Docker Docker Security Readonly Root Filesystem readonly

1. Core Command / Concept

The Read-Only Root Filesystem (ROFS) prevents a container from modifying the root filesystem, improving security and reducing the risk of data corruption. docker run --read-only

2. Step-by-Step

1. Create a new Dockerfile with a simple "hello world" application: echo "FROM alpine:latest" > Dockerfile && echo "CMD [\"echo\", \"Hello World!\"]" >> Dockerfile
2. Build the Docker image: docker build -t myimage .
3. Run the container with ROFS: docker run --read-only --name mycontainer myimage
4. Attempt to write to the root filesystem: docker exec -it mycontainer echo "Hello" > /root/test.txt
5. Check the output: docker logs mycontainer (should show an error message)
6. ⚠️ Delete the container: docker rm -f mycontainer
7. Clean up the image: docker rmi myimage

3. Real Commands with Examples

Example 1: Run a container with ROFS and a volume

Purpose: Run a container with ROFS and mount a volume for data storage.
Command: docker run --read-only -v /data:/data --name mycontainer myimage Flags: -v mounts a volume, --read-only enables ROFS.

Example 2: Run a container with ROFS and a bind mount

Purpose: Run a container with ROFS and bind-mount a directory from the host.
Command: docker run --read-only -v /host/data:/data --name mycontainer myimage Flags: -v mounts a volume, --read-only enables ROFS.

Example 3: Run a container with ROFS and a tmpfs mount

Purpose: Run a container with ROFS and mount a tmpfs filesystem for temporary storage.
Command: docker run --read-only -v /tmp:/tmp --name mycontainer myimage Flags: -v mounts a volume, --read-only enables ROFS.

4. Common Errors

Error 1: "Error: unable to write to root filesystem"

Error message or symptom: The container fails to start due to a write error.
Why it happens: The container is trying to write to the root filesystem, which is read-only.
One-line fix: docker run --read-only -v /data:/data myimage

Error 2: "Error: unable to mount volume"

Error message or symptom: The container fails to start due to a volume mount error.
Why it happens: The volume mount is not properly configured.
One-line fix: docker run --read-only -v /host/data:/data myimage

Error 3: "Error: unable to bind-mount directory"

Error message or symptom: The container fails to start due to a bind-mount error.
Why it happens: The bind-mount is not properly configured.
One-line fix: docker run --read-only -v /host/data:/data myimage

5. Quick Checks

Scenario 1: Check if a container is running with ROFS

Situation: You want to check if a container is running with ROFS.
Command: docker inspect --format '{{.Config.Readonly}}' mycontainer Correct response: true

Scenario 2: Check if a container has a volume mounted

Situation: You want to check if a container has a volume mounted.
Command: docker inspect --format '{{.Mounts}}' mycontainer Correct response: [{"Name":"data","Mountpoint":"/data","Source":"/host/data","Type":"bind","RW":true}]

Scenario 3: Check if a container has a tmpfs mount

Situation: You want to check if a container has a tmpfs mount.
Command: docker inspect --format '{{.Mounts}}' mycontainer Correct response: [{"Name":"tmp","Mountpoint":"/tmp","Source":"tmpfs","Type":"tmpfs","RW":true}]

6. Last-Minute Reference

• --read-only flag: enables ROFS • -v flag: mounts a volume • --name flag: sets the container name • docker inspect: inspects a container • docker logs: displays container logs • docker rm: removes a container • docker rmi: removes an image • ? Verify with docker version for version-specific flags • ⚠️ Be careful when deleting containers and images • ⚠️ Use --read-only with caution, as it can cause issues with some applications