Why CoreOS has /usr as read only ? is this only because to make auto-update work fine ?

[Parag Gupta]

Do we have any other reason and advantage to make /usr as read-only?

I know this is read-only to make auto-update work smoothly?

What are the other reasons for the same ?

[Nick Stielau]

Mounting /usr read-only, and generally as much of the disk as possible, reduces security surface area and the possibility for configuration-drift across a fleet of servers.

See [1] for an example of a security vulnerability that was mitigated by the read-only disk.

[1] https://thenewstack.io/what-you-need-to-know-about-the-runc-container-escape-vulnerability/

--
You received this message because you are subscribed to the Google Groups "CoreOS Dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to coreos-dev+...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/coreos-dev/4b26331d-852d-4bf8-be2d-c3ed85d14bb2%40googlegroups.com.

--

-----

Nick Stielau

He - Him - His

SFO, OpenShift