Skip to main content
Welcome to Virtru's support portal. As we work to make this page more accessible to screen readers, please contact us at support@virtru.com for technical support.

Virtru Private Keystore (for Virtru Solution) – Docker Mount Error: Read-Only File System

  • Updated

Summary

During the deployment of the Virtru Private Keystore (CKS) container, you may encounter a Docker error related to mounting the /var/virtru/cks directory. This typically occurs when the underlying file system is read-only.

Error Message

docker: Error response from daemon: error while creating mount source path '/var/virtru/cks/keys': mkdir /var/virtru: read-only file system

Cause

This error occurs when the /var directory is mounted as read-only on the host system. This prevents Docker from creating required subdirectories (e.g., /var/virtru/cks/keys or /var/virtru/cks/ssl) or performing bind mounts.

Common causes for this issue include:

  • Hardened or immutable system images, where directories like /var or /opt are intentionally mounted as read-only to enhance security and prevent unauthorized changes.
  • Cloud-based virtual machines or containers provisioned with restricted root filesystems (e.g., AWS EC2, Azure VM images with tight security baselines).
  • VMware templates or managed Linux environments where base system partitions are locked down to reduce risk of misconfiguration.
  • Boot-time issues or filesystem errors that have caused the OS to mount certain partitions as read-only to preserve data integrity.
  • Lack of permissions or misconfigured directory ownership, preventing Docker from accessing or writing to the bind mount source path.

Resolution

Use a Writable Directory Instead of /var

We recommend relocating the CKS deployment to a writable path, such as /home/virtru/cks.

Step-by-Step Instructions

1. Create a new directory:

sudo mkdir -p /home/virtru/cks

2. Move your CKS files:

sudo mv /var/virtru/cks/* /home/virtru/cks/

3. Update your run.sh script to reflect the new path:

  • Navigate to /home/virtru/cks/
  • Edit the run.sh script with the new path

Check our release notes to grab the latest version number

docker run \
--name Virtru_CKS \
--interactive --tty --detach \
--env-file /home/virtru/cks/env/cks.env \
-v /home/virtru/cks/keys/:/app/keys \
-v /home/virtru/cks/ssl/:/app/ssl \
--restart unless-stopped \
-p 443:9000 \
containers.virtru.com/cks:<latestCKSVersionNumber>

4. Run the script:

  • Bring down the running containers
docker stop <containerID>
docker rm <containerID>
  • Check to make sure no other containers are running or stopped 
docker ps -a
cd /home/virtru/cks
sh run.sh

 

Related articles