News for hackers. Stuff that matters.
Re:Immutable Infrastructure and Disposable Components by mwcampbell on Tuesday July 02, 2013 @12:06PM (#5978745)
Do you mount the root file system read-only in these images? That seems like it would be a great way to lock things down further, if it's practical.
Re:Immutable Infrastructure and Disposable Components by awj on Tuesday July 02, 2013 @02:03PM (#5979634)
No, mostly because it's inconvenient. Making the root filesystem read only means having to track down everything that tries to write to it and fix mounts for them.

After a few years of working with this, I kind of wish we'd bitten that bullet at the start. The AMIs we produce have a root filesystem that's only like 2 gigs so it goes across the network faster. 2 gigs isn't a lot of space when something decides it wants to log or write out temp files in weird places.