[GH-ISSUE #384] Support read-only `/app` filesystem #145

New issue

Closed

opened 2026-02-27 08:15:31 +03:00 by kerem · 3 comments

kerem commented

2026-02-27 08:15:31 +03:00

Owner

Originally created by @RedlineTriad on GitHub (Nov 27, 2022).
Original GitHub issue: https://github.com/lldap/lldap/issues/384

I am unsure if this is feasible, but it would be nice to support read-only filesystems.
Currently, when starting lldap with a read-only filesystem, it will get to Setup permissions.. and then print a lot of chown errors:

[entrypoint] Copying the default config to /data/lldap_config.toml
[entrypoint] Edit this file to configure LLDAP.
> Setup permissions..
chown: /app: Read-only file system
chown: /app/app: Read-only file system
chown: /app/app/index.html: Read-only file system
...

The issue can be reproduced with the following docker-compose.yml file:

---
version: '3'

services:
  lldap:
    image: nitnelave/lldap:v0.4.1-alpine
    read_only: true
    ports:
      - 17170:17170
    volumes:
      - lldap-data:/data

volumes:
  lldap-data:

Read only filesystems are very useful for security, reducing data loss when forgetting to mount data directories, and to reduce disk usage.
It would probably also be nice if it was the default in docker-compose examples.

Originally created by @RedlineTriad on GitHub (Nov 27, 2022). Original GitHub issue: https://github.com/lldap/lldap/issues/384 I am unsure if this is feasible, but it would be nice to support read-only filesystems. Currently, when starting lldap with a read-only filesystem, it will get to `Setup permissions..` and then print a lot of `chown` errors: ```log [entrypoint] Copying the default config to /data/lldap_config.toml [entrypoint] Edit this file to configure LLDAP. > Setup permissions.. chown: /app: Read-only file system chown: /app/app: Read-only file system chown: /app/app/index.html: Read-only file system ... ``` The issue can be reproduced with the following `docker-compose.yml` file: ```yaml --- version: '3' services: lldap: image: nitnelave/lldap:v0.4.1-alpine read_only: true ports: - 17170:17170 volumes: - lldap-data:/data volumes: lldap-data: ``` Read only filesystems are very useful for security, reducing data loss when forgetting to mount data directories, and to reduce disk usage. It would probably also be nice if it was the default in docker-compose examples.

kerem

2026-02-27 08:15:31 +03:00

closed this issue
added the
question

docker
labels

kerem commented

2026-02-27 08:15:32 +03:00

Author

Owner

@nitnelave commented on GitHub (Nov 27, 2022):

Right now, the main problem with a read-only /app folder is that the SQlite DB is in that folder... So we need to write to it.

If you want to set up a read-only folder for the config and the static assets, you can do that by:

Overriding the entrypoint to just start lldap run (potentially with a couple of options)
Moving the DB to a different folder (that will be read-write) and changing the config to point to that folder.

I think with those 2 things, it should be enough. The entrypoint just sets up things by default for new users, for easier set up.

@nitnelave commented on GitHub (Nov 27, 2022): Right now, the main problem with a read-only `/app` folder is that the SQlite DB is in that folder... So we need to write to it. If you want to set up a read-only folder for the config and the static assets, you can do that by: - Overriding the entrypoint to just start `lldap run` (potentially with a couple of options) - Moving the DB to a different folder (that will be read-write) and changing the config to point to that folder. I think with those 2 things, it should be enough. The entrypoint just sets up things by default for new users, for easier set up.

kerem commented

2026-02-27 08:15:32 +03:00

Author

Owner

@RedlineTriad commented on GitHub (Nov 27, 2022):

I don't think that is correct?
The SQlite DB is stored in /data not /app, since I mount that, it is not an issue.

/data # ls -l
total 156
-rw-r--r--    1 lldap    lldap         5146 Nov 27 18:45 lldap_config.toml
-r--------    1 lldap    lldap          128 Nov 27 18:45 private_key
-rw-r--r--    1 lldap    lldap         4096 Nov 27 18:45 users.db
-rw-r--r--    1 lldap    lldap        32768 Nov 27 18:45 users.db-shm
-rw-r--r--    1 lldap    lldap       103032 Nov 27 18:45 users.db-wal

/app # ls -l
total 39236
drwxr-xr-x    1 lldap    lldap         4096 Oct 10 16:00 app
-rwxr-xr-x    1 lldap    lldap     26407896 Oct 10 16:00 lldap
-rw-r--r--    1 lldap    lldap         5146 Oct 10 16:00 lldap_config.docker_template.toml
-rwxr-xr-x    1 lldap    lldap     13746856 Oct 10 16:00 migration-tool

@RedlineTriad commented on GitHub (Nov 27, 2022): I don't think that is correct? The SQlite DB is stored in `/data` not `/app`, since I mount that, it is not an issue. ``` /data # ls -l total 156 -rw-r--r-- 1 lldap lldap 5146 Nov 27 18:45 lldap_config.toml -r-------- 1 lldap lldap 128 Nov 27 18:45 private_key -rw-r--r-- 1 lldap lldap 4096 Nov 27 18:45 users.db -rw-r--r-- 1 lldap lldap 32768 Nov 27 18:45 users.db-shm -rw-r--r-- 1 lldap lldap 103032 Nov 27 18:45 users.db-wal ``` ``` /app # ls -l total 39236 drwxr-xr-x 1 lldap lldap 4096 Oct 10 16:00 app -rwxr-xr-x 1 lldap lldap 26407896 Oct 10 16:00 lldap -rw-r--r-- 1 lldap lldap 5146 Oct 10 16:00 lldap_config.docker_template.toml -rwxr-xr-x 1 lldap lldap 13746856 Oct 10 16:00 migration-tool ```

kerem commented

2026-02-27 08:15:32 +03:00

Author

Owner

@nitnelave commented on GitHub (Nov 27, 2022):

Oh, right. Then you just need to override the entrypoint when you start the
container, you don't need the script at all.

On Sun, 27 Nov 2022, 19:48 RedlineTriad, @.***> wrote:

I don't think that is correct?
The SQlite DB is stored in /data not /app, since I mount that, it is not
an issue.

/data # ls -l
total 156
-rw-r--r-- 1 lldap lldap 5146 Nov 27 18:45 lldap_config.toml
-r-------- 1 lldap lldap 128 Nov 27 18:45 private_key
-rw-r--r-- 1 lldap lldap 4096 Nov 27 18:45 users.db
-rw-r--r-- 1 lldap lldap 32768 Nov 27 18:45 users.db-shm
-rw-r--r-- 1 lldap lldap 103032 Nov 27 18:45 users.db-wal

/app # ls -l
total 39236
drwxr-xr-x 1 lldap lldap 4096 Oct 10 16:00 app
-rwxr-xr-x 1 lldap lldap 26407896 Oct 10 16:00 lldap
-rw-r--r-- 1 lldap lldap 5146 Oct 10 16:00 lldap_config.docker_template.toml
-rwxr-xr-x 1 lldap lldap 13746856 Oct 10 16:00 migration-tool

—
Reply to this email directly, view it on GitHub
https://github.com/nitnelave/lldap/issues/384#issuecomment-1328315457,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAGCPWNRAROOJKMFFH5F5O3WKOUHVANCNFSM6AAAAAASMUMLUE
.
You are receiving this because you commented.Message ID:
@.***>

@nitnelave commented on GitHub (Nov 27, 2022): Oh, right. Then you just need to override the entrypoint when you start the container, you don't need the script at all. On Sun, 27 Nov 2022, 19:48 RedlineTriad, ***@***.***> wrote: > I don't think that is correct? > The SQlite DB is stored in /data not /app, since I mount that, it is not > an issue. > > /data # ls -l > total 156 > -rw-r--r-- 1 lldap lldap 5146 Nov 27 18:45 lldap_config.toml > -r-------- 1 lldap lldap 128 Nov 27 18:45 private_key > -rw-r--r-- 1 lldap lldap 4096 Nov 27 18:45 users.db > -rw-r--r-- 1 lldap lldap 32768 Nov 27 18:45 users.db-shm > -rw-r--r-- 1 lldap lldap 103032 Nov 27 18:45 users.db-wal > > /app # ls -l > total 39236 > drwxr-xr-x 1 lldap lldap 4096 Oct 10 16:00 app > -rwxr-xr-x 1 lldap lldap 26407896 Oct 10 16:00 lldap > -rw-r--r-- 1 lldap lldap 5146 Oct 10 16:00 lldap_config.docker_template.toml > -rwxr-xr-x 1 lldap lldap 13746856 Oct 10 16:00 migration-tool > > — > Reply to this email directly, view it on GitHub > <https://github.com/nitnelave/lldap/issues/384#issuecomment-1328315457>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AAGCPWNRAROOJKMFFH5F5O3WKOUHVANCNFSM6AAAAAASMUMLUE> > . > You are receiving this because you commented.Message ID: > ***@***.***> >

kerem referenced this issue

2026-02-27 08:18:01 +03:00

[PR #145] [MERGED] app: add bottom padding to avoid overlap with the footer #569