[BUG] - Docker image incompatible with readOnlyRootFilesystem (Kubernetes security best practice)

**Internal/External** External **Area** Other - Docker image / Nix wrapper / run-node script **Summary** The cardano-node Docker image (10.6.2) is incompatible with `readOnlyRootFilesystem: true` in Kubernetes due to two separate issues: 1. **Scripts mode (`NETWORK=mainnet`)**: The Nix-generated wrapper hardcodes RTS option `-tcardano-node.stats` which tries to write to the current working directory 2. **Custom mode (`run` arg)**: The `/usr/local/bin/run-node` script writes to `/usr/local/bin/env` Running with `readOnlyRootFilesystem: true` is a Kubernetes security best practice recommended by CIS benchmarks. **Steps to reproduce** **Issue 1 - Scripts mode:** ```bash docker run --read-only -e NETWORK=mainnet ghcr.io/intersectmbo/cardano-node:10.6.2 ``` Error: `cardano-node: Can't open stats file cardano-node.stats` **Issue 2 - Custom mode:** ```bash docker run --read-only ghcr.io/intersectmbo/cardano-node:10.6.2 run ``` Error: `/usr/local/bin/run-node: line 93: /usr/local/bin/env: Read-only file system` **Expected behavior** The node should start successfully with `readOnlyRootFilesystem: true`. **System info:** - OS: Kubernetes (EKS) with containerd - Node version: cardano-node 10.6.2 - Docker image: `ghcr.io/intersectmbo/cardano-node:10.6.2` **Logs - Issue 1 (Scripts mode)** ``` Starting: exec /nix/store/.../cardano-node run ... +RTS --machine-readable -tcardano-node.stats ... -RTS cardano-node: Can't open stats file cardano-node.stats ``` **Logs - Issue 2 (Custom mode)** ``` Running cardano node ... CARDANO_BIND_ADDR=0.0.0.0 CARDANO_BLOCK_PRODUCER=false CARDANO_CONFIG=/opt/cardano/config/mainnet/config.json CARDANO_DATABASE_PATH=/data/db CARDANO_LOG_DIR=/opt/cardano/logs CARDANO_PORT=3001 CARDANO_SOCKET_PATH=/ipc/node.socket CARDANO_TOPOLOGY=/configuration/topology.json /usr/local/bin/run-node: line 93: /usr/local/bin/env: Read-only file system ``` **Root Cause** 1. The Nix wrapper at `/nix/store/.../cardano-node-mainnet` hardcodes `-tcardano-node.stats` RTS option 2. The `run-node` script's `writeRootEnv()` function writes to `/usr/local/bin/env` **Suggested Fix** 1. Make the stats file path configurable or write to `/tmp` or `/data` 2. Write the env file to a writable location like `/tmp/env` instead of `/usr/local/bin/env` 3. Or provide a "minimal" mode that skips these writes entirely **Workaround** Disable `readOnlyRootFilesystem` (reduces security posture).