Container Files

A running workload's own container filesystem — the whole rootfs, not the workspace mounted into it. Read-mostly by default, since the hardened rootfs is read-only.