Docker daemon fails with read-only file system errors under /var/lib/docker in CI

Docker operations such as pulls, builds and runs can fail with 'read-only file system' errors when the daemon cannot write to its data directory under /var/lib/docker. The article explains this is a host-level condition rather than a problem with the image or workflow, and that the failing operation named in the error (mkdir, unlinkat, open) varies while the path stays the same. Common causes include the kernel remounting the disk read-only after I/O errors, hardened host images with a read-only root, a data-root pointed at a non-writable mount, or a container given a read-only bind of the data directory. To diagnose it, users can check the daemon's root directory, inspect mount options with findmnt, and review kernel logs. The suggested fix is to give the daemon a dedicated writable data volume configured through daemon.json.