CV-C011: Writable root filesystem
Warning Security
Why This Matters
By default, a container has a writable root filesystem. If an attacker gains access to the container, they can modify binaries, install tools, or tamper with application files. Setting read_only: true makes the root filesystem read-only, forcing writable paths to be explicitly declared as tmpfs or volume mounts.
How to Fix
Set read_only: true and use tmpfs mounts for paths that need to be writable
Before (incorrect)
services:
web:
image: nginxAfter (correct)
services:
web:
image: nginx
read_only: true
tmpfs:
- /tmp
- /var/runRule Details
- Rule Code
- CV-C011
- Severity
- Warning
- Category
- Security