In this lesson, you will learn how to harden your container security by preventing unauthorized processes from modifying your application’s files.
Why Filesystem Security Matters
By default, a container’s root filesystem is "writable." If an attacker manages to exploit a vulnerability in your application, they might try to download a malicious script, install a binary, or overwrite existing configuration files to establish persistence. Even if you restart the container, these malicious changes could persist if they were saved in the container's writable layer.
The Read-Only Approach
To stop this, we can mount the container’s root filesystem as read-only. This restricts the container so that it cannot modify any files or directories unless they are explicitly mounted as a separate volume. Essentially, you treat your container as an immutable, static artifact. If an attacker tries to run a command like apt-get install or echo "malicious" > config.json, the kernel will block the write attempt and return an "Operation not permitted" error.
How to Implement It
In Docker, you can enforce this with the --read-only flag when starting your container:
docker run --read-only nginx
If your application needs to write logs or temporary data, you simply provide a specific location for those writes using a volume. This adheres to the Principle of Least Privilege, ensuring that only the directories you explicitly permit can be modified:
docker run --read-only -v /my-app-logs:/var/log/nginx nginx
In this setup, the entire file system is locked down, but the application can still function because /var/log/nginx remains writable via the volume. This drastically reduces the "attack surface" of your container because even if an intruder gains code execution, they cannot modify the core application binaries or system files to hide their tracks or maintain control.
Key Takeaway: Mounting your container’s root filesystem as read-only forces immutability, preventing attackers from installing persistent malicious binaries or tampering with system configuration.