Read-only image configuration for production-like testing #1475
+68
−18
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This does several things: * Adds DJANGO_WRITEABLE_ROOT to our environment variables. This is where we are allowed to write data. * Mounts /media as our writeable `tempfs` * Explicitly makes everything else non-writeable. All unit tests and selenium tests should pass. It should be possible to upload an image for an app (existing or new). If you log into the container, it should be possible to ``` touch /media/test.txt ``` and it should fail if you try and ``` touch /code/test.txt ```
Again, this is simulating production-like conditions for Fargate.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
JIRA Ticket:
https://jira.cms.gov/browse/BB2-4424
What Does This PR Do?
We are moving to Fargate. Fargate has a read-only filesystem; therefore, we need to be confident that the Blue Button application does not (quietly or loudly) expect to be able to write to the local disk.
This PR makes a few changes to better simulate these conditions locally:
CSS assets statically built
Inside of the container, we now build the CSS static assets. This is hard to observe, though, because those assets are built inside of the
/code/staticpath. We then, in ourcomposefile, mount/codefrom the local filesystem as a bind volume. This then shadows the path in the image (which contains our assets).There are two ways we could resolve this:
../appsat/code/apps, and that would then limit the amount of code we are shadowing. The static assets in the image would then be used.distlocally, and use that.I've added both the build internal to the image (and tested it by not mounting
/code) as well as added to our local build the generation ofdistinstatic/bluebutton-css. Or: option 2 was chosen in this PR, and it is possible to instead use option. PR discussion welcome.An environment variable was added for WRITEABLE_ROOT
This is a breaking change, and should be reverted. Given that we don't actually write to the local FS (and instead write to S3) in production, this change would impact our deployed app in negative ways. I'll update the PR while it is in draft to remove this exploration.
What Should Reviewers Watch For?
make run-local)There should be no errors.
Validation
See above.
What Security Implications Does This PR Have?
No security implications.
Any Migrations?
No migrations.