New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Docker Read-Only File System #66

Closed
RehanSaeed opened this Issue Nov 6, 2017 · 5 comments

Comments

Projects
None yet
3 participants
@RehanSaeed
Copy link

RehanSaeed commented Nov 6, 2017

I learned that you have the ability to set the file system to read-only in docker by setting a simple boolean flag. Any custom volumes you've specified remain unaffected. This seems like a great little flag to turn on for some added security, so I tried it out and got the following error from my ASP.NET Core 2.0 runtime image:

Failed to initialize CoreCLR, HRESULT: 0x80004005

Does the ASP.NET Core image support this feature and could it even be turned on in the Dockerfile by default for some added security?

@richardgavel

This comment has been minimized.

Copy link

richardgavel commented Nov 15, 2017

I don't see anything that suggests this is something that goes in the Dockerfile, just a container runtime feature. Now it's possible that CoreCLR has code within it that tries to open files in a non-read-only mode...

@shirhatti

This comment has been minimized.

Copy link
Member

shirhatti commented Nov 15, 2017

This could possibly be achieved by specifying volume mounts corresponding to every directory that ASP.NET and your application may write temporary write files to.

@RehanSaeed if you want to give it a shot, we can help you through issues you encounter along the way.

@csharpfritz and @HongGit what are your thoughts on this?

@RehanSaeed

This comment has been minimized.

Copy link

RehanSaeed commented Nov 16, 2017

Typical ASP.NET Core apps don't use any temporary directories that I'm aware of. Volume mounts should work but I don't know which directories .NET Core needs write access to.

@shirhatti

This comment has been minimized.

Copy link
Member

shirhatti commented Nov 16, 2017

Ah sorry. This is the repo for ASP.NET, not ASP.NET Core. You're probably looking for https://github.com/aspnet/aspnet-docker

@RehanSaeed

This comment has been minimized.

Copy link

RehanSaeed commented Nov 17, 2017

@RehanSaeed RehanSaeed closed this Nov 17, 2017

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment