stacklok / toolhive / 43416334940

73%

Build Type

push

github

Committed by web-flow

Commit Message

Add opt-in read-only rootfs for Docker workloads (#7128)

* Add opt-in read-only rootfs for Docker workloads

Standalone workloads always ran with a writable root filesystem,
while the operator already sets readOnlyRootFilesystem on Kubernetes.
Add a RunConfig field, a thv run --read-only-rootfs flag and an API
field that set HostConfig.ReadonlyRootfs on the MCP container. The
setting is part of compareHostConfig so toggling it recreates the
container. Off by default to avoid breaking servers that write to
their root filesystem.

Fixes #6729

* Give read-only rootfs capped scratch tmpfs

Podman's compat API adds its own executable, uncapped tmpfs on /tmp,
/var/tmp and /run whenever ReadonlyRootfs is set, while Docker adds
none, so the same flag behaved differently per runtime. Set those
tmpfs mounts explicitly with rw,nosuid,nodev,noexec,size=64m and skip
any path a volume already targets, since Docker rejects duplicate
mount points.

Also cover the field in the API threading and round-trip tests, the
upgrade preservation test and runtime.Setup.

* Regenerate API docs for read-only rootfs comment

Coverage Stats

38 of 38 new or added lines in 8 files covered. (100.0%)

5 existing lines in 3 files now uncovered.

95720 of 130627 relevant lines covered (73.28%)

888.09 hits per line