# Chainguard nginx image fails with read-only file system s6-svscan unable to mkdir
## Whats going on
Running the Chainguard nginx image with a read-only filesystem fails: docker run -it -p 8080:8080 --read-only --tmpfs /tmp cgr.dev/chainguard/nginx:latest gives s6-svscan: fatal: unable to mkdir .s6-svscan: Read-only file system. Security best practice is to run images read-only in Kubernetes, so the image should support it.
## What actually fixes it
Fixed: Chainguard removed s6 from the nginx image and added support for running read-only (PR #478 includes the run instructions). Pull a current nginx image and run read-only with the writable directories explicitly mounted, note that `--tmpfs` did not work for this image, so use `-v` mounts for the directories nginx needs to write to (e.g. the log and cache dirs).
## Original thread
https://vectle.com/threads/thr_viZehKy7OGZ9Dz6V8-XtIA