gitea and read-only filsystems

[micheelengronne]

Gitea wants to modify files even if they are present and with the content gitea wants to put in.

Therefore, Gitea breaks on read-only filesystems (like an hardened docker container.)

My problem is simple.

This method wants to modify a .gitconfig file:

gitea/modules/git/git.go

Line 109 in 9a2e47b

func Init(ctx context.Context) error {

It runs even if the .gitconfig file exists with the correct content.

Is it possible to stop that behaviour ?

Thanks.

[CirnoT]

We rely on git config --global to make changes to Git config file

[micheelengronne]

Yes, but can we disable this method when the file already exists ?

[zeripath]

Just set the HOME environment variable as appropriate to somewhere that can be changed.

[CirnoT]

Yes, but can we disable this method when the file already exists ?

No, because we don't know whether correct values are set or not. The fact that file exists tells us nothing. The .gitconfig is supposed to be writable should new version introduce some new config to be set there.

[micheelengronne]

My usecase happens in a container environment. A new version is introduced by creating a new container image, not updating the existing one.

[micheelengronne]

I tried to do an init container that sets everything and a container with gitea web but still the gitea web cli wants to use this method.

It is a security issue as it forces to use a read-write filesystem for just a file that can easily be commmited in a git.

Can we, at least, have an option to use gitea web and other production-running state commands in a read-only filesystem ?

[zeripath]

@micheelengronne have you set the HOME environment variable appropriately?

[micheelengronne]

Changing the HOME variable is not a solution either. In an immutable hardened container, only data should change, nothing else.

[micheelengronne]

So, what can change is the content of ROOT according to the config cheat sheet.

[micheelengronne]

I am sorry to be strict on that. But this is an absolute condition to make gitea run in security hardened infrastructures. Containers must work with read-only FS and read-only configurations and secrets.

[zeripath]

Right the issue is that Git is making the change to the file.

We are limited in how we can tell Git to look for its .gitconfig.

Git uses HOME to determine the global gitconfig which we use to set various global settings and to look up various things.

So I ask again, have you tried setting the HOME variable to a mutable place?

[zeripath]

If that works then can consider if there is a place for using ROOT to artificially change the HOME for git etc. but without knowing that then we're likely leading down a blind alley and we might have to think about if we need to set things a different way eg. through the default args system

[micheelengronne]

To be sure we talk about the same thing. If I move HOME, I move my user directory, right ? So, I move all configurations in it ?

Did I understand correctly ?

In that way, configurations are not immutables and that will not pass hardened security tests.

Why can't we have a way to include a .gitconfig file containing the same content and for the method to check if the file exists with the correct content prior to create it ?

[zeripath]

No I mean just set the HOME environment variable when you run gitea

[micheelengronne]

But that will screw up my user directory.

For instance, my user is git. I put this file content in /home/git/.gitconfig.

[user]
	name = Gitea
	email = gitea@fake.local
[core]
	quotepath = false
	commitGraph = true
[gc]
	writeCommitGraph = true

Then the init method should not try to write this file.

Do you suggest, I move HOME to /home/git/mutable and make this directory writable ?

If it works that's better than nothing but that will still break the security hardening check as .gitconfig is also a configuration file.

I try.