readOnlyRootFilesystem研究

首先我们在 

apiVersion: apps/v1
kind: Deployment
metadata:
  name: tomcat-deployment
  labels:
    app: tomcat
spec:
  replicas: 1
  selector:
    matchLabels:
      app: tomcat
  template:
    metadata:
      labels:
        app: tomcat
    spec:
      containers:
      - name: tomcat
        image: test:latest
        imagePullPolicy: Never
        securityContext:
          readOnlyRootFilesystem: true
        ports:
        - containerPort: 8080
        command: ["/bin/sh"]
        args: ["-c","while true;do echo hello;sleep 1;done"]

How to exempt a directory when using readOnlyRootFilesystem in kubernetes? - Stack Overflow