CODEWITHSUNDEEP
kubernetesfilesystemssecurity-context
jrz
jrz

Reputation: 1397

readOnlyRootFilesystem prevents my code from writing logs

I added in my deployment readOnlyRootFilesystem: true but running my code ends with the following error:

OSError: [Errno30] Read-only file system: '/project/logs/dbt.log'

But /project/logs/dbt.log is NOT a root path.

Any idea why does it happen?

here's a more elaborated manifest I'm using:

spec:
  containers:
    .
    .
    .
    .     
    securityContext:
      capabilities:
        drop:
        - ALL
      privileged: false
      readOnlyRootFilesystem: true
      runAsNonRoot: true
    .
    .
    .
    .      
  securityContext:
    fsGroup: 2000
    runAsNonRoot: true
    runAsUser: 101

Upvotes: 1

Views: 7744

Answers (1)

gohm'c
gohm'c

Reputation: 15530

You can mount a temporary volume (same lifespan as your pod) to avoid writing to root:

spec:
  volumes:
  - name: logs
    emptyDir: {}

  containers:
  .
  .
    securityContext:
      capabilities:
        drop:
        - ALL
      privileged: false
      readOnlyRootFilesystem: true
      runAsNonRoot: true
    volumeMounts:
    - name: logs
      mountPath: /project/logs

Upvotes: 1

Related Questions