fix(docker): generate gunicorn logging config to writable /tmp path

[gantoine]

Summary

• The init script runs sed -i against /etc/gunicorn/logging.conf to wire LOGLEVEL into Gunicorn's logging config. This fails in two common Kubernetes deployment modes:
  • securityContext.readOnlyRootFilesystem: true — /etc is read-only.
  • Non-root UID — /etc/gunicorn is not made writable in the Dockerfile (unlike /etc/nginx/conf.d), so sed errors with can't create temp file '/etc/gunicorn/logging.confXXXXXX': Permission denied.
• Fix: at startup, copy /etc/gunicorn/logging.conf to /tmp/gunicorn/logging.conf, run sed on the copy, and pass that copy to gunicorn --log-config. The image file under /etc is no longer mutated. /tmp is writable in all deployment modes, so this resolves both cases without Dockerfile changes.

Fixes the issue reported where RomM cannot start under readOnlyRootFilesystem: true or as a non-root UID in Kubernetes.

Test plan

• Container starts normally with default config (root UID, writable rootfs).
• Container starts with securityContext.readOnlyRootFilesystem: true.
• Container starts when running as a non-root UID without /etc/gunicorn being writable.
• LOGLEVEL=DEBUG is correctly reflected in the generated /tmp/gunicorn/logging.conf and in Gunicorn's output.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates the container init script to avoid mutating Gunicorn’s logging config under /etc at runtime, enabling startup in environments where /etc is read-only or not writable (e.g., non-root Kubernetes deployments).

Changes:

• Copy /etc/gunicorn/logging.conf to /tmp/gunicorn/logging.conf on startup and apply the LOGLEVEL substitution to the copied file.
• Point Gunicorn’s --log-config to the generated runtime config under /tmp.
• Minor comment cleanup/clarification in the init script.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.