# How to prevent copied /etc/resolv.conf from being overwritten inside an Execution Environment?

**URL:** <https://forum.ansible.com/t/how-to-prevent-copied-etc-resolv-conf-from-being-overwritten-inside-an-execution-environment/46592>\
**Category:** Get Help\
**Tags:** ee, galaxy-ng\
**Created:** [November 3, 2026, 5:20pm UTC](https://forum.ansible.com/t/how-to-prevent-copied-etc-resolv-conf-from-being-overwritten-inside-an-execution-environment/46592 "2026-11-03T17:20:38Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![actionmystique](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/actionmystique/32/1678_2.png) [@actionmystique](https://forum.ansible.com/u/actionmystique)\
**Post date:** [November 3, 2026, 5:20pm UTC](https://forum.ansible.com/t/how-to-prevent-copied-etc-resolv-conf-from-being-overwritten-inside-an-execution-environment/46592/1 "2026-11-03T17:20:39Z")

</div>

I’m trying to copy my own /etc/resolv.conf inside an Execution Environment but it is always overwritten somehow.  
How can we prevent that from happening?

No matter in which section I put `RUN chmod 444 /etc/resolv.conf`, it always fails with the same eroor message `Read-only file system`;

Running `ansible-builder build -vvv --container-runtime=docker --context="/ee/context" --file="/ee/files/definition/file.yml" --tag="tag:version" -v3` with this definition file:

```auto
version: 3

dependencies:
  ansible_core:
    # Require minimum of 2.15 to get ansible-inventory --limit option
    package_pip: ansible-core<2.19
  ansible_runner:
    package_pip: ansible-runner
  galaxy:
    collections:
      - name: ansible.mysql
        ...
  python_interpreter:
    package_system: python311
    python_path: /usr/bin/python3.11
  python:
    - wheel
      ...

additional_build_steps:
  append_base:
    - RUN $PYCMD -m pip install -U pip
    - RUN dnf -y install dnf-plugins-core
    - RUN dnf -y install epel-release epel-next-release
    - RUN dnf -y config-manager --set-enabled crb
    - RUN mkdir -p /etc/ansible
  append_final:
    - COPY --from=quay.io/ansible/receptor:devel /usr/bin/receptor /usr/bin/receptor
    - RUN mkdir -p /var/run/receptor
    - RUN git lfs install --system
    - RUN alternatives --install /usr/bin/python python /usr/bin/python3.11 311
    - COPY ./etc/ansible/ansible.cfg /etc/ansible/
    - COPY ./etc/resolv.conf /etc/
    - COPY ./root/.gitconfig /root/
    - RUN chmod 644 /etc/ansible/ansible.cfg
    - RUN chmod 444 /etc/resolv.conf
    - RUN chmod 600 /root/.gitconfig

```

I get:

```auto
...
#47 [final 17/19] RUN chmod 444 /etc/resolv.conf
#47 0.164 chmod: changing permissions of '/etc/resolv.conf': Read-only file system
#47 ERROR: process "/bin/sh -c chmod 444 /etc/resolv.conf" did not complete successfully: exit code: 1

```

#ansible-builder #ee

---

<div class="post-metadata">

**Author:** ![johan](https://avatars.discourse-cdn.com/v4/letter/j/dec6dc/32.png) [@johan](https://forum.ansible.com/u/johan)\
**Post date:** [November 3, 2026, 5:55pm UTC](https://forum.ansible.com/t/how-to-prevent-copied-etc-resolv-conf-from-being-overwritten-inside-an-execution-environment/46592/2 "2026-11-03T17:55:49Z")

</div>

hello,  
2 things : copy —chmod=444 might be more appropriate instead of running an additionnal RUN command.  
That being said, i think there’s a mechanism in docker/podman where the resolv.conf file is anyway overriden dynamically at run time (—dns and —dns\_search options to customize); i saw somebody using a CMD option where first a custom resolv.conf was copied over /etc/resolv.conf, but it looked dirty , and it wasn’t in the context of an execution environment, might work though 😊

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [November 3, 2026, 6:52pm UTC](https://forum.ansible.com/t/how-to-prevent-copied-etc-resolv-conf-from-being-overwritten-inside-an-execution-environment/46592/3 "2026-11-03T18:52:26Z")

</div>

While `chmod` or `setfacl` can help, it rarely does with that file since anything writing to it is doing so with `root` permissions. I would use the `file` action and set the the file system attribute to ‘immutable’:

```auto
ansible -m file -a 'path=/etc/resolve.conf attributes="+i"' targethost

```

---

<div class="post-metadata">

**Author:** ![bvitnik](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bvitnik/32/4132_2.png) [@bvitnik](https://forum.ansible.com/u/bvitnik)\
**Post date:** [November 5, 2026, 10:10pm UTC](https://forum.ansible.com/t/how-to-prevent-copied-etc-resolv-conf-from-being-overwritten-inside-an-execution-environment/46592/4 "2026-11-05T22:10:45Z")

</div>

What @johan said. `/etc/hosts` and `/etc/resolv.conf` are files managed by docker/podman and you can’t really enforce the content of these files. You have to use `--dns*` and `--add-host` docker command line options.

There is one idea though. You can try mounting your custom file in container using `-v /your/resolv.conf:/etc/resolv.conf`. I vaguely recall that I tried to do this with `/etc/hosts` but I can’t recall if it worked or not.