Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Recursive chown in container entrypoint breaks on read-only volumes #2104

Closed
witten opened this issue Oct 28, 2024 · 3 comments
Closed

Recursive chown in container entrypoint breaks on read-only volumes #2104

witten opened this issue Oct 28, 2024 · 3 comments
Labels
enhancement New feature or request

Comments

@witten
Copy link

witten commented Oct 28, 2024

First of all, thank you so much for all of your work on Listmonk! I know maintaining an open source project like this isn't easy.

Is your feature request related to a problem? Please describe.

When I attempted to upgrade from the Listmonk 3 container to 4, the recursive chown in entrypoint.sh is erroring (with "Read-only filesystem" for each file accessed). This is because I'm using read-only volumes for both the Listmonk configuration file and static files. That's for security purposes; it's generally best practice to give a container the minimum ability to alter files on the host, just on the off chance the container becomes compromised.

Side note: The chown is also triggering "Operation not permitted" errors on other container files because I'm running the container in rootless Podman, which worked fine with Listmonk 3. I totally understand if this is not a supported use case with Listmonk, but I thought I should mention it as well. (I've tried various permutations of setting PUID and PGID, but that hasn't helped.)

Describe the solution you'd like

I have two ideas for "fixes":

  • Instead of unconditionally attempting to chown, maybe just check that files have the correct permissions and error if they don't (without modifying their permissions).
  • Or just remove the chown entirely.
@witten witten added the enhancement New feature or request label Oct 28, 2024
@knadh knadh closed this as completed in 136d9d1 Oct 28, 2024
@knadh
Copy link
Owner

knadh commented Oct 28, 2024

Made chown gracefully fail and move on.

There's another minor but annoying that I shipped with v4.0.0 yesterday. Fixing that and will release v4.0.1 shortly.

Edit. That other bug report needs investigation. #2103

@witten
Copy link
Author

witten commented Oct 28, 2024

Thank you! I appreciate the quick fix.

@witten
Copy link
Author

witten commented Oct 28, 2024

FWIW, I can confirm the fix works! Listmonk now runs again with both read-only volumes and rootless Podman.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants