Container Filesystem is Writable

LOW

Service has writable root filesystem. Consider making it read-only for better security.

Rule Information

Language
Docker Compose
Category
Security
Author
Code Pathfinder
Last Updated
2026-01-17
Tags
docker-composecomposefilesystemread-onlysecurityimmutabilitymalware-preventionhardeningbest-practice
CWE References
CWE-732

Interactive Playground

Experiment with the vulnerable code and security rule below. Edit the code to see how the rule detects different vulnerability patterns.

pathfinder ci --ruleset docker-compose/COMPOSE-SEC-006 --project .
Vulnerable Code
1
2
3
4
Security Rule

Similar Rules

Explore related security rules for Docker Compose

MEDIUM

Using Host IPC Mode

Service uses host IPC namespace. Container shares inter-process communication with host.

MEDIUM

Missing no-new-privileges Security Option

Service does not have 'no-new-privileges:true' in security_opt. This allows

MEDIUM

SELinux Separation Disabled

Service has 'label:disable' in security_opt, which disables SELinux mandatory

Frequently Asked Questions

Common questions about Container Filesystem is Writable

Service has writable root filesystem. Consider making it read-only for better security.
This vulnerability is rated as LOW severity, which means it should be addressed when convenient as it represents a lower security risk but still indicates areas for improvement in code quality and security posture.

Use Code Pathfinder to scan your Docker Compose codebase and automatically detect instances of this vulnerability pattern. Install Code Pathfinder and run the following command in your project directory:

pathfinder ci --ruleset docker-compose/COMPOSE-SEC-006 --project .

This rule is aligned with industry-standard security frameworks and classifications:

  • CWE (Common Weakness Enumeration): CWE-732
  • Tags: docker-compose, compose, filesystem, read-only, security, immutability, malware-prevention, hardening, best-practice
Yes! Code Pathfinder allows you to customize rules to match your specific security requirements and coding standards. You can modify the detection patterns, adjust severity levels, add custom sanitizers, and configure the rule to fit your organization's security policies. The interactive playground above lets you experiment with the rule and see how it behaves with different code patterns.
When this vulnerability is detected in your code, review the flagged instances carefully. Check the "Vulnerable Code" section above for examples of insecure patterns and the "Security Rule" section to understand what the rule is looking for. Follow security best practices for Docker Compose and consult the CWE/CVE references for detailed remediation guidance. Always test your fixes thoroughly before deploying to production.
Back to SecurityAll Languages →