Re:Immutable Infrastructure and Disposable Components
by mwcampbell on Tuesday July 02, 2013 @12:06PM
(#5978745)
Do you mount the root file system read-only in these images? That seems like it would be a great way to lock things down further, if it's practical.
[ Parent
| on HN ]
Re:Immutable Infrastructure and Disposable Components
by awj on Tuesday July 02, 2013 @02:03PM
(#5979634)
No, mostly because it's inconvenient. Making the root filesystem read only means having to track down everything that tries to write to it and fix mounts for them.
After a few years of working with this, I kind of wish we'd bitten that bullet at the start. The AMIs we produce have a root filesystem that's only like 2 gigs so it goes across the network faster. 2 gigs isn't a lot of space when something decides it wants to log or write out temp files in weird places.