Read-only containers
In the development of our previous examples spanning most of the chapters, we did not really pay much attention to whether containers changed the state of the filesystem while running. This is not such a problem for test and development systems, but in production, it is very important to lock things down even further in order to prevent malicious runtime exploitation from both internal and external sources. For this purpose, there is a docker run --read-only flag, which (unsurprisingly) mounts the container's root filesystem as read-only. By doing this, we ensure that all data that is not mounted with volumes is as pristine as when we built the image, ensuring consistency and protecting your cluster. The only thing that ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access