Read-only filesystem containers in Docker - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does it mean when a Docker container has a read-only filesystem?

It means the container's filesystem cannot be changed or written to during its runtime. Any attempt to write files will fail unless specific writable areas are set up.

beginner

How do you start a Docker container with a read-only filesystem?

Use the --read-only flag when running the container, like docker run --read-only image_name.

intermediate

Why would you use a read-only filesystem in a container?

To improve security by preventing changes inside the container, reduce accidental data loss, and ensure consistency by avoiding unexpected writes.

intermediate

How can a container with a read-only filesystem still write data if needed?

By mounting writable volumes or tmpfs (temporary file systems) at specific paths inside the container where write access is required.

beginner

What happens if a process inside a read-only container tries to write to the filesystem?

The write operation will fail with an error because the filesystem does not allow modifications.

Which Docker run option makes the container's filesystem read-only?

A --read-only

B --no-write

C --readonlyfs

D --disable-write

The correct flag to make the container filesystem read-only is --read-only.

How can you allow write access in a read-only container?

A Mount a writable volume or tmpfs

B Use --write-only flag

C Restart the container with write permissions

D You cannot allow write access in a read-only container

Writable volumes or tmpfs mounts provide specific writable areas inside a read-only container.

What is a main benefit of using a read-only filesystem in containers?

A Reduces container size

B Increases container startup speed

C Improves security by preventing changes

D Allows unlimited writes

Read-only filesystems help improve security by stopping any changes inside the container.

If a container tries to write to a read-only filesystem, what happens?

A Filesystem becomes writable

B Write succeeds silently

C Container restarts automatically

D Write fails with an error

Write attempts fail because the filesystem does not allow modifications.

Which of these is NOT a way to provide writable space in a read-only container?

A Mounting a volume

B Using --read-only flag

C Using tmpfs

D Mounting a bind mount

The --read-only flag makes the filesystem read-only; it does not provide writable space.

Explain how to run a Docker container with a read-only filesystem and still allow writing to specific directories.

Think about combining read-only with writable mounts.

Describe the benefits and limitations of using read-only filesystems in Docker containers.

Consider both pros and cons.

Practice

1. What does the --read-only flag do when starting a Docker container?

easy

A. Runs the container with root privileges.

B. Deletes all files inside the container before starting it.

C. Makes the container's filesystem read-only, preventing any changes inside it.

D. Allows the container to write to the host filesystem.

Solution

1. Step 1: Understand the --read-only flag purpose

   The --read-only flag makes the container's filesystem read-only, so no files can be changed or created inside the container.

2. Step 2: Compare other options

   Running with root privileges, deleting files, or allowing writes to the host filesystem are unrelated or incorrect behaviors for this flag.

3. Final Answer:

   Makes the container's filesystem read-only, preventing any changes inside it. -> Option C

4. Quick Check:

   --read-only = read-only filesystem [OK]

Hint: Remember: --read-only locks container files from changes [OK]

Common Mistakes:

• Thinking it deletes files instead of locking them
• Confusing with volume mounts
• Assuming it grants root access

2. Which of the following is the correct Docker command to start a container with a read-only filesystem?

easy

A. docker run --read-only alpine

B. docker run --readonly alpine

C. docker run -ro alpine

D. docker run --readwrite alpine

Solution

1. Step 1: Check the correct flag syntax

   The correct flag to make the filesystem read-only is --read-only with a hyphen.

2. Step 2: Validate options

   docker run --read-only alpine uses the correct flag --read-only. The short flag -ro doesn't exist, --readonly lacks the hyphen, and --readwrite is the opposite meaning.

3. Final Answer:

   docker run --read-only alpine -> Option A

4. Quick Check:

   Correct flag is --read-only [OK]

Hint: Use double dash and hyphen: --read-only [OK]

Common Mistakes:

• Using --readonly without hyphen
• Using short flags like -ro which don't exist
• Confusing with --readwrite

3. Consider this command:
docker run --read-only -v /data alpine sh -c "echo hello > /data/file.txt && cat /data/file.txt"
What will be the output?

medium

A. hello

B. Permission denied error

C. No such file or directory error

D. Empty output

Solution

1. Step 1: Understand --read-only with volume mount

   The container filesystem is read-only, but the /data directory is mounted as a volume, which is writable.

2. Step 2: Analyze the command behavior

   The command writes "hello" to /data/file.txt and then reads it back. Since /data is writable, this succeeds and outputs "hello".

3. Final Answer:

   hello -> Option A

4. Quick Check:

   Writable volume inside read-only container = writable [OK]

Hint: Writable volumes override read-only container filesystem [OK]

Common Mistakes:

• Assuming entire container is fully read-only including volumes
• Expecting permission denied on volume writes
• Confusing volume mount syntax

4. You run this command:
docker run --read-only alpine sh -c "touch /tmp/testfile"
But it fails with a permission error. What is the best fix?

medium

A. Remove the --read-only flag

B. Add a writable tmpfs mount for /tmp using --tmpfs /tmp

C. Run the container as root user

D. Use -v /tmp:/tmp to mount host /tmp

Solution

1. Step 1: Identify cause of permission error

   The container filesystem is read-only, so creating files in /tmp fails.

2. Step 2: Provide writable space with tmpfs

   Using --tmpfs /tmp mounts a writable temporary filesystem at /tmp, allowing file creation despite read-only root.

3. Final Answer:

   Add a writable tmpfs mount for /tmp using --tmpfs /tmp -> Option B

4. Quick Check:

   Writable tmpfs fixes write errors in read-only containers [OK]

Hint: Use --tmpfs to add writable temp folders in read-only containers [OK]

Common Mistakes:

• Removing --read-only loses security benefits
• Mounting host /tmp may cause permission issues
• Assuming root user can write despite read-only filesystem

5. You want to run a container with a read-only filesystem but allow writing only to /app/logs. Which command correctly achieves this?

hard

A. docker run --read-only alpine

B. docker run --read-only --tmpfs /app/logs alpine

C. docker run -v /host/logs:/app/logs alpine

D. docker run --read-only -v /host/logs:/app/logs alpine

Solution

1. Step 1: Understand read-only with writable folder

   The container filesystem is read-only, but mounting a host directory as a volume at /app/logs makes that folder writable.

2. Step 2: Evaluate options

   docker run --read-only -v /host/logs:/app/logs alpine uses --read-only plus a volume mount for writable logs. docker run --read-only --tmpfs /app/logs alpine uses tmpfs which is temporary and not persistent. docker run -v /host/logs:/app/logs alpine lacks --read-only. docker run --read-only alpine has no writable folder.

3. Final Answer:

   docker run --read-only -v /host/logs:/app/logs alpine -> Option D

4. Quick Check:

   Volume mount + --read-only = writable folder [OK]

Hint: Use volume mount with --read-only for writable folders [OK]

Common Mistakes:

• Using tmpfs when persistence is needed
• Forgetting --read-only flag
• Expecting writable without volume or tmpfs