Enhancement: allow kubeinvaders to run with read-only FS

Given the following deployment.yaml:

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/instance: kubeinvaders
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubeinvaders
    argocd.argoproj.io/instance: kubeinvaders
    helm.sh/chart: kubeinvaders-1.9.2
  name: kubeinvaders
  namespace: kubeinvaders
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: kubeinvaders
      app.kubernetes.io/name: kubeinvaders
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: kubeinvaders
        app.kubernetes.io/name: kubeinvaders
    spec:
      containers:
        - env:
            - name: ENDPOINT
              value: space.alleaffengaffen.ch
            - name: NAMESPACE
              value: default
            - name: ALIENPROXIMITY
              value: '10'
            - name: HITSLIMIT
              value: '1'
            - name: UPDATETIME
              value: '0.5'
          image: 'luckysideburn/kubeinvaders:v1.9'
          name: kubeinvaders
          ports:
            - containerPort: 8080
              name: http
              protocol: TCP
          volumeMounts:
            - mountPath: /usr/local/openresty
              name: openresty
      securityContext:
        fsGroup: 999
        runAsGroup: 999
        runAsUser: 999
      serviceAccount: kubeinvaders
      serviceAccountName: kubeinvaders
      terminationGracePeriodSeconds: 30
      volumes:
        - emptyDir: {}
          name: openresty

I still get the following error log:

sed: couldn't open temporary file /var/www/html/sedJAIsTK: Read-only file system
2022/09/19 14:44:03 [emerg] 11#11: unknown directive "access_by_lua_file" in /etc/nginx/conf.d/KubeInvaders.conf:21
nginx: [emerg] unknown directive "access_by_lua_file" in /etc/nginx/conf.d/KubeInvaders.conf:21

*** FATAL CONFIG FILE ERROR ***
Reading the configuration file, at line 13
>>> 'logfile stdou'
Can't open the log file: Read-only file system

Given that the Dockerfile shows /var/www/html contains files from the repo/app which prevents my from mounting emptyDir in /var/www/html and the file that he want’s to write there is randomly generated, I guess kubeinvaders cannot be run when the container is run with a read-only FS.

So that would be an enhancement 😉

[lucky-sideburn]

Thanks @the-technat!

I added new feature for programming mode… The purpose is use Yaml for do a kind of “Chaos Engineering Programming”… Please let me know what do you think!

Thanks Eug

[the-technat]

I tried it, there are still some issues with read-only FS and non-root. I guess the app is just not made to be run with read-only FS.

I’m closing this as it seems not easily achievable and not really necessary unless someone else has the same “problem”.