Hey folks. We've been seeing more deployments of the NeMo Inference Microservice (NIM) container, and one common hardening step that often gets overlooked is moving the container's root filesystem to read-only. It's a simple but effective way to limit the impact of a potential container breakout or a compromised process.

The default NIM images typically have a writable root filesystem, which isn't needed for normal inference operations. By making it read-only, you prevent an attacker from writing malicious binaries, tampering with configuration, or planting persistence mechanisms. Let's walk through how to set this up.

First, you'll need to ensure any paths the NIM service *does* need to write to are explicitly mounted as volumes. This usually includes the model cache directory and any location for temporary files or logs. You can specify these volumes in your container runtime command or orchestration manifest (like a Kubernetes pod spec).

Then, when you run the container, add the `--read-only` flag (for Docker) or the equivalent `readOnlyRootFilesystem: true` in your security context for Kubernetes. The key is to test thoroughly afterward—make sure your model still loads and inferences run correctly. If the service crashes, check for missing volume mounts for required write paths.

This is a foundational step for building a more secure NIM deployment. It pairs well with other practices like dropping capabilities and running as a non-root user. If you've tried this and ran into issues, or have other tips for locking down the NIM container, share your experience below.