Read-only filesystem containers in Docker - Mini Project: Build & Apply

Read-only Filesystem Containers

📖 Scenario: You are working on a Docker project where security is important. You want to run a container that cannot change its files. This means the container's filesystem should be read-only. This helps protect the container from accidental or harmful changes.

🎯 Goal: You will create a Docker container with a read-only filesystem. You will start with a simple Dockerfile, then add a configuration to make the container's filesystem read-only, and finally run the container to see the effect.

📋 What You'll Learn

Create a Dockerfile with a base image and a simple command

Add a configuration to run the container with a read-only filesystem

Run the container and verify the filesystem is read-only

Print the result of trying to write a file inside the container

💡 Why This Matters

🌍 Real World

Running containers with read-only filesystems is common in production to reduce risks of accidental or malicious changes inside containers.

💼 Career

DevOps engineers and system administrators use read-only containers to improve security and stability of applications running in Docker.

1

Create a Dockerfile with a base image

Create a file named Dockerfile with the content: FROM alpine and CMD ["/bin/sh", "-c", "echo Hello World"].

Docker

# Create a Dockerfile with FROM alpine and CMD to echo Hello World
# Your code here

Hint

Use FROM alpine as the base image. Use CMD ["/bin/sh", "-c", "echo Hello World"] to print a message.

2

Add a read-only flag to the container run command

Add a variable run_command with the value docker run --rm --read-only alpine /bin/sh -c "echo Hello World" to run the container with a read-only filesystem.

Docker

FROM alpine
CMD ["/bin/sh", "-c", "echo Hello World"]

# Add a variable run_command with the docker run command including --read-only
# Your code here

Hint

Use --read-only flag in the docker run command to make the container filesystem read-only.

3

Try to write a file inside the read-only container

Add a variable write_test_command with the value docker run --rm --read-only alpine /bin/sh -c "touch /testfile" to test writing a file inside the container.

Docker

FROM alpine
CMD ["/bin/sh", "-c", "echo Hello World"]

run_command = "docker run --rm --read-only alpine /bin/sh -c \"echo Hello World\""

# Add a variable write_test_command to try creating a file inside the container
# Your code here

Hint

Use the touch /testfile command inside the container to try creating a file.

4

Run the write test and print the error message

Add a print statement that runs write_test_command using os.popen and prints the output to show the error caused by the read-only filesystem.

Docker

FROM alpine
CMD ["/bin/sh", "-c", "echo Hello World"]

run_command = "docker run --rm --read-only alpine /bin/sh -c \"echo Hello World\""
write_test_command = "docker run --rm --read-only alpine /bin/sh -c \"touch /testfile\""

# Run the write_test_command and print the output
# Your code here

Hint

Use os.popen(write_test_command).read() to run the command and capture the output. Then print it.

Practice

1. What does the --read-only flag do when starting a Docker container?

easy

A. Runs the container with root privileges.

B. Deletes all files inside the container before starting it.

C. Makes the container's filesystem read-only, preventing any changes inside it.

D. Allows the container to write to the host filesystem.

Solution

1. Step 1: Understand the --read-only flag purpose

   The --read-only flag makes the container's filesystem read-only, so no files can be changed or created inside the container.

2. Step 2: Compare other options

   Running with root privileges, deleting files, or allowing writes to the host filesystem are unrelated or incorrect behaviors for this flag.

3. Final Answer:

   Makes the container's filesystem read-only, preventing any changes inside it. -> Option C

4. Quick Check:

   --read-only = read-only filesystem [OK]

Hint: Remember: --read-only locks container files from changes [OK]

Common Mistakes:

• Thinking it deletes files instead of locking them
• Confusing with volume mounts
• Assuming it grants root access

2. Which of the following is the correct Docker command to start a container with a read-only filesystem?

easy

A. docker run --read-only alpine

B. docker run --readonly alpine

C. docker run -ro alpine

D. docker run --readwrite alpine

Solution

1. Step 1: Check the correct flag syntax

   The correct flag to make the filesystem read-only is --read-only with a hyphen.

2. Step 2: Validate options

   docker run --read-only alpine uses the correct flag --read-only. The short flag -ro doesn't exist, --readonly lacks the hyphen, and --readwrite is the opposite meaning.

3. Final Answer:

   docker run --read-only alpine -> Option A

4. Quick Check:

   Correct flag is --read-only [OK]

Hint: Use double dash and hyphen: --read-only [OK]

Common Mistakes:

• Using --readonly without hyphen
• Using short flags like -ro which don't exist
• Confusing with --readwrite

3. Consider this command:
docker run --read-only -v /data alpine sh -c "echo hello > /data/file.txt && cat /data/file.txt"
What will be the output?

medium

A. hello

B. Permission denied error

C. No such file or directory error

D. Empty output

Solution

1. Step 1: Understand --read-only with volume mount

   The container filesystem is read-only, but the /data directory is mounted as a volume, which is writable.

2. Step 2: Analyze the command behavior

   The command writes "hello" to /data/file.txt and then reads it back. Since /data is writable, this succeeds and outputs "hello".

3. Final Answer:

   hello -> Option A

4. Quick Check:

   Writable volume inside read-only container = writable [OK]

Hint: Writable volumes override read-only container filesystem [OK]

Common Mistakes:

• Assuming entire container is fully read-only including volumes
• Expecting permission denied on volume writes
• Confusing volume mount syntax

4. You run this command:
docker run --read-only alpine sh -c "touch /tmp/testfile"
But it fails with a permission error. What is the best fix?

medium

A. Remove the --read-only flag

B. Add a writable tmpfs mount for /tmp using --tmpfs /tmp

C. Run the container as root user

D. Use -v /tmp:/tmp to mount host /tmp

Solution

1. Step 1: Identify cause of permission error

   The container filesystem is read-only, so creating files in /tmp fails.

2. Step 2: Provide writable space with tmpfs

   Using --tmpfs /tmp mounts a writable temporary filesystem at /tmp, allowing file creation despite read-only root.

3. Final Answer:

   Add a writable tmpfs mount for /tmp using --tmpfs /tmp -> Option B

4. Quick Check:

   Writable tmpfs fixes write errors in read-only containers [OK]

Hint: Use --tmpfs to add writable temp folders in read-only containers [OK]

Common Mistakes:

• Removing --read-only loses security benefits
• Mounting host /tmp may cause permission issues
• Assuming root user can write despite read-only filesystem

5. You want to run a container with a read-only filesystem but allow writing only to /app/logs. Which command correctly achieves this?

hard

A. docker run --read-only alpine

B. docker run --read-only --tmpfs /app/logs alpine

C. docker run -v /host/logs:/app/logs alpine

D. docker run --read-only -v /host/logs:/app/logs alpine

Solution

1. Step 1: Understand read-only with writable folder

   The container filesystem is read-only, but mounting a host directory as a volume at /app/logs makes that folder writable.

2. Step 2: Evaluate options

   docker run --read-only -v /host/logs:/app/logs alpine uses --read-only plus a volume mount for writable logs. docker run --read-only --tmpfs /app/logs alpine uses tmpfs which is temporary and not persistent. docker run -v /host/logs:/app/logs alpine lacks --read-only. docker run --read-only alpine has no writable folder.

3. Final Answer:

   docker run --read-only -v /host/logs:/app/logs alpine -> Option D

4. Quick Check:

   Volume mount + --read-only = writable folder [OK]

Hint: Use volume mount with --read-only for writable folders [OK]

Common Mistakes:

• Using tmpfs when persistence is needed
• Forgetting --read-only flag
• Expecting writable without volume or tmpfs