# Container security

The following settings are applied to all containers running in Nais:

- Read only root filesystem. Only `/tmp` is writable.
- Runs as non-root, with user and group id `1069`

To override these settings, see the following how-to guides:

🎯 [Disable read-only file system](/workloads/how-to/disable-readonly.md)

🎯 [Overriding runAsUser / runAsGroup](/workloads/how-to/override-user-group.md)