How do I run ryot rootless and as a read-only container?

[UtkarshVerma]

I tried giving ryot a shot today but couldn't get it to run for me as a normal user and read-only container. Here is my compose.yaml:

include:
  - ../compose.common.yaml
  - ../traefik/compose.yaml
  - ../vectorchord/compose.yaml

services:
  ryot:
    container_name: ryot
    image: ghcr.io/ignisda/ryot:v10.0.2

    user: $PUID:$PGID
    read_only: true
    security_opt:
      - no-new-privileges
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE  # Needed for Caddy.

    networks:
      - traefik
      - vectorchord
      # - internet

    environment:
      DISABLE_TELEMETRY: true
      FRONTEND_URL: https://ryot.$DOMAIN
      DATABASE_URL: postgres://$RYOT_DB_USER:$RYOT_DB_PASSWORD@vectorchord:5432/$RYOT_DB
      SERVER_ADMIN_ACCESS_TOKEN: $RYOT_ADMIN_ACCESS_TOKEN
      SERVER_OIDC_ISSUER_URL: https://pocket-id.$DOMAIN
      RUST_LOG: ryot=debug
      TZ: $TZ

    expose:
      - &port 8000

    labels:
      traefik.enable: true
      traefik.http.routers.ryot.rule: Host(`ryot.$DOMAIN`)
      traefik.http.services.ryot.loadbalancer.server.port: *port 

    # tmpfs:
    #  - /tmp:noexec

    # volumes:
    # - ./cache:/app/cache:rw
    # - ./state:/app/config:rw

    restart: unless-stopped

When I run this, I get the following:

ryot  | [backend] Error: Read-only file system (os error 30)
ryot  | [backend] BACKEND_PORT=5000 /usr/local/bin/backend exited with code 1
ryot  | --> Sending SIGTERM to other processes..
ryot  | [frontend] PORT=3000 npx react-router-serve ./build/server/index.js exited with code SIGTERM
ryot  | --> Sending SIGTERM to other processes..
ryot  | [proxy] caddy run --config /etc/caddy/Caddyfile exited with code SIGTERM
ryot exited with code 1 (restarting)

This was expected to some extent and it would be nice to know which directories ryot expects to write to so that I can mount externally backed-up directories inside.

I disabled the read-only flag, and even then I get permission denied:

ryot  | [backend] Error: Permission denied (os error 13)
ryot  | [backend] BACKEND_PORT=5000 /usr/local/bin/backend exited with code 1
ryot  | --> Sending SIGTERM to other processes..
ryot  | [proxy] caddy run --config /etc/caddy/Caddyfile exited with code SIGTERM
ryot  | --> Sending SIGTERM to other processes..
ryot  | [frontend] PORT=3000 npx react-router-serve ./build/server/index.js exited with code SIGTERM

[IgnisDa]

Ryot also writes the finalized configuration to /home/ryot/tmp. So you should whitelist that directory.

[UtkarshVerma]

Thanks, I was able to modify my compose.yaml and now it works. All I had to do was add a tmpfs mount for /home/ryot/tmp and volume mounts for /.local and .config.

[IgnisDa]

Thanks for the confirmation! Could you also post the final compose so that people can refer to it in the future?

[UtkarshVerma]

Sure, here it is:

include:
  - ../compose.common.yaml
  - ../traefik/compose.yaml
  - ../vectorchord/compose.yaml

services:
  ryot:
    container_name: ryot
    image: ghcr.io/ignisda/ryot:v10.0.2

    user: $PUID:$PGID
    read_only: true
    security_opt:
      - no-new-privileges
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE  # Needed for Caddy.

    networks:
      - traefik
      - vectorchord
      - internet  # For metadata.

    environment:
      DISABLE_TELEMETRY: true
      FRONTEND_URL: https://ryot.$DOMAIN
      DATABASE_URL: postgres://$RYOT_DB_USER:$RYOT_DB_PASSWORD@vectorchord:5432/$RYOT_DB
      SERVER_ADMIN_ACCESS_TOKEN: $RYOT_ADMIN_ACCESS_TOKEN
      USERS_DISABLE_LOCAL_AUTH: true

      SERVER_OIDC_ISSUER_URL: https://pocket-id.$DOMAIN
      SERVER_OIDC_CLIENT_ID: $RYOT_OIDC_CLIENT_ID
      SERVER_OIDC_CLIENT_SECRET: $RYOT_OIDC_CLIENT_SECRET
      FRONTEND_OIDC_BUTTON_LABEL: Login with Pocket ID

      TZ: $TZ

    expose:
      - &port 8000

    labels:
      traefik.enable: true
      traefik.http.routers.ryot.rule: Host(`ryot.$DOMAIN`)
      traefik.http.services.ryot.loadbalancer.server.port: *port 

      glance.name: &name Ryot
      glance.icon: auto-invert di:ryot
      glance.url: https://ryot.$DOMAIN
      glance.category: frontend/users
      glance.description: Media tracker

      wud.watch: true
      wud.display.name: *name 
      wud.display.icon: di:ryot
      wud.tag.include: ^\d+\.\d+\.\d+$$
      wud.link.template: https://github.com/ignisda/ryot/releases/tag/v$${major}.$${minor}.$${patch}

    tmpfs:
      - /home/ryot/tmp:noexec,uid=$PUID,gid=$PGID

    volumes:
      - ./state/config:/.config:rw
      - ./state/local:/.local:rw

    restart: unless-stopped