Subfolders are being written to in docker (not really a bug)

[Uatschitchun]

This one is not really a bug, but a security problem!
As because of this:
docker/for-linux#788

Adding a folder with submounts read only like:
-v /media:/media:ro
doesn't make mountpoints underneath /media, like /media/movies, read only, if movies is a mountpoint.
This should be documented here:
https://jellyfin.readthedocs.io/en/latest/administrator-docs/installing/#docker-hub

I was wondering, as jellyfin wrote nfo files and posters to a bind mount that I thought is read only, although it isn't!

I know of many people having their media added to jellyfin like this, who believe, their media is safe this way!

[ThatNerdyPikachu]

@anthonylavado Does Jellyfin:

• ever write to the media files? (I assume not, just wondering :P)
• write to the folders containing the files on its own, without user configuration of a feature that does that?

Thanks!

[anthonylavado]

@ThatNerdyPikachu

1. No
2. No. As you said, you’d have to enable something, like NFO writing, or keeping images next to the media, etc.

[JustAMan]

1. Not completely "No" :) there's that dready "Delete" button which an admin can push (and it should not trigger automatically but bugs could happen as we all know)

[dkanada]

Looks like a warning was added in the docker section so I'll close this.