Read-Only Filesystems

Protecting the Container Filesystem

The --read-only option makes the container's root filesystem read-only. Applications that need temporary writes can receive a tmpfs mount or a specific writable volume.

This limits persistence and reduces the impact of an attacker who gains code execution.