read_only & process user
Reduce writable runtime surfaces
Lesson 16 of 20 · 12 min · Module 5: Readiness and runtime boundaries
Give the process only the writable paths it is supposed to use.
Start this lesson →Free. No installation: you write and run the code in your browser, and it is checked automatically.
By the end, you’ll be able to…
- Constrain writes deliberately
- Keep required temporary space
The idea
Compose describes services and their relationships as YAML mappings and sequences. Read the whole service graph, including access and storage boundaries.
01Constrain writes deliberately
A read-only root filesystem limits where a process can change files. It requires you to know which paths the application genuinely needs to write.
02Keep required temporary space
tmpfs provides temporary memory-backed writable storage. Its contents are not durable application data or an independent backup.
03Test the actual application contract
The practice model checks configuration. A real rollout must verify that libraries, caches, and startup scripts work with those restrictions.
Your turn
What the checks look for
- Runs under the specified nonroot identity
- Sets a read-only root
- Provides temporary space
Take this with you
Constrain writable paths while providing the ones the application requires.
Go a little further
List the directories your own application writes during startup and normal requests.