Read-only filesystem containers in Docker - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Output of running a read-only container with write attempt

What is the output when you run this Docker command that tries to write a file inside a read-only container?

Docker

docker run --rm --read-only alpine sh -c "echo 'test' > /tmp/testfile"

A testfile created successfully

B sh: can't create /tmp/testfile: Read-only file system

C Permission denied

D No such file or directory

💡 Hint

Think about what happens when you try to write to a read-only filesystem.

The container's filesystem is mounted as read-only, so any write operation fails with a 'Read-only file system' error.

🧠 Conceptual

intermediate

Purpose of read-only filesystem in containers

Why would you want to run a container with a read-only filesystem?

A To allow unlimited writes without disk space limits

B To increase container startup speed

C To enable container networking features

D To improve security by preventing writes inside the container

💡 Hint

Think about how restricting writes can protect the container.

Running a container with a read-only filesystem helps improve security by preventing any changes or writes inside the container, reducing attack surface.

❓ Configuration

advanced

Correct Docker run command for read-only container with writable volume

Which Docker command correctly runs a container with a read-only root filesystem but allows writing to /data directory?

A docker run --rm --read-only -v /host/data:/data:rw alpine

B docker run --rm -v /host/data:/data:ro alpine

C docker run --rm --read-only -v /host/data:/data:ro alpine

D docker run --rm --read-only alpine

💡 Hint

Remember that the root filesystem is read-only but volumes can be mounted writable.

The --read-only flag makes the root filesystem read-only, but mounting a volume with :rw allows writing to that specific directory.

❓ Troubleshoot

advanced

Troubleshooting write failure in read-only container with volume

You run a container with --read-only and a volume mounted as writable, but writing to the volume still fails. What is the most likely cause?

A The --read-only flag disables all writes including volumes

B The container image does not support volumes

C The volume is mounted with read-only permissions on the host

D Docker daemon is not running

💡 Hint

Check the host directory permissions for the volume mount.

If the host directory is read-only or lacks write permissions, the container cannot write to the mounted volume even if it is mounted as writable.

✅ Best Practice

expert

Best practice for logging in read-only containers

What is the best practice to handle application logs when running a container with a read-only filesystem?

A Mount a writable volume or tmpfs at the log directory path

B Write logs inside the container root filesystem

C Disable logging to avoid write errors

D Send logs only to stdout without any volume mounts

💡 Hint

Think about how to allow writes for logs without changing the root filesystem.

Since the root filesystem is read-only, logs should be written to a mounted writable volume or tmpfs to avoid write errors and preserve logs.