How would you answer an interview scenario involving read-only root filesystem in Container Security?

An application writes temporary reports under /app. Explain how to support it without making the whole filesystem writable.