DOCKER · Security · 8 min

Give a read-only container a scratch space

Allow temporary writes without making the root filesystem writable.

Not completed

Your task

Start the container with --read-only and a tmpfs at /tmp. Write ok into /tmp/probe, then inspect the read-only setting.

What you’re aiming for

ReadonlyRootfs is true.
/tmp/probe contains ok.
The /tmp mount is temporary tmpfs storage.

1. Prepare your practice folder

Use a running Docker engine in Linux container mode. The setup commands below use a Bash-compatible shell: Git Bash on Windows, or Bash on Linux/macOS.

Create a new, empty folder for this exercise. If that name already exists, choose another new name. Continue only after you’re inside the new folder.

NEW PRACTICE FOLDER

mkdir opsrung-docker-readonly-with-tmpfs && cd opsrung-docker-readonly-with-tmpfs

Run these setup commands in that folder:

SETUP — RUN ONCE

cat > Dockerfile <<'DOCKERFILE'
FROM alpine:3.22
USER 65534:65534
CMD ["sleep","3600"]
DOCKERFILE
docker build -t opsrung-readonly-with-tmpfs:practice .

Docker may download the official Alpine image and, for the web task, its HTTP package. If an example container name already exists, use a different name consistently. If port 8088 is occupied, choose another free local port.

2. Try the task

Work toward the goal above. Start by inspecting the files or resources, then use a hint if you need one.

Hint 1

A read-only root filesystem can coexist with a writable tmpfs mount.

Hint 2

Use --tmpfs /tmp:rw,noexec,nosuid,mode=1777.

Hint 3

Inspect the host configuration as well as reading the file.

3. Review your result

Use these commands to look at your result and compare it with the goals. The website does not run or verify them.

REVIEW IN YOUR TERMINAL

docker exec opsrung-readonly-with-tmpfs cat /tmp/probe
docker inspect opsrung-readonly-with-tmpfs --format "{{json .HostConfig.Tmpfs}}"

What you should see

ReadonlyRootfs is true.
/tmp/probe contains ok.
The /tmp mount is temporary tmpfs storage.

If your result differs: Compare the actual output with each goal. Keep your work inside this exercise’s folder and use only its named resources.

Compare with one possible solution

ONE POSSIBLE SOLUTION

docker run -d --name opsrung-readonly-with-tmpfs --network none --read-only --cap-drop ALL --security-opt no-new-privileges --tmpfs /tmp:rw,noexec,nosuid,mode=1777 opsrung-readonly-with-tmpfs:practice
docker exec opsrung-readonly-with-tmpfs sh -c 'printf ok > /tmp/probe'
docker inspect opsrung-readonly-with-tmpfs --format "{{.HostConfig.ReadonlyRootfs}}"

Other approaches are fine if you reach the same goal. Opening this solution does not mark the exercise complete.

Clean up this exercise

Only remove the example resources you created. Volume cleanup deletes that exercise’s saved sample data. Keep anything you need.

OPTIONAL CLEANUP

docker stop opsrung-readonly-with-tmpfs
docker rm opsrung-readonly-with-tmpfs
docker image rm opsrung-readonly-with-tmpfs:practice

Finished this exercise?

You decide when you’re done. Your choice is saved in this browser, and you can change it later.