Merge pull request #1439 from alphagov/review_apps_root_fs_ro

Review apps: make apps' root filesystems readonly

Author: AP-Hunt

.review_apps/ecs_task_definition.tf

@@ -80,11 +80,12 @@ resource "aws_ecs_task_definition" "task" {
 
     # forms-runner
     {
-      name        = "forms-runner"
-      image       = var.forms_runner_container_image
-      command     = []
-      essential   = true
-      environment = local.forms_runner_env_vars
+      name                   = "forms-runner"
+      image                  = var.forms_runner_container_image
+      command                = []
+      essential              = true
+      environment            = local.forms_runner_env_vars
+      readonlyRootFilesystem = true
 
       dockerLabels = {
         "traefik.http.middlewares.forms-runner-pr-${var.pull_request_number}.basicauth.users" : data.terraform_remote_state.review.outputs.traefik_basic_auth_credentials
@@ -140,11 +141,12 @@ resource "aws_ecs_task_definition" "task" {
 
     # forms-api
     {
-      name        = "forms-api"
-      image       = "711966560482.dkr.ecr.eu-west-2.amazonaws.com/forms-api-deploy:latest"
-      command     = []
-      essential   = true
-      environment = local.forms_api_env_vars
+      name                   = "forms-api"
+      image                  = "711966560482.dkr.ecr.eu-west-2.amazonaws.com/forms-api-deploy:latest"
+      command                = []
+      essential              = true
+      environment            = local.forms_api_env_vars
+      readonlyRootFilesystem = true
 
       portMappings = [{ containerPort = 9292 }]
 
@@ -178,11 +180,12 @@ resource "aws_ecs_task_definition" "task" {
 
     # forms-admin
     {
-      name        = "forms-admin"
-      image       = "711966560482.dkr.ecr.eu-west-2.amazonaws.com/forms-admin-deploy:latest"
-      command     = []
-      essential   = true
-      environment = local.forms_admin_env_vars
+      name                   = "forms-admin"
+      image                  = "711966560482.dkr.ecr.eu-west-2.amazonaws.com/forms-admin-deploy:latest"
+      command                = []
+      essential              = true
+      environment            = local.forms_admin_env_vars
+      readonlyRootFilesystem = true
 
       dockerLabels = {
         "traefik.http.middlewares.forms-runner-pr-${var.pull_request_number}-admin-app.basicauth.users" : data.terraform_remote_state.review.outputs.traefik_basic_auth_credentials
@@ -289,11 +292,12 @@ resource "aws_ecs_task_definition" "task" {
 
     # forms-runner-seeding
     {
-      name        = "forms-runner-seeding"
-      image       = var.forms_runner_container_image
-      command     = ["rake", "db:setup"]
-      essential   = false
-      environment = local.forms_runner_env_vars
+      name                   = "forms-runner-seeding"
+      image                  = var.forms_runner_container_image
+      command                = ["rake", "db:create", "db:migrate", "db:seed"]
+      essential              = false
+      environment            = local.forms_runner_env_vars
+      readonlyRootFilesystem = true
 
       logConfiguration = {
         logDriver = "awslogs"
@@ -314,11 +318,12 @@ resource "aws_ecs_task_definition" "task" {
 
     # forms-api-seeding
     {
-      name        = "forms-api-seeding"
-      image       = "711966560482.dkr.ecr.eu-west-2.amazonaws.com/forms-api-deploy:latest"
-      command     = ["rake", "db:setup"]
-      essential   = false
-      environment = local.forms_api_env_vars
+      name                   = "forms-api-seeding"
+      image                  = "711966560482.dkr.ecr.eu-west-2.amazonaws.com/forms-api-deploy:latest"
+      command                = ["rake", "db:setup"]
+      essential              = false
+      environment            = local.forms_api_env_vars
+      readonlyRootFilesystem = true
 
       logConfiguration = {
         logDriver = "awslogs"
@@ -339,11 +344,12 @@ resource "aws_ecs_task_definition" "task" {
 
     # forms-admin-seeding
     {
-      name        = "forms-admin-seeding"
-      image       = "711966560482.dkr.ecr.eu-west-2.amazonaws.com/forms-admin-deploy:latest"
-      command     = ["rake", "db:setup"]
-      essential   = false
-      environment = local.forms_admin_env_vars
+      name                   = "forms-admin-seeding"
+      image                  = "711966560482.dkr.ecr.eu-west-2.amazonaws.com/forms-admin-deploy:latest"
+      command                = ["rake", "db:setup"]
+      essential              = false
+      environment            = local.forms_admin_env_vars
+      readonlyRootFilesystem = true
 
       logConfiguration = {
         logDriver = "awslogs"

Dockerfile

@@ -72,9 +72,10 @@ RUN chmod 0755 bin/*
 COPY --chown=ruby:ruby --from=build /usr/local/bundle /usr/local/bundle
 COPY --chown=ruby:ruby --from=build /app /app
 
-RUN mkdir -p "/app/tmp/" && chown ruby:ruby "/app/tmp/"
+RUN mkdir -p "/app/tmp/" && chown ruby:ruby "/app/tmp/" && chown ruby:ruby "/app/db/"
 VOLUME "/tmp/"
 VOLUME "/app/tmp/"
+VOLUME "/app/db/"
 
 EXPOSE 3000