In this lesson, you will learn how to harden your containerized applications by restricting file system access through read-only volume mounts.
Why Limit Write Access?
When you mount a volume (like a bind mount or a named volume) into a container, Docker grants write permissions by default. This creates a potential security risk: if a vulnerability is exploited in your application, an attacker could modify your critical configuration files, delete source code, or plant malicious scripts directly into the mounted directory.
By enforcing a read-only policy, you ensure that the container can read necessary data—such as web assets, certificates, or static configurations—without the ability to alter or delete them. This implements the "Principle of Least Privilege," significantly reducing the blast radius of a potential container compromise.
Implementing Read-Only Mounts
You can implement this restriction directly within your docker-compose.yml file. When defining your volumes, simply append :ro to the end of the mapping string.
For example, imagine you are serving a static website from a directory on your host:
services:
web-server:
image: nginx:alpine
volumes:
- ./static-content:/usr/share/nginx/html:ro
In this configuration, the nginx process can read the files inside /usr/share/nginx/html to serve your website, but it lacks the permission to modify, rename, or delete any of those files. If the web server process attempts to write to that directory, the kernel will block the operation and return an "Access Denied" error, effectively neutralizing any attempts to tamper with your static assets.
This simple addition to your configuration acts as a powerful security gatekeeper, ensuring that your application's data remains immutable throughout its lifecycle.
Key Takeaway: Appending :ro to your volume mappings enforces immutability, preventing containers from modifying critical host files and strengthening your overall security posture.