doc: TRG 4.07: Read-Only Filesystem (DRAFT)

docs/release/trg-4/trg-4-07.md

@@ -0,0 +1,38 @@
+---
+title: TRG 4.07 - Read-only filesystems
+---
+
+:::caution
+Proposed release date: "mandatory after": 19th of May 2023
+:::
+
+| Status     | Created      | Post-History                           |
+|------------|--------------|----------------------------------------|
+| Draft      | 03-Octo-2023 | Initial contribution                   |
+
+## Why
+
+A read-only root filesystem helps to limit the impact of a compromised container on a Kubernetes node. It is recommended to utilize read-only filesystems when possible. This prevents a malicious process or application from writing back to the host system. Read-only filesystems are a key component to preventing container breakout.
+
+## Description
+
+Whether this container has a read-only root filesystem. Default is false.
+
+### Implementation
+
+The container's **Pod resource file (yaml)** has to be modified to set rights to read-only.
+
+Mounts the container's root filesystem as read-only:
+
+```yaml
+apiVersion: v1  
+kind: Pod  
+metadata:  
+  name: read-only-fs
+spec:  
+  containers:  
+
+  securityContext:  
+    #read-only fs explicitly defined
+    readOnlyRootFilesystem: true
+```