Add ReadonlyRootfs in ContainerSpec for --read-only#1872
Add ReadonlyRootfs in ContainerSpec for --read-only#1872aaronlehmann merged 1 commit intomoby:masterfrom
ReadonlyRootfs in ContainerSpec for --read-only#1872Conversation
Current coverage is 53.74% (diff: 100%)@@ master #1872 diff @@
==========================================
Files 106 106
Lines 18367 18367
Methods 0 0
Messages 0 0
Branches 0 0
==========================================
- Hits 9873 9872 -1
+ Misses 7282 7281 -1
- Partials 1212 1214 +2
|
|
ping @stevvooe |
api/specs.proto
Outdated
| // OpenStdin declares that the standard input (stdin) should be open. | ||
| bool open_stdin = 18; | ||
|
|
||
| // ReadonlyRootfs declares that the container root filesystem is read-only. |
There was a problem hiding this comment.
How does this interact with mounts that are not readonly?
|
I don't see any issue with this, other than I would just call it |
yongtang
force-pushed
the
29972-service-read-only
branch
from
1565920 to
d0e23d5
Compare
|
@stevvooe @aaronlehmann sorry for the late update. The PR has been updated with name changed to |
|
LGTM |
api/specs.proto
Outdated
| bool open_stdin = 18; | ||
|
|
||
| // ReadOnly declares that the container root filesystem is read-only. | ||
| // This only impacts the root filesystem, not additionally mounts (including |
There was a problem hiding this comment.
nit: "not additional mounts"
api/specs.proto
Outdated
| // ReadOnly declares that the container root filesystem is read-only. | ||
| // This only impacts the root filesystem, not additionally mounts (including | ||
| // tmpfs). For additional mounts that are not part of the initial rootfs, | ||
| // they will be decided by the modes passed alone. |
There was a problem hiding this comment.
Should this say "the modes passed in the mount definition"?
This fix tries to address the issue raised in docker/29972 where it was not possible to specify `--read-only` for `docker service create` and `docker service update`, in order to have the container's root file system to be read only. This fix adds `ReadOnly` so that it is possible to specify `--read-only` for `service update` and `service create`. Signed-off-by: Yong Tang <[email protected]>
yongtang
force-pushed
the
29972-service-read-only
branch
from
d0e23d5 to
c2ae199
Compare
|
@aaronlehmann The PR has been updated. Please take a look. |
|
LGTM |
4 participants
This fix tries to address the issue raised in moby/moby#29972 where it was not possible to specify
--read-onlyfordocker service createanddocker service update, in order to have the container's root file system to be read only.This fix adds
ReadonlyRootfsso that it is possible to specify--read-onlyforservice updateandservice createRelated docker PR is moby/moby#30162
Signed-off-by: Yong Tang [email protected]