Mounting read-only volumes in Docker - Deep Dive

Overview - Mounting read-only volumes

What is it?

Mounting read-only volumes means attaching a folder or file from your computer into a Docker container so the container can use it, but cannot change it. This protects the original data from accidental edits or deletions by the container. It is useful when you want to share data safely between your computer and the container.

Why it matters

Without read-only mounts, containers could accidentally or maliciously change important files on your computer or shared storage. This could cause data loss or security problems. Read-only mounts let you share data safely, making your container setups more reliable and secure.

Where it fits

You should know basic Docker concepts like containers and volumes before learning this. After this, you can learn about advanced volume options, data persistence, and Docker Compose for managing multi-container setups.

Mental Model

Core Idea

Mounting a read-only volume is like lending a book to a friend who can read it but cannot write or mark anything inside.

Think of it like...

Imagine you have a cookbook that you want to share with a friend. You let them read the book but you don’t want them to write notes or tear pages. Mounting a read-only volume is like giving them a copy that they can only read, protecting your original book.

Host Machine
  ┌───────────────┐
  │  /data-folder │
  └──────┬────────┘
         │ Mount read-only
         ▼
Docker Container
  ┌───────────────┐
  │ /app/data (ro)│
  └───────────────┘

(ro) means read-only access

Build-Up - 6 Steps

1

Foundation

Understanding Docker Volumes Basics

Concept: Learn what Docker volumes are and why they are used to share data between host and containers.

Docker volumes let containers access files from your computer or other storage. They help keep data even if the container stops or is deleted. Volumes can be read-write by default, meaning containers can change the files.

Result

You understand that volumes connect host files to containers and that by default containers can read and write these files.

Knowing volumes are the bridge for data sharing helps you see why controlling access (like read-only) is important.

2

Foundation

Basic Syntax for Mounting Volumes

Concept: Learn the command syntax to mount a volume into a container.

The basic Docker run command to mount a volume is: docker run -v /host/path:/container/path image This mounts the host folder at /host/path into the container at /container/path with read-write access.

Result

You can run a container with a folder from your computer accessible inside it.

Understanding the syntax is key to controlling how containers see your files.

3

Intermediate

Adding Read-Only Flag to Volume Mounts

🤔Before reading on: do you think adding ':ro' to the volume mount makes the container unable to write to the volume? Commit to your answer.

Concept: Learn how to make a mounted volume read-only by adding ':ro' at the end of the mount path.

To mount a volume as read-only, add ':ro' after the container path: docker run -v /host/path:/container/path:ro image This means the container can read files but cannot modify or delete them.

Result

The container can access the files but any attempt to write or delete will fail with permission errors.

Knowing the ':ro' flag lets you protect your data from accidental changes by containers.

4

Intermediate

Testing Read-Only Volume Behavior

🤔Before reading on: do you think a container with a read-only volume can create new files inside that volume? Commit to your answer.

Concept: Learn how to verify that a volume is truly read-only by trying to write inside the container.

Run a container with a read-only volume: docker run -it -v /host/data:/data:ro alpine sh Inside the container, try: touch /data/newfile You will get a 'Read-only file system' error, confirming the volume is read-only.

Result

The container cannot create or modify files in the mounted volume.

Testing confirms the protection and helps you trust the read-only setting.

5

Advanced

Combining Read-Only Volumes with Docker Compose

🤔Before reading on: do you think Docker Compose supports read-only volume mounts the same way as the Docker CLI? Commit to your answer.

Concept: Learn how to declare read-only volumes in Docker Compose files for multi-container setups.

In docker-compose.yml, you can specify read-only volumes like this: services: app: image: alpine volumes: - /host/data:/data:ro This mounts the volume as read-only inside the container managed by Compose.

Result

You can manage read-only volumes easily in complex setups using Compose.

Knowing Compose supports this lets you scale safe volume mounts beyond single containers.

6

Expert

Security Implications and Kernel-Level Enforcement

🤔Before reading on: do you think the read-only flag is enforced by Docker itself or by the operating system? Commit to your answer.

Concept: Understand how the read-only mount is enforced by the operating system kernel, not just Docker, providing strong protection.

When you mount a volume with ':ro', Docker tells the OS to mount the filesystem as read-only inside the container's namespace. The Linux kernel enforces this, so even if a process tries to write, the OS blocks it. This is stronger than just a Docker policy.

Result

Read-only mounts provide real, low-level protection against writes, improving container security.

Knowing the OS enforces read-only mounts explains why this method is reliable and hard to bypass.

Under the Hood

Docker uses the host operating system's mount namespaces and filesystem features to attach directories or files into containers. When a volume is mounted with the read-only flag, Docker instructs the OS kernel to mount that filesystem path inside the container with read-only permissions. This means the kernel prevents any write operations from the container processes, ensuring data integrity.

Why designed this way?

This design leverages existing OS-level security and filesystem controls, avoiding the need for Docker to implement complex access control itself. It provides strong guarantees and performance benefits. Alternatives like software-level permission checks would be less secure and slower.

Host OS
┌─────────────────────────────┐
│ /host/data (read-write)     │
│                             │
│  Docker Engine               │
│  ┌───────────────────────┐  │
│  │ Container Namespace   │  │
│  │ ┌───────────────────┐ │  │
│  │ │ /data (mounted)    │ │  │
│  │ │ (read-only mount)  │ │  │
│  │ └───────────────────┘ │  │
│  └───────────────────────┘  │
└─────────────────────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does mounting a volume as read-only mean the container cannot delete files inside it? Commit to yes or no.

Common Belief: Mounting a volume as read-only only prevents editing files but allows deleting them.

Reality: Read-only mounts prevent all write operations, including creating, modifying, and deleting files inside the volume.

Why it matters: Assuming deletes are allowed can cause unexpected data loss or errors when containers try to delete files.

Quick: Do you think the read-only flag can be overridden inside the container by root user? Commit to yes or no.

Common Belief: The container's root user can override the read-only mount and write to the volume.

Reality: The read-only mount is enforced by the OS kernel and cannot be bypassed by container users, even root.

Why it matters: Believing root can override this leads to false security assumptions and potential data corruption.

Quick: Does mounting a volume as read-only affect the host's original files' permissions? Commit to yes or no.

Common Belief: Mounting a volume as read-only changes the permissions of the original files on the host.

Reality: The read-only flag only affects the container's view; the host files remain unchanged and writable on the host.

Why it matters: Misunderstanding this can cause confusion about file access and permissions on the host system.

Quick: Can you mount a read-only volume on Windows the same way as on Linux? Commit to yes or no.

Common Belief: Read-only volume mounts work identically on Windows and Linux hosts.

Reality: Windows Docker has limitations and may not fully enforce read-only mounts the same way Linux does.

Why it matters: Assuming identical behavior can cause security gaps or bugs in cross-platform Docker setups.

Expert Zone

1

Read-only mounts do not prevent processes inside the container from writing to other writable layers or tmpfs mounts, so data can still be changed elsewhere.

2

Combining read-only volumes with user namespaces can further restrict container permissions, enhancing security.

3

Some filesystem types or network mounts may not fully support read-only enforcement, requiring extra caution.

When NOT to use

Avoid read-only mounts when the container needs to update or generate files in the volume. Instead, use read-write mounts or Docker named volumes designed for persistent writable data.

Production Patterns

In production, read-only mounts are often used for configuration files, static assets, or code libraries to prevent accidental changes. They are combined with writable volumes for logs or temporary data, balancing safety and flexibility.

Connections

Filesystem Permissions

Builds-on

Understanding OS-level filesystem permissions helps grasp how read-only mounts enforce access control inside containers.

Immutable Infrastructure

Supports

Read-only volumes support the idea of immutable infrastructure by preventing changes to shared data, making deployments more predictable.

Library Book Lending

Opposite

Unlike lending a book where the borrower can write notes, read-only mounts ensure the container cannot alter the shared data, preserving its original state.

Common Pitfalls

#1 Trying to write to a read-only mounted volume inside the container causes errors.

Wrong approach:

docker run -v /host/data:/data:ro alpine sh -c "echo 'test' > /data/file.txt"

Correct approach:

docker run -v /host/data:/data alpine sh -c "echo 'test' > /data/file.txt"

Root cause:

Misunderstanding that ':ro' disables all write operations inside the mounted volume.

#2 Assuming the host files become read-only after mounting with ':ro'.

Wrong approach:

chmod -R 444 /host/data
# Then mount with ':ro' expecting host files to be protected

Correct approach:

# Keep host permissions as needed; use ':ro' to protect container access
docker run -v /host/data:/data:ro alpine

Root cause:

Confusing container mount permissions with host filesystem permissions.

#3 Using read-only mounts for directories where the container must write logs or temp files.

Wrong approach:

docker run -v /host/logs:/app/logs:ro myapp

Correct approach:

docker run -v /host/logs:/app/logs myapp

Root cause:

Not analyzing container write needs before setting volume permissions.

Key Takeaways

Mounting read-only volumes in Docker protects host data by preventing containers from modifying shared files.

The ':ro' flag in volume mounts tells the operating system to enforce read-only access inside the container.

Read-only mounts are enforced at the kernel level, making them reliable even against root users inside containers.

Misunderstanding read-only mounts can lead to permission errors or false security assumptions.

Using read-only volumes wisely improves container security and stability, especially for shared configuration or static data.