Skip to content

[Feature]: Support immutable container image #939

@hwaastad

Description

@hwaastad

What problem are you trying to solve?

Be able to run poweradmin as a readonly image

What would you like implemented?

The current implementation uses a hardcoded CONFIG_FILE (/app/config/settings.php) and this is updated in entrypoint,
However, to increase security (immutable image), it would be a good thing to be able to have config file path configurable so that we can mount this r/w volume (and php run dirs etc) outside container. both std docker and in k8s.

So atm there is a PA_CONFIG_PATH which is read and then written to CONFIG_FILE.

  1. CONFIG_FILE="${CUSTOM_CONFIG_FILE:-/app/config/settings.php}"
  2. Extend AppInitializer and ConfigurationManager to support this env variable

Maybe by a

class EnvReader
{
    public static function get(string $key, $default = null)
    {
        $value = getenv($key);

        if ($value === false) {
            return $default;
        }

        return $value;
    }
}

This is just a very rough draft on my part :-)
Maybe there are better ways of implementing this also....

/hw

Additional context (optional)

No response

Metadata

Metadata

Assignees

Labels

infraPerformance & InfrastructuresecuritySecurity-related issues, vulnerabilities, and etc

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions