Mounting read-only volumes in Docker - Commands & Configuration

Introduction

Sometimes you want to share files or folders with a container but prevent the container from changing them. Mounting a volume as read-only lets the container use the files without risking accidental changes.

When you want to share configuration files with a container but keep them safe from modification.

When you run a container that needs to read data files but should not write or delete them.

When multiple containers share the same data but only one container should be allowed to modify it.

When you want to protect important scripts or binaries inside a container from being changed.

When you want to debug or inspect files inside a container without risking changes.

Commands

This command runs an Nginx container named 'my-nginx'. It mounts the host folder '/usr/share/nginx/html' into the container as a read-only volume using ':ro'. The container listens on port 80, mapped to host port 8080.

Terminal

docker run -d --name my-nginx -v /usr/share/nginx/html:/usr/share/nginx/html:ro -p 8080:80 nginx:1.23.3

Expected Output

a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6

→

-v - Mounts a volume from host to container

→

:ro - Makes the mounted volume read-only inside the container

→

-p - Maps container port to host port

This command lists the files inside the mounted folder in the running container to verify the volume is mounted correctly and accessible.

Terminal

docker exec my-nginx ls -l /usr/share/nginx/html

Expected Output

total 4

-rw-r--r-- 1 root root 612 Apr 10 12:00 index.html

This command tries to create a new file inside the read-only mounted volume to demonstrate that write operations are blocked.

Terminal

docker exec my-nginx touch /usr/share/nginx/html/testfile

Expected Output

touch: cannot touch '/usr/share/nginx/html/testfile': Read-only file system

Key Concept

If you remember nothing else from this pattern, remember: adding ':ro' after the volume path makes the container see the volume as read-only.

Common Mistakes

Forgetting to add ':ro' after the volume path when mounting.

The volume will be mounted with default read-write permissions, allowing the container to modify files.

Always append ':ro' to the volume path to enforce read-only access.

Trying to write or create files inside a read-only mounted volume.

The container will get a 'Read-only file system' error and fail to write.

Avoid write operations on read-only volumes or mount a separate writable volume if needed.

Summary

Use the '-v' flag with ':ro' to mount a host folder as read-only inside a container.

Verify the volume is mounted by listing files inside the container.

Write operations inside a read-only volume will fail with a read-only file system error.

Practice

1. What does adding :ro at the end of a Docker volume mount do?

easy

A. Mounts the volume with root user permissions

B. Mounts the volume as read-write, allowing container writes

C. Removes the volume after container stops

D. Mounts the volume as read-only, preventing container writes

Solution

1. Step 1: Understand Docker volume mount options

   Docker allows mounting volumes with options like :ro or :rw to control access.

2. Step 2: Identify the effect of :ro

   The :ro option makes the mounted volume read-only inside the container, so the container cannot modify the data.

3. Final Answer:

   Mounts the volume as read-only, preventing container writes -> Option D

4. Quick Check:

   :ro means read-only mount [OK]

Hint: Remember 'ro' means read-only, no writes allowed [OK]

Common Mistakes:

• Confusing :ro with :rw
• Thinking :ro deletes volume after use
• Assuming :ro changes user permissions

2. Which of the following is the correct syntax to mount a host directory /data as a read-only volume inside a container at /app/data?

easy

A. docker run -v /data:/app/data:rw myimage

B. docker run -v /data:/app/data:read-only myimage

C. docker run -v /data:/app/data:ro myimage

D. docker run -v /data:/app/data:readonly myimage

Solution

1. Step 1: Recall Docker volume mount syntax

   The syntax is -v host_path:container_path:options, where options can be ro or rw.

2. Step 2: Identify correct read-only option

   The correct option for read-only is ro. Options like read-only or readonly are invalid.

3. Final Answer:

   docker run -v /data:/app/data:ro myimage -> Option C

4. Quick Check:

   Use :ro for read-only mount [OK]

Hint: Use ':ro' exactly for read-only volume mounts [OK]

Common Mistakes:

• Using ':rw' instead of ':ro' for read-only
• Writing 'readonly' or 'read-only' instead of 'ro'
• Omitting the option entirely

3. Given the command:

docker run -v /host/config:/app/config:ro myapp

What will happen if the container tries to write a file inside /app/config?

medium

A. The write will fail with a permission error

B. The container will crash immediately

C. The write will succeed and file will be saved

D. Docker will remount the volume as read-write automatically

Solution

1. Step 1: Understand the effect of :ro mount

   The volume is mounted read-only, so the container cannot modify files in /app/config.

2. Step 2: Predict container behavior on write attempt

   When the container tries to write, the OS denies permission, causing a write failure with an error.

3. Final Answer:

   The write will fail with a permission error -> Option A

4. Quick Check:

   Read-only mount blocks writes with permission error [OK]

Hint: Read-only volumes block writes, causing permission errors [OK]

Common Mistakes:

• Assuming writes succeed on read-only mounts
• Thinking Docker remounts volumes automatically
• Believing container crashes on write failure

4. You run this command:

docker run -v /data:/app/data myimage

You want to make the volume read-only but accidentally write :ro as :or. What will happen?

medium

A. Docker will mount the volume as read-only anyway

B. Docker will throw an error and refuse to start the container

C. The volume will be mounted as read-write

D. The container will start but fail when writing to the volume

Solution

1. Step 1: Check the mount option syntax

   The option :ro is valid for read-only. :or is invalid and not recognized by Docker.

2. Step 2: Understand Docker's response to invalid options

   Docker will detect the invalid option and refuse to start the container, showing an error.

3. Final Answer:

   Docker will throw an error and refuse to start the container -> Option B

4. Quick Check:

   Invalid mount options cause Docker errors [OK]

Hint: Check option spelling carefully; invalid options cause errors [OK]

Common Mistakes:

• Assuming Docker ignores invalid mount options
• Thinking volume mounts as read-only despite typo
• Believing container starts but fails later

5. You want to share a configuration directory /etc/config with multiple containers but prevent them from modifying it. Which command correctly mounts it read-only and ensures the container user cannot override this?

hard

A. docker run -v /etc/config:/config:ro myapp

B. docker run --read-only -v /etc/config:/config myapp

C. docker run -v /etc/config:/config:rw --user 1000 myapp

D. docker run -v /etc/config:/config:rw myapp

Solution

1. Step 1: Understand read-only volume mount

   Mounting with :ro makes the volume read-only inside the container, preventing writes regardless of user.

2. Step 2: Evaluate other options

   docker run --read-only -v /etc/config:/config myapp makes the entire container filesystem read-only, which is overly restrictive. docker run -v /etc/config:/config:rw --user 1000 myapp adds user but does not prevent writes since volume is read-write. docker run -v /etc/config:/config:rw myapp mounts read-write, allowing changes.

3. Final Answer:

   docker run -v /etc/config:/config:ro myapp -> Option A

4. Quick Check:

   Use :ro to share read-only volumes safely [OK]

Hint: Use ':ro' to protect shared data from container writes [OK]

Common Mistakes:

• Confusing container read-only flag with volume read-only
• Mounting volume as read-write by mistake
• Thinking user ID affects volume write permissions