Docker and CI/CD · Middle · Question 24 of 75

What does running with `--read-only` achieve?

✓Correct answer: The root filesystem can't be modified; writes go to volumes
2The container can read files but can't open network ports
3Other containers can only read this container's logs

Explanation

An attacker can't drop binaries or change code. Mount a tmpfs for /tmp and volumes for data that must be written.

Further reading

Test yourself

Take the Docker and CI/CD · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.