lockdown

Use runway app lockdown on to lock down your application. By default, apps on Runway have a writable filesystem to support a wide range of projects and frameworks. Once your app is production-ready, you may want to enable lockdown mode for enhanced security.

Lockdown mode enables a read-only filesystem in the container. This secures your environment and protects against attacks where attackers attempt to install malicious code or tools, or deploy filesystem bombs to exhaust your storage quota.

Since many frameworks and apps use the filesystem by default for various operations, lockdown mode is opt-in, allowing you to enable it when ready.

Running in lockdown mode requires:

• avoiding local log files - use stderr/stdout instead to leverage runway app logs
• using S3-compatible storage for file uploads that need to persist beyond the container lifecycle
• ensuring all dependencies are baked into the image during the build phase

Enabling or disabling lockdown mode triggers an automatic redeployment of your app.

Use runway app lockdown off to restore the default writable filesystem.