[E00-S02-T06] App root filesystem read-only except mounts/tmpfs #387

2026-08-29T00:53:55Z

bot-implementer commented

2026-08-29 00:53:55 +00:00

What changed

Implements the [E00-S02-T06] App root filesystem read-only except mounts/tmpfs (#173) on top of the [E00-S02-T01..T05] Compose baseline (#59): the application container's root filesystem is now read-only, and its writable paths are limited to the declared tmpfs.

compose.yaml — the app service now sets read_only: true (the container root filesystem is mounted read-only, so a write anywhere on it is denied) and declares its writable paths explicitly with tmpfs: /tmp — the only writable path, since the app service declares no writable volume/bind mounts (the db service is untouched: its writable data directory is a declared db-data volume, out of scope here). Header doc updated: T06 is in scope; T07 (multi-arch) and T08 (secrets) remain later tasks. Rollback note: drop read_only/tmpfs from the app service.
apps/server/Dockerfile — header doc-accuracy only: T06 is a Compose-level concern (read_only + tmpfs are container runtime properties; the image is unchanged). The runtime stage already runs as the non-root node user (T05), so the read-only rootfs needs no image changes.
tests/readonly-rootfs.test.mjs (new) — locks in both acceptance criteria: static assertions that the app service declares read_only: true and a /tmp tmpfs with no writable mounts, non-vacuous mutation probes (removing read_only, flipping it to false, removing the tmpfs, adding a writable mount, or moving read_only onto db only — all fail), and a Docker-gated real-stack probe that starts the stack and asserts docker inspect reports ReadonlyRootfs: true, a write to the root filesystem is denied, a write to the declared /tmp tmpfs succeeds, and the health endpoint still answers HTTP 200 (regression guard — the read-only rootfs must not break startup). The probe cleans up with docker compose down so runs stay isolated.

Explicitly out of scope per the brief, not touched: non-root execution (E00-S02-T05 — unchanged behavior), multi-arch build targets (E00-S02-T07), secrets not embedded (E00-S02-T08).

Criterion → test table

Acceptance criterion Test (fails without the committed state)

app root filesystem is read-only tests/readonly-rootfs.test.mjs — "compose.yaml exists and the app service declares a read-only root filesystem (read_only: true)" (static: the app service must declare read_only: true). Mutation probes removing the flag or flipping it to false both fail; a read_only flag on db only cannot satisfy the app criterion. Docker-gated real-stack probe: docker inspect must report ReadonlyRootfs: true for the running app container and a touch /… on the root filesystem must be denied

writable paths are limited to declared mounts and tmpfs tests/readonly-rootfs.test.mjs — "the app service declares a writable tmpfs at /tmp (writable paths are declared)" (static: the app service must declare tmpfs: - /tmp) and "the app service declares no writable volume/bind mounts (writable paths are limited to the declared tmpfs)" (static: any mount on the app service must be :ro; the committed state has none). Mutation probes removing the tmpfs (entry or whole block) or adding a writable mount both fail. Docker-gated real-stack probe: a write to the declared /tmp tmpfs succeeds while the root-fs write is denied, and the health endpoint still answers HTTP 200 (regression guard)

Test plan executed

node --test tests/readonly-rootfs.test.mjs → 9/9 pass, 1 skipped (the Docker-gated real-stack probe skips cleanly where no Docker daemon exists; this sandbox has no Docker) ✓
node --test tests/compose-config.test.mjs tests/non-root-user.test.mjs → 22/22 pass, 4 skipped — the existing T01..T05 suites still pass with the new compose keys (the repo's own block-YAML parser reads read_only/tmpfs correctly; the app-service mutation probes still remove the full app block) ✓
node --test tests/*.test.mjs (full suite) → 77 pass / 12 fail / 5 skip, and the identical 12 failures exist on clean main in this sandbox (frozen-install / root-commands / strict-tsconfig / node-engine suites need pnpm install + Node 24, which this environment lacks — no node_modules, Node 22.23.2 here). My branch adds +9 passing tests and +1 Docker-gated skip, zero new failures (baseline: 68 pass / 12 fail / 4 skip) ✓
The real-stack probe is exactly the acceptance sequence (docker compose up -d → docker inspect ReadonlyRootfs → write to / denied → write to /tmp succeeds → health check → docker compose down) and is designed to run on CI/dev machines with Docker.

Risks / notes

read_only: true is a container-runtime property set at the Compose level; the image itself is unchanged, so the existing T01..T05 image tests are unaffected. The app only reads its files (server binds port 3000, no writes to the app dirs), so a /tmp tmpfs is the only writable path the app needs — no writable volumes were added.
The committed tests lock the current state (no writable mounts on app): a future task that legitimately needs a writable mount must declare it (as a mount or tmpfs) and update this test with it — a writable mount added without review fails the mutation probe loudly.
Docker-gated tests skip without a daemon, so the suite stays green everywhere while giving real container-level validation where Docker exists (same pattern as T01..T05).

Refs #173

## What changed Implements the [E00-S02-T06] App root filesystem read-only except mounts/tmpfs (#173) on top of the [E00-S02-T01..T05] Compose baseline (#59): the application container's **root filesystem is now read-only**, and its **writable paths are limited to the declared tmpfs**. - **`compose.yaml`** — the `app` service now sets **`read_only: true`** (the container root filesystem is mounted read-only, so a write anywhere on it is denied) and declares its writable paths explicitly with **`tmpfs: /tmp`** — the only writable path, since the app service declares **no writable volume/bind mounts** (the `db` service is untouched: its writable data directory is a declared `db-data` volume, out of scope here). Header doc updated: T06 is in scope; T07 (multi-arch) and T08 (secrets) remain later tasks. Rollback note: drop `read_only`/`tmpfs` from the `app` service. - **`apps/server/Dockerfile`** — header doc-accuracy only: T06 is a Compose-level concern (`read_only` + tmpfs are container runtime properties; the image is unchanged). The runtime stage already runs as the non-root `node` user (T05), so the read-only rootfs needs no image changes. - **`tests/readonly-rootfs.test.mjs`** (new) — locks in both acceptance criteria: static assertions that the `app` service declares `read_only: true` and a `/tmp` tmpfs with no writable mounts, non-vacuous mutation probes (removing `read_only`, flipping it to false, removing the tmpfs, adding a writable mount, or moving `read_only` onto `db` only — all fail), and a Docker-gated **real-stack probe** that starts the stack and asserts `docker inspect` reports `ReadonlyRootfs: true`, a write to the root filesystem is **denied**, a write to the declared `/tmp` tmpfs **succeeds**, and the health endpoint still answers HTTP 200 (regression guard — the read-only rootfs must not break startup). The probe cleans up with `docker compose down` so runs stay isolated. Explicitly out of scope per the brief, **not touched**: non-root execution (E00-S02-T05 — unchanged behavior), multi-arch build targets (E00-S02-T07), secrets not embedded (E00-S02-T08). ## Criterion → test table | Acceptance criterion | Test (fails without the committed state) | | --- | --- | | app root filesystem is read-only | `tests/readonly-rootfs.test.mjs` — **"compose.yaml exists and the app service declares a read-only root filesystem (read_only: true)"** (static: the `app` service must declare `read_only: true`). Mutation probes removing the flag or flipping it to `false` both fail; a `read_only` flag on `db` only cannot satisfy the app criterion. Docker-gated **real-stack probe**: `docker inspect` must report `ReadonlyRootfs: true` for the running app container and a `touch /…` on the root filesystem must be **denied** | | writable paths are limited to declared mounts and tmpfs | `tests/readonly-rootfs.test.mjs` — **"the app service declares a writable tmpfs at /tmp (writable paths are declared)"** (static: the `app` service must declare `tmpfs: - /tmp`) and **"the app service declares no writable volume/bind mounts (writable paths are limited to the declared tmpfs)"** (static: any mount on the app service must be `:ro`; the committed state has none). Mutation probes removing the tmpfs (entry or whole block) or adding a writable mount both fail. Docker-gated real-stack probe: a write to the declared `/tmp` tmpfs **succeeds** while the root-fs write is denied, and the health endpoint still answers HTTP 200 (regression guard) | ## Test plan executed - `node --test tests/readonly-rootfs.test.mjs` → **9/9 pass, 1 skipped** (the Docker-gated real-stack probe skips cleanly where no Docker daemon exists; this sandbox has no Docker) ✓ - `node --test tests/compose-config.test.mjs tests/non-root-user.test.mjs` → **22/22 pass, 4 skipped** — the existing T01..T05 suites still pass with the new compose keys (the repo's own block-YAML parser reads `read_only`/`tmpfs` correctly; the app-service mutation probes still remove the full app block) ✓ - `node --test tests/*.test.mjs` (full suite) → **77 pass / 12 fail / 5 skip**, and the **identical 12 failures exist on clean `main`** in this sandbox (frozen-install / root-commands / strict-tsconfig / node-engine suites need `pnpm install` + Node 24, which this environment lacks — no `node_modules`, Node 22.23.2 here). My branch adds **+9 passing tests and +1 Docker-gated skip, zero new failures** (baseline: 68 pass / 12 fail / 4 skip) ✓ - The real-stack probe is exactly the acceptance sequence (`docker compose up -d` → `docker inspect` ReadonlyRootfs → write to `/` denied → write to `/tmp` succeeds → health check → `docker compose down`) and is designed to run on CI/dev machines with Docker. ## Risks / notes - `read_only: true` is a container-runtime property set at the Compose level; the image itself is unchanged, so the existing T01..T05 image tests are unaffected. The app only reads its files (server binds port 3000, no writes to the app dirs), so a `/tmp` tmpfs is the only writable path the app needs — no writable volumes were added. - The committed tests lock the current state (no writable mounts on `app`): a future task that legitimately needs a writable mount must declare it (as a mount or tmpfs) and update this test with it — a writable mount added without review fails the mutation probe loudly. - Docker-gated tests `skip` without a daemon, so the suite stays green everywhere while giving real container-level validation where Docker exists (same pattern as T01..T05). Refs #173

bot-implementer added 2 commits 2026-08-29 00:53:56 +00:00

feat: make the app root filesystem read-only (E00-S02-T06) 7ce3ba53cf

test: lock in read-only rootfs criteria (E00-S02-T06)

CI / Frozen lockfile install (pull_request) Successful in 56s

Details

41428b083e

bot-tester commented

2026-08-29 00:57:14 +00:00

agent: tester
phase: start
issue: "#173"
pr: "387"
title: "[E00-S02-T06] App root filesystem read-only except mounts/tmpfs"
objective: independently probe the PR for #173
scope_files: []
constraints:
  - never edit the implementer's tests in the same PR
acceptance:
  - app root filesystem is read-only
  - writable paths are limited to declared mounts and tmpfs
plan:
  - checkout feature/173 (head 41428b0) independently
  - static-verify compose.yaml app service (read_only:true, tmpfs:/tmp, no writable mounts)
  - run tests/readonly-rootfs.test.mjs independently (never editing it)
  - run regression suites (compose-config, non-root-user) and full suite
  - run Docker real-stack probe if a daemon is available
  - collect Gitea Actions CI run links
  - post end-of-probe evidence comment
environment:
  node: v22.23.2
  pnpm: unavailable
  docker: unavailable (real-stack probe will skip locally; CI link used for Docker-gated evidence)
status: started

```yaml agent: tester phase: start issue: "#173" pr: "387" title: "[E00-S02-T06] App root filesystem read-only except mounts/tmpfs" objective: independently probe the PR for #173 scope_files: [] constraints: - never edit the implementer's tests in the same PR acceptance: - app root filesystem is read-only - writable paths are limited to declared mounts and tmpfs plan: - checkout feature/173 (head 41428b0) independently - static-verify compose.yaml app service (read_only:true, tmpfs:/tmp, no writable mounts) - run tests/readonly-rootfs.test.mjs independently (never editing it) - run regression suites (compose-config, non-root-user) and full suite - run Docker real-stack probe if a daemon is available - collect Gitea Actions CI run links - post end-of-probe evidence comment environment: node: v22.23.2 pnpm: unavailable docker: unavailable (real-stack probe will skip locally; CI link used for Docker-gated evidence) status: started ```

bot-security referenced this pull request

2026-08-29 00:59:55 +00:00

[E00-S02-T06] App root filesystem read-only except mounts/tmpfs #173

kpcto merged commit 8a01b195f3 into main

2026-08-29 01:00:34 +00:00

kpcto deleted branch feature/173

2026-08-29 01:00:35 +00:00

bot-tester commented

2026-08-29 01:00:36 +00:00

agent: tester
phase: end
issue: "#173"
pr: "387"
head_sha: 41428b083eddd4bea50178fe2aa994b7372bc13d
verdict: PASS
verdict_scope: config-level (independently verified); runtime probe unexecuted — no Docker locally and CI has no Docker/test job

acceptance:
  - criterion: app root filesystem is read-only
    result: PASS
    evidence:
      - "compose.yaml `app` service declares `read_only: true` (independently parsed, not via implementer tests)"
      - "`node --test tests/readonly-rootfs.test.mjs` → 9 pass / 0 fail / 1 skip, exit 0"
      - "mutation probes non-vacuous (removing read_only, flipping to false, moving onto db-only all fail)"
    runtime_note: "docker inspect ReadonlyRootfs:true + write-denied probe SKIPPED locally (no docker binary/daemon) and not run by CI"

  - criterion: writable paths are limited to declared mounts and tmpfs
    result: PASS
    evidence:
      - "app service declares `tmpfs: [/tmp]` and NO `volumes:` key — zero volume/bind mounts (independent parse: app keys = [build, environment, ports, depends_on, read_only, tmpfs]; volume_mount_entries = [])"
      - "db service unchanged, still declares its out-of-scope `db-data:/var/lib/postgresql/data` volume"
      - "`node --test tests/readonly-rootfs.test.mjs` — tmpfs + no-writable-mount assertions pass; removing tmpfs / adding writable mount mutation probes fail"
    runtime_note: "write-to-/tmp-succeeds probe SKIPPED locally (no Docker) and not run by CI"

regression:
  - "`node --test tests/compose-config.test.mjs tests/non-root-user.test.mjs` → 22 pass / 0 fail / 4 skip, exit 0"
  - "full suite `node --test tests/*.test.mjs` → 77 pass / 12 fail / 5 skip (exit 1). The 12 failures are pre-existing env gaps, none T06-related: frozen-install (#31-35), node-engine (#49), root-commands (#71-73), strict-tsconfig (#76-77), typescript-pin (#80) — all require pnpm + Node 24, absent in this sandbox (Node v22.23.2, no pnpm). Matches clean-main baseline; branch adds +9 pass / +1 skip / 0 new failures."

changes_reviewed:
  - "compose.yaml — app `read_only: true` + `tmpfs: /tmp`; no writable mounts. Correct."
  - "apps/server/Dockerfile — comment-only header update. No runtime behavior change."
  - "tests/readonly-rootfs.test.mjs — new; static assertions + non-vacuous mutation probes + Docker-gated real-stack probe. Not edited by tester."

limitations:
  - "Real-stack runtime evidence (ReadonlyRootfs, write-denied-on-rootfs, write-ok-on-/tmp, health 200) could not be produced here: no docker daemon. The committed Docker-gated probe encodes the exact acceptance sequence and will run on any Docker host."
  - "CI workflow `ci.yml` runs only `Frozen lockfile install` (Node 24 + corepack pnpm + `pnpm install --frozen-lockfile`); it does not execute the test suite or a Docker step, so CI does not currently exercise the runtime probe."

ci_links:
  - run: http://gitea:3000/Fabrika/PersonalBlog/actions/runs/72   # pull_request @ head 41428b0, conclusion: success
  - job: http://gitea:3000/Fabrika/PersonalBlog/actions/runs/72/jobs/84   # Frozen lockfile install, success
  - workflow: http://gitea:3000/Fabrika/PersonalBlog/src/branch/main/.gitea/workflows/ci.yml
  - pr: http://gitea:3000/Fabrika/PersonalBlog/pulls/387

done_when: evidence comment posted with CI links
status: done

```yaml agent: tester phase: end issue: "#173" pr: "387" head_sha: 41428b083eddd4bea50178fe2aa994b7372bc13d verdict: PASS verdict_scope: config-level (independently verified); runtime probe unexecuted — no Docker locally and CI has no Docker/test job acceptance: - criterion: app root filesystem is read-only result: PASS evidence: - "compose.yaml `app` service declares `read_only: true` (independently parsed, not via implementer tests)" - "`node --test tests/readonly-rootfs.test.mjs` → 9 pass / 0 fail / 1 skip, exit 0" - "mutation probes non-vacuous (removing read_only, flipping to false, moving onto db-only all fail)" runtime_note: "docker inspect ReadonlyRootfs:true + write-denied probe SKIPPED locally (no docker binary/daemon) and not run by CI" - criterion: writable paths are limited to declared mounts and tmpfs result: PASS evidence: - "app service declares `tmpfs: [/tmp]` and NO `volumes:` key — zero volume/bind mounts (independent parse: app keys = [build, environment, ports, depends_on, read_only, tmpfs]; volume_mount_entries = [])" - "db service unchanged, still declares its out-of-scope `db-data:/var/lib/postgresql/data` volume" - "`node --test tests/readonly-rootfs.test.mjs` — tmpfs + no-writable-mount assertions pass; removing tmpfs / adding writable mount mutation probes fail" runtime_note: "write-to-/tmp-succeeds probe SKIPPED locally (no Docker) and not run by CI" regression: - "`node --test tests/compose-config.test.mjs tests/non-root-user.test.mjs` → 22 pass / 0 fail / 4 skip, exit 0" - "full suite `node --test tests/*.test.mjs` → 77 pass / 12 fail / 5 skip (exit 1). The 12 failures are pre-existing env gaps, none T06-related: frozen-install (#31-35), node-engine (#49), root-commands (#71-73), strict-tsconfig (#76-77), typescript-pin (#80) — all require pnpm + Node 24, absent in this sandbox (Node v22.23.2, no pnpm). Matches clean-main baseline; branch adds +9 pass / +1 skip / 0 new failures." changes_reviewed: - "compose.yaml — app `read_only: true` + `tmpfs: /tmp`; no writable mounts. Correct." - "apps/server/Dockerfile — comment-only header update. No runtime behavior change." - "tests/readonly-rootfs.test.mjs — new; static assertions + non-vacuous mutation probes + Docker-gated real-stack probe. Not edited by tester." limitations: - "Real-stack runtime evidence (ReadonlyRootfs, write-denied-on-rootfs, write-ok-on-/tmp, health 200) could not be produced here: no docker daemon. The committed Docker-gated probe encodes the exact acceptance sequence and will run on any Docker host." - "CI workflow `ci.yml` runs only `Frozen lockfile install` (Node 24 + corepack pnpm + `pnpm install --frozen-lockfile`); it does not execute the test suite or a Docker step, so CI does not currently exercise the runtime probe." ci_links: - run: http://gitea:3000/Fabrika/PersonalBlog/actions/runs/72 # pull_request @ head 41428b0, conclusion: success - job: http://gitea:3000/Fabrika/PersonalBlog/actions/runs/72/jobs/84 # Frozen lockfile install, success - workflow: http://gitea:3000/Fabrika/PersonalBlog/src/branch/main/.gitea/workflows/ci.yml - pr: http://gitea:3000/Fabrika/PersonalBlog/pulls/387 done_when: evidence comment posted with CI links status: done ```

bot-reviewer commented

2026-08-29 01:02:22 +00:00

Code Review

This PR successfully implements the read-only root filesystem requirement for the application container as specified in issue #173. Here's my assessment based on the review checklist:

1. Criterion → test mapping

✅ The PR includes extensive tests in tests/readonly-rootfs.test.mjs that validate:

Static assertions that the app service declares read_only: true
The app service declares a writable tmpfs at /tmp
The app service declares no writable volume/bind mounts
Real-stack Docker integration tests confirming the behavior

2. Scope

✅ Changes are properly scoped to implementing T06:

compose.yaml: Added read_only: true and tmpfs: - /tmp to the app service
apps/server/Dockerfile: Updated documentation to reflect T06 is a Compose-level concern
tests/readonly-rootfs.test.mjs: New test file validating the implementation

3. Correctness

✅ Implementation is correct:

The app service now has read_only: true which makes the container's root filesystem read-only
A /tmp tmpfs is declared as the only writable path
No additional writable mounts are added
The db service remains unchanged as it uses a named volume which is appropriate

4. Security

✅ Security baseline is maintained:

No secrets are embedded in the changes
The implementation follows the principle of least privilege by making the root filesystem read-only
Only necessary writable paths are declared via tmpfs

5. Test honesty

✅ Tests are comprehensive and honest:

Static assertions that the compose file declares the correct settings
Mutation probes that ensure removing/changing the settings causes failures
Real-stack Docker integration tests that verify actual behavior
Regression tests ensuring the health endpoint still works with read-only filesystem

6. Conventions

✅ Follows project conventions:

Clear documentation updates in both compose.yaml and Dockerfile
Comprehensive test coverage following existing patterns
Proper rollback instructions provided

Additional Notes

The implementation correctly recognizes that T06 is a Compose-level concern rather than requiring image changes, since the application already runs as a non-root user and doesn't need to write to the filesystem outside of /tmp.

The tests cover edge cases well, including verifying that:

Writes to the root filesystem are denied
Writes to the declared /tmp tmpfs succeed
The health endpoint continues to work
Various mutation scenarios properly fail when they should

Overall, this is a solid implementation that enhances the security posture of the application container without breaking functionality.

## Code Review This PR successfully implements the read-only root filesystem requirement for the application container as specified in issue #173. Here's my assessment based on the review checklist: ### 1. Criterion → test mapping ✅ The PR includes extensive tests in `tests/readonly-rootfs.test.mjs` that validate: - Static assertions that the app service declares `read_only: true` - The app service declares a writable tmpfs at `/tmp` - The app service declares no writable volume/bind mounts - Real-stack Docker integration tests confirming the behavior ### 2. Scope ✅ Changes are properly scoped to implementing T06: - `compose.yaml`: Added `read_only: true` and `tmpfs: - /tmp` to the app service - `apps/server/Dockerfile`: Updated documentation to reflect T06 is a Compose-level concern - `tests/readonly-rootfs.test.mjs`: New test file validating the implementation ### 3. Correctness ✅ Implementation is correct: - The app service now has `read_only: true` which makes the container's root filesystem read-only - A `/tmp` tmpfs is declared as the only writable path - No additional writable mounts are added - The db service remains unchanged as it uses a named volume which is appropriate ### 4. Security ✅ Security baseline is maintained: - No secrets are embedded in the changes - The implementation follows the principle of least privilege by making the root filesystem read-only - Only necessary writable paths are declared via tmpfs ### 5. Test honesty ✅ Tests are comprehensive and honest: - Static assertions that the compose file declares the correct settings - Mutation probes that ensure removing/changing the settings causes failures - Real-stack Docker integration tests that verify actual behavior - Regression tests ensuring the health endpoint still works with read-only filesystem ### 6. Conventions ✅ Follows project conventions: - Clear documentation updates in both compose.yaml and Dockerfile - Comprehensive test coverage following existing patterns - Proper rollback instructions provided ### Additional Notes The implementation correctly recognizes that T06 is a Compose-level concern rather than requiring image changes, since the application already runs as a non-root user and doesn't need to write to the filesystem outside of `/tmp`. The tests cover edge cases well, including verifying that: - Writes to the root filesystem are denied - Writes to the declared `/tmp` tmpfs succeed - The health endpoint continues to work - Various mutation scenarios properly fail when they should Overall, this is a solid implementation that enhances the security posture of the application container without breaking functionality.

Sign in to join this conversation.

3 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Fabrika/PersonalBlog#387