Mounting read-only volumes in Docker - Step-by-Step Execution

Process Flow - Mounting read-only volumes

Start Docker Container

↓

Specify Volume Mount

↓

Add :ro flag to volume

↓

Docker mounts volume as read-only

↓

Container can read but not write

↓

Container runs with read-only volume

This flow shows how Docker mounts a volume as read-only by adding the :ro flag during container start.

Execution Sample

Docker

docker run -v /host/data:/container/data:ro alpine ls /container/data

Runs an Alpine container mounting /host/data as read-only inside /container/data and lists its contents.

Process Table

Step	Action	Command Part	Docker Behavior	Result
1	Start container with volume mount	-v /host/data:/container/data:ro	Docker parses volume mount	Volume mount recognized with :ro flag
2	Mount volume inside container	Mount /host/data to /container/data as read-only	Docker sets mount permissions	Container sees /container/data as read-only
3	Run command inside container	ls /container/data	Container executes ls	Lists files in /container/data
4	Attempt to write to volume (not shown in command)	Write denied due to read-only mount	Docker enforces read-only	Write fails if attempted
5	Container exits after command	Container stops	Volume unmounted	Container stopped, volume unmounted

💡 Container stops after running ls command; volume was mounted read-only throughout

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
Volume Mount	None	/host/data:/container/data:ro	Mounted read-only	Accessible read-only	Unmounted after container stops
Container State	Stopped	Starting	Running	Running command	Stopped

Key Moments - 3 Insights

Why can't the container write to the mounted volume?

Because the volume was mounted with the :ro flag (see execution_table step 2), Docker enforces read-only access preventing any write operations.

What happens if the container tries to write to the read-only volume?

The write operation fails silently or with an error because Docker mounts the volume as read-only (execution_table step 4), blocking any changes.

Does the :ro flag affect the host directory permissions?

No, the :ro flag only affects the container's view. The host directory permissions remain unchanged (execution_table step 2).

Visual Quiz - 3 Questions

Look at the execution table, at which step does Docker set the volume as read-only?

A Step 3

B Step 1

C Step 2

D Step 4

💡 Hint

Check the 'Docker Behavior' column for when the mount permissions are set.

According to the variable tracker, what is the container state after step 3?

A Starting

B Running

C Stopped

D Paused

💡 Hint

Look at the 'Container State' row under 'After Step 3'.

If the :ro flag was removed, what would change in the execution table?

A Step 2 would show volume mounted as read-write

B Step 3 would fail to list files

C Step 4 would show write denied

D Container would not start

💡 Hint

Compare the 'Docker Behavior' in step 2 with and without :ro flag.

Concept Snapshot

Mount volumes in Docker with -v host_path:container_path[:ro]
Add :ro to make volume read-only inside container
Container can read but cannot write to this volume
Useful for protecting host data from container changes
Without :ro, volume is read-write by default

Full Transcript

This visual execution shows how Docker mounts a volume as read-only using the :ro flag. The process starts by running a container with the volume mount option including :ro. Docker then mounts the host directory inside the container with read-only permissions. The container can list files but cannot write to the mounted directory. Attempts to write fail because Docker enforces the read-only setting. Finally, the container stops and the volume is unmounted. This method protects host data from accidental changes by the container.

Practice

1. What does adding :ro at the end of a Docker volume mount do?

easy

A. Mounts the volume with root user permissions

B. Mounts the volume as read-write, allowing container writes

C. Removes the volume after container stops

D. Mounts the volume as read-only, preventing container writes

Solution

1. Step 1: Understand Docker volume mount options

   Docker allows mounting volumes with options like :ro or :rw to control access.

2. Step 2: Identify the effect of :ro

   The :ro option makes the mounted volume read-only inside the container, so the container cannot modify the data.

3. Final Answer:

   Mounts the volume as read-only, preventing container writes -> Option D

4. Quick Check:

   :ro means read-only mount [OK]

Hint: Remember 'ro' means read-only, no writes allowed [OK]

Common Mistakes:

• Confusing :ro with :rw
• Thinking :ro deletes volume after use
• Assuming :ro changes user permissions

2. Which of the following is the correct syntax to mount a host directory /data as a read-only volume inside a container at /app/data?

easy

A. docker run -v /data:/app/data:rw myimage

B. docker run -v /data:/app/data:read-only myimage

C. docker run -v /data:/app/data:ro myimage

D. docker run -v /data:/app/data:readonly myimage

Solution

1. Step 1: Recall Docker volume mount syntax

   The syntax is -v host_path:container_path:options, where options can be ro or rw.

2. Step 2: Identify correct read-only option

   The correct option for read-only is ro. Options like read-only or readonly are invalid.

3. Final Answer:

   docker run -v /data:/app/data:ro myimage -> Option C

4. Quick Check:

   Use :ro for read-only mount [OK]

Hint: Use ':ro' exactly for read-only volume mounts [OK]

Common Mistakes:

• Using ':rw' instead of ':ro' for read-only
• Writing 'readonly' or 'read-only' instead of 'ro'
• Omitting the option entirely

3. Given the command:

docker run -v /host/config:/app/config:ro myapp

What will happen if the container tries to write a file inside /app/config?

medium

A. The write will fail with a permission error

B. The container will crash immediately

C. The write will succeed and file will be saved

D. Docker will remount the volume as read-write automatically

Solution

1. Step 1: Understand the effect of :ro mount

   The volume is mounted read-only, so the container cannot modify files in /app/config.

2. Step 2: Predict container behavior on write attempt

   When the container tries to write, the OS denies permission, causing a write failure with an error.

3. Final Answer:

   The write will fail with a permission error -> Option A

4. Quick Check:

   Read-only mount blocks writes with permission error [OK]

Hint: Read-only volumes block writes, causing permission errors [OK]

Common Mistakes:

• Assuming writes succeed on read-only mounts
• Thinking Docker remounts volumes automatically
• Believing container crashes on write failure

4. You run this command:

docker run -v /data:/app/data myimage

You want to make the volume read-only but accidentally write :ro as :or. What will happen?

medium

A. Docker will mount the volume as read-only anyway

B. Docker will throw an error and refuse to start the container

C. The volume will be mounted as read-write

D. The container will start but fail when writing to the volume

Solution

1. Step 1: Check the mount option syntax

   The option :ro is valid for read-only. :or is invalid and not recognized by Docker.

2. Step 2: Understand Docker's response to invalid options

   Docker will detect the invalid option and refuse to start the container, showing an error.

3. Final Answer:

   Docker will throw an error and refuse to start the container -> Option B

4. Quick Check:

   Invalid mount options cause Docker errors [OK]

Hint: Check option spelling carefully; invalid options cause errors [OK]

Common Mistakes:

• Assuming Docker ignores invalid mount options
• Thinking volume mounts as read-only despite typo
• Believing container starts but fails later

5. You want to share a configuration directory /etc/config with multiple containers but prevent them from modifying it. Which command correctly mounts it read-only and ensures the container user cannot override this?

hard

A. docker run -v /etc/config:/config:ro myapp

B. docker run --read-only -v /etc/config:/config myapp

C. docker run -v /etc/config:/config:rw --user 1000 myapp

D. docker run -v /etc/config:/config:rw myapp

Solution

1. Step 1: Understand read-only volume mount

   Mounting with :ro makes the volume read-only inside the container, preventing writes regardless of user.

2. Step 2: Evaluate other options

   docker run --read-only -v /etc/config:/config myapp makes the entire container filesystem read-only, which is overly restrictive. docker run -v /etc/config:/config:rw --user 1000 myapp adds user but does not prevent writes since volume is read-write. docker run -v /etc/config:/config:rw myapp mounts read-write, allowing changes.

3. Final Answer:

   docker run -v /etc/config:/config:ro myapp -> Option A

4. Quick Check:

   Use :ro to share read-only volumes safely [OK]

Hint: Use ':ro' to protect shared data from container writes [OK]

Common Mistakes:

• Confusing container read-only flag with volume read-only
• Mounting volume as read-write by mistake
• Thinking user ID affects volume write permissions