---
title: "Make the container file system read-only · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/read-only-containers
id: INF-75
level: Recommended
applies: servers
updated: 2026-10-27
build: a2a6bdfed830
tokens: 693
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Make the container file system read-only

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Containers and orchestration](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: INF-75
- Level: Recommended
- Chapter: [Containers and orchestration](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration.md)
- Rule: Run containers with a read-only root file system. Mount a volume for data and a `tmpfs` for scratch files.
- Check: `docker exec web touch /app/write-test` fails with a read-only error, and the app still serves pages and writes its data.
- Applies when: The project runs its own servers, virtual machines or containers.
- How: An attacker who gets code running cannot then change the app or drop tools on the disk. Set `read_only: true` in Compose or `--read-only` on the command line. Give writable paths only where the app writes, such as the data volume and `/tmp`. Services outside containers get the same protection from [Lock the service in a sandbox](https://agentwranglers.se/playbook/operations/running-the-service/service-sandbox.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### YAML example

```yaml
services:
  web:
    read_only: true
    tmpfs: [/tmp]
    volumes: [data:/data]
```

## Sources

- [OWASP Docker Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html)

## Related rules

- OPS-33 [Lock the service in a sandbox](https://agentwranglers.se/playbook/operations/running-the-service/service-sandbox.md) in Operations and observability

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/read-only-containers">Agent Wranglers infrastructure and environments playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Never give a container control of the host](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/no-privileged-containers.md)
- Next: [Publish only the ports visitors use](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/published-ports.md)
- [Containers and orchestration](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration.md)