CKS Supply Chain Security Practice Question
You need to ensure that all containers in your cluster run with a read-only root filesystem. Which field should be set in the container's security context?
⚠ Common exam trap
This question tests the distinction between security context fields that limit privileges (like allowPrivilegeEscalation or capabilities.drop) and those that enforce filesystem immutability (readOnlyRootFilesystem). Candidates often confuse privilege reduction with filesystem write protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
readOnlyRootFilesystem: true
Setting `readOnlyRootFilesystem: true` in the container's security context mounts the container's root filesystem as read-only, preventing any writes to the root filesystem. This directly enforces the requirement that all containers run with a read-only root filesystem, which is a key supply chain security control to limit the impact of a compromised container.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
readOnlyRootFilesystem: true
Why this is correct
readOnlyRootFilesystem: true mounts the container's root filesystem as read-only, preventing processes from writing to binaries, libraries, or configuration files. This blocks runtime tampering with the container's filesystem layer. Note that writable tmpfs mounts or volumes are still allowed, but the root filesystem itself is immutable.
- ✗
allowPrivilegeEscalation: false
Why it's wrong here
allowPrivilegeEscalation: false prevents a process from gaining additional privileges, such as through setuid binaries or acquiring new capabilities, but it does not affect filesystem write permissions. The container can still write to its root filesystem, so this setting does not satisfy the requirement to make all containers run with a read-only root.
- ✗
capabilities.drop: ['ALL']
Why it's wrong here
capabilities.drop: ['ALL'] removes all Linux capabilities from the container's process, limiting its ability to perform privileged syscalls and operations. However, file write access is determined by the mount mode (read-write) and standard Unix file permission bits, not by capabilities. Therefore, the root filesystem remains writable, so this option fails to meet the read-only requirement.
- ✗
runAsNonRoot: true
Why it's wrong here
runAsNonRoot: true enforces that the container's primary process runs with a non-root user ID, reducing the risk of root-level attacks. This does not change the mount properties of the root filesystem; the non-root user may still write to files and directories where permissions permit. Consequently, it does not make the filesystem read-only and is insufficient for the stated requirement.
Go deeper
Related to this question
About these practice questions
This CKS question is part of Courseiva's 845-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.