My system is based upon Raspbian Stretch and has three partitions:

  1. boot (fat32)
  2. rootfs (ext4)
  3. home (ext4)

I don't have a lot of background services, just samba, ssh, lighttpd. I'm looking for a recommended way to mount the second partition as read-only.

Most guides I find are related to Jessie and they refer to outdated files. I'm able to mount the partition as ro, but I don't know what should I do with logging and the other system features that need to write to disk.

2 Answers 2


I was able to get this guide to work with Stretch 2017-11-29:


A few notes, though:

In the second code block, there is no "local-bottom" directory to copy, which is also noted by posts below the original. This is fine, and you don't need an "overlay-bottom" directory for it to work.

In the third code block, be sure to scroll down and modify/add every line that differs, not just the top 4, which get commented. This is where I really got into trouble when I made mistakes.

Below, I have copied the block and marked modified lines (m) and added lines (a).

m#   if [ "${readonly}" = "y" ]; then
m#   else
m#       roflag=-w
m#   fi

    # FIXME This has no error checking
    modprobe ${FSTYPE}

    checkfs ${ROOT} root

    # FIXME This has no error checking
    # Mount root
a    mkdir /upper /lower
    if [ "${FSTYPE}" != "unknown" ]; then
m        mount ${roflag} -t ${FSTYPE} ${ROOTFLAGS} ${ROOT} /lower
m        mount ${roflag} ${ROOTFLAGS} ${ROOT} /lower
a    modprobe overlay
a    mount -t tmpfs tmpfs /upper
a    mkdir /upper/data /upper/work
a    mount -t overlay \
a        -olowerdir=/lower,upperdir=/upper/data,workdir=/upper/work \
a        overlay ${rootmnt}

If you're curious about what's happening beneath, this document provided a reasonable explanation for me: https://www.kernel.org/doc/Documentation/filesystems/overlayfs.txt


I forked some existing scripts to easily setup a read-only root filesystem on a fresh install of the raspbian stretch dist.

With a single paste of commands from the README, everything will be configured and the Pi will reboot into read-only mode.

Two simple .sh scripts are placed in /root. One to reboot in to permanent-write mode (disable read-only mode permanently) and one to enable read-only permanently.

Get the script here: https://github.com/JasperE84/root-ro

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.