What does docker run --read-only do and how do you handle apps that need to write?
--read-only makes the container's root filesystem unwritable, so malware cannot modify binaries or drop files. Give the app writable tmpfs or volume mounts only for the paths it truly needs, such as /tmp.
Explain it simply
A printed question paper cannot be changed by students; they get a separate answer sheet for writing. A read-only root filesystem is the printed paper, and tmpfs or volumes are the answer sheets.
With --read-only, any write to the image filesystem fails with 'Read-only file system'. An attacker who gets code execution cannot replace your binary, edit config or install tools. Real apps still need some writable space: temp files, PID files, caches. Add --tmpfs /tmp or mount a volume at that exact path. Run the app, watch the errors in the logs, and add only the paths it complains about. Nginx, for instance, needs /var/cache/nginx and /var/run writable.
Kubernetes equivalent: securityContext.readOnlyRootFilesystem: true with emptyDir volumes for writable paths.
Example
docker run -d --read-only \
--tmpfs /tmp --tmpfs /var/cache/nginx --tmpfs /var/run \
-p 8080:80 nginxWhat to say in the interview
"--read-only locks the root filesystem so attackers cannot change binaries or config. I allow writes only through tmpfs or volume mounts on specific paths the app needs, found by checking error logs."
Common mistakes
- Giving the whole app directory a writable volume and defeating the purpose.