Container security hardening (phase 4) (#24140)

* Support read-only rootfs with self-signed certs in /config/tls

* Support read-only rootfs in s6 and pre-compile bytecode

* Assert read-only rootfs support in CI

* Document hardened read-only deployment

* keep certsync's cert selection identical to nginx's

* note the uid trade-off in user: mode

* fail fast when EXTRA_GROUPS or a missing media volume meets read_only

* keep nosuid and nodev on the /run tmpfs

* support read_only in the default mode

* don't take go2rtc down when the homekit file isn't writable

* lead with the hardware consequence of switching to user:

* refuse to write TLS material through a symlink as root

* note that memryx writes models to the root filesystem

* certsync watches whichever cert path nginx loaded

docker/main/Dockerfile

@@ -316,6 +316,9 @@ EXPOSE 8555/tcp 8555/udp
 ENV S6_LOGGING_SCRIPT="T 1 n0 s10000000 T"
 # Do not fail on long-running download scripts
 ENV S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0
+# Allow running with a read-only root filesystem: s6 copies its scan dir into
+# /run and executes service scripts from there, so /run must allow exec
+ENV S6_READ_ONLY_ROOT=1
 
 ENTRYPOINT ["/init"]
 CMD []
@@ -387,3 +390,7 @@ FROM deps AS frigate
 
 WORKDIR /opt/frigate/
 COPY --from=rootfs / /
+
+# Pre-compile bytecode so a read-only rootfs doesn't force re-parsing the
+# source tree on every boot (pip-installed packages are already compiled)
+RUN python3 -m compileall -q -j0 /opt/frigate/frigate

docker/main/rootfs/etc/s6-overlay/s6-rc.d/certsync/run

@@ -26,7 +26,15 @@ function reload_nginx() {
 
 echo "[INFO] Starting certsync..."
 
-lefile="/etc/letsencrypt/live/frigate/fullchain.pem"
+# Resolved once, and the condition must stay identical to the nginx run
+# script's. Testing only fullchain.pem here would pick the mounted cert on a
+# half-populated mount that nginx rejected, and the two fingerprints would then
+# never agree, reloading nginx every cycle forever.
+if [ -f /etc/letsencrypt/live/frigate/privkey.pem ] && [ -f /etc/letsencrypt/live/frigate/fullchain.pem ]; then
+    lefile="/etc/letsencrypt/live/frigate/fullchain.pem"
+else
+    lefile="/config/tls/fullchain.pem"
+fi
 
 tls_enabled=`python3 /usr/local/nginx/get_nginx_settings.py | jq -r .tls.enabled`
 listen_external_port=`python3 /usr/local/nginx/get_nginx_settings.py | jq -r .listen.external_port`

docker/main/rootfs/etc/s6-overlay/s6-rc.d/init-usermod/run

@@ -79,6 +79,15 @@ fi
 
 # EXTRA_GROUPS: numeric host GIDs granting device access (e.g. host render/video)
 if [[ -n "${EXTRA_GROUPS:-}" ]]; then
+    # groupadd and usermod -aG both write /etc/group. Checked up front so a
+    # read-only rootfs reports the real problem instead of dying mid-loop.
+    if [[ ! -w /etc/group ]]; then
+        echo "[ERROR] EXTRA_GROUPS needs a writable /etc and is not compatible with read_only: true." >&2
+        echo "[ERROR] Use docker's group_add: with the same GIDs instead; it needs no writes inside the container." >&2
+        echo "[ERROR] See https://docs.frigate.video/configuration/non_root for the compatibility matrix." >&2
+        exit 1
+    fi
+
     for gid in ${EXTRA_GROUPS//,/ }; do
         if ! [[ "$gid" =~ ^[0-9]+$ ]] || [[ "$gid" -eq 0 ]]; then
             echo "[ERROR] EXTRA_GROUPS must be nonzero numeric GIDs, got '${gid}'" >&2

docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx/run

@@ -80,22 +80,49 @@ cp -r /usr/local/nginx/conf/. /tmp/nginx/conf/
 
 set_worker_processes
 
-# ensure the directory for ACME challenges exists
-mkdir -p /etc/letsencrypt/www
-
-# Create self signed certs if needed
+# TLS certs: user-mounted certs at /etc/letsencrypt/live/frigate (documented
+# contract) always win; otherwise fall back to a self-signed cert persisted in
+# /config/tls, which stays writable under a read-only root filesystem.
 letsencrypt_path=/etc/letsencrypt/live/frigate
-mkdir -p $letsencrypt_path
+selfsigned_path=/config/tls
 
-if [ ! \( -f "$letsencrypt_path/privkey.pem" -a -f "$letsencrypt_path/fullchain.pem" \) ]; then
-    echo "[INFO] No TLS certificate found. Generating a self signed certificate..."
-    openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 \
-        -subj "/O=FRIGATE DEFAULT CERT/CN=*" \
-        -keyout "$letsencrypt_path/privkey.pem" -out "$letsencrypt_path/fullchain.pem" 2>/dev/null
-    chmod 600 "$letsencrypt_path/privkey.pem"
-    chmod 644 "$letsencrypt_path/fullchain.pem"
+if [ -f "$letsencrypt_path/privkey.pem" ] && [ -f "$letsencrypt_path/fullchain.pem" ]; then
+    cert_path="$letsencrypt_path"
+else
+    cert_path="$selfsigned_path"
+
+    # Root writing into /config follows any symlink planted there, and /config
+    # is owned by whoever the host mount says, not by root. Generate as the
+    # runtime user wherever we are going to drop to it; the escape hatch keeps
+    # root all the way through, so that path is refused rather than dropped.
+    gen=()
+    if [[ "$(id -u)" -eq 0 && "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
+        gen=(s6-setuidgid frigate)
+    elif [[ "$(id -u)" -eq 0 ]]; then
+        for link in "$cert_path" "$cert_path/privkey.pem" "$cert_path/fullchain.pem"; do
+            if [[ -L "$link" ]]; then
+                echo "[ERROR] ${link} is a symlink; refusing to write TLS material through it as root" >&2
+                exit 1
+            fi
+        done
+    fi
+
+    "${gen[@]}" mkdir -p "$cert_path"
+
+    if [ ! \( -f "$cert_path/privkey.pem" -a -f "$cert_path/fullchain.pem" \) ]; then
+        echo "[INFO] No TLS certificate found. Generating a self signed certificate..."
+        "${gen[@]}" openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 \
+            -subj "/O=FRIGATE DEFAULT CERT/CN=*" \
+            -keyout "$cert_path/privkey.pem" -out "$cert_path/fullchain.pem" 2>/dev/null
+        "${gen[@]}" chmod 600 "$cert_path/privkey.pem"
+        "${gen[@]}" chmod 644 "$cert_path/fullchain.pem"
+    fi
 fi
 
+# ACME challenges are only served from a writable rootfs; skipping the mkdir
+# under read_only leaves the location 404ing, which is the same as unused
+mkdir -p /etc/letsencrypt/www 2>/dev/null || true
+
 # nginx settings are read once; both templates consume them
 nginx_settings=$(python3 /usr/local/nginx/get_nginx_settings.py)
 
@@ -104,8 +131,10 @@ echo "$nginx_settings" | \
     tempio -template /usr/local/nginx/templates/base_path.gotmpl \
            -out /tmp/nginx/conf/base_path.conf
 
-# build templates for additional network settings
+# build templates for additional network settings; listen.conf is the only
+# template that needs the resolved cert directory
 echo "$nginx_settings" | \
+    jq --arg p "$cert_path" '.tls.cert_path = $p' | \
     tempio -template /usr/local/nginx/templates/listen.gotmpl \
            -out /tmp/nginx/conf/listen.conf
 
@@ -118,9 +147,12 @@ if [[ "$(id -u)" -eq 0 && "$runs_as_root" -eq 0 ]]; then
     # nginx reopens /dev/stdout by path for its logs, and s6 made the pipe
     # root-owned 0600; without this the non-root master exits EACCES
     chown frigate /dev/stdout
-    # self-signed certs are root-generated; tolerant because mounted certs may be :ro
-    if [ -f "$letsencrypt_path/privkey.pem" ]; then
-        chown frigate:frigate "$letsencrypt_path/privkey.pem" "$letsencrypt_path/fullchain.pem" 2>/dev/null || true
+    # Only mounted certs need handing over; the self-signed pair is already
+    # owned by the runtime user that generated it. Never chown the /config copy:
+    # chown follows symlinks, so it would retarget onto any root file the
+    # runtime user pointed it at. Tolerant because mounted certs may be :ro.
+    if [ "$cert_path" = "$letsencrypt_path" ] && [ -f "$cert_path/privkey.pem" ]; then
+        chown frigate:frigate "$cert_path/privkey.pem" "$cert_path/fullchain.pem" 2>/dev/null || true
     fi
 fi
 

docker/main/rootfs/etc/s6-overlay/s6-rc.d/prepare/run

@@ -189,7 +189,14 @@ fi
 # Must stay after the sweep, which reads an absent /media/frigate as an
 # unmounted volume rather than a swept one
 if [[ "$(id -u)" -eq 0 && ! -d /media/frigate ]]; then
-    mkdir -p /media/frigate
+    # The image does not ship this directory, so on a read-only rootfs it can
+    # only come from a mount. Report that rather than failing under errexit.
+    if ! mkdir -p /media/frigate 2>/dev/null; then
+        echo "[ERROR] /media/frigate does not exist and could not be created, which is what happens with read_only: true and no recordings volume." >&2
+        echo "[ERROR] Mount a volume at /media/frigate." >&2
+        echo "[ERROR] See https://docs.frigate.video/configuration/non_root for the compatibility matrix." >&2
+        exit 1
+    fi
     if [[ "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
         chown "${PUID:-1000}:${PGID:-1000}" /media/frigate
     fi

docker/main/rootfs/usr/local/go2rtc/prepare_homekit.py

@@ -66,7 +66,17 @@ def main() -> int:
     path = sys.argv[1]
     do_chown = "--chown" in sys.argv[2:]
 
-    fd = open_nofollow(path)
+    try:
+        fd = open_nofollow(path)
+    except PermissionError:
+        print(
+            f"[WARN] {path} is not writable by uid {os.geteuid()}, so HomeKit "
+            "pairing changes will not persist. It is owned by the go2rtc user "
+            "from an earlier run in the default mode. To fix, on the host run: "
+            f"chown {os.geteuid()}:{os.getegid()} <your config dir>/{os.path.basename(path)}"
+        )
+        return 0
+
     try:
         content = os.read(fd, MAX_BYTES).decode("utf-8", "replace")
         normalized = normalize(content)

docker/main/rootfs/usr/local/nginx/templates/listen.gotmpl

@@ -8,8 +8,8 @@ listen {{ .listen.internal }};
     listen {{ .listen.external }} ssl;
     {{ if .ipv6.enabled }}listen [::]:{{ .listen.external_port }} ssl;{{ end }}
 
-    ssl_certificate /etc/letsencrypt/live/frigate/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/frigate/privkey.pem;
+    ssl_certificate {{ .tls.cert_path }}/fullchain.pem;
+    ssl_certificate_key {{ .tls.cert_path }}/privkey.pem;
 
     # generated 2024-06-01, Mozilla Guideline v5.7, nginx 1.25.3, OpenSSL 1.1.1w, modern configuration, no OCSP
     # https://ssl-config.mozilla.org/#server=nginx&version=1.25.3&config=modern&openssl=1.1.1w&ocsp=false&guideline=5.7