Skip to content

Review apps: make apps' root filesystems readonly #1439

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AP-Hunt merged 3 commits into from
May 28, 2025
Merged

Review apps: make apps' root filesystems readonly #1439

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4cea806
Review apps: make apps' root filesystems readonly
AP-Hunt May 27, 2025
7d943ce
Review apps: seed forms-runner using 3 separate Rake tasks instead of…
AP-Hunt May 27, 2025
0bff082
Make "db/" into a volume inside the Docker container
AP-Hunt May 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
66 changes: 36 additions & 30 deletions .review_apps/ecs_task_definition.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,11 +80,12 @@ resource "aws_ecs_task_definition" "task" {

# forms-runner
{
name = "forms-runner"
image = var.forms_runner_container_image
command = []
essential = true
environment = local.forms_runner_env_vars
name = "forms-runner"
image = var.forms_runner_container_image
command = []
essential = true
environment = local.forms_runner_env_vars
readonlyRootFilesystem = true

dockerLabels = {
"traefik.http.middlewares.forms-runner-pr-${var.pull_request_number}.basicauth.users" : data.terraform_remote_state.review.outputs.traefik_basic_auth_credentials
Expand Down Expand Up @@ -140,11 +141,12 @@ resource "aws_ecs_task_definition" "task" {

# forms-api
{
name = "forms-api"
image = "711966560482.dkr.ecr.eu-west-2.amazonaws.com/forms-api-deploy:latest"
command = []
essential = true
environment = local.forms_api_env_vars
name = "forms-api"
image = "711966560482.dkr.ecr.eu-west-2.amazonaws.com/forms-api-deploy:latest"
command = []
essential = true
environment = local.forms_api_env_vars
readonlyRootFilesystem = true

portMappings = [{ containerPort = 9292 }]

Expand Down Expand Up @@ -178,11 +180,12 @@ resource "aws_ecs_task_definition" "task" {

# forms-admin
{
name = "forms-admin"
image = "711966560482.dkr.ecr.eu-west-2.amazonaws.com/forms-admin-deploy:latest"
command = []
essential = true
environment = local.forms_admin_env_vars
name = "forms-admin"
image = "711966560482.dkr.ecr.eu-west-2.amazonaws.com/forms-admin-deploy:latest"
command = []
essential = true
environment = local.forms_admin_env_vars
readonlyRootFilesystem = true

dockerLabels = {
"traefik.http.middlewares.forms-runner-pr-${var.pull_request_number}-admin-app.basicauth.users" : data.terraform_remote_state.review.outputs.traefik_basic_auth_credentials
Expand Down Expand Up @@ -289,11 +292,12 @@ resource "aws_ecs_task_definition" "task" {

# forms-runner-seeding
{
name = "forms-runner-seeding"
image = var.forms_runner_container_image
command = ["rake", "db:setup"]
essential = false
environment = local.forms_runner_env_vars
name = "forms-runner-seeding"
image = var.forms_runner_container_image
command = ["rake", "db:create", "db:migrate", "db:seed"]
essential = false
environment = local.forms_runner_env_vars
readonlyRootFilesystem = true

logConfiguration = {
logDriver = "awslogs"
Expand All @@ -314,11 +318,12 @@ resource "aws_ecs_task_definition" "task" {

# forms-api-seeding
{
name = "forms-api-seeding"
image = "711966560482.dkr.ecr.eu-west-2.amazonaws.com/forms-api-deploy:latest"
command = ["rake", "db:setup"]
essential = false
environment = local.forms_api_env_vars
name = "forms-api-seeding"
image = "711966560482.dkr.ecr.eu-west-2.amazonaws.com/forms-api-deploy:latest"
command = ["rake", "db:setup"]
essential = false
environment = local.forms_api_env_vars
readonlyRootFilesystem = true

logConfiguration = {
logDriver = "awslogs"
Expand All @@ -339,11 +344,12 @@ resource "aws_ecs_task_definition" "task" {

# forms-admin-seeding
{
name = "forms-admin-seeding"
image = "711966560482.dkr.ecr.eu-west-2.amazonaws.com/forms-admin-deploy:latest"
command = ["rake", "db:setup"]
essential = false
environment = local.forms_admin_env_vars
name = "forms-admin-seeding"
image = "711966560482.dkr.ecr.eu-west-2.amazonaws.com/forms-admin-deploy:latest"
command = ["rake", "db:setup"]
essential = false
environment = local.forms_admin_env_vars
readonlyRootFilesystem = true

logConfiguration = {
logDriver = "awslogs"
Expand Down
3 changes: 2 additions & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,9 +72,10 @@ RUN chmod 0755 bin/*
COPY --chown=ruby:ruby --from=build /usr/local/bundle /usr/local/bundle
COPY --chown=ruby:ruby --from=build /app /app

RUN mkdir -p "/app/tmp/" && chown ruby:ruby "/app/tmp/"
RUN mkdir -p "/app/tmp/" && chown ruby:ruby "/app/tmp/" && chown ruby:ruby "/app/db/"
VOLUME "/tmp/"
VOLUME "/app/tmp/"
VOLUME "/app/db/"

EXPOSE 3000

Expand Down