Think about switching some containers to readonlyrootfs

[szaimen]

in order to improve the security

• needs allow to specify read_only root FS in containers definition #2641
• needs allow to add tmpfs #2811

Important:
All locations where tmpfs are mounted need to have 777 applied beforehand (if running as non-root user). Otherwise it will not work.

Possible:

• Apache (yes? but Caddyfile would need to not get changed then by sed) make apache container read-only #2874
• borgbackup (yes, needs testing) FileNotFoundError: [Errno 2] No usable temporary directory found in ['/tmp', '/var/tmp', '/usr/tmp', '/'] Make borgbackup read-only #2812
• clamav (yes, needs testing) (problem: ln: /var/lock/lock: Read-only file system) make clamav read-only #2813
• collabora (probably no as they copy some stuff internally, but they copy to /opt/coll/child-roots so could be investigated) (make collabora container read-only #2872) Not possible without huge effort. Reverted with Revert "make collabora container read-only" #2952
• domaincheck (yes? /var/www/domaincheck/index.html would need to be static then, /etc/lighttpd/lighttpd.conf as well) make domaincheck container read-only #2870
• fulltextsearch (make FTS read-only #3048) Not possible without huge effort. Reverted with Revert "make FTS read-only" #3117
• imaginary make imaginary read-only #2783
• mastercontainer (no it e.g. needs to add wwe-data to some group on startup or investigate if it is as swcure to just always put www-data into root group, would need to add it to docker run command then and remove it from develop command, also check if it could run as www-data user thdn athen and other stuff) (will be done in Think about making mastercontainer read-only #3137)
• nextcloud (no as we would not be abke to add dependencies anymore)
• onlyoffice (no)
• postgresql (yes? need to not change the postgresql conf then, needs testing) (/var/run/postgresql/.s.PGSQL.5432.lock": Read-only file system) make postgresql container read-only #2871
• notify-push: put notify-push into its own container #2703
• redis (yes, needs testing) redis - enable readonlyrootfs #2642
• talkk (yes, would need to change completely to write into writeable dir or to use envs then but could be investigated) make talk container read-only #2875
• talk-recording? (yes, but the conf that we adjust should be put into /tmp then) make talk-recording read-only #2876
• watchtower (yes, needs testing) make watchtower read-only #2706

[szaimen]

Redis is now read-only which is released with v6.1.0 Beta. Testing and feedback is welcome! See https://github.com/nextcloud/all-in-one#how-to-switch-the-channel

[szaimen]

Borg, imaginary, watchtower and clamav are now also read-only which is released with v6.2.0 Beta. Testing and feedback is welcome! See https://github.com/nextcloud/all-in-one#how-to-switch-the-channel

[szaimen]

Apache, domaincheck, postgresql, talk and talk-recording are now also read-only which is released with v6.3.0 Beta. Testing and feedback is welcome! See https://github.com/nextcloud/all-in-one#how-to-switch-the-channel

[sriccio]

Hmm, by curiositry, what's the goal for the containers to be read only ? What are the advantages for this ?

[szaimen]

See e.g. https://www.techtarget.com/searchitoperations/answer/Is-read-only-mode-a-viable-approach-to-container-hardening#:~:text=Setting%20containers%20as%20read%2Donly,anyone%20else%20from%20doing%20so.

[sriccio]

Hello @szaimen,

Oh, thanks for the link. Sounds great indeed.

Kind regards

[szaimen]

Mastercontainer will be done in #3137