0

I have an embedded device that I want to harden against data corruption due to unexpected power outages. It is a vanilla Ubuntu 20.04 LTS build with an app in a docker container on top, and I have established the handful of directories in the root filesystem that are touched by the app during normal operation.

My intention is to mount all but those directories read-only. Is it possible to mount some of the RFS in a RO partition and the rest in a separate RW partition, or is there a better approach to this?

Much appreciated in advance!

6
  • Is it crucial that the data that is written is persisted across reboots? (Also, is it "a lot"?) Otherwise, you might consider putting those directories into a ram disk and have your drive entirely read-only. Jun 7 at 17:07
  • Thanks for your quick response! I had considered a ram disk, but unfortunately persistence is necessary and there is potentially quite a lot of data written in the event of patchy network connection (it's a telemetry/control device). Jun 8 at 8:30
  • Does the app touch anything outside its Docker volume? Jun 8 at 8:33
  • Good question. I'm quite new to the project and don't have much of an understanding of the app itself, just the linux system and hardware that it runs on. Is there an easy way to determine this? It touches /etc and /var, so my assumption is yes. Jun 8 at 14:54
  • How is your container set up? Containers don’t have access to anything outside their volume unless it’s explicitly configured (and that’s unusual). Jun 8 at 14:59
2

When all the directories belong to the same filesystem it doesn't matter if some of them are mounted RO and some are RW, because writes to some directories may affect something else.

The only surefire solution against damage is to allow writes only to a separate partition (in a perfect world this partition should belong to a different storage device).

4
  • Mm, this was my thought also. In the past I've done this by having separate partitions for almost every directory in the root filesystem, but it was a faff to build and maintain. The question is, is it possible to split the filesystem across just two partitions (RW and RO) and if so, how would I go about it? Jun 8 at 9:48
  • 1) symbolic links 2) mount -o binds 3) network mounts (cifs/nfs/whatever) Jun 8 at 13:18
  • I've been looking into bind mounts as an option. If I mount everything in / as RO and then bind mount specific directories to themselves as RW, will that get me where I need to be? Jun 8 at 14:58
  • If that's the same storage, again, it won't protect you from damage. Jun 8 at 15:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.