Skip to main content
Welcome to Virtru's support portal. As we work to make this page more accessible to screen readers, please contact us at support@virtru.com for technical support.

Virtru Private Keystore (for Google Workspace) – Docker Mount Error: Read-Only File System

  • Updated

Summary

During the deployment of the Virtru Private Keystore (CSE) container, you may encounter a Docker error related to mounting the /var/virtru/cse directory. This typically occurs when the underlying file system is read-only.

Error Message

docker: Error response from daemon: error while creating mount source path '/var/virtru/cse/keys': mkdir /var/virtru: read-only file system

Cause

This error occurs when the /var directory is mounted as read-only on the host system. This prevents Docker from creating required subdirectories (e.g., /var/virtru/cse) or performing bind mounts.

Common causes for this issue include:

  • Hardened or immutable system images, where directories like /var or /opt are intentionally mounted as read-only to enhance security and prevent unauthorized changes.
  • Cloud-based virtual machines or containers provisioned with restricted root filesystems (e.g., AWS EC2, Azure VM images with tight security baselines).
  • VMware templates or managed Linux environments where base system partitions are locked down to reduce risk of misconfiguration.
  • Boot-time issues or filesystem errors that have caused the OS to mount certain partitions as read-only to preserve data integrity.
  • Lack of permissions or misconfigured directory ownership, preventing Docker from accessing or writing to the bind mount source path.

Resolution

Use a Writable Directory Instead of /var

We recommend relocating the CSE deployment to a writable path, such as /home/virtru/cse.

Step-by-Step Instructions

1. Create a new directory:

sudo mkdir -p /home/virtru/cse

2. Move your cse files:

sudo mv /var/virtru/cse/* /home/virtru/cse/

3. Update your run.sh script to reflect the new path:

  • Navigate to /home/virtru/cse/
  • Edit the run.sh script with the new path

Check our release notes to grab the latest version number 

docker run \
docker run --detach \
--env-file ./cse.env \
-p 443:9000 \
-v /var/virtru/cse/server.cert:/run/secrets/server.cert \
-v /var/virtru/cse/server.key:/run/secrets/server.key \
--restart unless-stopped \
--name cse-v \
containers.virtru.com/cse:<latestCSEVersionNumber>

4. Run the script:

  • Bring down the running containers
docker stop <containerID>
docker rm <containerID>
  • Check to make sure no other containers are running or stopped 
docker ps -a
cd /home/virtru/cse
sh run.sh

 

Related articles