Read-only filesystem containers in Docker - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the command to run a Docker container with a read-only filesystem.

Docker

docker run --rm -it --read-only [1] sh

Drag options to blanks, or click blank then click option'

A--name readonly

Balpine

C-v /data:/data

D-p 80:80

Attempts:

3 left

💡 Hint

Common Mistakes

Putting volume mount options in place of the image name.

Forgetting to specify the image name.

The image name 'alpine' is required to run the container. The --read-only flag makes the filesystem read-only.

2fill in blank

medium

Complete the command to mount a writable tmpfs volume inside a read-only Docker container.

Docker

docker run --rm -it --read-only --tmpfs [1] alpine sh

Drag options to blanks, or click blank then click option'

A/tmp

B/home

C/etc

D/var/log

Attempts:

3 left

💡 Hint

Common Mistakes

Mounting tmpfs on system directories like /etc which should remain read-only.

Choosing directories that are not writable by default.

Mounting a tmpfs at /tmp allows temporary writable storage inside a read-only container.

3fill in blank

hard

Fix the error in the command to run a read-only container with a writable /var/log directory.

Docker

docker run --rm -it --read-only -v [1] alpine sh

Drag options to blanks, or click blank then click option'

A/var/log:/tmp

B/var/log

C/tmp:/var/log

D/var/log:/var/log

Attempts:

3 left

💡 Hint

Common Mistakes

Using only the container path without specifying the host path.

Reversing the host and container paths.

To make /var/log writable, you must mount a volume from the host to /var/log inside the container.

4fill in blank

hard

Fill both blanks to create a read-only container with a writable /tmp and /var/cache directories.

Docker

docker run --rm -it --read-only --tmpfs [1] --tmpfs [2] alpine sh

Drag options to blanks, or click blank then click option'

A/tmp

B/var/cache

C/var/log

D/home

Attempts:

3 left

💡 Hint

Common Mistakes

Mounting tmpfs on directories that should remain read-only.

Using the same directory for both mounts.

Mounting tmpfs volumes at /tmp and /var/cache allows these directories to be writable in a read-only container.

5fill in blank

hard

Fill all three blanks to run a read-only container with a writable /tmp, a volume mount for /var/log, and a container name.

Docker

docker run --rm -it --read-only --tmpfs [1] -v [2] --name [3] alpine sh

Drag options to blanks, or click blank then click option'

A/tmp

B/host/logs:/var/log

Creadonly_container

D/var/cache

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing volume mount syntax.

Forgetting to specify the container name.

Using incorrect paths for tmpfs or volume mounts.

The tmpfs mount at /tmp allows writable temp storage, the volume mount maps host logs to /var/log, and --name sets the container's name.

Practice

1. What does the --read-only flag do when starting a Docker container?

easy

A. Runs the container with root privileges.

B. Deletes all files inside the container before starting it.

C. Makes the container's filesystem read-only, preventing any changes inside it.

D. Allows the container to write to the host filesystem.

Solution

1. Step 1: Understand the --read-only flag purpose

   The --read-only flag makes the container's filesystem read-only, so no files can be changed or created inside the container.

2. Step 2: Compare other options

   Running with root privileges, deleting files, or allowing writes to the host filesystem are unrelated or incorrect behaviors for this flag.

3. Final Answer:

   Makes the container's filesystem read-only, preventing any changes inside it. -> Option C

4. Quick Check:

   --read-only = read-only filesystem [OK]

Hint: Remember: --read-only locks container files from changes [OK]

Common Mistakes:

• Thinking it deletes files instead of locking them
• Confusing with volume mounts
• Assuming it grants root access

2. Which of the following is the correct Docker command to start a container with a read-only filesystem?

easy

A. docker run --read-only alpine

B. docker run --readonly alpine

C. docker run -ro alpine

D. docker run --readwrite alpine

Solution

1. Step 1: Check the correct flag syntax

   The correct flag to make the filesystem read-only is --read-only with a hyphen.

2. Step 2: Validate options

   docker run --read-only alpine uses the correct flag --read-only. The short flag -ro doesn't exist, --readonly lacks the hyphen, and --readwrite is the opposite meaning.

3. Final Answer:

   docker run --read-only alpine -> Option A

4. Quick Check:

   Correct flag is --read-only [OK]

Hint: Use double dash and hyphen: --read-only [OK]

Common Mistakes:

• Using --readonly without hyphen
• Using short flags like -ro which don't exist
• Confusing with --readwrite

3. Consider this command:
docker run --read-only -v /data alpine sh -c "echo hello > /data/file.txt && cat /data/file.txt"
What will be the output?

medium

A. hello

B. Permission denied error

C. No such file or directory error

D. Empty output

Solution

1. Step 1: Understand --read-only with volume mount

   The container filesystem is read-only, but the /data directory is mounted as a volume, which is writable.

2. Step 2: Analyze the command behavior

   The command writes "hello" to /data/file.txt and then reads it back. Since /data is writable, this succeeds and outputs "hello".

3. Final Answer:

   hello -> Option A

4. Quick Check:

   Writable volume inside read-only container = writable [OK]

Hint: Writable volumes override read-only container filesystem [OK]

Common Mistakes:

• Assuming entire container is fully read-only including volumes
• Expecting permission denied on volume writes
• Confusing volume mount syntax

4. You run this command:
docker run --read-only alpine sh -c "touch /tmp/testfile"
But it fails with a permission error. What is the best fix?

medium

A. Remove the --read-only flag

B. Add a writable tmpfs mount for /tmp using --tmpfs /tmp

C. Run the container as root user

D. Use -v /tmp:/tmp to mount host /tmp

Solution

1. Step 1: Identify cause of permission error

   The container filesystem is read-only, so creating files in /tmp fails.

2. Step 2: Provide writable space with tmpfs

   Using --tmpfs /tmp mounts a writable temporary filesystem at /tmp, allowing file creation despite read-only root.

3. Final Answer:

   Add a writable tmpfs mount for /tmp using --tmpfs /tmp -> Option B

4. Quick Check:

   Writable tmpfs fixes write errors in read-only containers [OK]

Hint: Use --tmpfs to add writable temp folders in read-only containers [OK]

Common Mistakes:

• Removing --read-only loses security benefits
• Mounting host /tmp may cause permission issues
• Assuming root user can write despite read-only filesystem

5. You want to run a container with a read-only filesystem but allow writing only to /app/logs. Which command correctly achieves this?

hard

A. docker run --read-only alpine

B. docker run --read-only --tmpfs /app/logs alpine

C. docker run -v /host/logs:/app/logs alpine

D. docker run --read-only -v /host/logs:/app/logs alpine

Solution

1. Step 1: Understand read-only with writable folder

   The container filesystem is read-only, but mounting a host directory as a volume at /app/logs makes that folder writable.

2. Step 2: Evaluate options

   docker run --read-only -v /host/logs:/app/logs alpine uses --read-only plus a volume mount for writable logs. docker run --read-only --tmpfs /app/logs alpine uses tmpfs which is temporary and not persistent. docker run -v /host/logs:/app/logs alpine lacks --read-only. docker run --read-only alpine has no writable folder.

3. Final Answer:

   docker run --read-only -v /host/logs:/app/logs alpine -> Option D

4. Quick Check:

   Volume mount + --read-only = writable folder [OK]

Hint: Use volume mount with --read-only for writable folders [OK]

Common Mistakes:

• Using tmpfs when persistence is needed
• Forgetting --read-only flag
• Expecting writable without volume or tmpfs