Description
Some customers run containers with readOnlyRootFilesystem.
Our Intel/Collab images write to:
- /run/volatile/** (runtime, plugins, caches, app logs like log-codetogether/server.log)
- /run/nginx.pid
- /var/log/nginx, /var/cache/nginx
Current Helm charts (intel & collab) don’t template the necessary RW mounts when rootfs is RO, leading to errors such as:
- cp/tee: Permission denied writing under /run/volatile/**
- nginx: open() "/run/nginx.pid" failed (30: Read-only file system)
- nginx: could not open error log file /var/log/nginx/error.log
We need a chart-level solution so users can enable RO mode with a single values switch.
Scope / Affected
- codetogether-intel Helm chart
- codetogether-collab Helm chart
No change in default behavior. Feature is opt-in.
Proposed Solution
Add a readOnlyMode block in values.yaml that, when enabled, wires the required mounts and security context. Keep defaults compatible.
Description
Some customers run containers with readOnlyRootFilesystem.
Our Intel/Collab images write to:
Current Helm charts (intel & collab) don’t template the necessary RW mounts when rootfs is RO, leading to errors such as:
We need a chart-level solution so users can enable RO mode with a single values switch.
Scope / Affected
No change in default behavior. Feature is opt-in.
Proposed Solution
Add a readOnlyMode block in values.yaml that, when enabled, wires the required mounts and security context. Keep defaults compatible.