fix: keep the NetBird daemon socket and log file off the read-only rootfs

[stubbi]

Problem

The spec.netbird sidecar crash-loops with the standard netbirdio/netbird image (#624). The image entrypoint starts netbird service run before netbird up, and both default to paths on the root filesystem, which the operator makes read-only:

Failed to write to log, can't make directories for new logfile: mkdir /var/log/netbird: read-only file system
Error: listen daemon interface: listen unix /var/run/netbird.sock: bind: read-only file system
daemon failed to start, exiting...

Change

In internal/resources/mesh_netbird.go the sidecar now also gets:

• NB_DAEMON_ADDR=unix:///tmp/netbird/netbird.sock: the daemon socket lives on the netbird-state emptyDir. Both service run and up read it (NetBird maps every persistent flag to NB_<FLAG>, here --daemon-addr).
• NB_LOG_FILE=console,/tmp/netbird/client.log: logs still go to the console. A real file is kept as well because the entrypoint tails it for started daemon server before it runs netbird up. With console only, it would sleep blindly instead. The client rotates the file itself (lumberjack).
• USER=netbird: once the first two were fixed, netbird up failed next with user: Current requires cgo or $USER set in environment, because the pod UID has no passwd entry in the image.

No API change and no new volume. The image entrypoint is unchanged.

Testing

• Reproduced and verified locally with netbirdio/netbird:0.60.8 under docker run --read-only --user 1000:1000 --cap-drop ALL --security-opt no-new-privileges, a writable tmpfs at /tmp/netbird, and the operator's env:
  • before: the two errors above, exit 1 after 5 s.
  • after: started daemon server: /tmp/netbird/netbird.sock, then netbird up gets as far as contacting the management URL. With an unreachable loopback URL and a fake key it then fails on enrollment, which is the expected end of this test, the same scope as the report.
• New unit test TestNetBirdSidecar_WritablePathsLiveOnMountedVolume: the daemon socket, log file, state dir and config must all sit on a writable mount, and USER must be set.
• New e2e spec Should start the NetBird daemon under a read-only root filesystem: starts the real image in kind and waits for started daemon server in the sidecar log, with no read-only file system error. This is the container startup test the report asked for.
• I could not run make test locally (the machine ran out of disk), so unit tests, lint and e2e run in CI only.

Not covered

• Inbound forwarding (NB_ENABLE_NETSTACK_LOCAL_FORWARDING) and real enrollment are untested, as noted in the issue.

Fixes #624

🤖 Generated with Claude Code

[stubbi]

Merge order note (maintenance pass, 2026-10-11). The open stubbi PRs are stacked so they apply cleanly in this order: #623 → #627 → #620 → #618 → #617 → #628 → #629. This is position 7 of 7. This branch has #628 (and everything below it) merged in, so until those land the diff here also shows their changes; once they are squash-merged, "Update branch" reduces it to this PR's own changes without conflicts. #623 is at the bottom because the required E2E check cannot pass without its sticky /tmp fix (OpenClaw >= 2026.9.6 crash-loops otherwise). Branch protection requires an up-to-date branch, so after each merge click "Update branch" on the next PR and let CI re-run before merging it.

[github-actions]

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs. If this PR is still relevant, please push updates or leave a comment.

[jtatum]

Not stale