Using a read-only root filesystem

Using a read-only root filesystem can be tricky at first. Many startup scripts and even some daemons expect to be able to write to the root filesystem, and fail if they cannot.

To solve these kinds of problems, carefully watch the console of a booting node for errors related to a 'Read-only file system'. When these kinds of errors occur, determine which file or directory was trying to be written to and include LINKDIR or LINKFILE directives in the configuration as appropriate.

As an example, several distributions like to write .pid files into /var/run to keep track of the process IDs of running daemons. At boot time, when these daemons try to start, there will be complaints about a 'Read-only file system' when /var/run is not writable. One solution for this problem is to add the following directive to the sysimage.conf file of the master image:

LINKDIR

/var/run

Don't forget to run mk-sysimage on the image after creating any LINK* directives. Now when the node boots, it will be able to write to /var/run, since the directory now effectively lives in /ram, the oneSIS RAM disk.

Many distributions have directories nested under /var/run, and while the above directive may work for most scenarios, it may be desirable to duplicate all of /var/run by adding the -d option:

LINKDIR

/var/run -d

This will duplicate your image exactly as-is, so you may want to clean out any existing .pid files from that directory in your image.

Configuring the ability to write to a single file, such as /var/lib/random-seed, can be handled similarly. Rather than link all of /var/lib into the RAM disk with a LINKDIR directive, we can link just the one file the needs to be writable:

LINKFILE

/var/lib/random-seed -d

Again, don't forget to run mk-sysimage on the image. This directive also has the -d flag so that the random-seed file is not created empty.

Closely watch the bootup and add any needed directives to the configuration to handle the idiosyncrasies of a read-only root filesystem.

Important tip: It usually helps to disable most of the unnecessary daemons enabled by default in many distributions. You can do this on RedHat compatible distributions by chroot'ing into the image and running 'chkconfig $<$service$>$ off'.