How would you answer an interview scenario involving read-only root filesystem in Container Security?

For an interview scenario involving read-only root filesystem, I would first clarify the business goal, scale, constraints, and the failure or quality attribute the interviewer wants to explore. A read-only root filesystem prevents runtime processes from modifying most files inside the container image. In this scenario, an application writes temporary reports under /app. Explain how to support it without making the whole filesystem writable. For production, make root read-only, mount narrowly scoped writable volumes for required paths, and use tmpfs for ephemeral data. I would then explain the main alternatives and tradeoffs, identify likely failure modes, and describe how I would validate the solution through testing, observability, security controls, and recovery or rollback planning.