title: How to exempt a directory when using readOnlyRootFilesystem in kubernetes?
body: <p>I need to block my k8s pods from writing to root folders, with an exemption to /tmp dir. There are 2 reasons I need to write to this dir:</p>
  
  <ol>
  <li>Flask needs to write to somewhere. It's trying to write to /tmp and /etc/... and /opt/... , but all of them are blocked because it's under root folder</li>
  <li>I'm going to need to write to a file for liveness probe, but if the entire file system is blocked, then I can't do it</li>
  </ol>
  
  <p>I'm running kubernetes 1.13.6-gke.13 in GKE</p>
  
  <p>The relevant part from the yaml file:</p>
  
  <pre><code>securityContext:
    runAsUser: 1000
    readOnlyRootFilesystem: true
    runAsNonRoot: true
  </code></pre>
  
  <p>I expect the pod to be able to write to a predefined folder, maybe a mounted one.</p>