What is Kubernetes Pod Security Context ReadOnly?

Question

Accepted Answer

**ReadOnly Root Filesystem** — prevent container writes to root filesystem.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: readonly-pod
spec:
  securityContext:
    runAsNonRoot: true
  containers:
  - name: app
    image: nginx:latest
    securityContext:
      readOnlyRootFilesystem: true
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
    volumeMounts:
    - name: tmp
      mountPath: /tmp
    - name: nginx-cache
      mountPath: /var/cache/nginx
    - name: nginx-run
      mountPath: /var/run
  volumes:
  - name: tmp
    emptyDir: {}
  - name: nginx-cache
    emptyDir: {}
  - name: nginx-run
    emptyDir: {}
```

```bash
kubectl exec readonly-pod -- touch /test 2>&1  # Should fail
kubectl exec readonly-pod -- touch /tmp/test  # Should succeed
```

**Benefit:** prevent malware writes, enforce immutable filesystem.

DevOps: What is Kubernetes Pod Security Context ReadOnly?