Read-only root filesystem

read_only: true mounts the container's image read-only: nothing can be added or changed outside volumes and tmpfs mounts, neither by the app nor by an attacker who takes it over.

How it works

Data goes to volumes; scratch space goes to a tmpfs (tmpfs: [/tmp]), a small folder in memory emptied at each start. Images document the folders they write: nginx uses /var/cache/nginx and a pid file, PostgreSQL /var/run/postgresql. docker diff on a running container lists what it has written so far.

What breaks

Programs that write when they start fail with Read-only file system (EROFS): a temporary folder, a pid file, a cache. The fix is a tmpfs or a volume for that path only, never giving up read_only for the whole container.

In compose.yaml

services:
  api:
    image: shop-api:4.6
    read_only: true
    tmpfs:
      - /tmp

See it break, then fix it

Write the Dockerfile or the compose file, type the docker commands, and watch a simulated server run them through reboots, upgrades and traffic. Free to start.

Open the learning path Open the sandbox