App compilation fails on snap install due to read-only Deno temp location

Description:

Rocket.Chat Apps cannot be enabled on the official Snap deployment of Rocket.Chat 8.5.1. This is reproducible with the Marketplace app GIPHY.

When enabling the GIPHY app, Rocket.Chat reports a generic compiler error in the UI. The server logs show that the Apps Deno runtime attempts to create deno.runtime.jsonc inside the read-only Snap filesystem under /snap/rocketchat-server/....

This appears to be a Snap/runtime path issue rather than an app-specific issue.

Steps to reproduce:

1. Install Rocket.Chat Server 8.5.1 using the official Snap package.
2. Open Administration -> Marketplace.
3. Install or open the Marketplace app GIPHY.
4. Try to enable the GIPHY app.
5. Check the Rocket.Chat server logs.

Expected behavior:

The GIPHY Marketplace app should compile and enable successfully.

The Apps Deno runtime should create temporary runtime configuration files in a writable location, such as /tmp or another writable application temp directory.

Actual behavior:

The GIPHY app cannot be enabled.

The UI shows:

Apps_Error_The App had compiler errors, can not enable it.

The server logs show:

Error: EROFS: read-only file system, open '/snap/rocketchat-server/1788/programs/server/npm/node_modules/@rocket.chat/apps/deno-runtime/deno.runtime.jsonc'

The failure occurs during Apps Deno runtime initialization, before the app itself can run.

Server Setup Information:

• Version of Rocket.Chat Server: 8.5.1
• License Type: Community
• Number of Users: N/A
• Operating System: Ubuntu Linux
• Deployment Method: Snap
• Number of Running Instances: 1
• DB Replicaset Oplog: Default Snap deployment
• NodeJS Version: Bundled with Rocket.Chat Snap
• MongoDB Version: Bundled with Rocket.Chat Snap

Client Setup Information

• Desktop App or Browser Version: Browser, not app-specific
• Operating System: N/A

Additional context

The installed Snap package is:

Name               Version  Rev   Tracking    Publisher
rocketchat-server  8.5.1    1788  8.x/stable  rocketchat

The failing path is inside the immutable Snap mount:

/snap/rocketchat-server/1788/programs/server/npm/node_modules/@rocket.chat/apps/deno-runtime/deno.runtime.jsonc

The directory contains the static Deno runtime files, but not deno.runtime.jsonc:

/snap/rocketchat-server/1788/programs/server/npm/node_modules/@rocket.chat/apps/deno-runtime/

AppObjectRegistry.ts
deno.jsonc
deno.lock
error-handlers.ts
handlers/
lib/
main.ts

There is no writable location available at that path because the Snap filesystem is mounted read-only.

The temp directory appears to be writable and correctly set:

snap run --shell rocketchat-server -c 'echo TMPDIR=$TMPDIR; node -e "console.log(require(\"os\").tmpdir())"'

Output:

TMPDIR=/tmp
/tmp

While inspecting the bundled Apps runtime code, the comment says that the generated runtime Deno config should be created in a temp directory:

/**
 * Generates a runtime deno.jsonc at `<tempDir>/deno_runtime.jsonc`
 */

However, the implementation appears to derive the runtime config path from the static config path:

this.denoEphemeralConfigPath =
    this.denoConfigPath.replace('.jsonc', '.runtime.jsonc');

Because this.denoConfigPath points into /snap/rocketchat-server/1788/..., this resolves to a read-only path:

/snap/rocketchat-server/1788/programs/server/npm/node_modules/@rocket.chat/apps/deno-runtime/deno.runtime.jsonc

This seems incompatible with Snap deployments, where /snap/... is read-only.

Possible fix:

The generated runtime Deno config should be written to the temporary runtime directory that is already used for the Deno runtime symlink, rather than next to the static deno.jsonc file inside the installed package directory.

Current behavior appears equivalent to:

this.denoEphemeralConfigPath =
    this.denoConfigPath.replace('.jsonc', '.runtime.jsonc');

This produces a target path under:

/snap/rocketchat-server/<revision>/programs/server/npm/node_modules/@rocket.chat/apps/deno-runtime/

which is read-only in Snap deployments.

A possible fix would be to set the generated config path under this.tempFilePath, for example:

this.denoEphemeralConfigPath = path.join(
    this.tempFilePath,
    'deno-runtime',
    'deno.runtime.jsonc'
);

or otherwise use a writable temp/config path controlled by the host runtime.

This would better match the code comment that says the generated runtime deno.jsonc is created at /deno_runtime.jsonc and would avoid writing to the immutable Snap mount.

If Deno requires the config file to be near the runtime entrypoint, the generated config could be placed in the symlinked temp deno-runtime directory, since this.denoRuntimePath is already set to:

path.join(this.tempFilePath, 'deno-runtime', 'main.ts')

and the runtime directory is created/symlinked before generateEphemeralDenoConfig(...) is called.

Relevant logs:

2026-06-19T14:30:23+02:00 rocketchat-server.rocketchat-server[364986]: Error while compiling the App "GIPHY (8b882242-0cb7-419f-87d8-93b1d09e1ec2)":
2026-06-19T14:30:23+02:00 rocketchat-server.rocketchat-server[364986]: Error: EROFS: read-only file system, open '/snap/rocketchat-server/1788/programs/server/npm/node_modules/@rocket.chat/apps/deno-runtime/deno.runtime.jsonc'
2026-06-19T14:30:23+02:00 rocketchat-server.rocketchat-server[364986]:     at generateEphemeralDenoConfig (/snap/rocketchat-server/1788/programs/server/npm/node_modules/@rocket.chat/apps/src/server/runtime/deno/AppsEngineDenoRuntime.ts:118:5)
2026-06-19T14:30:23+02:00 rocketchat-server.rocketchat-server[364986]:     at new DenoRuntimeSubprocessController (/snap/rocketchat-server/1788/programs/server/npm/node_modules/@rocket.chat/apps/src/server/runtime/deno/AppsEngineDenoRuntime.ts:198:3)
2026-06-19T14:30:23+02:00 rocketchat-server.rocketchat-server[364986]:     at AppRuntimeManager.defaultRuntimeFactory [as runtimeFactory] (/snap/rocketchat-server/1788/programs/server/npm/node_modules/@rocket.chat/apps/src/server/managers/AppRuntimeManager.ts:22:2)
2026-06-19T14:30:23+02:00 rocketchat-server.rocketchat-server[364986]:     at AppRuntimeManager.startRuntimeForApp (/snap/rocketchat-server/1788/programs/server/npm/node_modules/@rocket.chat/apps/src/server/managers/AppRuntimeManager.ts:43:35)
2026-06-19T14:30:23+02:00 rocketchat-server.rocketchat-server[364986]:     at AppCompiler.toSandBox (/snap/rocketchat-server/1788/programs/server/npm/node_modules/@rocket.chat/apps/src/server/compiler/AppCompiler.ts:24:46)
2026-06-19T14:30:23+02:00 rocketchat-server.rocketchat-server[364986]:     at AppManager.load (/snap/rocketchat-server/1788/programs/server/npm/node_modules/@rocket.chat/apps/src/server/AppManager.ts:294:42)
2026-06-19T14:30:23+02:00 rocketchat-server.rocketchat-server[364986]:     at AppServerOrchestrator.load (ee/server/apps/orchestrator.js:195:3) {
2026-06-19T14:30:23+02:00 rocketchat-server.rocketchat-server[364986]:   path: '/snap/rocketchat-server/1788/programs/server/npm/node_modules/@rocket.chat/apps/deno-runtime/deno.runtime.jsonc'

Start in packages/apps/src/server/runtime/deno/AppsEngineDenoRuntime.ts at generateEphemeralDenoConfig and follow DenoRuntimeSubprocessController initialization, including the existing temp runtime path. Reproduce the GIPHY enablement failure on the official Snap deployment and verify that the generated config is written to a writable temp location so the app compiles and enables successfully.