News for hackers. Stuff that matters.

A comment on CoreOS Overview, Part One. Parent comment

Re:CoreOS Overview, Part One by icebraining on Saturday January 30, 2016 @05:43AM (#11001410)
Enforcing an immutable filesystem is actually pretty easy to do, just don't give write permissions to the user under which the program is running :)

What Docker integrates is a layered filesystem, in which the application can mutate the filesystem, but only it will see those changes (and they'll go away when the container is destroyed).

[ Parent | on HN ]
Re:CoreOS Overview, Part One by justincormack on Saturday January 30, 2016 @07:20AM (#11001596)
You can mount the base filesystem read only in the container as of 1.10, with tmpfs mounts for where you need ephemeral mutation.
[ Parent | on HN ]
Re:CoreOS Overview, Part One by merb on Saturday January 30, 2016 @06:15AM (#11001481)
oh yeah sorry. however on some linux filesystems you could also use `chattr +x` however most things won't play well with that ;) especially not programs which create logs / pids / whatever.
[ Parent | on HN ]