What is read-only root filesystem in Container Security?

A read-only root filesystem prevents runtime processes from modifying most files inside the container image. In practice, the value of this concept comes from understanding where it belongs in the architecture, what problem it solves, and what constraints or tradeoffs it introduces.