Read-only filesystem containers in Docker - Step-by-Step Execution

Process Flow - Read-only filesystem containers

Start Container

↓

Mount Filesystem as Read-Only

↓

Container Runs

↓

Attempt Write Operation?

No→Continue Running

Yes↓

Write Fails with Error

↓

Container Stops or Handles Error

This flow shows how a container starts with a read-only filesystem, runs, and blocks any write attempts causing errors.

Execution Sample

Docker

docker run --rm -it --read-only alpine sh
# touch /testfile

Run an Alpine container with a read-only filesystem and try to create a file inside it.

Process Table

Step	Command/Action	Filesystem State	Write Attempt	Result	Container State
1	docker run --rm -it --read-only alpine sh	Mounted as read-only	No	N/A	Running shell
2	touch /testfile	Read-only filesystem	Yes	Error: Read-only file system	Running shell
3	exit	N/A	No	Container stops	Exited

💡 Container stops after user exits shell; write attempt fails due to read-only filesystem

Status Tracker

Variable	Start	After Step 1	After Step 2	Final
Filesystem Mode	N/A	Read-only	Read-only	N/A
Container State	Not running	Running	Running	Exited
Write Attempt Result	N/A	N/A	Error: Read-only file system	N/A

Key Moments - 2 Insights

Why does the 'touch /testfile' command fail inside the container?

Because the container's filesystem is mounted as read-only (see execution_table step 2), any write operation like creating a file is blocked and returns an error.

Can the container write to any location inside if the filesystem is read-only?

No, the entire container filesystem is read-only, so all write attempts fail unless a writable volume or tmpfs is mounted separately.

Visual Quiz - 3 Questions

Look at the execution table, what is the filesystem state after starting the container?

A Mounted as read-only

B Mounted as read-write

C Unmounted

D Corrupted

💡 Hint

Check execution_table row 1, column 'Filesystem State'

At which step does the write attempt fail due to the read-only filesystem?

A Step 1

B Step 3

C Step 2

D No failure occurs

💡 Hint

See execution_table row 2, column 'Result'

If we remove the '--read-only' flag, what would change in the execution table?

A Container would not start

B Write attempt would succeed at step 2

C Filesystem state would still be read-only

D Container would exit immediately

💡 Hint

Consider how the 'Filesystem State' and 'Result' columns would differ without read-only mode

Concept Snapshot

Read-only filesystem containers:
- Use '--read-only' flag in 'docker run' to mount container filesystem as read-only.
- Prevents any write operations inside container filesystem.
- Write attempts cause errors like 'Read-only file system'.
- Useful for security and immutability.
- Writable volumes or tmpfs can be added separately if needed.

Full Transcript

This visual execution shows how to run a Docker container with a read-only filesystem using the '--read-only' flag. When the container starts, its filesystem is mounted as read-only, preventing any write operations. For example, trying to create a file with 'touch /testfile' fails with an error 'Read-only file system'. The container continues running until the user exits the shell, at which point it stops. This setup is useful to increase security by preventing changes inside the container. Writable storage can be added separately if needed.

Practice

1. What does the --read-only flag do when starting a Docker container?

easy

A. Runs the container with root privileges.

B. Deletes all files inside the container before starting it.

C. Makes the container's filesystem read-only, preventing any changes inside it.

D. Allows the container to write to the host filesystem.

Solution

1. Step 1: Understand the --read-only flag purpose

   The --read-only flag makes the container's filesystem read-only, so no files can be changed or created inside the container.

2. Step 2: Compare other options

   Running with root privileges, deleting files, or allowing writes to the host filesystem are unrelated or incorrect behaviors for this flag.

3. Final Answer:

   Makes the container's filesystem read-only, preventing any changes inside it. -> Option C

4. Quick Check:

   --read-only = read-only filesystem [OK]

Hint: Remember: --read-only locks container files from changes [OK]

Common Mistakes:

• Thinking it deletes files instead of locking them
• Confusing with volume mounts
• Assuming it grants root access

2. Which of the following is the correct Docker command to start a container with a read-only filesystem?

easy

A. docker run --read-only alpine

B. docker run --readonly alpine

C. docker run -ro alpine

D. docker run --readwrite alpine

Solution

1. Step 1: Check the correct flag syntax

   The correct flag to make the filesystem read-only is --read-only with a hyphen.

2. Step 2: Validate options

   docker run --read-only alpine uses the correct flag --read-only. The short flag -ro doesn't exist, --readonly lacks the hyphen, and --readwrite is the opposite meaning.

3. Final Answer:

   docker run --read-only alpine -> Option A

4. Quick Check:

   Correct flag is --read-only [OK]

Hint: Use double dash and hyphen: --read-only [OK]

Common Mistakes:

• Using --readonly without hyphen
• Using short flags like -ro which don't exist
• Confusing with --readwrite

3. Consider this command:
docker run --read-only -v /data alpine sh -c "echo hello > /data/file.txt && cat /data/file.txt"
What will be the output?

medium

A. hello

B. Permission denied error

C. No such file or directory error

D. Empty output

Solution

1. Step 1: Understand --read-only with volume mount

   The container filesystem is read-only, but the /data directory is mounted as a volume, which is writable.

2. Step 2: Analyze the command behavior

   The command writes "hello" to /data/file.txt and then reads it back. Since /data is writable, this succeeds and outputs "hello".

3. Final Answer:

   hello -> Option A

4. Quick Check:

   Writable volume inside read-only container = writable [OK]

Hint: Writable volumes override read-only container filesystem [OK]

Common Mistakes:

• Assuming entire container is fully read-only including volumes
• Expecting permission denied on volume writes
• Confusing volume mount syntax

4. You run this command:
docker run --read-only alpine sh -c "touch /tmp/testfile"
But it fails with a permission error. What is the best fix?

medium

A. Remove the --read-only flag

B. Add a writable tmpfs mount for /tmp using --tmpfs /tmp

C. Run the container as root user

D. Use -v /tmp:/tmp to mount host /tmp

Solution

1. Step 1: Identify cause of permission error

   The container filesystem is read-only, so creating files in /tmp fails.

2. Step 2: Provide writable space with tmpfs

   Using --tmpfs /tmp mounts a writable temporary filesystem at /tmp, allowing file creation despite read-only root.

3. Final Answer:

   Add a writable tmpfs mount for /tmp using --tmpfs /tmp -> Option B

4. Quick Check:

   Writable tmpfs fixes write errors in read-only containers [OK]

Hint: Use --tmpfs to add writable temp folders in read-only containers [OK]

Common Mistakes:

• Removing --read-only loses security benefits
• Mounting host /tmp may cause permission issues
• Assuming root user can write despite read-only filesystem

5. You want to run a container with a read-only filesystem but allow writing only to /app/logs. Which command correctly achieves this?

hard

A. docker run --read-only alpine

B. docker run --read-only --tmpfs /app/logs alpine

C. docker run -v /host/logs:/app/logs alpine

D. docker run --read-only -v /host/logs:/app/logs alpine

Solution

1. Step 1: Understand read-only with writable folder

   The container filesystem is read-only, but mounting a host directory as a volume at /app/logs makes that folder writable.

2. Step 2: Evaluate options

   docker run --read-only -v /host/logs:/app/logs alpine uses --read-only plus a volume mount for writable logs. docker run --read-only --tmpfs /app/logs alpine uses tmpfs which is temporary and not persistent. docker run -v /host/logs:/app/logs alpine lacks --read-only. docker run --read-only alpine has no writable folder.

3. Final Answer:

   docker run --read-only -v /host/logs:/app/logs alpine -> Option D

4. Quick Check:

   Volume mount + --read-only = writable folder [OK]

Hint: Use volume mount with --read-only for writable folders [OK]

Common Mistakes:

• Using tmpfs when persistence is needed
• Forgetting --read-only flag
• Expecting writable without volume or tmpfs