[Feature Request] Support for OpenShift
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 431
- Forks
- 179
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 71
Description
Is your feature request related to a problem? Please describe.
I attempted to deploy temporal via helm (https://github.com/temporalio/helm-charts/tree/main) onto an openshift cluster.
Ran into issues running the temporal server and temporal ui containers on openshift due to security constraints (running on openshift - https://cloud.redhat.com/blog/a-guide-to-openshift-and-uids)
Identified the root cause to be the following sections:
- server issue #1 - added to issue - https://github.com/temporalio/helm-charts/issues/558
- server issue #2 - added to issue: https://github.com/temporalio/docker-builds/issues/241
- ui - https://github.com/temporalio/ui-server/blob/main/Dockerfile#L32
Essentially what we are observing is openshift enforces specific UID and GID for the running containers that do not match the predefined values in the image definition and therefore fail with the following error:
2024/09/13 06:29:11 unable to create open ./config/docker.yaml: permission denied
Describe the solution you'd like
Dockerfile definition should not pin specific UIDs for non root user enforcement, but instead ensure that all directories that are required for functionality have sufficient privileges.
Describe alternatives you've considered
To get around this issue the following Dockerfile was used and confirmed to work
FROM temporalio/ui:2.30.3
RUN chmod o+w /home/ui-server/config
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with ui-server/Dockerfile at the referenced line and compare its fixed user settings with the OpenShift permission failure. Review the provided Dockerfile workaround and verify that the required config directory and config/docker.yaml remain writable for OpenShift-assigned UIDs without relying on a fixed UID. Done means the Temporal UI container can start under those security constraints.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- dockerfile, typescript
- Domain
- devops, infrastructure
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100