Re: [I] Running Apisix with securityContext does not work [apisix-helm-chart]

["luarx (via GitHub)" <gi...@apache.org>]

luarx commented on issue #805:
URL: https://github.com/apache/apisix-helm-chart/issues/805#issuecomment-4729318968

   Confirmed workaround from @JulianSobott works. For those using UID 636 (the actual apisix system user in the official apache/apisix image), the same approach applies with runAsUser: 636 instead of 1000.
   
     The writable paths that need emptyDir mounts are:
     - /usr/local/apisix/conf — APISIX rewrites nginx.conf and config_listen.sock at every startup
     - /usr/local/apisix/logs — worker event sockets
     - /tmp, /usr/local/apisix/client_body_temp, proxy_temp, fastcgi_temp, uwsgi_temp, scgi_temp — nginx temp dirs
   
     The initContainer copying /usr/local/apisix/conf/* into the writable emptyDir is required — without it APISIX starts with an empty conf dir and fails.
   
   **This should be supported by default**. 
   Running with readOnlyRootFilesystem: true is a baseline security expectation for production workloads, and requiring users to manually wire up 8 emptyDir volumes plus an initContainer is a significant barrier. The Bitnami bitnami/apisix chart already ships this configuration out of the box — readOnlyRootFilesystem: true is their default, with all necessary volumes and initContainer pre-configured. The official chart should do the same.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org