Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[BUG] - Docker image incompatible with readOnlyRootFilesystem (Kubernetes security best practice)

Abierto
  • ¿Algo no está bien?
#6,470 4 comentarios 1 reacción 1 asignado Ver en GitHub

Los mantenedores suelen responder en 2 días

@dermetfan ya está trabajando en esto.

Desde el 5/6/2026.

  • #6599 de @dermetfan — fusionado

Evaluación

Este issue todavía no se ha evaluado.

Descripción

docker Stale

Internal/External
External

Area
Other - Docker image / Nix wrapper / run-node script

Summary
The cardano-node Docker image (10.6.2) is incompatible with readOnlyRootFilesystem: true in Kubernetes due to two separate issues:

  1. Scripts mode (NETWORK=mainnet): The Nix-generated wrapper hardcodes RTS option -tcardano-node.stats which tries to write to the current working directory
  2. Custom mode (run arg): The /usr/local/bin/run-node script writes to /usr/local/bin/env

Running with readOnlyRootFilesystem: true is a Kubernetes security best practice recommended by CIS benchmarks.

Steps to reproduce

Issue 1 - Scripts mode:

docker run --read-only -e NETWORK=mainnet ghcr.io/intersectmbo/cardano-node:10.6.2

Error: cardano-node: Can't open stats file cardano-node.stats

Issue 2 - Custom mode:

docker run --read-only ghcr.io/intersectmbo/cardano-node:10.6.2 run

Error: /usr/local/bin/run-node: line 93: /usr/local/bin/env: Read-only file system

Expected behavior
The node should start successfully with readOnlyRootFilesystem: true.

System info:

  • OS: Kubernetes (EKS) with containerd
  • Node version: cardano-node 10.6.2
  • Docker image: ghcr.io/intersectmbo/cardano-node:10.6.2

Logs - Issue 1 (Scripts mode)

Starting: exec /nix/store/.../cardano-node run
...
+RTS
--machine-readable
-tcardano-node.stats
...
-RTS

cardano-node: Can't open stats file cardano-node.stats

Logs - Issue 2 (Custom mode)

Running cardano node ...
CARDANO_BIND_ADDR=0.0.0.0
CARDANO_BLOCK_PRODUCER=false
CARDANO_CONFIG=/opt/cardano/config/mainnet/config.json
CARDANO_DATABASE_PATH=/data/db
CARDANO_LOG_DIR=/opt/cardano/logs
CARDANO_PORT=3001
CARDANO_SOCKET_PATH=/ipc/node.socket
CARDANO_TOPOLOGY=/configuration/topology.json
/usr/local/bin/run-node: line 93: /usr/local/bin/env: Read-only file system

Root Cause

  1. The Nix wrapper at /nix/store/.../cardano-node-mainnet hardcodes -tcardano-node.stats RTS option
  2. The run-node script's writeRootEnv() function writes to /usr/local/bin/env

Suggested Fix

  1. Make the stats file path configurable or write to /tmp or /data
  2. Write the env file to a writable location like /tmp/env instead of /usr/local/bin/env
  3. Or provide a "minimal" mode that skips these writes entirely

Workaround
Disable readOnlyRootFilesystem (reduces security posture).

Lenguaje dominante
Haskell
Estrellas
3.2k
Forks
763
Merge medio
3 d 11 h
PR fusionados (30 d)
18

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de IntersectMBO/cardano-node

Todos los issues de IntersectMBO/cardano-node

Issues similares

Más issues de Haskell

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.