From 1d28bde918283a30d737d2aa47728f7667133db0 Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Tue, 10 Nov 2026 18:28:22 -0600
Subject: [PATCH] docker-compose: Run prometheus with a read-only root
 filesystem

The prometheus image now keeps Alertmanager's configuration and state on
the /prometheus data volume, so nothing writes to the root filesystem.

Needs https://github.com/sourcegraph/sourcegraph/pull/18737 in the pinned image.

Amp-Thread-ID: https://ampcode.com/threads/T-01a13cfb-9756-7111-8b29-381a841065e1
Co-authored-by: Amp <amp@ampcode.com>
---
 docker-compose/docker-compose.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docker-compose/docker-compose.yaml b/docker-compose/docker-compose.yaml
index 6febd829d..f0fb810ac 100644
--- a/docker-compose/docker-compose.yaml
+++ b/docker-compose/docker-compose.yaml
@@ -443,6 +443,7 @@ services:
     mem_limit: '8g'
     security_opt:
       - no-new-privileges:true
+    read_only: true
     volumes:
       - 'prometheus-v2:/prometheus'
       - '../prometheus:/sg_prometheus_add_ons'