Infrastructure As Code

How a writable root filesystem service vulnerability happens in Docker Compose and how to fix it

The `opensearch` service defined in `Docker/LocalCluster.s3.yaml` was running with a fully writable root filesystem, giving any process inside the container the ability to modify binaries, drop payloads, or persist malicious changes. The fix pins the container to a read-only root filesystem with `read_only: true`, closing off a common post-compromise persistence and tampering vector while preserving normal OpenSearch operation.