Trying to set up a mysql container in docker with the read-only flag set for security, but running into this error:
[ERROR] Could not create unix socket lock file /var/run/mysqld/mysqld.sock.lock.
Trying to alleviate the problem by mounting /var/run/mysqld as a tmpfs, however it seems that as long as the container is read-only the tmpfs mount is also read-only.
docker run --read-only --mount type=tmpfs,destination=/var/run/mysqld,tmpfs-mode=1777 mysql:5 touch /var/run/mysqld/test
touch: cannot touch '/var/run/mysqld/test': Read-only file system
Using a volume mount instead of tmpfs works, but that is not what I want to do:
docker run --read-only --mount destination=/var/run/mysqld mysql:5 touch /var/run/mysqld
Testing it on a non-existant directory also works:
docker run --read-only --mount type=tmpfs,destination=/test,tmpfs-mode=1777 mysql:5 touch /test/test
And it works if you remove the read-only flag from the container:
docker run --mount type=tmpfs,destination=/var/run/mysqld,tmpfs-mode=1777 mysql:5 touch /var/run/mysqld/test
Is this by design or a bug or am I missing some setting?
Docker version 19.03.12, build 48a66213fe