Add --read-only for read only container rootfs #10093

crosbymichael · 2015-01-14T18:46:55Z

Add a --read-only flag to allow the container's root filesystem to be
mounted as read only. This can be used in combination with volumes to
force a container's process to only write to locations that will be
persisted. This is useful in many cases where the admin controls where
they would like developers to write files and error on any other
locations.

Closes #7923
Closes #8752

Signed-off-by: Michael Crosby crosbymichael@gmail.com

LK4D4 · 2015-01-14T18:50:27Z

@crosbymichael Tests not compiling :)

crosbymichael · 2015-01-14T18:51:26Z

@LK4D4 i don't know what you are talking about....

tianon · 2015-01-14T18:54:51Z

+1 for this even without --tmpfs 👍

mrunalp · 2015-01-14T18:55:56Z

docs/man/docker-run.1.md

+**--readonly**=*true*|*false*
+    Mount the container's root filesystem as readonly.
+
+    By default a container will have it's root filesystem writable allowing processes


typo: it's --> its

mrunalp · 2015-01-14T18:56:57Z

👍

jessfraz · 2015-01-14T20:45:58Z

cooooollll the diff is so smalll! LGTM

tiborvass · 2015-01-14T20:47:09Z

docs/sources/reference/commandline/cli.md

@@ -1681,6 +1683,13 @@ will automatically create this directory on the host for you. In the
 example above, Docker will create the `/doesnt/exist`
 folder before starting your container.

+    $ sudo docker run -v /icanwrite --readonly busybox touch /icanwrite here


Minor nit, but docker run --readonly -v /icanwrite ... could be better, as "icanwrite readonly" sounds weird.

i agree - putting the flag you're talking about first also gives it emphasis.

tiborvass · 2015-01-14T21:34:59Z

Should we add a small warning somewhere explaining that tmpfs mountpoints are still writeable?

crosbymichael · 2015-01-14T21:36:14Z

Any mounts are still writable, if they are mounted as rw

tiborvass · 2015-01-14T21:37:22Z

Oh right, it's only the rootfs that's readonly, my bad. Code LGTM

LK4D4 · 2015-01-14T21:42:38Z

docs/sources/reference/api/docker_remote_api_v1.17.md

@@ -323,6 +326,7 @@ Return low-level information on the container `id`
 			"NetworkMode": "bridge",
 			"PortBindings": {},
 			"Privileged": false,
+            "ReadonlyRootfs": false,


weird formatting

LK4D4 · 2015-01-14T21:50:03Z

I have no idea where, but should be in "what's new"

SvenDowideit · 2015-01-14T22:04:38Z

docs/sources/reference/commandline/cli.md

+a container writes files.  The `--readonly` flag mounts the container's root
+filesystem as read only prohibiting writes to locations other than the
+specified volumes for the container.
+


I'd flip the first sentence to be more like

To control where a container can write files, you can combine the--readonlyflag with volumes of volume containers

Starting a discussion about readonly with Volumes made me wonder if it was out of place.

no matter tho, easy for us to discuss post-merge.

@fredlf ! ! ! ^^^ I'm trying to apply what you told us but @SvenDowideit is saying you are wrong or I did it wrong.

Heh, this is one of those cases where we can see the fact that writing is not code. There's no right or wrong, here, it's a question of what we most want to emphasize. @crosbymichael 's original sentence emphasizes the idea of "control over where a container writes". @SvenDowideit 's rewrite places reader emphasis on the idea of "combining the --readonly flag with volumes." Only the writer knows what he actually wanted to emphasize. But @SvenDowideit's response as a reader (another term for RET is reader-response criticism), gives an important clue: he did not have any context for mentally processing the concept of "volumes" when it was introduced. So, let's give the reader the context they need and expect: "The --readonly flag can be used in combination with volumes to control where a container writes files."

SvenDowideit · 2015-01-14T22:06:41Z

This is a very cool featurette! Docs LGTM @fredlf @jamtur01

Need to create a working example showing how its useful tho

jamtur01 · 2015-01-14T22:10:29Z

I think readonly should probably be read-only both in option and text. It's definitely read-only when used in a sentence.

jamtur01 · 2015-01-14T22:10:34Z

Otherwise LGTM

crosbymichael · 2015-01-14T22:10:52Z

@jamtur01 you mean --read-only?

jamtur01 · 2015-01-14T22:12:57Z

Yes - though I'm open to be told I'm wrong as an option - but definitely the docs should say "read-only" - readonly is wrong.

crosbymichael · 2015-01-14T22:14:30Z

@tianon what do you think? --readonly or --read-only for a cli flag?

tianon · 2015-01-14T22:17:44Z

I think --read-only for consistency, even though I like --readonly.

from man mount:

       -r, --read-only
              Mount the filesystem read-only. A synonym is -o ro.

              Note  that,  depending  on the filesystem type, state and kernel
              behavior, the system may still write to the device. For example,
              ext3 or ext4 will replay its journal if the filesystem is dirty.
              To prevent this kind of write access, you may want to mount ext3
              or  ext4  filesystem  with  "ro,noload" mount options or set the
              block device to read-only mode, see command blockdev(8).

crosbymichael · 2015-01-14T22:18:22Z

@tianon thanks, consistency wins, i'll make the change in docs and code.

crosbymichael · 2015-01-14T22:25:56Z

@jamtur01 made the changes and changed the flag name to be consistent with other tools.

jamtur01 · 2015-01-14T22:27:42Z

LGTM

LK4D4 · 2015-01-14T23:23:55Z

Okay, I was ignored again :(
I found What's new section for you @crosbymichael : docs/sources/reference/api/docker_remote_api.md.

crosbymichael · 2015-01-14T23:34:03Z

@LK4D4 I saw your comment, I just don't know what to say about adding a new field to an api object, it looks to be more about endpoints.

LK4D4 · 2015-01-14T23:36:14Z

@crosbymichael Now it is possible to mount container rootfs as read-only!!!!!! or something like this. This is new feature in api, this should be there.
ping @SvenDowideit maybe you know how to write it better.

Add a --readonly flag to allow the container's root filesystem to be mounted as readonly. This can be used in combination with volumes to force a container's process to only write to locations that will be persisted. This is useful in many cases where the admin controls where they would like developers to write files and error on any other locations. Closes moby#7923 Closes moby#8752 Signed-off-by: Michael Crosby <crosbymichael@gmail.com>

crosbymichael · 2015-01-14T23:41:43Z

@LK4D4 added

LK4D4 · 2015-01-14T23:56:48Z

LGTM

Add --read-only for read only container rootfs

noisy · 2015-02-16T14:33:50Z

👍

crosbymichael force-pushed the readonly-containers branch from 8cdd372 to 88e1e41 Compare January 14, 2015 18:51

mrunalp reviewed Jan 14, 2015
View reviewed changes

crosbymichael force-pushed the readonly-containers branch from 88e1e41 to 42cbe0e Compare January 14, 2015 19:06

jessfraz added the /project/doc label Jan 14, 2015

tiborvass reviewed Jan 14, 2015
View reviewed changes

LK4D4 reviewed Jan 14, 2015
View reviewed changes

crosbymichael force-pushed the readonly-containers branch from 42cbe0e to 18b612a Compare January 14, 2015 21:48

SvenDowideit reviewed Jan 14, 2015
View reviewed changes

crosbymichael force-pushed the readonly-containers branch from 18b612a to 202471e Compare January 14, 2015 22:10

crosbymichael force-pushed the readonly-containers branch from 202471e to 84c27e0 Compare January 14, 2015 22:24

crosbymichael changed the title ~~Add --readonly for read only container rootfs~~ Add --read-only for read only container rootfs Jan 14, 2015

crosbymichael force-pushed the readonly-containers branch from 84c27e0 to 4094070 Compare January 14, 2015 23:41

LK4D4 added a commit that referenced this pull request Jan 14, 2015

Merge pull request #10093 from crosbymichael/readonly-containers

95c0f07

Add --read-only for read only container rootfs

LK4D4 merged commit 95c0f07 into moby:master Jan 14, 2015

crosbymichael deleted the readonly-containers branch January 14, 2015 23:57

SvenDowideit mentioned this pull request Jan 27, 2015

Post 1.4.1 docs update 2 #9739

Merged

wking mentioned this pull request Jun 25, 2015

Clarify readonlyRootfs opencontainers/runtime-spec#23

Closed

josephpage mentioned this pull request Aug 5, 2015

Read-only container ficusio/openresty#7

Closed

deniseschannon mentioned this pull request Mar 8, 2016

[Cattle] Support Read Only Containers rancher/rancher#3837

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add --read-only for read only container rootfs #10093

Add --read-only for read only container rootfs #10093

crosbymichael commented Jan 14, 2015

LK4D4 commented Jan 14, 2015

crosbymichael commented Jan 14, 2015

tianon commented Jan 14, 2015

mrunalp Jan 14, 2015

mrunalp commented Jan 14, 2015

jessfraz commented Jan 14, 2015

tiborvass Jan 14, 2015

SvenDowideit Jan 14, 2015

tiborvass commented Jan 14, 2015

crosbymichael commented Jan 14, 2015

tiborvass commented Jan 14, 2015

LK4D4 Jan 14, 2015

LK4D4 commented Jan 14, 2015

SvenDowideit Jan 14, 2015

crosbymichael Jan 14, 2015

fredlf Jan 15, 2015

SvenDowideit commented Jan 14, 2015

jamtur01 commented Jan 14, 2015

jamtur01 commented Jan 14, 2015

crosbymichael commented Jan 14, 2015

jamtur01 commented Jan 14, 2015

crosbymichael commented Jan 14, 2015

tianon commented Jan 14, 2015

crosbymichael commented Jan 14, 2015

crosbymichael commented Jan 14, 2015

jamtur01 commented Jan 14, 2015

LK4D4 commented Jan 14, 2015

crosbymichael commented Jan 14, 2015

LK4D4 commented Jan 14, 2015

crosbymichael commented Jan 14, 2015

LK4D4 commented Jan 14, 2015

noisy commented Feb 16, 2015

Add --read-only for read only container rootfs #10093

Add --read-only for read only container rootfs #10093

Conversation

crosbymichael commented Jan 14, 2015

LK4D4 commented Jan 14, 2015

crosbymichael commented Jan 14, 2015

tianon commented Jan 14, 2015

mrunalp Jan 14, 2015

Choose a reason for hiding this comment

mrunalp commented Jan 14, 2015

jessfraz commented Jan 14, 2015

tiborvass Jan 14, 2015

Choose a reason for hiding this comment

SvenDowideit Jan 14, 2015

Choose a reason for hiding this comment

tiborvass commented Jan 14, 2015

crosbymichael commented Jan 14, 2015

tiborvass commented Jan 14, 2015

LK4D4 Jan 14, 2015

Choose a reason for hiding this comment

LK4D4 commented Jan 14, 2015

SvenDowideit Jan 14, 2015

Choose a reason for hiding this comment

crosbymichael Jan 14, 2015

Choose a reason for hiding this comment

fredlf Jan 15, 2015

Choose a reason for hiding this comment

SvenDowideit commented Jan 14, 2015

jamtur01 commented Jan 14, 2015

jamtur01 commented Jan 14, 2015

crosbymichael commented Jan 14, 2015

jamtur01 commented Jan 14, 2015

crosbymichael commented Jan 14, 2015

tianon commented Jan 14, 2015

crosbymichael commented Jan 14, 2015

crosbymichael commented Jan 14, 2015

jamtur01 commented Jan 14, 2015

LK4D4 commented Jan 14, 2015

crosbymichael commented Jan 14, 2015

LK4D4 commented Jan 14, 2015

crosbymichael commented Jan 14, 2015

LK4D4 commented Jan 14, 2015

noisy commented Feb 16, 2015