Frontend fails because it tries to rewrite readonly ngnix default.conf

[officerNordberg]

Current Behavior

We customize our default.conf file for ssl termination and various other reasons. 4.9.1 should not attempt to rewrite the file. Our configuration is controlled by puppet and we don't want the container making changes.

Steps to Reproduce

1. docker-compose.yml contains

    volumes:
      - /opt/nginx/conf.d/:/etc/nginx/conf.d/

2. docker pull newest dtrack-frontend
3. docker-compose up
4. 502 Bad gateway to frontend

dtrack-frontend_1   | /docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
dtrack-frontend_1   | sed: can't create temp file '/etc/nginx/conf.d/default.confXXXXXX': Permission denied
opt_dtrack-frontend_1 exited with code 1

Expected Behavior

Don't try to rewrite our default.conf

Do not check whether the default configuration file has been changed vs
what is packaged with the distribution's installation. We customized the
file and want the changes the applied regardless.

No I don't, please restore this check or fail on the rewrite more gracefully
https://github.com/nginxinc/docker-nginx-unprivileged/blob/1.25.2/entrypoint/10-listen-on-ipv6-by-default.sh
was wise to allow users to control this.

Dependency-Track Frontend Version

4.9.1

Browser

Google Chrome

Browser Version

No response

Operating System

Linux

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[nscuro]

Our configuration is controlled by puppet and we don't want the container making changes.

An easy solution would be to make the file not writable by the user of the container (UID is 101 per default) in your Puppet manifest. We do a touch on the file now to determine whether or not we can write to it. Most likely you currently are giving "others" write permissions on it (e.g. 777 or 666, but should be 664 or so instead).

If you are using Docker volumes to mount the file, keep in mind you can specify the volume to be read-only as well. So in your case:

/opt/nginx/conf.d/:/etc/nginx/conf.d/:ro

[officerNordberg]

Nope, others don't have write. I can try those other solutions later. :ro did not resolve the issue either. I am unable to attempt the Puppet manifest suggestion without a devops team member so I'm still stuck for now.

[nscuro]

Hmmm, that's odd. I can reproduce this as follows (executing commands in this repository):

# Ensure the conf.d directory is accessible by others (including 101 in container)
# This will be the case for you because otherwise the container process wouldn't even see the default.conf file.
$ chmod 775 docker/etc/nginx/conf.d

# Ensure default.conf is writable by others (so touch succeeds and sed will be executed)
$ chmod 666 docker/etc/nginx/conf.d/default.conf

Mount conf.d into container, WITHOUT :ro

$ docker run -it --rm -v "./docker/etc/nginx/conf.d/:/etc/nginx/conf.d/" dependencytrack/frontend:4.9.1
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
sed: can't create temp file '/etc/nginx/conf.d/default.confXXXXXX': Permission denied

Mount conf.d into container, WITH :ro

$ docker run -it --rm -v "./docker/etc/nginx/conf.d/:/etc/nginx/conf.d/:ro" dependencytrack/frontend:4.9.1
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
10-listen-on-ipv6-by-default.sh: info: can not modify /etc/nginx/conf.d/default.conf (read-only file system?)
/docker-entrypoint.sh: Sourcing /docker-entrypoint.d/15-local-resolvers.envsh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-oidc-configuration.sh

Conversely, when changing permissions of default.conf to 664 and WITHOUT :ro in the volume mount, it works as expected as well:

chmod 664 docker/etc/nginx/conf.d/default.conf
$ docker run -it --rm -v "./docker/etc/nginx/conf.d/:/etc/nginx/conf.d/" dependencytrack/frontend:4.9.1   
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
10-listen-on-ipv6-by-default.sh: info: can not modify /etc/nginx/conf.d/default.conf (read-only file system?)