Review container root filesystem write protection

Description

A writable container root filesystem lets a process change image-based files within its file permissions. Application errors or compromise can leave unintended files in the running environment.

A read-only root filesystem reduces what can be changed, but does not make separately mounted volumes read-only or prevent every malicious operation.

Potential impact

A compromised process may leave files behind or modify runtime configuration.
Enabling read-only mode without required writable paths can prevent application startup or operation.

Remediation

Set read_only_root_filesystem = true in the container security_context.
Provide emptyDir or PVC volumes only for required writes such as logs and temporary files, and restrict volume permissions.
Apply other protections such as allow_privilege_escalation = false and test normal operation.

Examples

These excerpts compare protection settings only. The existing nginx:1.7.9 is not recommended for current deployment. Use a maintained image and separately provide volumes and configuration for required nginx cache and runtime directories.

Before

hcl

resource "kubernetes_pod" "example" {
  metadata {
    name = "app"
  }

  spec {
    container {
      name  = "web"
      image = "nginx:1.7.9"

      security_context {
        read_only_root_filesystem = false
      }
    }
  }
}

After

hcl

resource "kubernetes_pod" "example" {
  metadata {
    name = "app"
  }

  spec {
    container {
      name  = "web"
      image = "nginx:1.7.9"

      security_context {
        read_only_root_filesystem  = true
        allow_privilege_escalation = false
      }
    }
  }
}

Explanation:

Before: Root filesystem writes are not restricted by this setting. Actual file changes depend on process permissions.
After: The root filesystem is read-only and privilege escalation is restricted. Required writable application paths must be provided separately.