feat: allow running cli in readonly container

Author: zebby76

Dockerfiles/cli-prd.m4

@@ -23,11 +23,13 @@ LABEL be.fgov.elasticms.base.build-date=$BUILD_DATE_ARG \
 
 USER root
 
-ENV AWS_CLI_VERSION=${AWS_CLI_VERSION_ARG:-2.22.10} \
+ENV PHP_INI_SCAN_DIR="/usr/local/etc/php/conf.d:/app/etc/php/conf.d" \
+    AWS_CLI_VERSION=${AWS_CLI_VERSION_ARG:-2.22.10} \
     PHP_EXT_REDIS_VERSION=${PHP_EXT_REDIS_VERSION_ARG:-6.1.0} \
     PHP_EXT_APCU_VERSION=${PHP_EXT_APCU_VERSION_ARG:-5.1.24} \
     HOME=/home/default \
-    PATH=/opt/bin:/usr/local/bin:/usr/bin:$PATH
+    TMPDIR=/app/tmp \
+    PATH=/app/bin:/app/sbin:/usr/local/bin:/usr/bin:$PATH
 
 COPY --from=hairyhenderson/gomplate:stable /gomplate /usr/bin/gomplate
 
@@ -37,10 +39,16 @@ COPY --from=node /usr/local/lib /usr/local/lib
 COPY --from=node /usr/local/include /usr/local/include
 COPY --from=node /usr/local/bin /usr/local/bin
 
-COPY --chmod=775 --chown=1001:0 etc/php/ /usr/local/etc/
 COPY --chmod=775 --chown=1001:0 bin/ /usr/local/bin/
 
-RUN mkdir -p /home/default /app \
+COPY --chmod=664 --chown=1001:0 config/php/conf.d/ /app/config/php/conf.d/
+
+RUN mkdir -p /home/default \
+             /app/src \
+             /app/etc \
+             /app/tmp \
+             /app/bin \
+             /app/sbin \
     && chmod +x /usr/local/bin/apk-list \
                 /usr/local/bin/container-entrypoint-cli \
                 /usr/local/bin/wait-for-it \

bin/container-entrypoint-cli

@@ -1,6 +1,17 @@
-#!/bin/bash
+#!/usr/bin/env bash
+set -eo pipefail
 
-set -e
+export DEBUG=${DEBUG:-false}
+[[ "${DEBUG}" == "true" ]] && set -x
+
+source /usr/local/bin/container-entrypoint.d/entrypoint.d/00-functions.sh
+source /usr/local/bin/container-entrypoint.d/entrypoint.d/01-php.sh
+
+log "INFO" "+---- Configure PHP Container -----"
+
+source /usr/local/bin/container-entrypoint.d/base.d/01-php.sh
+
+log "INFO" "+---- PHP Container configured succesfully -----"
 
 # first arg is `-f` or `--some-option`
 if [ "${1#-}" != "$1" ]; then

etc/php/conf.d/base-php.ini

@@ -26,17 +26,57 @@ export BATS_CONTAINER_COMPOSE_ENGINE="${BATS_CONTAINER_ENGINE} compose"
 
 }
 
+@test "[$TEST_FILE] Check Docker external Volumes (local)" {
+
+  BATS_CONTAINER_VOLUME_NAMES=("$BATS_APP_TMP_VOLUME_NAME")
+  BATS_CONTAINER_VOLUME_NAMES+=("$BATS_APP_ETC_VOLUME_NAME")
+
+  for BATS_CONTAINER_VOLUME_NAME in "${BATS_CONTAINER_VOLUME_NAMES[@]}"; do
+
+    run ${BATS_CONTAINER_ENGINE} volume inspect ${BATS_CONTAINER_VOLUME_NAME}
+  
+    if [ "$status" -ne 0 ]; then
+
+      run ${BATS_CONTAINER_ENGINE} volume create ${BATS_CONTAINER_VOLUME_NAME}
+      [ "$status" -eq 0 ]
+  
+    fi
+
+  done
+
+}
+
 @test "[$TEST_FILE] Test PHP version" {
-  run ${BATS_CONTAINER_ENGINE} run --rm ${BATS_PHP_DOCKER_IMAGE_NAME} -v
+  run ${BATS_CONTAINER_ENGINE} run --read-only --rm \
+  -v $BATS_APP_TMP_VOLUME_NAME:/app/tmp \
+  -v $BATS_APP_ETC_VOLUME_NAME:/app/etc \
+  ${BATS_PHP_DOCKER_IMAGE_NAME} -v
   assert_output -l -r "^PHP ${BATS_PHP_VERSION} \(cli\) \(.*\) \(NTS\)"
 }
 
 @test "[$TEST_FILE] Testing NPM Version (with unrecognized uid)" {
-  run ${BATS_CONTAINER_ENGINE} run -u 1000 --rm ${BATS_PHP_DOCKER_IMAGE_NAME} npm -v
+  run ${BATS_CONTAINER_ENGINE} run -u 1000 --read-only --rm \
+  -v $BATS_APP_TMP_VOLUME_NAME:/app/tmp \
+  -v $BATS_APP_ETC_VOLUME_NAME:/app/etc \
+  ${BATS_PHP_DOCKER_IMAGE_NAME} npm -v
   assert_output -l -r "^[0-9]+.[0-9]+.[0-9]+*$"
 }
 
 @test "[$TEST_FILE] Test aws cli version" {
-  run ${BATS_CONTAINER_ENGINE} run --rm ${BATS_PHP_DOCKER_IMAGE_NAME} aws --version
+  run ${BATS_CONTAINER_ENGINE} run --read-only --rm \
+  -v $BATS_APP_TMP_VOLUME_NAME:/app/tmp \
+  -v $BATS_APP_ETC_VOLUME_NAME:/app/etc \
+  ${BATS_PHP_DOCKER_IMAGE_NAME} aws --version
   assert_output -l -r "^aws-cli/${BATS_AWS_CLI_VERSION} Python/.* .*$"
+}
+
+@test "[$TEST_FILE] Cleanup Docker external Volumes (local)" {
+
+  BATS_CONTAINER_VOLUME_NAMES=("$BATS_APP_TMP_VOLUME_NAME")
+  BATS_CONTAINER_VOLUME_NAMES+=("$BATS_APP_ETC_VOLUME_NAME")
+  
+  for BATS_CONTAINER_VOLUME_NAME in "${BATS_CONTAINER_VOLUME_NAMES[@]}"; do
+    run ${BATS_CONTAINER_ENGINE} volume rm ${BATS_CONTAINER_VOLUME_NAME}
+  done
+
 }