mediumMultiple ChoiceObjective-mapped

CAS-004 Practice Question: The Docker container `myservice` has the mount…

Exhibit

$ docker inspect myservice | jq '.[].Mounts'
[
  {
    "Type": "bind",
    "Source": "/data/config",
    "Destination": "/app/config",
    "Mode": "ro",
    "RW": false,
    "Propagation": "rprivate"
  }
]

The Docker container `myservice` has the mount configuration shown. What is the most significant security implication of this configuration?

⚠ Common exam trap

The common misconception is that any bind mount grants full host filesystem access, when in fact the scope is limited to the specific mounted directory and the read-only flag further restricts write capabilities.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The container can read host files at /data/config, but not write.

The mount configuration shown (a bind mount with read-only flag) restricts the container to read-only access to the host's /data/config directory. The container cannot write to or modify files on the host at that path, which is the most significant security implication: it prevents the container from altering host configuration or data, reducing the risk of privilege escalation or data corruption.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The container can modify files on the host at /data/config.
Why it's wrong here
The mode 'ro' indicates read-only, not writable.
✗
The container has full access to the host's filesystem.
Why it's wrong here
Access is limited to the bound directory, not the entire filesystem.
✓
The container can read host files at /data/config, but not write.
Why this is correct
Read-only bind mount allows reading, no writing.
✗
The container can mount additional filesystems using the bind mount.
Why it's wrong here
The mount is already defined and does not grant mounting capability.

Go deeper

CAS-004 Practice Question: The Docker container `myservice` has the mount…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question