Run Mongo in Docker with read-only FS
<p>I want to start a Mongo container with a read-only fs for security reason according to <a href="https://benchmarks.cisecurity.org/tools2/docker/CIS_Docker_1.11.0_Benchmark_v1.0.0.pdf" rel="nofollow noreferrer">5.12</a>.</p>

<p>I have the following <code>docker-compose.yml</code>:</p>

<pre><code>version: '2'
services:
  mongodb:
    image: mongo:3.2
    command: -f /etc/mongo.conf
    volumes:
      - ./mongo/mongo.conf:/etc/mongo.conf:ro
      - /data/db
    user: mongodb
    read_only: true
</code></pre>

<p>On <code>docker-compose up</code> it fails with the error <code>Failed to unlink socket file /tmp/mongodb-27017.sock errno:30 Read-only file system</code>.</p>

<p>OK. No problem. I could add <code>- /tmp</code> to the volumes.</p>

<p>But is this good practice to add every path to the volumes? And are there some other paths to add? Like some log paths and so on?</p>

<p>Is there a list from Mongodb?</p>