Support read-only root file-system in jetstream-controller

[nats-io]

Support read-only root file-system in jetstream-controller

[variadico]

With readOnlyRootFilesystem set, it seems even writing files in the OS's default temp dir wouldn't be allowed, at least in my testing with Alpine.

The reason we used . for the temp dir is because we're using scratch as the base image. As a result, the container has almost nothing of an OS, not even a temp dir, and basically only holds our Go binary.

If we want to use readOnlyRootFilesystem, then I think we need to rethink where we keep that cache dir. Maybe we would need a separate volume to store the cache.

[wallyqs]

maybe we should change to the alpine image like in the nats-server?

[mionskowski-form3]

With readOnlyRootFilesystem set, it seems even writing files in the OS's default temp dir wouldn't be allowed, at least in my testing with Alpine.

That's correct. To overcome that you can attach a volume with write permissions under the path of the temp dir.

[cortopy]

I created a PR for @mionskowski-form3 suggestion ☝️