From 3d0d90304cec5ebcdb34935400de31afd62e258d Mon Sep 17 00:00:00 2001 From: Jorijn Schrijvershof Date: Mon, 5 Jan 2026 10:49:02 +0100 Subject: [PATCH] fix: add tmpfs mount for fontconfig cache to fix read-only filesystem errors MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The container runs with read_only: true for security hardening, but fontconfig needs a writable cache directory. Added tmpfs mount at /var/cache/fontconfig to allow fontconfig to write its cache without compromising the read-only filesystem security. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 --- docker-compose.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/docker-compose.yml b/docker-compose.yml index 85062cc..03d751a 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -47,6 +47,7 @@ services: read_only: true tmpfs: - /tmp:noexec,nosuid,size=64m + - /var/cache/fontconfig:noexec,nosuid,size=4m # Resource limits deploy: