LXC Container with Overlayfs/Squashfs

Question

We are using a Centos LXC container with the rootfs contained in a squashfs filesystem. I really like the fact that a user cannot edit the rootfs from the host.

During the development, developers would infact like to make changes to the filesystem, and I'd like to move to an overlayfs. But I notice that although the upper layer can be used to make changes to the lower layer, it is also possible to make changes to lower layer rootfs by simply editing the files on the host. How can I prevent this?

Answer 1

lxc.pre.mount gets executed before the rootfs gets loaded:

lxc.hook.pre-mount = /var/lib/lxc/container0/mount-squashfs.sh
lxc.rootfs.path = overlayfs:/var/lib/lxc/container0/rootfs:/var/lib/lxc/container0/delta0

And in the mount script:

#!/bin/bash
mount -nt squashfs -o ro /var/lib/lxc/container0/rootfs.sqsh /var/lib/lxc/container0/rootfs