.tip

A process that gets code execution in a writable container can drop a binary next to yours or patch a file in place, and it stays there until the container restarts. Take the write permission away and hand back only the paths the app actually needs.

services:
  web:
    read_only: true
    tmpfs:
      - /tmp

docker run --read-only --tmpfs /tmp is the same thing. Turn it on locally first and let it crash, the errors name every path the app writes to, and that list is usually shorter than anyone guessed.