What is Kubernetes Pod Security Context ReadOnlyRootFilesystem?

Question

Accepted Answer

**ReadOnlyRootFilesystem** — prevent writes to container root filesystem.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: readonly-pod
spec:
  securityContext:
    runAsNonRoot: true
  containers:
  - name: app
    image: nginx:latest
    securityContext:
      readOnlyRootFilesystem: true
    volumeMounts:
    - name: tmp
      mountPath: /tmp
    - name: nginx-cache
      mountPath: /var/cache/nginx
  volumes:
  - name: tmp
    emptyDir: {}
  - name: nginx-cache
    emptyDir: {}
```

```bash
kubectl exec readonly-pod -- touch /test 2>&1  # Should fail
kubectl exec readonly-pod -- touch /tmp/test  # Should succeed
```

**Benefit:** prevent malware writes, enforce immutable filesystem.

DevOps: What is Kubernetes Pod Security Context ReadOnlyRootFilesystem?