Set readOnlyRootFSEnabled Parameter to True

Note

Be aware that configuring this step is entirely optional and should be undertaken exclusively if you seek to enhance the security of your containers.

To change the readOnlyRootfSEnabled setting from false to true, perform the following:

Set readOnlyRootFSEnabled: true in accelo.yml file.
Run the following command:

accelo admin database push-config

Restart accelo by running the following command:

accelo restart all -d

To ensure that all the containers are in ReadOnlyRootFileSystem, run the following command:

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: ReadonlyRootfs={{ .HostConfig.ReadonlyRootfs }}'

In case any service requires additional paths to be mounted as tmpfs, you must add it to the <service>.yml file.

For example: ad-proxy.yml

version: "2" services: ad-proxy: image: ad-proxy container_name: "" environment: [] volumes: - /etc/localtime:/etc/localtime:ro - /data01/acceldata/config/proxy/traefik.toml:/etc/traefik/traefik.toml - /data01/acceldata/config/proxy/config.toml:/etc/traefik/conf/config.toml - /data01/acceldata/config/proxy/certs:/etc/acceldata ulimits: {} ports: - 443:443 depends_on: [] opts: {} restart: "" extra_hosts: [] network_alias: [] tmpfs: /tmp: rw label: Proxy

Last updated on

Was this page helpful?