fix: make runner egress proxy logs writable after Squid drops privileges #575

New issue

Closed

opened 2026-07-22 07:19:19 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-07-22 07:19:19 +00:00

Owner

Flux deployed the runner egress proxy from commit 2896a78, but both replicas restart after Squid parses the config and initializes networking. Live logs show the proxy effective user refusing access_log stdio:/dev/stdout and cache_log /dev/stderr because those parent paths are not writable.

Use an init container to create log-path symlinks inside the writable /var/log/squid emptyDir, then point Squid at those paths. Preserve Kubernetes stdout/stderr visibility and the existing allowlist. Remove the via off setting that Squid warns violates HTTP requirements.

Acceptance: both replicas become Ready, startup logs are clean, and allowed CONNECT requests remain visible through kubectl logs.

Flux deployed the runner egress proxy from commit 2896a78, but both replicas restart after Squid parses the config and initializes networking. Live logs show the `proxy` effective user refusing `access_log stdio:/dev/stdout` and `cache_log /dev/stderr` because those parent paths are not writable. Use an init container to create log-path symlinks inside the writable `/var/log/squid` emptyDir, then point Squid at those paths. Preserve Kubernetes stdout/stderr visibility and the existing allowlist. Remove the `via off` setting that Squid warns violates HTTP requirements. Acceptance: both replicas become Ready, startup logs are clean, and allowed CONNECT requests remain visible through `kubectl logs`.

coilyco-ops referenced this issue from a commit

2026-07-22 07:20:19 +00:00

fix(ci): stream Squid logs through writable paths

coilyco-ops commented

2026-07-22 07:23:22 +00:00

Author

Owner

The first correction created the log symlinks, but the new ReplicaSet still failed Squid’s parent-directory safety check because the mounted /var/log/squid directory remained root-owned. The next correction assigns that directory to the image’s existing proxy account before Squid starts. This is the same effective-user log-path defect, not a new network or proxy-config failure.

The first correction created the log symlinks, but the new ReplicaSet still failed Squid’s parent-directory safety check because the mounted `/var/log/squid` directory remained root-owned. The next correction assigns that directory to the image’s existing `proxy` account before Squid starts. This is the same effective-user log-path defect, not a new network or proxy-config failure.

coilyco-ops referenced this issue from a commit

2026-07-22 07:24:59 +00:00

fix(ci): hand Squid ownership of its log directory

coilyco-ops closed this issue

2026-07-22 07:24:59 +00:00

coilyco-ops referenced this issue from a commit

2026-07-22 07:28:06 +00:00

fix(ci): disable Squid file logging