Read-only filesystem containers in Docker - Time & Space Complexity

Time Complexity: Read-only filesystem containers

O(1)

Understanding Time Complexity

We want to understand how using a read-only filesystem in a Docker container affects the time it takes to run container commands.

Specifically, how does making the filesystem read-only change the speed or steps of container operations?

Scenario Under Consideration

Analyze the time complexity of the following Docker run command with a read-only filesystem.

docker run --read-only --name mycontainer alpine sh -c "echo Hello && touch /file"

This command runs an Alpine container with its filesystem set to read-only, then tries to print a message and create a file inside the container.

Identify Repeating Operations

Look for repeated actions or loops in the container's filesystem operations.

• Primary operation: The container tries to write a file with touch /file.
• How many times: This write operation happens once during the container run.

How Execution Grows With Input

The container's attempt to write a file does not depend on input size; it is a single operation.

Input Size (n)	Approx. Operations
10	1 write attempt
100	1 write attempt
1000	1 write attempt

Pattern observation: The number of operations stays the same regardless of input size because the filesystem is read-only and the write fails immediately.

Final Time Complexity

Time Complexity: O(1)

This means the time to run the container command with a read-only filesystem stays constant no matter the input size.

Common Mistake

[X] Wrong: "Making the filesystem read-only will slow down all container operations significantly because every file access is checked."

[OK] Correct: The read-only setting mainly affects write operations, which fail fast. Read operations proceed normally without extra delay.

Interview Connect

Understanding how container filesystem modes affect operation speed helps you explain trade-offs in container security and performance clearly.

Self-Check

"What if the container uses a writable volume mounted on top of the read-only filesystem? How would that change the time complexity of write operations?"

Practice

1. What does the --read-only flag do when starting a Docker container?

easy

A. Runs the container with root privileges.

B. Deletes all files inside the container before starting it.

C. Makes the container's filesystem read-only, preventing any changes inside it.

D. Allows the container to write to the host filesystem.

Solution

1. Step 1: Understand the --read-only flag purpose

   The --read-only flag makes the container's filesystem read-only, so no files can be changed or created inside the container.

2. Step 2: Compare other options

   Running with root privileges, deleting files, or allowing writes to the host filesystem are unrelated or incorrect behaviors for this flag.

3. Final Answer:

   Makes the container's filesystem read-only, preventing any changes inside it. -> Option C

4. Quick Check:

   --read-only = read-only filesystem [OK]

Hint: Remember: --read-only locks container files from changes [OK]

Common Mistakes:

• Thinking it deletes files instead of locking them
• Confusing with volume mounts
• Assuming it grants root access

2. Which of the following is the correct Docker command to start a container with a read-only filesystem?

easy

A. docker run --read-only alpine

B. docker run --readonly alpine

C. docker run -ro alpine

D. docker run --readwrite alpine

Solution

1. Step 1: Check the correct flag syntax

   The correct flag to make the filesystem read-only is --read-only with a hyphen.

2. Step 2: Validate options

   docker run --read-only alpine uses the correct flag --read-only. The short flag -ro doesn't exist, --readonly lacks the hyphen, and --readwrite is the opposite meaning.

3. Final Answer:

   docker run --read-only alpine -> Option A

4. Quick Check:

   Correct flag is --read-only [OK]

Hint: Use double dash and hyphen: --read-only [OK]

Common Mistakes:

• Using --readonly without hyphen
• Using short flags like -ro which don't exist
• Confusing with --readwrite

3. Consider this command:
docker run --read-only -v /data alpine sh -c "echo hello > /data/file.txt && cat /data/file.txt"
What will be the output?

medium

A. hello

B. Permission denied error

C. No such file or directory error

D. Empty output

Solution

1. Step 1: Understand --read-only with volume mount

   The container filesystem is read-only, but the /data directory is mounted as a volume, which is writable.

2. Step 2: Analyze the command behavior

   The command writes "hello" to /data/file.txt and then reads it back. Since /data is writable, this succeeds and outputs "hello".

3. Final Answer:

   hello -> Option A

4. Quick Check:

   Writable volume inside read-only container = writable [OK]

Hint: Writable volumes override read-only container filesystem [OK]

Common Mistakes:

• Assuming entire container is fully read-only including volumes
• Expecting permission denied on volume writes
• Confusing volume mount syntax

4. You run this command:
docker run --read-only alpine sh -c "touch /tmp/testfile"
But it fails with a permission error. What is the best fix?

medium

A. Remove the --read-only flag

B. Add a writable tmpfs mount for /tmp using --tmpfs /tmp

C. Run the container as root user

D. Use -v /tmp:/tmp to mount host /tmp

Solution

1. Step 1: Identify cause of permission error

   The container filesystem is read-only, so creating files in /tmp fails.

2. Step 2: Provide writable space with tmpfs

   Using --tmpfs /tmp mounts a writable temporary filesystem at /tmp, allowing file creation despite read-only root.

3. Final Answer:

   Add a writable tmpfs mount for /tmp using --tmpfs /tmp -> Option B

4. Quick Check:

   Writable tmpfs fixes write errors in read-only containers [OK]

Hint: Use --tmpfs to add writable temp folders in read-only containers [OK]

Common Mistakes:

• Removing --read-only loses security benefits
• Mounting host /tmp may cause permission issues
• Assuming root user can write despite read-only filesystem

5. You want to run a container with a read-only filesystem but allow writing only to /app/logs. Which command correctly achieves this?

hard

A. docker run --read-only alpine

B. docker run --read-only --tmpfs /app/logs alpine

C. docker run -v /host/logs:/app/logs alpine

D. docker run --read-only -v /host/logs:/app/logs alpine

Solution

1. Step 1: Understand read-only with writable folder

   The container filesystem is read-only, but mounting a host directory as a volume at /app/logs makes that folder writable.

2. Step 2: Evaluate options

   docker run --read-only -v /host/logs:/app/logs alpine uses --read-only plus a volume mount for writable logs. docker run --read-only --tmpfs /app/logs alpine uses tmpfs which is temporary and not persistent. docker run -v /host/logs:/app/logs alpine lacks --read-only. docker run --read-only alpine has no writable folder.

3. Final Answer:

   docker run --read-only -v /host/logs:/app/logs alpine -> Option D

4. Quick Check:

   Volume mount + --read-only = writable folder [OK]

Hint: Use volume mount with --read-only for writable folders [OK]

Common Mistakes:

• Using tmpfs when persistence is needed
• Forgetting --read-only flag
• Expecting writable without volume or tmpfs