3 ms·
Do you mount the root file system read-only in these images? That seems like it would be a great way to lock things down further, if it's practical.
by mwcampbell 13y ago
Do you mount the root file system read-only in these images? That seems like it would be a great way to lock things down further, if it's practical.
- awj 13y agoNo, mostly because it's inconvenient. Making the root filesystem read only means having to track down everything that tries to write to it and fix mounts for them. After a few years of working with this, I kind of wish we'd bitten that bullet at the start. The AMIs we produce have a root filesystem that's only like 2 gigs so it goes across the network faster. 2 gigs isn't a lot of space when something decides it wants to log or write out temp files in weird places.