Enclave-Information-Systems/helm
2
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages 5 Wiki Activity Actions

fix(sure): make /tmp usable for ruby #43

Merged
ryan.mcgee merged 1 commit from fix/sure-tmp-volume into main 2026-10-30 18:57:23 +00:00
Conversation 0 Commits 1 Files changed 4 +21 -3
ryan.mcgee commented 2026-10-30 18:55:30 +00:00
Owner
Copy link

Summary

  • On a cluster the web pod crash-looped at start: /tmp is world-writable, could not find a temporary directory. Kubernetes creates a disk-backed emptyDir with mode 2777 (no sticky bit) and Ruby's Dir.tmpdir refuses it. The podman test used a tmpfs, which is sticky, and did not show it.
  • Found while moving an instance onto the cluster on 2026-10-30; the stack worked around it with TMPDIR pointing at the upload volume.

Changes

  • sure.volumes: /tmp is a memory-backed emptyDir with sizeLimit from the new value tmp.sizeLimit (256Mi). A memory-backed one is created 3777.
  • The memory use counts against the container's limit, so the size is capped: a write beyond it fails with "no space left" instead of the pod being OOM-killed.
  • Chart version 0.2.1; README updated.

Verification

  • Tested in a pod on the cluster with the real image (0.7.7-alpha.1), uid 1000, read-only root, fsGroup 1000: disk-backed emptyDir at /tmp is 2777 and Dir.tmpdir raises; with a subPath the same; medium: Memory is 3777 and Dir.tmpdir returns /tmp; a directory made by an init container (0700) also works.
  • helm lint --strict on ci/default-values.yaml and ci/external-values.yaml: 0 failed; helm template renders medium: Memory, sizeLimit: "256Mi".
  • Not yet run: the full chart with this fix on the cluster (planned after the chart is published, by removing the workaround from the stack).

Notes

  • Alternative considered: an init container creating a 0700 directory on the disk-backed volume and TMPDIR pointing at it. It works but adds a container to every pod.
  • Large uploads: the cap is 256Mi; raise tmp.sizeLimit together with the memory limit if imports need more.
## Summary - On a cluster the web pod crash-looped at start: `/tmp is world-writable`, `could not find a temporary directory`. Kubernetes creates a disk-backed `emptyDir` with mode 2777 (no sticky bit) and Ruby's `Dir.tmpdir` refuses it. The podman test used a tmpfs, which is sticky, and did not show it. - Found while moving an instance onto the cluster on 2026-10-30; the stack worked around it with `TMPDIR` pointing at the upload volume. ## Changes - `sure.volumes`: `/tmp` is a memory-backed `emptyDir` with `sizeLimit` from the new value `tmp.sizeLimit` (256Mi). A memory-backed one is created 3777. - The memory use counts against the container's limit, so the size is capped: a write beyond it fails with "no space left" instead of the pod being OOM-killed. - Chart version 0.2.1; README updated. ## Verification - Tested in a pod on the cluster with the real image (0.7.7-alpha.1), uid 1000, read-only root, `fsGroup` 1000: disk-backed `emptyDir` at `/tmp` is 2777 and `Dir.tmpdir` raises; with a `subPath` the same; `medium: Memory` is 3777 and `Dir.tmpdir` returns `/tmp`; a directory made by an init container (0700) also works. - `helm lint --strict` on `ci/default-values.yaml` and `ci/external-values.yaml`: 0 failed; `helm template` renders `medium: Memory`, `sizeLimit: "256Mi"`. - Not yet run: the full chart with this fix on the cluster (planned after the chart is published, by removing the workaround from the stack). ## Notes - Alternative considered: an init container creating a 0700 directory on the disk-backed volume and `TMPDIR` pointing at it. It works but adds a container to every pod. - Large uploads: the cap is 256Mi; raise `tmp.sizeLimit` together with the memory limit if imports need more.
fix(sure): make /tmp usable for ruby
All checks were successful
Publish preview charts / preview (pull_request) Successful in 17s
Details
Lint charts / lint (pull_request) Successful in 1m13s
Details
7eed080ec3 
- a disk-backed emptyDir is created 2777 without the sticky bit, and
  Ruby's Dir.tmpdir refuses it, so the web pod crash-looped at start
  ("could not find a temporary directory")
- mount /tmp as a memory-backed emptyDir, which is created 3777
- new value tmp.sizeLimit (256Mi): the use counts against the memory
  limit, so cap it
- chart version 0.2.1
ryan.mcgee deleted branch fix/sure-tmp-volume 2026-10-30 18:57:23 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Enclave-Information-Systems/helm!43
No description provided.