Read-only root filesystem on container

[kzagganas]

Hello, I hope you are well. I tried running a container with a quarkus app in a read-only root filesystem but I am getting an error since the app needs to write inside the container. Is there a way I could bypass that, by mounting a writable volume at some locations? If so, what are those locations?

Thank you in advance.

[maxandersen]

What error are you getting?

You can mount volumes using normal docker. Nothing quarkus special here.

[kzagganas]

The issue is that quarkus needs to write inside the docker container filesystem, thus, the container cannot be deployed with a read-only filesystem. Is there a specific list with locations where quarkus needs to write files inside the container available? If it exists and the directories just contain temporary files required for app deployment, then I could probably mount a write-enabled volume and the rest of the filesystem could remain in a read-only mode. Thanks.

[maxandersen]

the error should state the location it writes - my guess its in temporary storage only.

[maxandersen]

if you show the error/stacktrace it is easier to pinpoint for us.

[kzagganas]

It indeed seems to be in the /tmp folder:
ERROR: Failed to start application (with profile develop) java.nio.file.FileSystemException: /tmp/vertx-cache: Read-only file system at java.base/sun.nio.fs.UnixException.translateToIOException(UnixException.java:100) at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:106) at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111) at java.base/sun.nio.fs.UnixFileSystemProvider.createDirectory(UnixFileSystemProvider.java:397) at java.base/java.nio.file.Files.createDirectory(Files.java:700) at java.base/java.nio.file.Files.createAndCheckIsDirectory(Files.java:807) at java.base/java.nio.file.Files.createDirectories(Files.java:793) at io.vertx.core.file.impl.FileCache.setupCacheDir(FileCache.java:57) at io.vertx.core.file.impl.FileCache.setupCache(FileCache.java:30) at io.vertx.core.file.impl.FileResolverImpl.<init>(FileResolverImpl.java:66) at io.vertx.core.impl.VertxBuilder.initFileResolver(VertxBuilder.java:334) at io.vertx.core.impl.VertxBuilder.init(VertxBuilder.java:274) at io.quarkus.vertx.core.runtime.VertxCoreRecorder.initialize(VertxCoreRecorder.java:237) at io.quarkus.vertx.core.runtime.VertxCoreRecorder$VertxSupplier.get(VertxCoreRecorder.java:589) at io.quarkus.vertx.core.runtime.VertxCoreRecorder$VertxSupplier.get(VertxCoreRecorder.java:571) at io.quarkus.oidc.runtime.OidcRecorder.setup(OidcRecorder.java:52) at io.quarkus.deployment.steps.OidcBuildStep$setup635434700.deploy_0(Unknown Source) at io.quarkus.deployment.steps.OidcBuildStep$setup635434700.deploy(Unknown Source) at io.quarkus.runner.ApplicationImpl.doStart(Unknown Source) at io.quarkus.runtime.Application.start(Application.java:101) at io.quarkus.runtime.ApplicationLifecycleManager.run(ApplicationLifecycleManager.java:108) at io.quarkus.runtime.Quarkus.run(Quarkus.java:67) at io.quarkus.runtime.Quarkus.run(Quarkus.java:41) at io.quarkus.runtime.Quarkus.run(Quarkus.java:120) at io.quarkus.runner.GeneratedMain.main(Unknown Source) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:568) at io.quarkus.bootstrap.runner.QuarkusEntryPoint.doRun(QuarkusEntryPoint.java:60) at io.quarkus.bootstrap.runner.QuarkusEntryPoint.main(QuarkusEntryPoint.java:31)
I'll try to mount a volume and see if it makes a change.