bitdeals
0801b0d376
Build docker image and push to registry.bitdeals.org / main-build-job (push) Successful in 1m4s
/var/log/letsencrypt was the only thing this image wrote outside its volumes, and it is what stopped `read_only: true` from working. --logs-dir moves it to /etc/letsencrypt/logs, beside the account key and the renewal config it already keeps there. The second gain is the one that matters more here. This is the service whose breakage does not announce itself: a renewal that stops working is an expired certificate sixty days later, and the log is what says why. On the root filesystem it died with every container the registry replaced; in the volume it outlives them. Nothing else about the container needs to change to be confined. It never changes user, the files it touches are its own, the ACME challenge is served on 380 rather than a privileged port, and the HAProxy runtime socket it writes to is group-owned by root -- so it reaches it by permission rather than by CAP_DAC_OVERRIDE, and `cap_drop: ALL` takes nothing away. Measured on the live relay: no file under /etc/letsencrypt or /etc/certificates is owned by anyone but root, and the socket is srw-rw---- 1001:0. Both READMEs say what a caller should set now, stop_grace_period included -- the entrypoint has asked for that one since it was written.