Agent Wranglers

Containers Recommended

Make the container file system read-only

Run containers with a read-only root file system. Mount a volume for data and a tmpfs for scratch files.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

An attacker who gets code running cannot then change the app or drop tools on the disk. Set read_only: true in Compose or --read-only on the command line. Give writable paths only where the app writes, such as the data volume and /tmp.

Example

services:
  web:
    read_only: true
    tmpfs: [/tmp]
    volumes: [data:/data]

How to check

docker exec web touch /app/write-test fails with a read-only error, and the app still serves pages and writes its data.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers operations playbook: https://agentwranglers.se/playbook/operations/containers/read-only-containers.