Make containers readonlyrootFileSystem=true compatible (#3961)

Author: sir-sigurd

catalog/Dockerfile

@@ -16,18 +16,22 @@ RUN ln -sf /dev/stdout /var/log/nginx/access.log && \
 COPY nginx.conf /etc/nginx/nginx.conf
 COPY nginx-web.conf /etc/nginx/conf.d/default.conf
 
+ARG NGINX_STATIC_DIR=/usr/share/nginx/html
 # Copy pre-built catalog assets to nginx
-RUN rm -rf /usr/share/nginx/html
-COPY build /usr/share/nginx/html
+RUN rm -rf $NGINX_STATIC_DIR
+COPY build $NGINX_STATIC_DIR
 
 # Copy config file
 COPY config.json.tmpl config.json.tmpl
 
+RUN ln -s /tmp/config.json $NGINX_STATIC_DIR/config.json && \
+    ln -s /tmp/config.js $NGINX_STATIC_DIR/config.js
+
 # Use SIGQUIT for a "graceful" shutdown
 STOPSIGNAL SIGQUIT
 
 # Substitute environment variables into config.json and generate config.js based on that before starting nginx.
 # Note: use "exec" because otherwise the shell will catch Ctrl-C and other signals.
-CMD envsubst < config.json.tmpl > /usr/share/nginx/html/config.json \
-    && echo "window.QUILT_CATALOG_CONFIG = `cat /usr/share/nginx/html/config.json`" > /usr/share/nginx/html/config.js \
+CMD envsubst < config.json.tmpl > /tmp/config.json \
+    && echo "window.QUILT_CATALOG_CONFIG = `cat /tmp/config.json`" > /tmp/config.js \
     && exec nginx -g 'daemon off;'

s3-proxy/Dockerfile

@@ -34,11 +34,11 @@ RUN set -x \
         --error-log-path=/dev/stdout \
         --pid-path=/var/run/nginx.pid \
         --lock-path=/var/run/nginx.lock \
-        --http-client-body-temp-path=/var/cache/nginx/client_temp \
-        --http-proxy-temp-path=/var/cache/nginx/proxy_temp \
-        --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \
-        --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \
-        --http-scgi-temp-path=/var/cache/nginx/scgi_temp \
+        --http-client-body-temp-path=/var/lib/nginx/tmp/client_temp \
+        --http-proxy-temp-path=/var/lib/nginx/tmp/proxy_temp \
+        --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi_temp \
+        --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi_temp \
+        --http-scgi-temp-path=/var/lib/nginx/tmp/scgi_temp \
         --user=nginx \
         --group=nginx \
         --with-compat \
@@ -77,9 +77,10 @@ RUN set -x \
 RUN set -x \
     && useradd --system --user-group --no-create-home --home /nonexistent --shell /sbin/nologin nginx
 
-RUN mkdir /var/cache/nginx/
+RUN mkdir -p /var/lib/nginx/tmp/
 COPY nginx.conf /root/nginx.conf.tmpl
 COPY run-nginx.sh /root/run-nginx.sh
+RUN ln -sf /tmp/nginx.conf /etc/nginx/nginx.conf
 
 # Use SIGQUIT for a "graceful" shutdown
 STOPSIGNAL SIGQUIT

s3-proxy/run-nginx.sh

@@ -20,6 +20,6 @@ fi
 
 export NAMESERVER=$nameserver
 
-envsubst '$INTERNAL_REGISTRY_URL $NAMESERVER' < /root/nginx.conf.tmpl > /etc/nginx/nginx.conf
+envsubst '$INTERNAL_REGISTRY_URL $NAMESERVER' < /root/nginx.conf.tmpl > /tmp/nginx.conf
 
 exec nginx -g 'daemon off;'