Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[BUG] - Docker image incompatible with readOnlyRootFilesystem (Kubernetes security best practice)

Aperta
  • Qualcosa non va?
#6,470 4 commenti 1 reazione 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@dermetfan ci sta già lavorando.

Dal 5/6/2026.

  • #6599 di @dermetfan — integrata

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

docker Stale

Internal/External
External

Area
Other - Docker image / Nix wrapper / run-node script

Summary
The cardano-node Docker image (10.6.2) is incompatible with readOnlyRootFilesystem: true in Kubernetes due to two separate issues:

  1. Scripts mode (NETWORK=mainnet): The Nix-generated wrapper hardcodes RTS option -tcardano-node.stats which tries to write to the current working directory
  2. Custom mode (run arg): The /usr/local/bin/run-node script writes to /usr/local/bin/env

Running with readOnlyRootFilesystem: true is a Kubernetes security best practice recommended by CIS benchmarks.

Steps to reproduce

Issue 1 - Scripts mode:

docker run --read-only -e NETWORK=mainnet ghcr.io/intersectmbo/cardano-node:10.6.2

Error: cardano-node: Can't open stats file cardano-node.stats

Issue 2 - Custom mode:

docker run --read-only ghcr.io/intersectmbo/cardano-node:10.6.2 run

Error: /usr/local/bin/run-node: line 93: /usr/local/bin/env: Read-only file system

Expected behavior
The node should start successfully with readOnlyRootFilesystem: true.

System info:

  • OS: Kubernetes (EKS) with containerd
  • Node version: cardano-node 10.6.2
  • Docker image: ghcr.io/intersectmbo/cardano-node:10.6.2

Logs - Issue 1 (Scripts mode)

Starting: exec /nix/store/.../cardano-node run
...
+RTS
--machine-readable
-tcardano-node.stats
...
-RTS

cardano-node: Can't open stats file cardano-node.stats

Logs - Issue 2 (Custom mode)

Running cardano node ...
CARDANO_BIND_ADDR=0.0.0.0
CARDANO_BLOCK_PRODUCER=false
CARDANO_CONFIG=/opt/cardano/config/mainnet/config.json
CARDANO_DATABASE_PATH=/data/db
CARDANO_LOG_DIR=/opt/cardano/logs
CARDANO_PORT=3001
CARDANO_SOCKET_PATH=/ipc/node.socket
CARDANO_TOPOLOGY=/configuration/topology.json
/usr/local/bin/run-node: line 93: /usr/local/bin/env: Read-only file system

Root Cause

  1. The Nix wrapper at /nix/store/.../cardano-node-mainnet hardcodes -tcardano-node.stats RTS option
  2. The run-node script's writeRootEnv() function writes to /usr/local/bin/env

Suggested Fix

  1. Make the stats file path configurable or write to /tmp or /data
  2. Write the env file to a writable location like /tmp/env instead of /usr/local/bin/env
  3. Or provide a "minimal" mode that skips these writes entirely

Workaround
Disable readOnlyRootFilesystem (reduces security posture).

Lingua principale
Haskell
Stelle
3.2k
Fork
762
Merge medio
1g 23h
PR unite (30g)
21

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di IntersectMBO/cardano-node

Tutte le issue di IntersectMBO/cardano-node

Issue simili

Altre issue su Haskell

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.