Skip to content

Commit 0c9ff52

Browse files
mms-giannimms-gianni
committed
make app storage writable
1 parent f3ecdab commit 0c9ff52

File tree

4 files changed

+146
-27
lines changed

4 files changed

+146
-27
lines changed

‎client/src/components/apps/new.vue‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -350,6 +350,24 @@
350350
color="primary"
351351
></v-switch>
352352
</v-col>
353+
<v-col
354+
cols="12"
355+
md="6"
356+
>
357+
</v-col>
358+
</v-row>
359+
360+
<v-row>
361+
<v-col
362+
cols="12"
363+
md="6"
364+
>
365+
<v-switch
366+
v-model="buildpack.run.readOnlyAppStorage"
367+
label="Read only app storage"
368+
color="primary"
369+
></v-switch>
370+
</v-col>
353371
<v-col
354372
cols="12"
355373
md="6"
@@ -1029,6 +1047,7 @@ export default {
10291047
},
10301048
image: {
10311049
run: {
1050+
readOnlyAppStorage: true,
10321051
command: '',
10331052
securityContext: {
10341053
readOnlyRootFilesystem: true,

‎config.yaml‎

Lines changed: 125 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ buildpacks:
3030
fetch:
3131
repository: ghcr.io/kubero-dev/buildpacks/fetch
3232
tag: v1.2
33+
readOnlyAppStorage: false
3334
securityContext:
3435
runAsUser: 0
3536
runAsGroup: 0
@@ -43,6 +44,7 @@ buildpacks:
4344
repository: node
4445
tag: latest
4546
command: "npm install"
47+
readOnlyAppStorage: false
4648
securityContext:
4749
runAsUser: 0
4850
runAsGroup: 0
@@ -56,6 +58,7 @@ buildpacks:
5658
repository: node
5759
tag: latest
5860
command: "node index.js"
61+
readOnlyAppStorage: true
5962
securityContext:
6063
runAsUser: 0
6164
runAsGroup: 0
@@ -70,93 +73,184 @@ buildpacks:
7073
fetch:
7174
repository: ghcr.io/kubero-dev/buildpacks/fetch
7275
tag: v1.2
76+
readOnlyAppStorage: false
77+
securityContext:
78+
runAsUser: 0
79+
runAsGroup: 0
80+
runAsNonRoot: false
81+
readOnlyRootFilesystem: false
82+
allowPrivilegeEscalation: false
83+
capabilities:
84+
add: []
85+
drop: []
7386
build:
7487
repository: composer
7588
tag: latest
7689
command: "composer install; chown -R 1000:1000 /app"
90+
readOnlyAppStorage: false
91+
securityContext:
92+
runAsUser: 0
93+
runAsGroup: 0
94+
runAsNonRoot: false
95+
readOnlyRootFilesystem: false
96+
allowPrivilegeEscalation: false
97+
capabilities:
98+
add: []
99+
drop: []
77100
run:
78101
repository: ghcr.io/kubero-dev/buildpacks/php
79102
tag: "main"
103+
command: "apache2-foreground"
104+
readOnlyAppStorage: false
80105
securityContext:
106+
runAsUser: 0
107+
runAsGroup: 0
108+
runAsNonRoot: false
81109
allowPrivilegeEscalation: true
82110
readOnlyRootFilesystem: false
83-
command: "apache2-foreground"
111+
capabilities:
112+
add: []
113+
drop: []
84114
- name: Python
85115
language: Python
86116
fetch:
87117
repository: ghcr.io/kubero-dev/buildpacks/fetch
88118
tag: v1.2
119+
readOnlyAppStorage: false
120+
securityContext:
121+
runAsUser: 0
122+
runAsGroup: 0
123+
runAsNonRoot: false
124+
readOnlyRootFilesystem: false
125+
allowPrivilegeEscalation: false
126+
capabilities:
127+
add: []
128+
drop: []
89129
build:
90130
repository: python
91131
tag: 3.10-buster
92132
command: "python3 -m venv .venv && . .venv/bin/activate && pip install -r requirements.txt"
133+
readOnlyAppStorage: false
134+
securityContext:
135+
runAsUser: 0
136+
runAsGroup: 0
137+
runAsNonRoot: false
138+
readOnlyRootFilesystem: false
139+
allowPrivilegeEscalation: false
140+
capabilities:
141+
add: []
142+
drop: []
93143
run:
94144
repository: python
95145
tag: 3.10-buster
96146
command: ". .venv/bin/activate && python3 main.py"
147+
readOnlyAppStorage: true
148+
securityContext:
149+
runAsUser: 0
150+
runAsGroup: 0
151+
runAsNonRoot: false
152+
readOnlyRootFilesystem: false
153+
allowPrivilegeEscalation: false
154+
capabilities:
155+
add: []
156+
drop: []
97157
- name: GoLang
98158
language: GoLang
99159
fetch:
100160
repository: ghcr.io/kubero-dev/buildpacks/fetch
101161
tag: v1.2
162+
readOnlyAppStorage: false
163+
securityContext:
164+
runAsUser: 0
165+
runAsGroup: 0
166+
runAsNonRoot: false
167+
readOnlyRootFilesystem: false
168+
allowPrivilegeEscalation: false
169+
capabilities:
170+
add: []
171+
drop: []
102172
build:
103173
repository: golang
104174
tag: alpine
105175
command: "go mod download && go mod verify && go build -v -o app"
176+
readOnlyAppStorage: false
177+
securityContext:
178+
runAsUser: 0
179+
runAsGroup: 0
180+
runAsNonRoot: false
181+
readOnlyRootFilesystem: true
182+
allowPrivilegeEscalation: false
183+
capabilities:
184+
add: []
185+
drop: []
106186
run:
107187
repository: golang
108188
tag: alpine
109189
command: "./app"
190+
readOnlyAppStorage: true
191+
securityContext:
192+
runAsUser: 0
193+
runAsGroup: 0
194+
runAsNonRoot: false
195+
readOnlyRootFilesystem: true
196+
allowPrivilegeEscalation: false
197+
capabilities:
198+
add: []
199+
drop: []
110200
- name: Hugo
111201
language: GoLang
112202
fetch:
113203
repository: ghcr.io/kubero-dev/buildpacks/fetch
114204
tag: v1.2
205+
readOnlyAppStorage: false
115206
securityContext:
116-
runAsUser: 0
117-
runAsGroup: 0
118-
runAsNonRoot: false
119-
readOnlyRootFilesystem: false
120-
allowPrivilegeEscalation: false
121-
capabilities:
122-
add: []
123-
drop: []
207+
runAsUser: 0
208+
runAsGroup: 0
209+
runAsNonRoot: false
210+
readOnlyRootFilesystem: true
211+
allowPrivilegeEscalation: false
212+
capabilities:
213+
add: []
214+
drop: []
124215
build:
125216
repository: klakegg/hugo
126217
tag: latest
127218
command: hugo -D
219+
readOnlyAppStorage: false
128220
securityContext:
129-
runAsUser: 0
130-
runAsGroup: 0
131-
runAsNonRoot: false
132-
readOnlyRootFilesystem: false
133-
allowPrivilegeEscalation: false
134-
capabilities:
135-
add: []
136-
drop: []
221+
runAsUser: 0
222+
runAsGroup: 0
223+
runAsNonRoot: false
224+
readOnlyRootFilesystem: true
225+
allowPrivilegeEscalation: false
226+
capabilities:
227+
add: []
228+
drop: []
137229
run:
138230
repository: caddy
139231
tag: latest
140232
command: caddy file-server --listen :8080 --root /app/public
233+
readOnlyAppStorage: true
141234
securityContext:
142-
runAsUser: 0
143-
runAsGroup: 0
144-
runAsNonRoot: false
145-
readOnlyRootFilesystem: false
146-
allowPrivilegeEscalation: false
147-
capabilities:
148-
add: []
149-
drop: []
235+
runAsUser: 0
236+
runAsGroup: 0
237+
runAsNonRoot: false
238+
readOnlyRootFilesystem: true
239+
allowPrivilegeEscalation: false
240+
capabilities:
241+
add: []
242+
drop: []
150243
- name: Ruby
151244
language: Ruby
152245
fetch:
153246
repository: ghcr.io/kubero-dev/buildpacks/fetch
154247
tag: v1.2
248+
readOnlyAppStorage: false
155249
securityContext:
156250
runAsUser: 0
157251
runAsGroup: 0
158252
runAsNonRoot: false
159-
readOnlyRootFilesystem: false
253+
readOnlyRootFilesystem: true
160254
allowPrivilegeEscalation: false
161255
capabilities:
162256
add: []
@@ -165,6 +259,7 @@ buildpacks:
165259
repository: ruby
166260
tag: "2.7"
167261
command: "export GEM_HOME=/app/bundle; bundle install --jobs=4 --retry=3"
262+
readOnlyAppStorage: false
168263
securityContext:
169264
runAsUser: 0
170265
runAsGroup: 0
@@ -178,6 +273,7 @@ buildpacks:
178273
repository: ruby
179274
tag: "2.7"
180275
command: "export GEM_HOME=/app/bundle; bundle exec ruby main.rb"
276+
readOnlyAppStorage: true
181277
securityContext:
182278
runAsUser: 0
183279
runAsGroup: 0
@@ -192,6 +288,7 @@ buildpacks:
192288
fetch:
193289
repository: ghcr.io/kubero-dev/buildpacks/fetch
194290
tag: v1.2
291+
readOnlyAppStorage: false
195292
securityContext:
196293
runAsUser: 0
197294
runAsGroup: 0
@@ -205,6 +302,7 @@ buildpacks:
205302
repository: busybox
206303
tag: latest
207304
command: "echo 'Buildpack not required'"
305+
readOnlyAppStorage: false
208306
securityContext:
209307
runAsUser: 0
210308
runAsGroup: 0
@@ -218,6 +316,7 @@ buildpacks:
218316
repository: caddy
219317
tag: latest
220318
command: caddy file-server --listen :8080 --root /app
319+
readOnlyAppStorage: true
221320
securityContext:
222321
runAsUser: 0
223322
runAsGroup: 0

‎src/modules/application.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ export class App implements IApp{
8484
run: {
8585
repository: string,
8686
tag: string,
87-
readOnly?: boolean,
87+
readOnlyAppStorage?: boolean,
8888
securityContext: ISecurityContext
8989
}
9090
};

‎src/types.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ export interface IApp {
3232
}
3333
run: {
3434
repository: string,
35+
readOnlyAppStorage?: boolean,
3536
tag: string,
3637
readOnly?: boolean,
3738
securityContext: ISecurityContext

0 commit comments

Comments
 (0)