We are using a Centos LXC container with the rootfs contained in a squashfs filesystem. I really like the fact that a user cannot edit the rootfs from the host.
During the development, developers would infact like to make changes to the filesystem, and I'd like to move to an overlayfs. But I notice that although the upper layer can be used to make changes to the lower layer, it is also possible to make changes to lower layer rootfs by simply editing the files on the host. How can I prevent this?