Repository: firecracker-microvm/firecracker-containerd
Pull request #283 (2019-10-10 23:46:32)

The rootfs of a microVM should be read-only
*Issue #, if available:*

NA

*Description of changes:*

While customers won't be able to access the rootfs, making it read-only
will reduce its attack surface.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.



Patch:
diff --git a/.buildkite/pipeline.yml b/.buildkite/pipeline.yml
index 6dfb216..33a699d 100644
--- a/.buildkite/pipeline.yml
+++ b/.buildkite/pipeline.yml
@@ -86,11 +86,3 @@ steps:
     command: 'make -C examples integ-test'
     concurrency: 1
     concurrency_group: 'loop-device test'
-
-  - wait: ~
-    continue_on_failure: true
-
-  - label: ":wastebasket: cleanup"
-    agents:
-      queue: "${BUILDKITE_AGENT_META_DATA_QUEUE:-default}"
-    command: 'make clean'
diff --git a/go.mod b/go.mod
index 588c01d..093544f 100644
--- a/go.mod
+++ b/go.mod
@@ -18,7 +18,7 @@ require (
 	github.com/docker/go-events v0.0.0-20170721190031-9461782956ad // indirect
 	github.com/docker/go-metrics v0.0.0-20181218153428-b84716841b82 // indirect
 	github.com/docker/go-units v0.3.3
-	github.com/firecracker-microvm/firecracker-go-sdk v0.17.1-0.20190920221449-6afccc1d121f
+	github.com/firecracker-microvm/firecracker-go-sdk v0.17.1-0.20191014182425-56995a05946a
 	github.com/go-ole/go-ole v1.2.4 // indirect
 	github.com/godbus/dbus v0.0.0-20181025153459-66d97aec3384 // indirect
 	github.com/gofrs/uuid v3.2.0+incompatible
diff --git a/go.sum b/go.sum
index ed9c2b5..bc99d81 100644
--- a/go.sum
+++ b/go.sum
@@ -59,8 +59,8 @@ github.com/docker/go-metrics v0.0.0-20181218153428-b84716841b82 h1:X0fj836zx99zF
 github.com/docker/go-metrics v0.0.0-20181218153428-b84716841b82/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
 github.com/docker/go-units v0.3.3 h1:Xk8S3Xj5sLGlG5g67hJmYMmUgXv5N4PhkjJHHqrwnTk=
 github.com/docker/go-units v0.3.3/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/firecracker-microvm/firecracker-go-sdk v0.17.1-0.20190920221449-6afccc1d121f h1:G81Ey0lQDWCqwdIRq6aLN5RyYbnSDx2O7FKFl433shc=
-github.com/firecracker-microvm/firecracker-go-sdk v0.17.1-0.20190920221449-6afccc1d121f/go.mod h1:tVXziw7GjioCKVjI5/agymYxUaqJM6q7cp9e6kwjo8Q=
+github.com/firecracker-microvm/firecracker-go-sdk v0.17.1-0.20191014182425-56995a05946a h1:WK1TpnYdiXA8Kb5UMMkybaZtlo+F1a2QeBmqCJHWeTE=
+github.com/firecracker-microvm/firecracker-go-sdk v0.17.1-0.20191014182425-56995a05946a/go.mod h1:tVXziw7GjioCKVjI5/agymYxUaqJM6q7cp9e6kwjo8Q=
 github.com/globalsign/mgo v0.0.0-20180905125535-1ca0a4f7cbcb h1:D4uzjWwKYQ5XnAvUbuvHW93esHg7F8N/OYeBBcJoTr0=
 github.com/globalsign/mgo v0.0.0-20180905125535-1ca0a4f7cbcb/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
 github.com/go-ole/go-ole v1.2.4 h1:nNBDSCOigTSiarFpYE9J/KtEA1IOW4CNeqT9TQDqCxI=
diff --git a/proto/types.pb.go b/proto/types.pb.go
index 09fdf9d..9c533be 100644
--- a/proto/types.pb.go
+++ b/proto/types.pb.go
@@ -507,7 +507,7 @@ func (m *FirecrackerMachineConfiguration) GetVcpuCount() uint32 {
 
 // Message to specify the block device config for a Firecracker VM
 type FirecrackerDrive struct {
-	IsReadOnly           bool                    `protobuf:"varint,1,opt,name=IsReadOnly,proto3" json:"IsReadOnly,omitempty"`
+	IsWritable           bool                    `protobuf:"varint,1,opt,name=IsWritable,proto3" json:"IsWritable,omitempty"`
 	IsRootDevice         bool                    `protobuf:"varint,2,opt,name=IsRootDevice,proto3" json:"IsRootDevice,omitempty"`
 	Partuuid             string                  `protobuf:"bytes,3,opt,name=Partuuid,proto3" json:"Partuuid,omitempty"`
 	PathOnHost           string                  `protobuf:"bytes,4,opt,name=PathOnHost,proto3" json:"PathOnHost,omitempty"`
@@ -541,9 +541,9 @@ func (m *FirecrackerDrive) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_FirecrackerDrive proto.InternalMessageInfo
 
-func (m *FirecrackerDrive) GetIsReadOnly() bool {
+func (m *FirecrackerDrive) GetIsWritable() bool {
 	if m != nil {
-		return m.IsReadOnly
+		return m.IsWritable
 	}
 	return false
 }
@@ -696,53 +696,53 @@ func init() { proto.RegisterFile("types.proto", fileDescriptor_d938547f84707355)
 var fileDescriptor_d938547f84707355 = []byte{
 	// 789 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x7c, 0x55, 0xdd, 0x8e, 0xe3, 0x34,
-	0x14, 0x56, 0x26, 0xd3, 0x6e, 0xeb, 0xce, 0x42, 0xb1, 0x56, 0x10, 0xba, 0x08, 0xaa, 0x88, 0x8b,
-	0x22, 0xad, 0x32, 0x68, 0x10, 0x48, 0x5c, 0xa0, 0x55, 0x7f, 0x16, 0xb6, 0x40, 0xa7, 0x95, 0x3b,
-	0xec, 0x05, 0x77, 0x9e, 0xe4, 0xb4, 0xb5, 0x9a, 0xda, 0x91, 0xe3, 0x4c, 0xb7, 0xfb, 0x08, 0x88,
-	0x77, 0xe0, 0x09, 0x78, 0x14, 0xae, 0x79, 0x1d, 0x64, 0xc7, 0x49, 0xdd, 0xee, 0xb2, 0x57, 0x33,
-	0xe7, 0xfb, 0xbe, 0x73, 0x8e, 0xfd, 0x9d, 0xe3, 0x14, 0x75, 0xd4, 0x21, 0x83, 0x3c, 0xca, 0xa4,
-	0x50, 0xa2, 0xf7, 0xe9, 0x5a, 0x88, 0x75, 0x0a, 0xd7, 0x26, 0xba, 0x2f, 0x56, 0xd7, 0x94, 0x1f,
-	0x4a, 0x2a, 0xfc, 0xd7, 0x43, 0xed, 0x17, 0xaf, 0x95, 0xa4, 0x13, 0xaa, 0x28, 0xee, 0xa1, 0xd6,
-	0xcf, 0xb9, 0xe0, 0xcb, 0x0c, 0xe2, 0xc0, 0xeb, 0x7b, 0x83, 0x2b, 0x52, 0xc7, 0xf8, 0x3b, 0xd4,
-	0x21, 0x05, 0x8f, 0xe7, 0x99, 0x62, 0x82, 0xe7, 0xc1, 0x45, 0xdf, 0x1b, 0x74, 0x6e, 0x9e, 0x44,
-	0x65, 0xe9, 0xa8, 0x2a, 0x1d, 0x0d, 0xf9, 0x81, 0xb8, 0x42, 0xfc, 0x19, 0x6a, 0x2f, 0x55, 0xc2,
-	0xf8, 0x42, 0x48, 0x15, 0xf8, 0x7d, 0x6f, 0xf0, 0x98, 0x1c, 0x01, 0xfc, 0x39, 0x42, 0x4b, 0x95,
-	0x88, 0x42, 0x19, 0xfa, 0xd2, 0xd0, 0x0e, 0x62, 0x79, 0x90, 0xd2, 0xf0, 0x8d, 0x9a, 0xb7, 0x08,
-	0x0e, 0xd0, 0xa3, 0x89, 0x64, 0x0f, 0x30, 0x9d, 0x04, 0xcd, 0xbe, 0x37, 0x68, 0x93, 0x2a, 0x0c,
-	0xff, 0xbe, 0x40, 0x4f, 0x7f, 0x64, 0x12, 0x62, 0x49, 0xe3, 0x2d, 0xc8, 0x5b, 0x50, 0x7b, 0x21,
-	0xb7, 0x53, 0xae, 0x40, 0xae, 0x68, 0x0c, 0xfa, 0x5c, 0xc3, 0x34, 0x15, 0xfb, 0xd9, 0x6c, 0xb2,
-	0x34, 0x97, 0x6d, 0x91, 0x23, 0x80, 0x7f, 0x40, 0x8f, 0xa7, 0x9c, 0x50, 0x05, 0xbf, 0xb2, 0x1d,
-	0x53, 0x20, 0xed, 0x7d, 0x3f, 0x89, 0x9c, 0x92, 0x0e, 0x4d, 0x4e, 0xd5, 0xf8, 0x39, 0xfa, 0x60,
-	0x5e, 0x28, 0x37, 0xdf, 0x7f, 0x7f, 0xfe, 0x99, 0x1c, 0x5f, 0xa3, 0xf6, 0xf8, 0x76, 0x3a, 0x16,
-	0x7c, 0xc5, 0xd6, 0xc6, 0x96, 0xce, 0xcd, 0x47, 0x51, 0x8d, 0x14, 0x92, 0x6a, 0x73, 0xc9, 0x51,
-	0x83, 0x9f, 0xa3, 0xab, 0xa5, 0xa2, 0x8a, 0xc5, 0x36, 0xa7, 0x61, 0x72, 0x9e, 0x46, 0x25, 0x68,
-	0x6f, 0x7f, 0x9a, 0x7d, 0x92, 0x10, 0xfe, 0x71, 0x81, 0xba, 0xe7, 0x0d, 0x70, 0x1f, 0x75, 0x6c,
-	0xea, 0x2d, 0xdd, 0x81, 0xb1, 0xa9, 0x4d, 0x5c, 0x08, 0x7f, 0xa9, 0x8d, 0xb2, 0x9e, 0x1a, 0xcd,
-	0x85, 0xd1, 0x9c, 0x82, 0x7a, 0x4c, 0x23, 0xc6, 0x17, 0x54, 0x6d, 0x02, 0xbf, 0xef, 0xeb, 0x31,
-	0xd9, 0x50, 0x33, 0xba, 0xe5, 0x84, 0x49, 0x73, 0xcd, 0x36, 0xa9, 0x42, 0xbd, 0x8c, 0x63, 0x1a,
-	0x6f, 0x40, 0x53, 0x0d, 0x43, 0xd5, 0x31, 0x7e, 0x86, 0x2e, 0x87, 0x72, 0x9d, 0x07, 0xcd, 0xbe,
-	0x3f, 0xe8, 0xdc, 0x04, 0x6f, 0x39, 0xa3, 0x81, 0xa1, 0x5c, 0x13, 0xa3, 0xea, 0x7d, 0x8d, 0x9a,
-	0x65, 0x8c, 0xbb, 0xc8, 0xff, 0x05, 0x0e, 0xf6, 0x1e, 0xfa, 0x5f, 0xfc, 0x04, 0x35, 0x5e, 0xd1,
-	0xb4, 0xa8, 0xce, 0x5d, 0x06, 0xe1, 0x9f, 0x1e, 0xea, 0xfd, 0xbf, 0x73, 0x7a, 0x2b, 0x67, 0x34,
-	0x1e, 0x26, 0x89, 0x84, 0x3c, 0xb7, 0xd5, 0x1c, 0x44, 0xdb, 0xf6, 0x52, 0xe4, 0x6a, 0x02, 0x0f,
-	0x8e, 0x25, 0x2e, 0x84, 0x9f, 0xa1, 0xd6, 0x74, 0x61, 0x47, 0x55, 0xae, 0x46, 0x37, 0xaa, 0x80,
-	0x6a, 0x3e, 0xb5, 0x22, 0xdc, 0xa3, 0x0f, 0xcf, 0x48, 0xdd, 0x62, 0x21, 0xd9, 0x8e, 0xca, 0x83,
-	0x6e, 0x5a, 0x4d, 0xc6, 0x81, 0xb4, 0xe2, 0x27, 0xaa, 0x60, 0x4f, 0x4b, 0x85, 0x5f, 0x2a, 0x1c,
-	0xc8, 0x4c, 0x97, 0xee, 0x20, 0x07, 0xf9, 0x00, 0x32, 0x0f, 0x2e, 0xcd, 0x64, 0x5c, 0x28, 0xfc,
-	0xcb, 0x43, 0x5f, 0x38, 0x1b, 0x3b, 0xa3, 0xf1, 0x86, 0x71, 0x78, 0xeb, 0x24, 0xe3, 0xc5, 0x6f,
-	0x77, 0xb0, 0xcb, 0x52, 0xaa, 0xea, 0x1d, 0x71, 0x20, 0xfd, 0xd4, 0x5e, 0xaa, 0x17, 0x9c, 0xde,
-	0xa7, 0x90, 0x18, 0x33, 0x5a, 0xe4, 0x08, 0x18, 0x33, 0x61, 0xb7, 0x64, 0x6f, 0x60, 0xc6, 0xee,
-	0xed, 0x17, 0xc2, 0x41, 0x74, 0xf6, 0xab, 0x38, 0x2b, 0xc6, 0xa2, 0xe0, 0xd5, 0x17, 0xe2, 0x08,
-	0x84, 0xff, 0x78, 0xa8, 0xeb, 0x9c, 0xd0, 0xbc, 0x7e, 0x5d, 0x72, 0x9a, 0x13, 0xa0, 0xc9, 0x9c,
-	0xa7, 0x07, 0xfb, 0xb8, 0x1d, 0x04, 0x87, 0xe8, 0x6a, 0x9a, 0x13, 0x21, 0xf4, 0x38, 0x58, 0x0c,
-	0xf6, 0x4c, 0x27, 0x98, 0x5e, 0xbf, 0x05, 0x95, 0xaa, 0x28, 0x58, 0x62, 0xbd, 0xab, 0x63, 0x5d,
-	0x5f, 0x2f, 0xef, 0x9c, 0xeb, 0x91, 0xda, 0xbd, 0x75, 0x10, 0xfc, 0x3d, 0xea, 0xb8, 0x6f, 0xbf,
-	0xf1, 0xfe, 0xb7, 0xef, 0x6a, 0xc3, 0x37, 0xe8, 0xe3, 0x77, 0xcb, 0xf0, 0xb7, 0xa8, 0x3d, 0xa2,
-	0x3c, 0xd9, 0xb3, 0x44, 0x6d, 0xcc, 0x9d, 0xce, 0x4a, 0xde, 0x89, 0x2d, 0xf0, 0x51, 0x11, 0x6f,
-	0x41, 0x91, 0xa3, 0x12, 0x7f, 0x85, 0xfc, 0x79, 0x96, 0xbf, 0xeb, 0xfb, 0xe5, 0x26, 0x68, 0x4d,
-	0xf8, 0xfa, 0xa4, 0xb7, 0x43, 0x6b, 0xc3, 0xe6, 0x1c, 0xee, 0xd8, 0x0e, 0x46, 0x85, 0xcc, 0x95,
-	0x69, 0xef, 0x93, 0x13, 0x4c, 0x9b, 0x42, 0x60, 0xc5, 0xd2, 0x54, 0x43, 0xa6, 0x9f, 0x4f, 0x1c,
-	0xa4, 0x7c, 0xcf, 0x19, 0x8d, 0x99, 0x3a, 0x18, 0x43, 0x7d, 0x52, 0xc7, 0xa3, 0x47, 0xbf, 0x37,
-	0xca, 0x5f, 0x90, 0xa6, 0xf9, 0xf3, 0xcd, 0x7f, 0x01, 0x00, 0x00, 0xff, 0xff, 0x79, 0x8c, 0x09,
-	0x9d, 0xc0, 0x06, 0x00, 0x00,
+	0x14, 0x56, 0x26, 0xd3, 0xd9, 0xd6, 0x9d, 0x85, 0x62, 0xad, 0x20, 0x74, 0x11, 0x54, 0x11, 0x17,
+	0x45, 0x5a, 0x65, 0xd0, 0x20, 0x90, 0xb8, 0x40, 0xab, 0xfe, 0x2c, 0x6c, 0x81, 0x4e, 0x2b, 0x77,
+	0x58, 0x24, 0xee, 0x3c, 0xc9, 0x69, 0x6b, 0x35, 0xb5, 0x23, 0xc7, 0x99, 0x6e, 0xf7, 0x11, 0x10,
+	0xef, 0xc0, 0x13, 0xf0, 0x28, 0x5c, 0xf3, 0x3a, 0xc8, 0x8e, 0x93, 0xba, 0xdd, 0xdd, 0xb9, 0x9a,
+	0x39, 0xdf, 0xf7, 0x9d, 0x73, 0xec, 0xef, 0x1c, 0xa7, 0xa8, 0xad, 0xf6, 0x19, 0xe4, 0x51, 0x26,
+	0x85, 0x12, 0xdd, 0x4f, 0x57, 0x42, 0xac, 0x52, 0xb8, 0x32, 0xd1, 0x5d, 0xb1, 0xbc, 0xa2, 0x7c,
+	0x5f, 0x52, 0xe1, 0x7f, 0x1e, 0x6a, 0xbd, 0x78, 0xad, 0x24, 0x1d, 0x53, 0x45, 0x71, 0x17, 0x35,
+	0x7f, 0xce, 0x05, 0x5f, 0x64, 0x10, 0x07, 0x5e, 0xcf, 0xeb, 0x5f, 0x92, 0x3a, 0xc6, 0xdf, 0xa1,
+	0x36, 0x29, 0x78, 0x3c, 0xcb, 0x14, 0x13, 0x3c, 0x0f, 0xce, 0x7a, 0x5e, 0xbf, 0x7d, 0xfd, 0x24,
+	0x2a, 0x4b, 0x47, 0x55, 0xe9, 0x68, 0xc0, 0xf7, 0xc4, 0x15, 0xe2, 0xcf, 0x50, 0x6b, 0xa1, 0x12,
+	0xc6, 0xe7, 0x42, 0xaa, 0xc0, 0xef, 0x79, 0xfd, 0xc7, 0xe4, 0x00, 0xe0, 0xcf, 0x11, 0x5a, 0xa8,
+	0x44, 0x14, 0xca, 0xd0, 0xe7, 0x86, 0x76, 0x10, 0xcb, 0x83, 0x94, 0x86, 0x6f, 0xd4, 0xbc, 0x45,
+	0x70, 0x80, 0x1e, 0x8d, 0x25, 0xbb, 0x87, 0xc9, 0x38, 0xb8, 0xe8, 0x79, 0xfd, 0x16, 0xa9, 0xc2,
+	0xf0, 0x9f, 0x33, 0xf4, 0xf4, 0x47, 0x26, 0x21, 0x96, 0x34, 0xde, 0x80, 0xbc, 0x01, 0xb5, 0x13,
+	0x72, 0x33, 0xe1, 0x0a, 0xe4, 0x92, 0xc6, 0xa0, 0xcf, 0x35, 0x48, 0x53, 0xb1, 0x9b, 0x4e, 0xc7,
+	0x0b, 0x73, 0xd9, 0x26, 0x39, 0x00, 0xf8, 0x07, 0xf4, 0x78, 0xc2, 0x09, 0x55, 0xf0, 0x2b, 0xdb,
+	0x32, 0x05, 0xd2, 0xde, 0xf7, 0x93, 0xc8, 0x29, 0xe9, 0xd0, 0xe4, 0x58, 0x8d, 0x9f, 0xa3, 0x0f,
+	0x66, 0x85, 0x72, 0xf3, 0xfd, 0x87, 0xf3, 0x4f, 0xe4, 0xf8, 0x0a, 0xb5, 0x46, 0x37, 0x93, 0x91,
+	0xe0, 0x4b, 0xb6, 0x32, 0xb6, 0xb4, 0xaf, 0x3f, 0x8a, 0x6a, 0xa4, 0x90, 0x54, 0x9b, 0x4b, 0x0e,
+	0x1a, 0xfc, 0x1c, 0x5d, 0x2e, 0x14, 0x55, 0x2c, 0xb6, 0x39, 0x0d, 0x93, 0xf3, 0x34, 0x2a, 0x41,
+	0x7b, 0xfb, 0xe3, 0xec, 0xa3, 0x84, 0xf0, 0xcf, 0x33, 0xd4, 0x39, 0x6d, 0x80, 0x7b, 0xa8, 0x6d,
+	0x53, 0x6f, 0xe8, 0x16, 0x8c, 0x4d, 0x2d, 0xe2, 0x42, 0xf8, 0x4b, 0x6d, 0x94, 0xf5, 0xd4, 0x68,
+	0xce, 0x8c, 0xe6, 0x18, 0xd4, 0x63, 0x1a, 0x32, 0x3e, 0xa7, 0x6a, 0x1d, 0xf8, 0x3d, 0x5f, 0x8f,
+	0xc9, 0x86, 0x9a, 0xd1, 0x2d, 0xc7, 0x4c, 0x9a, 0x6b, 0xb6, 0x48, 0x15, 0xea, 0x65, 0x1c, 0xd1,
+	0x78, 0x0d, 0x9a, 0x6a, 0x18, 0xaa, 0x8e, 0xf1, 0x33, 0x74, 0x3e, 0x90, 0xab, 0x3c, 0xb8, 0xe8,
+	0xf9, 0xfd, 0xf6, 0x75, 0xf0, 0x96, 0x33, 0x1a, 0x18, 0xc8, 0x15, 0x31, 0xaa, 0xee, 0xd7, 0xe8,
+	0xa2, 0x8c, 0x71, 0x07, 0xf9, 0xbf, 0xc0, 0xde, 0xde, 0x43, 0xff, 0x8b, 0x9f, 0xa0, 0xc6, 0x2b,
+	0x9a, 0x16, 0xd5, 0xb9, 0xcb, 0x20, 0xfc, 0xcb, 0x43, 0xdd, 0xf7, 0x3b, 0xa7, 0xb7, 0x72, 0x4a,
+	0xe3, 0x41, 0x92, 0x48, 0xc8, 0x73, 0x5b, 0xcd, 0x41, 0xb4, 0x6d, 0x2f, 0x45, 0xae, 0xc6, 0x70,
+	0xef, 0x58, 0xe2, 0x42, 0xf8, 0x19, 0x6a, 0x4e, 0xe6, 0x76, 0x54, 0xe5, 0x6a, 0x74, 0xa2, 0x0a,
+	0xa8, 0xe6, 0x53, 0x2b, 0xc2, 0x1d, 0xfa, 0xf0, 0x84, 0xd4, 0x2d, 0xe6, 0x92, 0x6d, 0xa9, 0xdc,
+	0xeb, 0xa6, 0xd5, 0x64, 0x1c, 0x48, 0x2b, 0x7e, 0xa2, 0x0a, 0x76, 0xb4, 0x54, 0xf8, 0xa5, 0xc2,
+	0x81, 0xcc, 0x74, 0xe9, 0x16, 0x72, 0x90, 0xf7, 0x20, 0xf3, 0xe0, 0xdc, 0x4c, 0xc6, 0x85, 0xc2,
+	0xbf, 0x3d, 0xf4, 0x85, 0xb3, 0xb1, 0x53, 0x1a, 0xaf, 0x19, 0x87, 0xb7, 0x4e, 0x32, 0x9a, 0xff,
+	0x76, 0x0b, 0xdb, 0x2c, 0xa5, 0xaa, 0xde, 0x11, 0x07, 0xd2, 0x4f, 0xed, 0xa5, 0x7a, 0xc1, 0xe9,
+	0x5d, 0x0a, 0x89, 0x31, 0xa3, 0x49, 0x0e, 0x80, 0x31, 0x13, 0xb6, 0x0b, 0xf6, 0x06, 0xa6, 0xec,
+	0xce, 0x7e, 0x21, 0x1c, 0x44, 0x67, 0xbf, 0x8a, 0xb3, 0x62, 0x24, 0x0a, 0x5e, 0x7d, 0x21, 0x0e,
+	0x40, 0xf8, 0xaf, 0x87, 0x3a, 0xce, 0x09, 0xcd, 0xeb, 0xd7, 0x25, 0x27, 0xf9, 0xef, 0x92, 0x29,
+	0xdd, 0xc1, 0x3e, 0x6e, 0x07, 0xc1, 0x21, 0xba, 0x9c, 0xe4, 0x44, 0x08, 0x3d, 0x0e, 0x16, 0x83,
+	0x3d, 0xd3, 0x11, 0xa6, 0xd7, 0x6f, 0x4e, 0xa5, 0x2a, 0x0a, 0x96, 0x58, 0xef, 0xea, 0x58, 0xd7,
+	0xd7, 0xcb, 0x3b, 0xe3, 0x7a, 0xa4, 0x76, 0x6f, 0x1d, 0x04, 0x7f, 0x8f, 0xda, 0xee, 0xdb, 0x6f,
+	0x3c, 0xfc, 0xf6, 0x5d, 0x6d, 0xf8, 0x06, 0x7d, 0xfc, 0x6e, 0x19, 0xfe, 0x16, 0xb5, 0x86, 0x94,
+	0x27, 0x3b, 0x96, 0xa8, 0xb5, 0xb9, 0xd3, 0x49, 0xc9, 0x5b, 0xb1, 0x01, 0x3e, 0x2c, 0xe2, 0x0d,
+	0x28, 0x72, 0x50, 0xe2, 0xaf, 0x90, 0x3f, 0xcb, 0xf2, 0x77, 0x7d, 0xbf, 0xdc, 0x04, 0xad, 0x09,
+	0x5f, 0x1f, 0xf5, 0x76, 0x68, 0x6d, 0xd8, 0x8c, 0xc3, 0x2d, 0xdb, 0xc2, 0xb0, 0x90, 0xb9, 0x32,
+	0xed, 0x7d, 0x72, 0x84, 0x69, 0x53, 0x08, 0x2c, 0x59, 0x9a, 0x6a, 0xc8, 0xf4, 0xf3, 0x89, 0x83,
+	0x94, 0xef, 0x39, 0xa3, 0x31, 0x53, 0x7b, 0x63, 0xa8, 0x4f, 0xea, 0x78, 0xf8, 0xe8, 0x8f, 0x46,
+	0xf9, 0x0b, 0x72, 0x61, 0xfe, 0x7c, 0xf3, 0x7f, 0x00, 0x00, 0x00, 0xff, 0xff, 0xaf, 0xfe, 0x59,
+	0xb8, 0xc0, 0x06, 0x00, 0x00,
 }
diff --git a/proto/types.proto b/proto/types.proto
index 27c92e1..ca60054 100644
--- a/proto/types.proto
+++ b/proto/types.proto
@@ -108,7 +108,7 @@ message FirecrackerMachineConfiguration {
 
 // Message to specify the block device config for a Firecracker VM
 message FirecrackerDrive {
-	bool IsReadOnly = 1; // Specifies if the drive is read only
+	bool IsWritable = 1; // Specifies if the drive is writable from a guest
 	bool IsRootDevice = 2; // Specifies if the drive is the root device
 	string Partuuid = 3; // Specifies the unique id of the boot partition on this device
 	string PathOnHost = 4; // Specifies the host level path for the guest drive
diff --git a/runtime/helpers.go b/runtime/helpers.go
index b7b058a..d09cdb3 100644
--- a/runtime/helpers.go
+++ b/runtime/helpers.go
@@ -122,7 +122,7 @@ func addDriveFromProto(builder firecracker.DrivesBuilder, drive *proto.Firecrack
 		}
 	}
 
-	return builder.AddDrive(drive.PathOnHost, drive.IsReadOnly, opt)
+	return builder.AddDrive(drive.PathOnHost, !drive.IsWritable, opt)
 }
 
 // rateLimiterFromProto creates a firecracker RateLimiter object from the
@@ -140,6 +140,15 @@ func rateLimiterFromProto(rl *proto.FirecrackerRateLimiter) *models.RateLimiter
 	return &result
 }
 
+func withRateLimiterFromProto(rl *proto.FirecrackerRateLimiter) firecracker.DriveOpt {
+	if rl == nil {
+		return func(d *models.Drive) {
+			// no-op
+		}
+	}
+	return firecracker.WithRateLimiter(*rateLimiterFromProto(rl))
+}
+
 // tokenBucketFromProto creates a firecracker TokenBucket object from the
 // protobuf message.
 func tokenBucketFromProto(bucket *proto.FirecrackerTokenBucket) *models.TokenBucket {
diff --git a/runtime/service.go b/runtime/service.go
index 43ae182..618f081 100644
--- a/runtime/service.go
+++ b/runtime/service.go
@@ -40,6 +40,7 @@ import (
 	"github.com/containerd/fifo"
 	"github.com/containerd/ttrpc"
 	"github.com/firecracker-microvm/firecracker-go-sdk"
+	"github.com/firecracker-microvm/firecracker-go-sdk/client/models"
 	"github.com/gofrs/uuid"
 	ptypes "github.com/gogo/protobuf/types"
 	"github.com/golang/protobuf/ptypes/empty"
@@ -638,27 +639,13 @@ func (s *service) buildVMConfiguration(req *proto.CreateVMRequest) (*firecracker
 		containerCount = 1
 	}
 
-	// Create stub drives first and let stub driver handler manage the drives
-	handler, err := newStubDriveHandler(s.shimDir.RootPath(), s.logger, containerCount)
+	stubDriveHandler, err := newStubDriveHandler(s.shimDir.RootPath(), s.logger, containerCount)
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to create stub drives")
 	}
-	s.stubDriveHandler = handler
+	s.stubDriveHandler = stubDriveHandler
 
-	var driveBuilder firecracker.DrivesBuilder
-	// Create non-stub drives
-	if root := req.RootDrive; root != nil {
-		driveBuilder = firecracker.NewDrivesBuilder(root.PathOnHost)
-	} else {
-		driveBuilder = firecracker.NewDrivesBuilder(s.config.RootDrive)
-	}
-
-	for _, drive := range req.AdditionalDrives {
-		driveBuilder = addDriveFromProto(driveBuilder, drive)
-	}
-
-	// a micro VM must know all drives
-	cfg.Drives = append(handler.GetDrives(), driveBuilder.Build()...)
+	cfg.Drives = append(stubDriveHandler.GetDrives(), s.buildNonStubDrives(req)...)
 
 	// If no value for NetworkInterfaces was specified (not even an empty but non-nil list) and
 	// the runtime config specifies a default list, use those defaults
@@ -681,6 +668,25 @@ func (s *service) buildVMConfiguration(req *proto.CreateVMRequest) (*firecracker
 	return &cfg, nil
 }
 
+func (s *service) buildNonStubDrives(req *proto.CreateVMRequest) []models.Drive {
+	var builder firecracker.DrivesBuilder
+
+	if input := req.RootDrive; input != nil {
+		builder = builder.WithRootDrive(input.PathOnHost,
+			firecracker.WithReadOnly(!input.IsWritable),
+			firecracker.WithPartuuid(input.Partuuid),
+			withRateLimiterFromProto(input.RateLimiter))
+	} else {
+		builder = builder.WithRootDrive(s.config.RootDrive, firecracker.WithReadOnly(true))
+	}
+
+	for _, drive := range req.AdditionalDrives {
+		builder = addDriveFromProto(builder, drive)
+	}
+
+	return builder.Build()
+}
+
 func (s *service) Create(requestCtx context.Context, request *taskAPI.CreateTaskRequest) (*taskAPI.CreateTaskResponse, error) {
 	logger := s.logger.WithField("task_id", request.ID)
 	defer logPanicAndDie(logger)
diff --git a/tools/docker/Dockerfile b/tools/docker/Dockerfile
index 579251a..0a68f13 100644
--- a/tools/docker/Dockerfile
+++ b/tools/docker/Dockerfile
@@ -165,7 +165,6 @@ RUN make -C /firecracker-containerd/internal test-bridged-tap && \
 	chmod a+x /firecracker-containerd/internal/test-bridged-tap
 
 COPY tools/docker/firecracker-runtime.json /etc/containerd/firecracker-runtime.json
-COPY tools/docker/firecracker-runtime-defaultnetwork.json /etc/containerd/firecracker-runtime-defaultnetwork.json
 COPY tools/docker/naive-snapshotter/entrypoint.sh /entrypoint
 
 ENTRYPOINT ["/entrypoint"]
diff --git a/tools/docker/firecracker-runtime-defaultnetwork.json b/tools/docker/firecracker-runtime-defaultnetwork.json
deleted file mode 100644
index 110169a..0000000
--- a/tools/docker/firecracker-runtime-defaultnetwork.json
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  "firecracker_binary_path": "/usr/local/bin/firecracker",
-  "kernel_image_path": "/var/lib/firecracker-containerd/runtime/default-vmlinux.bin",
-  "kernel_args": "ro console=ttyS0 noapic reboot=k panic=1 pci=off nomodules systemd.journald.forward_to_console systemd.unit=firecracker.target init=/sbin/overlay-init",
-  "root_drive": "/var/lib/firecracker-containerd/runtime/default-rootfs.img",
-  "cpu_count": 1,
-  "cpu_template": "T2",
-  "log_fifo": "/tmp/fc-logs.fifo",
-  "log_level": "Debug",
-  "metrics_fifo": "/tmp/fc-metrics.fifo",
-  "default_network_interfaces": [
-    {
-      "CNIConfig": {
-        "NetworkName": "fcnet",
-        "InterfaceName": "veth0"
-      }
-    }
-  ]
-}
diff --git a/tools/docker/firecracker-runtime.json b/tools/docker/firecracker-runtime.json
index 3edd6ac..110169a 100644
--- a/tools/docker/firecracker-runtime.json
+++ b/tools/docker/firecracker-runtime.json
@@ -7,5 +7,13 @@
   "cpu_template": "T2",
   "log_fifo": "/tmp/fc-logs.fifo",
   "log_level": "Debug",
-  "metrics_fifo": "/tmp/fc-metrics.fifo"
+  "metrics_fifo": "/tmp/fc-metrics.fifo",
+  "default_network_interfaces": [
+    {
+      "CNIConfig": {
+        "NetworkName": "fcnet",
+        "InterfaceName": "veth0"
+      }
+    }
+  ]
 }


Test patch:
diff --git a/runtime/cni_integ_test.go b/runtime/cni_integ_test.go
index 0d97b0c..923aa0f 100644
--- a/runtime/cni_integ_test.go
+++ b/runtime/cni_integ_test.go
@@ -94,7 +94,6 @@ func TestCNISupport_Isolated(t *testing.T) {
 				},
 				RootDrive: &proto.FirecrackerDrive{
 					PathOnHost:   defaultVMRootfsPath,
-					IsReadOnly:   false,
 					IsRootDevice: true,
 				},
 				NetworkInterfaces: []*proto.FirecrackerNetworkInterface{{
@@ -135,7 +134,6 @@ func TestCNISupport_Isolated(t *testing.T) {
 
 func TestAutomaticCNISupport_Isolated(t *testing.T) {
 	internal.RequiresIsolation(t)
-	useDefaultNetworkInterfaceRuntimeConfig(t)
 
 	testTimeout := 120 * time.Second
 	ctx, cancel := context.WithTimeout(namespaces.WithNamespace(context.Background(), defaultNamespace), testTimeout)
@@ -269,7 +267,6 @@ func TestCNIPlugin_Performance(t *testing.T) {
 				},
 				RootDrive: &proto.FirecrackerDrive{
 					PathOnHost:   defaultVMRootfsPath,
-					IsReadOnly:   false,
 					IsRootDevice: true,
 				},
 				NetworkInterfaces: []*proto.FirecrackerNetworkInterface{{
@@ -356,16 +353,6 @@ func writeCNIConf(path, chainedPluginName, networkName, nameserver string) error
 }`, networkName, nameserver, chainedPluginName)), 0644)
 }
 
-func useDefaultNetworkInterfaceRuntimeConfig(t *testing.T) {
-	t.Helper()
-
-	err := os.RemoveAll(runtimeConfigPath)
-	require.NoError(t, err, "failed to remove existing firecracker containerd runtime config file")
-
-	err = os.Symlink(defaultNetworkInterfaceRuntimeConfigPath, runtimeConfigPath)
-	require.NoError(t, err, "failed to symlink default network interface runtime config")
-}
-
 func runCommand(ctx context.Context, t *testing.T, name string, args ...string) {
 	t.Helper()
 	output, err := exec.CommandContext(ctx, name, args...).CombinedOutput()
diff --git a/runtime/helpers_test.go b/runtime/helpers_test.go
index b52944f..11d3153 100644
--- a/runtime/helpers_test.go
+++ b/runtime/helpers_test.go
@@ -210,7 +210,7 @@ func TestTokenBucketFromProto(t *testing.T) {
 
 func TestAddDriveFromProto(t *testing.T) {
 	list := addDriveFromProto(firecracker.DrivesBuilder{}, &proto.FirecrackerDrive{
-		IsReadOnly: true,
+		IsWritable: false,
 		PathOnHost: "/a",
 		Partuuid:   "xy",
 	}).Build()
diff --git a/runtime/service_integ_test.go b/runtime/service_integ_test.go
index ff746d1..ca4b4cd 100644
--- a/runtime/service_integ_test.go
+++ b/runtime/service_integ_test.go
@@ -63,9 +63,6 @@ const (
 	defaultVMRootfsPath = "/var/lib/firecracker-containerd/runtime/default-rootfs.img"
 	defaultVMNetDevName = "eth0"
 	varRunDir           = "/run/firecracker-containerd"
-
-	runtimeConfigPath                        = "/etc/containerd/firecracker-runtime.json"
-	defaultNetworkInterfaceRuntimeConfigPath = "/etc/containerd/firecracker-runtime-defaultnetwork.json"
 )
 
 // Images are presumed by the isolated tests to have already been pulled
@@ -268,7 +265,6 @@ func TestMultipleVMs_Isolated(t *testing.T) {
 				},
 				RootDrive: &proto.FirecrackerDrive{
 					PathOnHost:   rootfsPath,
-					IsReadOnly:   false,
 					IsRootDevice: true,
 				},
 				NetworkInterfaces: []*proto.FirecrackerNetworkInterface{
@@ -478,7 +474,6 @@ func TestLongUnixSocketPath_Isolated(t *testing.T) {
 		VMID: vmID,
 		RootDrive: &proto.FirecrackerDrive{
 			PathOnHost:   defaultVMRootfsPath,
-			IsReadOnly:   false,
 			IsRootDevice: true,
 		},
 		NetworkInterfaces: []*proto.FirecrackerNetworkInterface{},
@@ -533,7 +528,6 @@ func TestStubBlockDevices_Isolated(t *testing.T) {
 		VMID: strconv.Itoa(vmID),
 		RootDrive: &proto.FirecrackerDrive{
 			PathOnHost:   rootfsPath,
-			IsReadOnly:   false,
 			IsRootDevice: true,
 		},
 		NetworkInterfaces: []*proto.FirecrackerNetworkInterface{
@@ -670,7 +664,6 @@ func testCreateContainerWithSameName(t *testing.T, vmID string) {
 			VMID: vmID,
 			RootDrive: &proto.FirecrackerDrive{
 				PathOnHost:   defaultRootfsPath,
-				IsReadOnly:   true,
 				IsRootDevice: true,
 			},
 			ContainerCount: 2,
diff --git a/runtime/service_test.go b/runtime/service_test.go
index 7122e0d..b3596b7 100644
--- a/runtime/service_test.go
+++ b/runtime/service_test.go
@@ -44,7 +44,7 @@ func TestBuildVMConfiguration(t *testing.T) {
 		expectedStubDriveCount int
 	}{
 		{
-			name:    "ConfigFile",
+			name:    "Only Config",
 			request: &proto.CreateVMRequest{},
 			config: &Config{
 				KernelArgs:      "KERNEL ARGS",
@@ -60,7 +60,7 @@ func TestBuildVMConfiguration(t *testing.T) {
 					{
 						DriveID:      firecracker.String("root_drive"),
 						PathOnHost:   firecracker.String("ROOT DRIVE"),
-						IsReadOnly:   firecracker.Bool(false),
+						IsReadOnly:   firecracker.Bool(true),
 						IsRootDevice: firecracker.Bool(true),
 					},
 				},
@@ -74,12 +74,13 @@ func TestBuildVMConfiguration(t *testing.T) {
 			expectedStubDriveCount: 1,
 		},
 		{
-			name: "Input",
+			name: "Only Request",
 			request: &proto.CreateVMRequest{
 				KernelArgs:      "REQUEST KERNEL ARGS",
 				KernelImagePath: "REQUEST KERNEL IMAGE",
 				RootDrive: &proto.FirecrackerDrive{
 					PathOnHost: "REQUEST ROOT DRIVE",
+					IsWritable: true,
 				},
 				MachineCfg: &proto.FirecrackerMachineConfiguration{
 					CPUTemplate: "C3",
@@ -108,11 +109,13 @@ func TestBuildVMConfiguration(t *testing.T) {
 			expectedStubDriveCount: 1,
 		},
 		{
-			name: "Priority",
+			name: "Request is prioritized over Config",
 			request: &proto.CreateVMRequest{
-				KernelArgs: "REQUEST KERNEL ARGS",
+				KernelArgs:      "REQUEST KERNEL ARGS",
+				KernelImagePath: "REQUEST KERNEL IMAGE",
 				RootDrive: &proto.FirecrackerDrive{
 					PathOnHost: "REQUEST ROOT DRIVE",
+					IsWritable: true,
 				},
 				MachineCfg: &proto.FirecrackerMachineConfiguration{
 					CPUTemplate: "T2",
@@ -127,7 +130,7 @@ func TestBuildVMConfiguration(t *testing.T) {
 			},
 			expectedCfg: &firecracker.Config{
 				KernelArgs:      "REQUEST KERNEL ARGS",
-				KernelImagePath: "KERNEL IMAGE",
+				KernelImagePath: "REQUEST KERNEL IMAGE",
 				Drives: []models.Drive{
 					{
 						DriveID:      firecracker.String("root_drive"),
@@ -146,7 +149,43 @@ func TestBuildVMConfiguration(t *testing.T) {
 			expectedStubDriveCount: 1,
 		},
 		{
-			name:    "Container Count",
+			name: "Request can omit some fields",
+			request: &proto.CreateVMRequest{
+				KernelArgs:      "REQUEST KERNEL ARGS",
+				KernelImagePath: "REQUEST KERNEL IMAGE",
+				RootDrive: &proto.FirecrackerDrive{
+					PathOnHost: "REQUEST ROOT DRIVE",
+				},
+				MachineCfg: &proto.FirecrackerMachineConfiguration{},
+			},
+			config: &Config{
+				KernelArgs:      "KERNEL ARGS",
+				KernelImagePath: "KERNEL IMAGE",
+				CPUTemplate:     "C3",
+				CPUCount:        2,
+			},
+			expectedCfg: &firecracker.Config{
+				KernelArgs:      "REQUEST KERNEL ARGS",
+				KernelImagePath: "REQUEST KERNEL IMAGE",
+				Drives: []models.Drive{
+					{
+						DriveID:      firecracker.String("root_drive"),
+						PathOnHost:   firecracker.String("REQUEST ROOT DRIVE"),
+						IsReadOnly:   firecracker.Bool(true),
+						IsRootDevice: firecracker.Bool(true),
+					},
+				},
+				MachineCfg: models.MachineConfiguration{
+					CPUTemplate: models.CPUTemplateC3,
+					VcpuCount:   firecracker.Int64(2),
+					MemSizeMib:  firecracker.Int64(defaultMemSizeMb),
+					HtEnabled:   firecracker.Bool(false),
+				},
+			},
+			expectedStubDriveCount: 1,
+		},
+		{
+			name:    "Container Count affects StubDriveCount",
 			request: &proto.CreateVMRequest{ContainerCount: 2},
 			config: &Config{
 				KernelArgs:      "KERNEL ARGS",
@@ -162,7 +201,7 @@ func TestBuildVMConfiguration(t *testing.T) {
 					{
 						DriveID:      firecracker.String("root_drive"),
 						PathOnHost:   firecracker.String("ROOT DRIVE"),
-						IsReadOnly:   firecracker.Bool(false),
+						IsReadOnly:   firecracker.Bool(true),
 						IsRootDevice: firecracker.Bool(true),
 					},
 				},