combust-labs / firebuild

Convenience of containers, security of virtual machines
https://combust-labs.github.io/firebuild-docs/
GNU Affero General Public License v3.0
97 stars 7 forks source link

run command: Allow read-only root volumes #33

Open radekg opened 3 years ago

radekg commented 3 years ago

For Lambda similar use cases, it might not be necessary to have a writable root file system. Allow providing the root file system in a RO mode. When using RO rootfs, do not copy the rootfs file to the run cache but rather run the jail directly from the rootfs catalog copy.

Neither kill nor purge will remove that copy because these commands do not follow the links from jail and they assume that run cache contains a copy anyway.