opdemand/deis — pull request #489 by gabrtv (2014-01-25 21:13:12+00:00)
Title: `deis run` should not be able to modify app slugs

Big thanks to @ksikka for reporting this serious (yet hard to reproduce) issue.

Though `deis run` uses an ephemeral container, it has the release slug bind-mounted into /app. Because bind-mounts are read-write by default, any modifications to /app persist on the runtime host (even though they were performed inside the ephemeral container).

This PR changes `deis run` to bind-mount the slug to read-only, preventing this kind of disruptive modification. If you try to write/delete form /app you'll receive an I/O error. In the future, bind-mounts will go away and the slug will be an additional Docker image layer providing a better long-term solution.