How should read-only root filesystem be designed for production in Container Security?

Make root read-only, mount narrowly scoped writable volumes for required paths, and use tmpfs for ephemeral data. The implementation should be justified by measurable requirements, kept as simple as the problem allows, and validated with realistic tests, telemetry, failure handling, and documented tradeoffs.