Public search query: how to set read-only root filesystems in Kubernetes