1

We are using a Centos LXC container with the rootfs contained in a squashfs filesystem. I really like the fact that a user cannot edit the rootfs from the host.

During the development, developers would infact like to make changes to the filesystem, and I'd like to move to an overlayfs. But I notice that although the upper layer can be used to make changes to the lower layer, it is also possible to make changes to lower layer rootfs by simply editing the files on the host. How can I prevent this?

1

lxc.pre.mount gets executed before the rootfs gets loaded:

lxc.hook.pre-mount = /var/lib/lxc/container0/mount-squashfs.sh
lxc.rootfs.path = overlayfs:/var/lib/lxc/container0/rootfs:/var/lib/lxc/container0/delta0

And in the mount script:

#!/bin/bash
mount -nt squashfs -o ro /var/lib/lxc/container0/rootfs.sqsh /var/lib/lxc/container0/rootfs
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.