193,7 @@ services:
     mem_limit: '8g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     env_file: sourcegraph-uploads.env
     environment:
       - DEPLOY_TYPE=docker-compose
@@ -203,6 +211,10 @@ services:
       - 'OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4317'
     volumes:
       - 'sourcegraph-frontend-internal-0:/mnt/cache'
+      # A volume, not a tmpfs: a volume takes the image directory's owner, a tmpfs is owned by root
+      - 'sourcegraph-frontend-internal-0-home:/home/sourcegraph'
+    tmpfs:
+      - '/tmp'
     networks:
       - sourcegraph
     restart: always
@@ -233,12 +245,15 @@ services:
     mem_limit: '8g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     env_file: sourcegraph-uploads.env
     environment:
       - 'SRC_FRONTEND_INTERNAL=sourcegraph-frontend-internal:3090'
       - 'OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4317'
     volumes:
       - 'gitserver-0:/data/repos'
+    tmpfs:
+      - '/tmp'
     networks:
       - sourcegraph
     restart: always
@@ -259,6 +274,7 @@ services:
     mem_limit: '16g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     environment:
       - 'HOSTNAME=zoekt-webserver-0:6070'
       - 'SRC_FRONTEND_INTERNAL=http://sourcegraph-frontend-internal:3090'
@@ -284,6 +300,7 @@ services:
     mem_limit: '50g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     environment:
       - 'HOSTNAME=zoekt-webserver-0:6070'
       - 'OPENTELEMETRY_DISABLED=false'
@@ -313,6 +330,7 @@ services:
     mem_limit: '2g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     env_file: sourcegraph-uploads.env
     environment:
       - 'SRC_FRONTEND_INTERNAL=sourcegraph-frontend-internal:3090'
@@ -324,6 +342,8 @@ services:
       retries: 3
     volumes:
       - 'searcher-0:/mnt/cache'
+    tmpfs:
+      - '/tmp'
     networks:
       - sourcegraph
     restart: always
@@ -340,6 +360,7 @@ services:
     mem_limit: '4g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     env_file: sourcegraph-uploads.env
     environment:
       - 'SRC_FRONTEND_INTERNAL=sourcegraph-frontend-internal:3090'
@@ -350,6 +371,9 @@ services:
       timeout: 5s
       retries: 3
       start_period: 60s
+    volumes:
+      # On disk, not tmpfs: a tmpfs counts against mem_limit, and uploads can be several GB
+      - 'precise-code-intel-worker-tmp:/tmp'
     networks:
       - sourcegraph
     restart: always
@@ -367,6 +391,7 @@ services:
     mem_limit: '4g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     env_file: sourcegraph-uploads.env
     environment:
       - 'SRC_FRONTEND_INTERNAL=sourcegraph-frontend-internal:3090'
@@ -393,6 +418,7 @@ services:
     mem_limit: '4g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     env_file: sourcegraph-uploads.env
     environment:
       - 'SRC_FRONTEND_INTERNAL=sourcegraph-frontend-internal:3090'
@@ -403,6 +429,9 @@ services:
       timeout: 15s
       retries: 3
       start_period: 60s
+    volumes:
+      # On disk, not tmpfs: a tmpfs counts against mem_limit, and repository archives can be several GB
+      - 'syntactic-code-intel-worker-tmp:/tmp'
     networks:
       - sourcegraph
     restart: always
@@ -420,6 +449,7 @@ services:
     mem_limit: '6g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     healthcheck:
       test: "wget -q 'http://127.0.0.1:9238/health' -O /dev/null || exit 1"
       interval: 5s
@@ -473,6 +503,7 @@ services:
     mem_limit: '1g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     volumes:
       - 'grafana:/var/lib/grafana'
       - '../grafana/datasources:/sg_config_grafana/provisioning/datasources'
@@ -494,6 +525,7 @@ services:
     mem_limit: '1g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     # You may set `privileged` to `false and `cadvisor` will run with reduced privileges.
     # `cadvisor` requires root privileges in order to display provisioning metrics.
     # These metrics provide critical information to help you scale the Sourcegraph deployment.
@@ -529,6 +561,7 @@ services:
     mem_limit: '1g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     pid: 'host'
     volumes:
       - /proc:/host/proc:ro
@@ -560,6 +593,7 @@ services:
     mem_limit: '4g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     shm_size: '1g'
     healthcheck:
       test: '/liveness.sh'
@@ -570,6 +604,8 @@ services:
     volumes:
       - 'pgsql:/data/'
       - '../pgsql/conf:/conf/'
+      # A volume, not a tmpfs: a volume takes the image directory's owner, a tmpfs is owned by root
+      - 'pgsql-socket:/var/run/postgresql'
     networks:
       - sourcegraph
     restart: always
@@ -590,6 +626,7 @@ services:
     mem_limit: '50m'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     networks:
       - sourcegraph
     restart: always
@@ -611,6 +648,7 @@ services:
     mem_limit: '4g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     shm_size: '1g'
     healthcheck:
       test: '/liveness.sh'
@@ -621,6 +659,8 @@ services:
     volumes:
       - 'codeintel-db:/data/'
       - '../codeintel-db/conf:/conf/'
+      # A volume, not a tmpfs: a volume takes the image directory's owner, a tmpfs is owned by root
+      - 'codeintel-db-socket:/var/run/postgresql'
     networks:
       - sourcegraph
     restart: always
@@ -641,6 +681,7 @@ services:
     mem_limit: '50m'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     networks:
       - sourcegraph
     restart: always
@@ -662,6 +703,7 @@ services:
     mem_limit: '2g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     shm_size: '1g'
     environment:
       - POSTGRES_PASSWORD=password
@@ -677,6 +719,8 @@ services:
     volumes:
       - 'codeinsights-db:/var/lib/postgresql/data/'
       - '../codeinsights-db/conf:/conf/'
+      # A volume, not a tmpfs: a volume takes the image directory's owner, a tmpfs is owned by root
+      - 'codeinsights-db-socket:/var/run/postgresql'
     networks:
       - sourcegraph
     restart: always
@@ -697,6 +741,7 @@ services:
     mem_limit: '50m'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     networks:
       - sourcegraph
     restart: always
@@ -718,6 +763,7 @@ services:
     mem_limit: '1g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     healthcheck:
       test: ['CMD', 'curl', '-f', 'http://127.0.0.1:9000/']
       interval: 10s
@@ -726,6 +772,8 @@ services:
       start_period: 15s
     volumes:
       - 'blobstore:/data'
+    tmpfs:
+      - '/tmp'
     networks:
       - sourcegraph
     restart: always
@@ -743,6 +791,7 @@ services:
     mem_limit: '7g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     volumes:
       - 'redis-cache:/redis-data'
     networks:
@@ -761,6 +810,7 @@ services:
     mem_limit: '7g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     volumes:
       - 'redis-store:/redis-data'
     networks:
@@ -778,6 +828,7 @@ services:
     mem_limit: '1g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     networks:
       - sourcegraph
     restart: always
@@ -791,16 +842,23 @@ volumes:
   gitserver-0:
   grafana:
   pgsql:
+  pgsql-socket:
   codeintel-db:
+  codeintel-db-socket:
   codeinsights-db:
+  codeinsights-db-socket:
   blobstore:
+  precise-code-intel-worker-tmp:
   prometheus-v2:
   redis-cache:
   redis-store:
   worker:
   searcher-0:
   sourcegraph-frontend-0:
+  sourcegraph-frontend-0-home:
   sourcegraph-frontend-internal-0:
+  sourcegraph-frontend-internal-0-home:
+  syntactic-code-intel-worker-tmp:
   zoekt-0-shared:
 networks:
   sourcegraph:

docker-compose/executors/executor.docker-compose.yaml

@@ -8,6 +8,7 @@ services:
     user: root
     # Run with privileged capabilities (required for docker daemon control)
     privileged: true
+    read_only: true
     environment:
       # Refer to https://sourcegraph.com/docs/self-hosted/executors/executors-config on how to populate these variables
       - EXECUTOR_FRONTEND_URL=http://sourcegraph-frontend-0:3080
@@ -27,6 +28,9 @@ services:
       - '/var/run/docker.sock:/var/run/docker.sock'
       # Mount volume for workspaces shared by executor and launched containers
       - '/scratch:/scratch'
+    tmpfs:
+      # The git, docker, and src commands the executor runs do not inherit TMPDIR
+      - '/tmp'
     networks:
       - sourcegraph
     restart: always

docker-compose/jaeger/docker-compose.yaml

@@ -14,6 +14,7 @@ services:
     mem_limit: '512m'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     ports:
       # Query port
       - '0.0.0.0:16686:16686'