CKS Minimize Microservice Vulnerabilities Practice Question
Which ONE of the following is a valid method to restrict a container's filesystem to read-only in Kubernetes?
⚠ Common exam trap
In the CKS exam, the distinction between making a specific volume read-only (e.g., via `readOnly: true` on a mount) versus making the entire container's root filesystem read-only via `readOnlyRootFilesystem` is often tested. Candidates mistakenly think that setting `readOnly: true` on any volume achieves the same effect.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set readOnlyRootFilesystem: true in the container's securityContext
The only valid method listed. Setting `readOnlyRootFilesystem: true` in the container's securityContext directly makes the container's root filesystem read-only. Options A, B, and D only make specific volumes read-only (ConfigMap, hostPath, emptyDir), but do not prevent writes to the container's own filesystem (e.g., /etc, /tmp, /var). Therefore, only option C correctly restricts the container's filesystem to read-only.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a ConfigMap volume with defaultMode 0444
Why it's wrong here
Setting defaultMode on a ConfigMap volume only affects file permissions; the volume is still writable unless mounted with readOnly: true. Even with readOnly: true, only that specific volume is read-only, not the container's root filesystem.
- ✗
Set readOnly: true on a hostPath volume mount
Why it's wrong here
Setting readOnly: true on a hostPath volume mount only restricts writes to that specific hostPath directory or file when the container accesses it. The container's own root filesystem, which is built from the image and provides the operating system and application binaries, remains completely writable, so an attacker could still modify other directories such as /etc or /tmp. This option is therefore narrowly scoped to a single volume and does not achieve a read-only container root filesystem.
- ✓
Set readOnlyRootFilesystem: true in the container's securityContext
Why this is correct
Setting readOnlyRootFilesystem: true in the container's securityContext causes the entire root filesystem of the container to be mounted read-only, so any attempt to write to filesystem paths that are part of the image or container layer will fail. This is the standard, recognized method to enforce a read-only container filesystem, because it applies globally to the container's base filesystem rather than to a specific volume. Note that this does not affect volumes that are explicitly mounted; each volume still needs to be explicitly marked readOnly if that is desired.
- ✗
Mount an emptyDir volume with readOnly: true
Why it's wrong here
Mounting an emptyDir volume with readOnly: true makes only that particular emptyDir mount point read-only for the container; the emptyDir itself is just an ephemeral directory, not the container's root filesystem. The root filesystem, which is the writable layer over the container image, remains writable and is unaffected by this volume mount. Thus, this approach fails to restrict writes to the container's own filesystem and does not satisfy the requirement of a read-only container filesystem.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 114 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.