Read-only filesystem containers in Docker - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does it mean when a Docker container has a read-only filesystem?

It means the container's filesystem cannot be changed or written to during its runtime. Any attempt to write files will fail unless specific writable areas are set up.

beginner

How do you start a Docker container with a read-only filesystem?

Use the --read-only flag when running the container, like docker run --read-only image_name.

intermediate

Why would you use a read-only filesystem in a container?

To improve security by preventing changes inside the container, reduce accidental data loss, and ensure consistency by avoiding unexpected writes.

intermediate

How can a container with a read-only filesystem still write data if needed?

By mounting writable volumes or tmpfs (temporary file systems) at specific paths inside the container where write access is required.

beginner

What happens if a process inside a read-only container tries to write to the filesystem?

The write operation will fail with an error because the filesystem does not allow modifications.

Which Docker run option makes the container's filesystem read-only?

A --read-only

B --no-write

C --readonlyfs

D --disable-write

The correct flag to make the container filesystem read-only is --read-only.

How can you allow write access in a read-only container?

A Mount a writable volume or tmpfs

B Use --write-only flag

C Restart the container with write permissions

D You cannot allow write access in a read-only container

Writable volumes or tmpfs mounts provide specific writable areas inside a read-only container.

What is a main benefit of using a read-only filesystem in containers?

A Reduces container size

B Increases container startup speed

C Improves security by preventing changes

D Allows unlimited writes

Read-only filesystems help improve security by stopping any changes inside the container.

If a container tries to write to a read-only filesystem, what happens?

A Filesystem becomes writable

B Write succeeds silently

C Container restarts automatically

D Write fails with an error

Write attempts fail because the filesystem does not allow modifications.

Which of these is NOT a way to provide writable space in a read-only container?

A Mounting a volume

B Using --read-only flag

C Using tmpfs

D Mounting a bind mount

The --read-only flag makes the filesystem read-only; it does not provide writable space.

Explain how to run a Docker container with a read-only filesystem and still allow writing to specific directories.

Think about combining read-only with writable mounts.

Describe the benefits and limitations of using read-only filesystems in Docker containers.

Consider both pros and cons.