Read-only filesystem containers in Docker - Step-by-Step Execution

Process Flow - Read-only filesystem containers

Start Container

↓

Mount Filesystem as Read-Only

↓

Container Runs

↓

Attempt Write Operation?

No→Continue Running

Yes↓

Write Fails with Error

↓

Container Stops or Handles Error

This flow shows how a container starts with a read-only filesystem, runs, and blocks any write attempts causing errors.

Execution Sample

Docker

docker run --rm -it --read-only alpine sh
# touch /testfile

Run an Alpine container with a read-only filesystem and try to create a file inside it.

Process Table

Step	Command/Action	Filesystem State	Write Attempt	Result	Container State
1	docker run --rm -it --read-only alpine sh	Mounted as read-only	No	N/A	Running shell
2	touch /testfile	Read-only filesystem	Yes	Error: Read-only file system	Running shell
3	exit	N/A	No	Container stops	Exited

💡 Container stops after user exits shell; write attempt fails due to read-only filesystem

Status Tracker

Variable	Start	After Step 1	After Step 2	Final
Filesystem Mode	N/A	Read-only	Read-only	N/A
Container State	Not running	Running	Running	Exited
Write Attempt Result	N/A	N/A	Error: Read-only file system	N/A

Key Moments - 2 Insights

Why does the 'touch /testfile' command fail inside the container?

Because the container's filesystem is mounted as read-only (see execution_table step 2), any write operation like creating a file is blocked and returns an error.

Can the container write to any location inside if the filesystem is read-only?

No, the entire container filesystem is read-only, so all write attempts fail unless a writable volume or tmpfs is mounted separately.

Visual Quiz - 3 Questions

Look at the execution table, what is the filesystem state after starting the container?

A Mounted as read-only

B Mounted as read-write

C Unmounted

D Corrupted

💡 Hint

Check execution_table row 1, column 'Filesystem State'

At which step does the write attempt fail due to the read-only filesystem?

A Step 1

B Step 3

C Step 2

D No failure occurs

💡 Hint

See execution_table row 2, column 'Result'

If we remove the '--read-only' flag, what would change in the execution table?

A Container would not start

B Write attempt would succeed at step 2

C Filesystem state would still be read-only

D Container would exit immediately

💡 Hint

Consider how the 'Filesystem State' and 'Result' columns would differ without read-only mode

Concept Snapshot

Read-only filesystem containers:
- Use '--read-only' flag in 'docker run' to mount container filesystem as read-only.
- Prevents any write operations inside container filesystem.
- Write attempts cause errors like 'Read-only file system'.
- Useful for security and immutability.
- Writable volumes or tmpfs can be added separately if needed.

Full Transcript

This visual execution shows how to run a Docker container with a read-only filesystem using the '--read-only' flag. When the container starts, its filesystem is mounted as read-only, preventing any write operations. For example, trying to create a file with 'touch /testfile' fails with an error 'Read-only file system'. The container continues running until the user exits the shell, at which point it stops. This setup is useful to increase security by preventing changes inside the container. Writable storage can be added separately if needed.