Read-only filesystem containers in Docker - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Output of running a read-only container with write attempt

What is the output when you run this Docker command that tries to write a file inside a read-only container?

Docker

docker run --rm --read-only alpine sh -c "echo 'test' > /tmp/testfile"

A testfile created successfully

B sh: can't create /tmp/testfile: Read-only file system

C Permission denied

D No such file or directory

💡 Hint

Think about what happens when you try to write to a read-only filesystem.

The container's filesystem is mounted as read-only, so any write operation fails with a 'Read-only file system' error.

🧠 Conceptual

intermediate

Purpose of read-only filesystem in containers

Why would you want to run a container with a read-only filesystem?

A To allow unlimited writes without disk space limits

B To increase container startup speed

C To enable container networking features

D To improve security by preventing writes inside the container

💡 Hint

Think about how restricting writes can protect the container.

Running a container with a read-only filesystem helps improve security by preventing any changes or writes inside the container, reducing attack surface.

❓ Configuration

advanced

Correct Docker run command for read-only container with writable volume

Which Docker command correctly runs a container with a read-only root filesystem but allows writing to /data directory?

A docker run --rm --read-only -v /host/data:/data:rw alpine

B docker run --rm -v /host/data:/data:ro alpine

C docker run --rm --read-only -v /host/data:/data:ro alpine

D docker run --rm --read-only alpine

💡 Hint

Remember that the root filesystem is read-only but volumes can be mounted writable.

The --read-only flag makes the root filesystem read-only, but mounting a volume with :rw allows writing to that specific directory.

❓ Troubleshoot

advanced

Troubleshooting write failure in read-only container with volume

You run a container with --read-only and a volume mounted as writable, but writing to the volume still fails. What is the most likely cause?

A The --read-only flag disables all writes including volumes

B The container image does not support volumes

C The volume is mounted with read-only permissions on the host

D Docker daemon is not running

💡 Hint

Check the host directory permissions for the volume mount.

If the host directory is read-only or lacks write permissions, the container cannot write to the mounted volume even if it is mounted as writable.

✅ Best Practice

expert

Best practice for logging in read-only containers

What is the best practice to handle application logs when running a container with a read-only filesystem?

A Mount a writable volume or tmpfs at the log directory path

B Write logs inside the container root filesystem

C Disable logging to avoid write errors

D Send logs only to stdout without any volume mounts

💡 Hint

Think about how to allow writes for logs without changing the root filesystem.

Since the root filesystem is read-only, logs should be written to a mounted writable volume or tmpfs to avoid write errors and preserve logs.

Practice

1. What does the --read-only flag do when starting a Docker container?

easy

A. Runs the container with root privileges.

B. Deletes all files inside the container before starting it.

C. Makes the container's filesystem read-only, preventing any changes inside it.

D. Allows the container to write to the host filesystem.

Solution

1. Step 1: Understand the --read-only flag purpose

   The --read-only flag makes the container's filesystem read-only, so no files can be changed or created inside the container.

2. Step 2: Compare other options

   Running with root privileges, deleting files, or allowing writes to the host filesystem are unrelated or incorrect behaviors for this flag.

3. Final Answer:

   Makes the container's filesystem read-only, preventing any changes inside it. -> Option C

4. Quick Check:

   --read-only = read-only filesystem [OK]

Hint: Remember: --read-only locks container files from changes [OK]

Common Mistakes:

• Thinking it deletes files instead of locking them
• Confusing with volume mounts
• Assuming it grants root access

2. Which of the following is the correct Docker command to start a container with a read-only filesystem?

easy

A. docker run --read-only alpine

B. docker run --readonly alpine

C. docker run -ro alpine

D. docker run --readwrite alpine

Solution

1. Step 1: Check the correct flag syntax

   The correct flag to make the filesystem read-only is --read-only with a hyphen.

2. Step 2: Validate options

   docker run --read-only alpine uses the correct flag --read-only. The short flag -ro doesn't exist, --readonly lacks the hyphen, and --readwrite is the opposite meaning.

3. Final Answer:

   docker run --read-only alpine -> Option A

4. Quick Check:

   Correct flag is --read-only [OK]

Hint: Use double dash and hyphen: --read-only [OK]

Common Mistakes:

• Using --readonly without hyphen
• Using short flags like -ro which don't exist
• Confusing with --readwrite

3. Consider this command:
docker run --read-only -v /data alpine sh -c "echo hello > /data/file.txt && cat /data/file.txt"
What will be the output?

medium

A. hello

B. Permission denied error

C. No such file or directory error

D. Empty output

Solution

1. Step 1: Understand --read-only with volume mount

   The container filesystem is read-only, but the /data directory is mounted as a volume, which is writable.

2. Step 2: Analyze the command behavior

   The command writes "hello" to /data/file.txt and then reads it back. Since /data is writable, this succeeds and outputs "hello".

3. Final Answer:

   hello -> Option A

4. Quick Check:

   Writable volume inside read-only container = writable [OK]

Hint: Writable volumes override read-only container filesystem [OK]

Common Mistakes:

• Assuming entire container is fully read-only including volumes
• Expecting permission denied on volume writes
• Confusing volume mount syntax

4. You run this command:
docker run --read-only alpine sh -c "touch /tmp/testfile"
But it fails with a permission error. What is the best fix?

medium

A. Remove the --read-only flag

B. Add a writable tmpfs mount for /tmp using --tmpfs /tmp

C. Run the container as root user

D. Use -v /tmp:/tmp to mount host /tmp

Solution

1. Step 1: Identify cause of permission error

   The container filesystem is read-only, so creating files in /tmp fails.

2. Step 2: Provide writable space with tmpfs

   Using --tmpfs /tmp mounts a writable temporary filesystem at /tmp, allowing file creation despite read-only root.

3. Final Answer:

   Add a writable tmpfs mount for /tmp using --tmpfs /tmp -> Option B

4. Quick Check:

   Writable tmpfs fixes write errors in read-only containers [OK]

Hint: Use --tmpfs to add writable temp folders in read-only containers [OK]

Common Mistakes:

• Removing --read-only loses security benefits
• Mounting host /tmp may cause permission issues
• Assuming root user can write despite read-only filesystem

5. You want to run a container with a read-only filesystem but allow writing only to /app/logs. Which command correctly achieves this?

hard

A. docker run --read-only alpine

B. docker run --read-only --tmpfs /app/logs alpine

C. docker run -v /host/logs:/app/logs alpine

D. docker run --read-only -v /host/logs:/app/logs alpine

Solution

1. Step 1: Understand read-only with writable folder

   The container filesystem is read-only, but mounting a host directory as a volume at /app/logs makes that folder writable.

2. Step 2: Evaluate options

   docker run --read-only -v /host/logs:/app/logs alpine uses --read-only plus a volume mount for writable logs. docker run --read-only --tmpfs /app/logs alpine uses tmpfs which is temporary and not persistent. docker run -v /host/logs:/app/logs alpine lacks --read-only. docker run --read-only alpine has no writable folder.

3. Final Answer:

   docker run --read-only -v /host/logs:/app/logs alpine -> Option D

4. Quick Check:

   Volume mount + --read-only = writable folder [OK]

Hint: Use volume mount with --read-only for writable folders [OK]

Common Mistakes:

• Using tmpfs when persistence is needed
• Forgetting --read-only flag
• Expecting writable without volume or tmpfs