temporalio / temporalio/ui

[Feature Request] Support for OpenShift

Open
#2,327 4 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
TypeScript
Stars
431
Forks
179
Avg merge
2d 9h
Merged PRs (30d)
71

Description

Is your feature request related to a problem? Please describe.

I attempted to deploy temporal via helm (https://github.com/temporalio/helm-charts/tree/main) onto an openshift cluster.

Ran into issues running the temporal server and temporal ui containers on openshift due to security constraints (running on openshift - https://cloud.redhat.com/blog/a-guide-to-openshift-and-uids)

Identified the root cause to be the following sections:

Essentially what we are observing is openshift enforces specific UID and GID for the running containers that do not match the predefined values in the image definition and therefore fail with the following error:

2024/09/13 06:29:11 unable to create open ./config/docker.yaml: permission denied
Describe the solution you'd like

Dockerfile definition should not pin specific UIDs for non root user enforcement, but instead ensure that all directories that are required for functionality have sufficient privileges.

Describe alternatives you've considered

To get around this issue the following Dockerfile was used and confirmed to work

FROM temporalio/ui:2.30.3

RUN chmod o+w /home/ui-server/config

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with ui-server/Dockerfile at the referenced line and compare its fixed user settings with the OpenShift permission failure. Review the provided Dockerfile workaround and verify that the required config directory and config/docker.yaml remain writable for OpenShift-assigned UIDs without relying on a fixed UID. Done means the Temporal UI container can start under those security constraints.

Written by the indexing model from the issue text.

Assessment

Tech stack
dockerfile, typescript
Domain
devops, infrastructure
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.